Google PCA Manage and provision cloud infrastructure — 40 Questions

Question 1

Which THREE components are required to set up a private connection between an on-premises network and a VPC using Cloud VPN? (Choose three.)

Accepted Answer

Peer VPN gateway (on-premises).. A Peer VPN gateway represents the on-premises VPN device that terminates the IPsec tunnel from the Cloud VPN gateway. This is a required component to establish the encrypted tunnel between your on-premises network and the VPC, as it defines the public IP address and configuration of the remote endpoint.

Answer

VPC Network Peering.

Answer

Cloud Router.

Question 2

An administrator creates a GKE cluster with the command above. After deployment, the cluster has 3 nodes, but the node pool autoscaler never scales up even under load. What is the most likely reason?

Accepted Answer

The cluster is zonal, but node locations include multiple zones.. The node pool autoscaler in GKE cannot scale up a cluster that uses multiple zones in a single zonal cluster. The autoscaler requires that all nodes in the pool be in the same zone to properly manage capacity; when node locations span multiple zones in a zonal cluster, the autoscaler is disabled and will not trigger scaling events, even under load.

Answer

The autoscaler minimum nodes is set to 1 and maximum to 5.

Answer

The disk size of 100 GB is insufficient.

Answer

The machine type e2-medium is too small for the workloads.

Question 3

A startup is deploying a microservices application on Google Kubernetes Engine (GKE) with a regional cluster. They have services that need to communicate with each other and also with external APIs. The cluster uses VPC-native routing. They have enabled Cloud NAT to allow outbound internet access for nodes without external IPs. However, the development team reports that some pods cannot reach the external APIs, while others can. All pods are in the same namespace and are not using any network policies. The pods that fail have the annotation 'cloud.google.com/gke-nat-ips' set to a list of static IP addresses. The pods that work do not have this annotation. What is the most likely cause of the failure?

Accepted Answer

The annotation 'cloud.google.com/gke-nat-ips' is not compatible with Cloud NAT for outbound traffic.. The annotation 'cloud.google.com/gke-nat-ips' is used to assign specific static IP addresses for outbound traffic from pods, but it is only compatible with the GKE Native Networking (formerly VPC-native) and the Cloud NAT gateway when the pods use the default NAT configuration. When this annotation is set, Cloud NAT is bypassed for those pods, and the traffic is sent directly from the specified static IPs, which may not be properly routed or may be blocked by the external API's firewall rules. In contrast, pods without the annotation use Cloud NAT's dynamic IPs, which are correctly routed and allowed.

Answer

Network policies are blocking outbound traffic for those pods.

Answer

The VPC-native routing is misconfigured for the pods with the annotation.

Answer

The annotation is used to assign static IPs for inbound traffic only.

Question 4

A company is migrating its on-premises application to Google Cloud. The application requires low-latency access to a shared filesystem that can be mounted by multiple Compute Engine instances across different zones. Which storage solution should they use?

Accepted Answer

Provision a Filestore instance and mount it on the instances.. Filestore provides a fully managed, NFS-based shared filesystem that can be mounted by multiple Compute Engine instances across different zones with low-latency access. It supports the required multi-writer, multi-mount scenario natively, making it the ideal choice for shared storage in a zonal-distributed architecture.

Answer

Create a Persistent Disk and attach it to all instances.

Answer

Attach Local SSD to each instance and replicate data between them.

Answer

Use Cloud Storage FUSE to mount a bucket on each instance.

Question 5

A company wants to enable a new DevOps team to have read-only access to logs in the default Cloud Logging bucket for their project, but prevent them from modifying log views or creating linked datasets in BigQuery. Which two IAM roles should be granted to the team?

Accepted Answer

roles/logging.viewAccessor. Option A, roles/logging.viewAccessor, is correct because it grants read access to log views, including the _Default view of the default Cloud Logging bucket, without allowing the team to modify views or create linked datasets. Option D, roles/logging.viewer, is correct because it provides read-only access to all logs in the project, including the default bucket, while excluding permissions to change logging configuration or create BigQuery linked datasets. Option B, roles/logging.configWriter, is not appropriate because it allows managing logging configuration such as sinks and views, which the team must not modify. Option C, roles/logging.admin, is too broad because it grants full control over logging resources, including creating and modifying views and linked datasets. Option E, roles/bigquery.dataViewer, is unrelated to Cloud Logging access and would not grant the required read-only log access.

Answer

roles/logging.configWriter

Answer

roles/logging.admin

Answer

roles/bigquery.dataViewer

Question 6

A company runs an e-commerce platform on Google Cloud. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster (us-central1, three zones). The frontend service is exposed via an HTTP Load Balancer with Cloud CDN. Recently, during a flash sale, users experienced high latency and occasional 502 errors. The backend service is a Java application that reads from Cloud Spanner. The team has observed that Spanner CPU utilization averaged 65% during the sale, with a few spikes to 80%. The number of frontend pods was auto-scaled to 50, each running on n1-standard-2 nodes. The node pool is set to autoscale up to 100 nodes. The errors appear to correlate with periods of high CPU on the nodes, but not always. What is the most likely cause and recommended action?

Accepted Answer

Change the backend service to use a multi-zone NEG that includes endpoints from all three zones, and ensure the load balancer is configured for cross-zone load balancing.. The high latency and 502 errors are likely caused by the HTTP Load Balancer sending requests to unhealthy backend pods due to zone-imbalanced traffic. A regional GKE cluster with a multi-zone NEG and cross-zone load balancing ensures that the load balancer distributes requests evenly across all pods in all three zones, preventing node CPU spikes in a single zone from causing errors. Option B directly addresses this by enabling proper traffic distribution, which is the most probable root cause given that node CPU spikes correlate with errors but not always.

Answer

Scale up the Cloud Spanner instance to handle higher peak CPU, as the 80% spikes indicate insufficient capacity.

Answer

Increase the CPU request for the frontend pods and set a higher target CPU utilization for the Horizontal Pod Autoscaler.

Answer

Increase the health check interval and timeout settings to give pods more time to respond before being marked unhealthy.

Question 7

A Cloud Router BGP session is flapping. The logs show 'Interface flapping due to changes in the underlying network'. What is the most likely cause?

Accepted Answer

MTU mismatch across the network path.. The log message 'Interface flapping due to changes in the underlying network' indicates that the BGP session is unstable because the physical or logical interface is going up and down. An MTU mismatch across the network path can cause packet fragmentation issues, leading to intermittent connectivity and interface flaps as the router detects and recovers from the problem. This is the most likely cause because it directly affects the stability of the underlying network path.

Answer

BGP MD5 authentication failure.

Answer

Incorrect local AS number in Cloud Router configuration.

Answer

BGP timer misconfiguration between peers.

Question 8

Which THREE factors should be considered when selecting a machine series for a Compute Engine instance running a memory-intensive batch job?

Accepted Answer

Network throughput.. Network throughput (A) is a critical factor for a memory-intensive batch job because such jobs often involve reading or writing large datasets from persistent storage or other sources over the network. The instance series must provide sufficient network bandwidth to avoid I/O bottlenecks that could extend job completion time, even if the compute and memory resources are adequate.

Answer

Sustained use discount.

Answer

GPU availability.

Question 9

Which TWO statements are true about Cloud Load Balancing?

Accepted Answer

Regional load balancing supports TCP/UDP traffic.. Regional load balancing (such as the external regional TCP/UDP Network Load Balancer) operates at Layer 4 and supports TCP and UDP traffic, making option B correct. Additionally, global load balancers like the external HTTP(S), SSL Proxy, and TCP Proxy load balancers can be associated with instance groups in multiple regions, allowing traffic distribution across regions for high availability and low latency. This makes option E correct. Options A, C, and D are incorrect because: A – not all load balancers require a regional forwarding rule (e.g., global load balancers use a global forwarding rule); C – global load balancers support not only HTTP/S but also TCP and UDP via the SSL Proxy and TCP Proxy load balancers; D – internal load balancing can also span across peered VPCs, not just the same VPC.

Answer

All load balancers require a regional forwarding rule.

Answer

Global load balancing supports only HTTP/S traffic.

Answer

Internal load balancing is only for traffic within the same VPC.

Question 10

A developer wants to automate the creation of a Google Cloud project with a specific VPC and firewall rules. Which tool should they use?

Accepted Answer

Deployment Manager. Deployment Manager is the correct tool because it allows you to define and manage Google Cloud resources, including projects, VPCs, and firewall rules, using declarative templates (YAML, Python, or Jinja2). This enables infrastructure-as-code (IaC) automation, which is essential for repeatable and version-controlled project creation. Unlike interactive tools, Deployment Manager handles the entire lifecycle of resources, including dependencies and updates, without manual intervention.

Answer

Cloud Shell

Answer

Cloud Console

Answer

Cloud SDK

Question 11

An organization needs to ensure that only Compute Engine instances with a specific label can access a Cloud Storage bucket. Which policy type should be used?

Accepted Answer

IAM policy. IAM policies are the correct mechanism to control access to Cloud Storage buckets based on identity and conditions. By attaching an IAM policy to the bucket with a condition that checks for a specific label on the requesting Compute Engine instance (e.g., using `resource.labels.tag`), you can restrict access to only those instances that have that label. This is the native Google Cloud way to implement attribute-based access control (ABAC) for storage resources.

Answer

Organization policy

Answer

Firewall rule

Answer

Signed URL

Question 12

A DevOps engineer notices that a GKE cluster has nodes that are frequently preempted. They want to reduce costs but maintain resilience. What should they do?

Accepted Answer

Use a regional cluster with multiple zones. A regional cluster with multiple zones distributes workloads across zones, so if nodes in one zone are preempted, the cluster remains resilient by using nodes in other zones. This reduces costs by allowing the use of preemptible VMs (which are cheaper) while maintaining high availability, as the cluster can tolerate zone-level failures. The key is that regional clusters provide a managed control plane and node distribution across zones, which is essential for resilience against preemption.

Answer

Use node auto-repair

Answer

Use preemptible VMs for all nodes

Answer

Use committed use discounts

Question 13

Which TWO features help reduce costs for batch processing workloads on Compute Engine?

Accepted Answer

Preemptible VMs. Preemptible VMs are short-lived, low-cost instances that can be terminated at any time by Compute Engine, making them ideal for batch processing workloads that are fault-tolerant and can handle interruptions. They offer up to 80% cost savings compared to standard VMs, directly reducing costs for batch jobs that can checkpoint and resume.

Answer

GPU accelerators

Answer

Sole-tenant nodes

Answer

Committed use discounts

Question 14

Refer to the exhibit. What is the effect of this IAM policy on a Cloud Storage bucket?

Accepted Answer

Alice and all users from example.com can view objects.. The IAM policy grants the `storage.objectViewer` role to both the user `alice@example.com` and the domain `example.com`. This means Alice and all authenticated users from the example.com domain (i.e., any Google account ending in @example.com) can view objects in the bucket. The correct answer is C because the policy explicitly includes both principals.

Answer

All users from example.com can view objects.

Answer

Only Alice can view objects.

Answer

Alice can view objects but not list buckets.

Question 15

Refer to the exhibit. A developer wants to SSH into instance-1 from their local machine. Which command should they use?

Accepted Answer

gcloud compute ssh instance-1 --zone us-central1-a. The `gcloud compute ssh` command requires the `--zone` flag when the zone is not set in the gcloud configuration or when the instance is in a different zone than the default. In this scenario, instance-1 is in zone us-central1-a, so specifying `--zone us-central1-a` ensures the SSH connection targets the correct instance. Without this flag, the command may fail or connect to the wrong instance if the default zone is different.

Answer

gcloud compute ssh instance-2

Answer

gcloud compute ssh instance-1 --project default

Answer

gcloud compute ssh instance-1 --internal-ip

Question 16

Refer to the exhibit. Which statement is true about this Deployment Manager template?

Accepted Answer

The VM will have a public IP address.. The Deployment Manager template includes the property `type: ONE_TO_ONE_NAT` under the `accessConfigs` block, which configures a NAT on the network interface and automatically assigns an ephemeral external IP address to the VM, giving it a public IP address.

Answer

The VM will be created in the us-central1-b zone.

Answer

The VM will use a custom machine type.

Answer

The boot disk will not be deleted when the VM is deleted.

Question 17

A company has two VPC networks in the same project: vpc-a (us-central1) and vpc-b (us-east1). They want to allow communication between instances in these VPCs using internal IPs. Which action should they take?

Accepted Answer

Set up VPC Network Peering between vpc-a and vpc-b.. VPC Network Peering allows direct internal IP communication between two VPC networks, regardless of region, as long as they are in the same project or across projects. This is the simplest and most efficient method for enabling private RFC 1918 connectivity without requiring VPN tunnels or moving resources. Peering uses Google's internal infrastructure, so traffic stays within the Google network and does not traverse the public internet.

Answer

Move both VPCs to the same region.

Answer

Create a VPN tunnel between the VPCs.

Answer

Ensure firewall rules allow ingress from the other VPC's subnet ranges.

Question 18

A company uses a Shared VPC hosted in a common project (host project) to centralize network management. A service project team needs to create a Compute Engine instance with a specific static internal IP address from the Shared VPC subnet. What IAM permissions should be granted to the service project's Compute Engine default service account?

Accepted Answer

compute.subnetworks.use and compute.addresses.use on the subnet and static IP.. When a service project creates a Compute Engine instance with a specific static internal IP from a Shared VPC subnet, the service project's Compute Engine default service account needs both `compute.subnetworks.use` permission on the subnet (to allow using the subnet) and `compute.addresses.use` permission on the specific static internal IP address (to reserve and use that address). These permissions must be granted at the host project level for the service account.

Answer

compute.networkAdmin on the host project.

Answer

compute.subnetworks.use on the host project subnet.

Answer

compute.instances.create on the service project.

Question 19

A developer needs to grant public read access to all objects in a Cloud Storage bucket named 'my-public-assets'. What is the simplest way to achieve this?

Accepted Answer

Enable uniform bucket-level access and grant storage.objectViewer to AllUsers.. Option C is correct because enabling uniform bucket-level access lets you manage permissions solely through IAM, and granting the storage.objectViewer role to allUsers makes every object in the bucket publicly readable with a single, simple policy. This is the recommended and simplest approach for public read access to all objects in a bucket. Option A is incorrect because Cloud Storage does not use bucket policies in the AWS S3 sense; access is controlled via IAM and ACLs. Option B is incorrect because granting storage.objectViewer to allUsers requires uniform bucket-level access to be enabled, otherwise the IAM binding is rejected. Option D is incorrect because setting an ACL on each object is more complex and does not scale as the simplest solution.

Answer

Set a bucket policy that allows allUsers to read objects.

Answer

Grant storage.objectViewer to AllUsers on the bucket without enabling uniform bucket-level access.

Answer

Set an ACL on each object to allow public read.

Question 20

A company is experiencing high latency in their VPC. They enabled VPC Flow Logs to capture metadata but need to analyze the logs for traffic patterns. Which Google Cloud service should they use to query and analyze VPC Flow Logs?

Accepted Answer

BigQuery. BigQuery is the correct service because VPC Flow Logs can be exported directly to BigQuery for querying and analyzing traffic patterns using SQL. BigQuery provides a serverless, highly scalable data warehouse that can handle large volumes of flow log metadata, enabling complex queries on source/destination IPs, ports, protocols, and packet counts. This allows the company to identify latency sources by analyzing traffic patterns over time.

Answer

Cloud Storage

Answer

Cloud Logging

Answer

Cloud Monitoring