Google PCA Manage and provision cloud infrastructure — 20 Questions

Question 1

A company uses a Shared VPC hosted in a common project (host project) to centralize network management. A service project team needs to create a Compute Engine instance with a specific static internal IP address from the Shared VPC subnet. What IAM permissions should be granted to the service project's Compute Engine default service account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

compute.subnetworks.use and compute.addresses.use on the subnet and static IP.. When a service project creates a Compute Engine instance with a specific static internal IP from a Shared VPC subnet, the service project's Compute Engine default service account needs both `compute.subnetworks.use` permission on the subnet (to allow using the subnet) and `compute.addresses.use` permission on the specific static internal IP address (to reserve and use that address). These permissions must be granted at the host project level for the service account.

Answer

compute.networkAdmin on the host project.

Answer

compute.subnetworks.use on the host project subnet.

Answer

compute.instances.create on the service project.

Question 2

A developer needs to grant public read access to all objects in a Cloud Storage bucket named 'my-public-assets'. What is the simplest way to achieve this?

Accepted Answer

Enable uniform bucket-level access and grant storage.objectViewer to AllUsers.. Enabling uniform bucket-level access and granting storage.objectViewer to allUsers is the simplest and recommended method to grant public read access to all objects in the bucket. Option A is not the simplest: setting a bucket-level IAM policy without uniform bucket-level access may still allow object ACLs to restrict access, and requires managing both IAM and ACLs. Option B is incorrect because granting storage.objectViewer to allUsers without uniform bucket-level access does not guarantee public access, as existing object ACLs could deny access. Option D is incorrect because setting ACLs on each object is not simple and does not automatically apply to new objects.

Answer

Set a bucket policy that allows allUsers to read objects.

Answer

Grant storage.objectViewer to AllUsers on the bucket without enabling uniform bucket-level access.

Answer

Set an ACL on each object to allow public read.

Question 3

Which TWO methods can be used to restrict inbound traffic to a Compute Engine instance to only specific IP addresses without relying on instance-level firewall rules? (Choose 2)

Accepted Answer

Configure Cloud Armor policies. Both options B and C are correct. VPC firewall rules (C) are network-level rules that can filter inbound traffic by source IP ranges, allowing only specified IPs to access instances in the VPC. Cloud Armor policies (B) can also be used to restrict traffic by source IP when associated with a backend service behind a load balancer; they operate at the Google Cloud edge, not at the instance level, thus meeting the requirement. Option A (VPC Service Controls) does not filter by IP; it protects data exfiltration. Option D (service account) is an identity, not an IP filter. Option E (IAP) controls access by user identity, not IP address.

Answer

Use VPC Service Controls

Answer

Assign a service account to the instance

Answer

Use Identity-Aware Proxy (IAP) for TCP forwarding

Question 4

A company is deploying a new application on Compute Engine. They need to ensure that the application can automatically recover from a zone failure. What is the best approach?

Accepted Answer

Create a managed instance group with instances in multiple zones.. A managed instance group (MIG) with instances in multiple zones provides automatic recovery from a zone failure by distributing instances across zones and using auto-healing to recreate failed instances. If one zone becomes unavailable, the load balancer routes traffic to healthy instances in other zones, ensuring high availability without manual intervention.

Answer

Use a global load balancer in front of a single instance.

Answer

Create a single VM in a single zone and rely on live migration.

Answer

Use Cloud Storage to store application state and restore from a snapshot.

Question 5

An organization has multiple projects in Google Cloud and wants to centralize logging and monitoring for all projects. They need to aggregate logs from all projects into a single project for analysis. Which approach should they use?

Accepted Answer

Create a logs sink in each project that exports logs to a BigQuery dataset in the central project.. Google Cloud's logs sink feature allows you to route logs from multiple source projects to a centralized BigQuery dataset in a single destination project. This approach aggregates logs efficiently without requiring agents or manual import steps, and it supports real-time log export for analysis.

Answer

Export logs from each project to a Cloud Storage bucket and then import them into BigQuery.

Answer

Enable Cloud Audit Logs for all projects and view them from the central project.

Answer

Install the Stackdriver agent on all VMs and point them to the central project.

Question 6

A developer needs to deploy a containerized application on Google Kubernetes Engine (GKE) with minimal operational overhead. They want to automatically scale the number of pods based on CPU utilization. Which GKE feature should they use?

Accepted Answer

Horizontal Pod Autoscaler.. The Horizontal Pod Autoscaler (HPA) is the correct choice because it automatically scales the number of pod replicas in a GKE deployment based on observed CPU utilization (or other custom metrics). This directly meets the requirement of scaling pods with minimal operational overhead, as HPA is a native Kubernetes resource that requires no manual intervention once configured.

Answer

Node auto-repair.

Answer

Vertical Pod Autoscaler.

Answer

Cluster Autoscaler.

Question 7

A company is deploying a web application on Compute Engine behind a global HTTP(S) load balancer. They want to restrict access to only traffic from specific IP ranges. Which load balancer feature should they use?

Accepted Answer

Cloud Armor security policies.. Cloud Armor security policies are the correct choice because they allow you to define IP-based allow/deny rules at the edge of Google's network, directly integrated with the global HTTP(S) load balancer. This provides granular access control based on source IP ranges before traffic reaches your backend instances, which is exactly what the requirement specifies.

Answer

VPC firewall rules.

Answer

Identity-Aware Proxy (IAP).

Answer

Cloud CDN.

Question 8

A company has a production database running on Cloud SQL. They need to ensure high availability with automatic failover in the event of a zone outage. What should they do?

Accepted Answer

Enable Cloud SQL High Availability (HA) configuration.. Enabling Cloud SQL High Availability (HA) configuration provisions a standby instance in a different zone within the same region, using synchronous replication to ensure zero data loss. In the event of a zone outage, Cloud SQL automatically fails over to the standby instance, typically within 60 seconds, providing high availability without manual intervention.

Answer

Export the database to Cloud Storage and import in another region.

Answer

Create a cross-region read replica.

Answer

Configure automated backups.

Question 9

A developer wants to store and retrieve non-relational data with flexible schema and automatic scaling. Which Google Cloud service should they use?

Accepted Answer

Firestore.. Firestore is a NoSQL document database that supports flexible schema and automatic scaling, making it ideal for non-relational data. It offers real-time synchronization, offline support, and serverless scaling, which aligns with the requirement for storing and retrieving data without manual sharding or capacity planning.

Answer

Cloud Bigtable.

Answer

Cloud SQL.

Answer

Cloud Spanner.

Question 10

A company wants to migrate on-premises workloads to Google Cloud. They need to assess the existing infrastructure, plan the migration, and track progress. Which tool should they use?

Accepted Answer

Migrate for Compute Engine.. Migrate for Compute Engine (formerly Velostrata) is the correct tool because it is specifically designed to assess, plan, and migrate on-premises workloads to Google Cloud. It provides discovery of existing infrastructure, generates migration plans, and tracks progress through a dashboard, directly addressing the need for assessment, planning, and tracking.

Answer

Cloud Endpoints.

Answer

Cloud Deployment Manager.

Answer

Cloud Foundation Toolkit.

Question 11

A company is using Cloud Storage to store sensitive data. They need to enforce that objects are deleted exactly 30 days after creation. Which object lifecycle rule should they configure?

Accepted Answer

Delete action with condition age: 30.. The 'Delete action with condition age: 30' directly instructs Cloud Storage to remove objects 30 days after their creation time. The 'age' condition is measured from the object's creation timestamp, which aligns perfectly with the requirement to delete objects exactly 30 days after creation.

Answer

AbortIncompleteMultipartUpload after 30 days.

Answer

Delete action with condition daysFromNonCurrentTime: 30.

Answer

SetStorageClass to Nearline after 30 days.

Question 12

Which TWO options are valid ways to connect an on-premises network to a VPC in Google Cloud? (Choose two.)

Accepted Answer

Cloud VPN.. Cloud VPN is a valid way to connect an on-premises network to a VPC in Google Cloud. It uses IPsec (IKEv1 or IKEv2) to create an encrypted tunnel over the public internet between your on-premises VPN gateway and a Cloud VPN gateway in your VPC. This allows secure communication between your on-premises resources and your VPC subnets, making it a standard hybrid connectivity option.

Answer

Cloud NAT.

Answer

VPC Network Peering.

Answer

Private Google Access.

Question 13

Which THREE components are required to set up a private connection between an on-premises network and a VPC using Cloud VPN? (Choose three.)

Accepted Answer

Peer VPN gateway (on-premises).. A Peer VPN gateway represents the on-premises VPN device that terminates the IPsec tunnel from the Cloud VPN gateway. This is a required component to establish the encrypted tunnel between your on-premises network and the VPC, as it defines the public IP address and configuration of the remote endpoint.

Answer

VPC Network Peering.

Answer

Cloud Router.

Question 14

Which TWO statements about Google Cloud VPC networks are true? (Choose two.)

Accepted Answer

Subnets are regional resources.. Subnets in Google Cloud VPC are regional resources. When you create a subnet, you specify a region and a CIDR block, and the subnet spans all zones within that region. This allows resources in different zones of the same region to use the same subnet without additional configuration.

Answer

VPC networks are project-level resources.

Answer

Firewall rules are regional.

Answer

Subnets are zonal resources.

Question 15

A developer runs the command above. The instance is created successfully, but cannot be reached via HTTP from the internet. What is the most likely cause?

Accepted Answer

There is no firewall rule allowing ingress traffic on ports 80 and 443.. The most likely cause is that there is no firewall rule allowing ingress traffic on ports 80 and 443. By default, Google Cloud Platform (GCP) firewall rules block all incoming traffic from the internet. Even though the instance is created successfully, HTTP/HTTPS traffic cannot reach it unless a firewall rule explicitly permits ingress on TCP ports 80 and 443, typically via a target tag like 'http-server' or 'https-server'.

Answer

The machine type n1-standard-2 is not suitable for HTTP.

Answer

The image family debian-10 does not support HTTP.

Answer

The boot disk type pd-standard is too slow.

Question 16

An administrator creates a GKE cluster with the command above. After deployment, the cluster has 3 nodes, but the node pool autoscaler never scales up even under load. What is the most likely reason?

Accepted Answer

The cluster is zonal, but node locations include multiple zones.. The node pool autoscaler in GKE cannot scale up a cluster that uses multiple zones in a single zonal cluster. The autoscaler requires that all nodes in the pool be in the same zone to properly manage capacity; when node locations span multiple zones in a zonal cluster, the autoscaler is disabled and will not trigger scaling events, even under load.

Answer

The autoscaler minimum nodes is set to 1 and maximum to 5.

Answer

The disk size of 100 GB is insufficient.

Answer

The machine type e2-medium is too small for the workloads.

Question 17

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) across three zones in us-central1. The application uses a Cloud Spanner database. Recently, the application experienced increased latency and timeouts during peak hours. The operations team noticed that the MIG's CPU utilization is consistently above 80% during peak hours, and the autoscaler is configured to scale based on CPU utilization with a target of 60%. However, the autoscaler is not adding new instances quickly enough, causing performance degradation. The team also observed that new instances take over 5 minutes to become healthy and serve traffic. The health check is a simple TCP check on port 8080. The application startup script downloads large configuration files from Cloud Storage. What should the team do to improve the autoscaling response time and reduce latency?

Accepted Answer

Create a custom Compute Engine image that includes the application and configuration, and use it in the MIG.. The primary bottleneck is the long instance startup time (over 5 minutes) caused by downloading large configuration files from Cloud Storage at boot. By creating a custom Compute Engine image that bakes the application and configuration into the image, new instances can start serving traffic almost immediately, drastically reducing the time before they become healthy and the autoscaler can consider them in scaling decisions. This directly addresses the root cause of slow autoscaling response, as the autoscaler cannot add instances faster than they become healthy.

Answer

Increase the minimum number of instances in the MIG to handle peak load.

Answer

Reduce the autoscaler target CPU utilization to 40% so it scales earlier.

Answer

Change the health check to HTTP and reduce the initial delay and check intervals.

Question 18

A startup is deploying a microservices application on Google Kubernetes Engine (GKE) with a regional cluster. They have services that need to communicate with each other and also with external APIs. The cluster uses VPC-native routing. They have enabled Cloud NAT to allow outbound internet access for nodes without external IPs. However, the development team reports that some pods cannot reach the external APIs, while others can. All pods are in the same namespace and are not using any network policies. The pods that fail have the annotation 'cloud.google.com/gke-nat-ips' set to a list of static IP addresses. The pods that work do not have this annotation. What is the most likely cause of the failure?

Accepted Answer

The annotation 'cloud.google.com/gke-nat-ips' is not compatible with Cloud NAT for outbound traffic.. The annotation 'cloud.google.com/gke-nat-ips' is used to assign specific static IP addresses for outbound traffic from pods, but it is only compatible with the GKE Native Networking (formerly VPC-native) and the Cloud NAT gateway when the pods use the default NAT configuration. When this annotation is set, Cloud NAT is bypassed for those pods, and the traffic is sent directly from the specified static IPs, which may not be properly routed or may be blocked by the external API's firewall rules. In contrast, pods without the annotation use Cloud NAT's dynamic IPs, which are correctly routed and allowed.

Answer

Network policies are blocking outbound traffic for those pods.

Answer

The VPC-native routing is misconfigured for the pods with the annotation.

Answer

The annotation is used to assign static IPs for inbound traffic only.

Question 19

A company is migrating its on-premises application to Google Cloud. The application requires low-latency access to a shared filesystem that can be mounted by multiple Compute Engine instances across different zones. Which storage solution should they use?

Accepted Answer

Provision a Filestore instance and mount it on the instances.. Filestore provides a fully managed, NFS-based shared filesystem that can be mounted by multiple Compute Engine instances across different zones with low-latency access. It supports the required multi-writer, multi-mount scenario natively, making it the ideal choice for shared storage in a zonal-distributed architecture.

Answer

Create a Persistent Disk and attach it to all instances.

Answer

Attach Local SSD to each instance and replicate data between them.

Answer

Use Cloud Storage FUSE to mount a bucket on each instance.

Question 20

An organization has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They launched a Compute Engine instance in subnet-a with an internal IP 10.0.1.2 and a public IP. They want the instance to only allow HTTPS traffic from the internet. Which firewall rule should they create?

Accepted Answer

Ingress rule: allow tcp:443, source 0.0.0.0/0, target tag 'https-server'. The instance needs to accept incoming HTTPS traffic (TCP port 443) from the internet. An ingress firewall rule with source 0.0.0.0/0 allows traffic from any external IP, and applying it to instances with the target tag 'https-server' ensures only tagged instances are affected. This matches the requirement to allow only HTTPS from the internet.

Answer

Ingress rule: allow tcp:0-65535, source 0.0.0.0/0, target tag 'https-server'

Answer

Egress rule: allow tcp:443, destination 0.0.0.0/0, target tag 'https-server'

Answer

Ingress rule: allow tcp:443, source 10.0.0.0/16, target tag 'https-server'