Google PCA Manage and provision cloud infrastructure Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. Which statement is true about this Deployment Manager template?

Accepted Answer

The VM will have a public IP address.. The Deployment Manager template includes the property `type: ONE_TO_ONE_NAT` under the `accessConfigs` block, which configures a NAT on the network interface and automatically assigns an ephemeral external IP address to the VM, giving it a public IP address.

Answer

The VM will be created in the us-central1-b zone.

Answer

The VM will use a custom machine type.

Answer

The boot disk will not be deleted when the VM is deleted.

Question 2

A company has two VPC networks in the same project: vpc-a (us-central1) and vpc-b (us-east1). They want to allow communication between instances in these VPCs using internal IPs. Which action should they take?

Accepted Answer

Set up VPC Network Peering between vpc-a and vpc-b.. VPC Network Peering allows direct internal IP communication between two VPC networks, regardless of region, as long as they are in the same project or across projects. This is the simplest and most efficient method for enabling private RFC 1918 connectivity without requiring VPN tunnels or moving resources. Peering uses Google's internal infrastructure, so traffic stays within the Google network and does not traverse the public internet.

Answer

Move both VPCs to the same region.

Answer

Create a VPN tunnel between the VPCs.

Answer

Ensure firewall rules allow ingress from the other VPC's subnet ranges.

Question 3

A company uses a Shared VPC hosted in a common project (host project) to centralize network management. A service project team needs to create a Compute Engine instance with a specific static internal IP address from the Shared VPC subnet. What IAM permissions should be granted to the service project's Compute Engine default service account?

Accepted Answer

compute.subnetworks.use and compute.addresses.use on the subnet and static IP.. When a service project creates a Compute Engine instance with a specific static internal IP from a Shared VPC subnet, the service project's Compute Engine default service account needs both `compute.subnetworks.use` permission on the subnet (to allow using the subnet) and `compute.addresses.use` permission on the specific static internal IP address (to reserve and use that address). These permissions must be granted at the host project level for the service account.

Answer

compute.networkAdmin on the host project.

Answer

compute.subnetworks.use on the host project subnet.

Answer

compute.instances.create on the service project.

Question 4

A developer needs to grant public read access to all objects in a Cloud Storage bucket named 'my-public-assets'. What is the simplest way to achieve this?

Accepted Answer

Enable uniform bucket-level access and grant storage.objectViewer to AllUsers.. Option C is correct because enabling uniform bucket-level access lets you manage permissions solely through IAM, and granting the storage.objectViewer role to allUsers makes every object in the bucket publicly readable with a single, simple policy. This is the recommended and simplest approach for public read access to all objects in a bucket. Option A is incorrect because Cloud Storage does not use bucket policies in the AWS S3 sense; access is controlled via IAM and ACLs. Option B is incorrect because granting storage.objectViewer to allUsers requires uniform bucket-level access to be enabled, otherwise the IAM binding is rejected. Option D is incorrect because setting an ACL on each object is more complex and does not scale as the simplest solution.

Answer

Set a bucket policy that allows allUsers to read objects.

Answer

Grant storage.objectViewer to AllUsers on the bucket without enabling uniform bucket-level access.

Answer

Set an ACL on each object to allow public read.

Question 5

A company is experiencing high latency in their VPC. They enabled VPC Flow Logs to capture metadata but need to analyze the logs for traffic patterns. Which Google Cloud service should they use to query and analyze VPC Flow Logs?

Accepted Answer

BigQuery. BigQuery is the correct service because VPC Flow Logs can be exported directly to BigQuery for querying and analyzing traffic patterns using SQL. BigQuery provides a serverless, highly scalable data warehouse that can handle large volumes of flow log metadata, enabling complex queries on source/destination IPs, ports, protocols, and packet counts. This allows the company to identify latency sources by analyzing traffic patterns over time.

Answer

Cloud Storage

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 6

Which TWO IAM predefined roles grant read-only access to Cloud Storage objects but not the ability to list buckets?

Accepted Answer

roles/storage.legacyBucketReader. roles/storage.legacyBucketReader (A) is correct because it grants storage.buckets.get and storage.objects.list at the bucket level, providing read-only visibility into a bucket's contents without allowing object data reads or bucket listing across the project. roles/storage.objectViewer (B) is correct because it grants read-only access to object data and metadata (storage.objects.get, storage.objects.list) but does not include storage.buckets.list, so it cannot enumerate buckets. roles/storage.objectAdmin (C) is incorrect because it grants full control over objects, including create, delete, and overwrite, which exceeds read-only access. roles/storage.viewer (D) is incorrect because it grants storage.buckets.list and read access to bucket metadata, allowing bucket listing. roles/storage.admin (E) is incorrect because it grants full control over buckets and objects, including listing and modifying them.

Answer

roles/storage.objectAdmin

Answer

roles/storage.viewer

Answer

roles/storage.admin

Question 7

Which THREE are valid Google Cloud Dedicated Interconnect connection options?

Accepted Answer

High availability (HA) with two 10 Gbps circuits.. Google Cloud Dedicated Interconnect supports high availability configurations using two 10 Gbps circuits to provide redundancy and meet SLA requirements. This setup ensures that if one circuit fails, traffic can be rerouted through the other, maintaining connectivity.

Answer

IPsec VPN tunnel as a backup to the interconnect.

Answer

Partner Interconnect offering via a service provider.

Question 8

An organization policy at the organization level restricts project creation to only Project Creator role holders. The exhibit shows the IAM policy for the organization. A member of the group pm-team@example.com attempts to create a project but receives a permission denied error. What is the most likely cause?

Accepted Answer

An organization policy with a constraint to block project creation for non-allowlisted users is enforced.. The organization policy explicitly restricts project creation to only users who hold the Project Creator role. The user is a member of pm-team@example.com but does not have the Project Creator role, so the policy denies the request. This is a common IAM constraint at the organization level that overrides any lower-level permissions.

Answer

The user's email domain is not allowed by the organization policy.

Answer

The group pm-team@example.com does not exist.

Answer

The IAM policy is missing the resourcemanager.projectCreator role.

Question 9

A company wants to deploy a standard VM image with pre-installed software across multiple projects. Which Google Cloud solution should they use to automate this process?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager (option C) is the correct choice because it allows you to define a declarative template (in YAML, Jinja, or Python) that specifies the VM instance configuration, including the boot disk image with pre-installed software, and then deploy that template consistently across multiple projects. This automates the entire provisioning process, ensuring each VM is identical and reducing manual effort.

Answer

Cloud Build

Answer

Compute Engine

Answer

Cloud Shell

Answer

Artifact Registry

Question 10

A company has a production GKE cluster with a node pool using n1-standard-4 machine types. They need to change to e2-standard-4 without downtime. Which approach should be taken?

Accepted Answer

Create a new node pool with the new machine type, cordon and drain old nodes, then delete the old pool.. It ensures zero downtime by first creating a new node pool with the desired e2-standard-4 machine type, then cordoning and draining the old nodes to gracefully migrate workloads, and finally deleting the old pool. This approach leverages Kubernetes' native pod eviction and rescheduling mechanisms to maintain application availability throughout the migration.

Answer

Enable GKE Node Auto-Repair to automatically fix the issue.

Answer

Delete the existing node pool and create a new one with the new machine type.

Answer

Update the existing node pool's machine type via gcloud container node-pools update.

Answer

Use gcloud compute machine-types change on the nodes.

Question 11

A team wants to allow a service account to be used only on specific Compute Engine VMs. Which IAM condition should be applied to the service account's roles?

Accepted Answer

resource.name. The `resource.name` IAM condition allows you to restrict a service account's roles to specific Compute Engine VM instances by matching the VM's resource name (e.g., `projects/project-id/zones/zone/instances/instance-name`). This ensures the service account can only be used on designated VMs, enforcing fine-grained access control.

Answer

resource.service

Answer

resource.owner

Answer

resource.type

Answer

resource.labels

Question 12

A company is migrating hundreds of on-premises VMs to Compute Engine. They want to minimize manual effort and downtime. Which service should they use?

Accepted Answer

Migrate for Compute Engine. Migrate for Compute Engine (formerly Velostrata) is the correct choice because it is a fully managed service specifically designed for migrating large-scale VM workloads to Compute Engine with minimal downtime. It uses a streaming migration approach that moves the OS and application data while the source VM continues running, then performs a cutover with near-zero downtime, making it ideal for hundreds of VMs without manual effort.

Answer

Cloud Build

Answer

gcloud compute instances import

Answer

Transfer Appliance

Answer

CloudEndure

Question 13

An organization's security policy requires that all Compute Engine VMs have Shielded VM features enabled. How can this be enforced at the organization level?

Accepted Answer

Create an Organization Policy with the constraint compute.requireShieldedVm.. The Organization Policy constraint `compute.requireShieldedVm` is a Google Cloud-native mechanism that enforces Shielded VM features at the organization, folder, or project level. When this constraint is applied, any Compute Engine VM creation request that does not include Shielded VM settings (such as Secure Boot, vTPM, and Integrity Monitoring) is denied by the Organization Policy service, ensuring compliance without relying on user behavior or manual review.

Answer

Enable Cloud Audit Logs and review VM creations.

Answer

Use VPC Service Controls to restrict VM creation.

Answer

Assign a custom IAM role that only allows creation of Shielded VMs.

Answer

Use Deployment Manager templates that include Shielded VM.

Question 14

Which TWO of the following are valid ways to deploy a Cloud Function? (Choose two.)

Accepted Answer

gcloud functions deploy. `gcloud functions deploy` is the primary command-line interface (CLI) method to deploy a Cloud Function directly from a local source or a specified source location. Option E is correct because Cloud Build triggers can be configured to automatically deploy a Cloud Function whenever a change is pushed to a repository (e.g., Cloud Source Repositories, GitHub), enabling continuous deployment.

Answer

Cloud Source Repositories

Answer

Cloud Run

Answer

Cloud Scheduler

Question 15

A company has a Cloud SQL for PostgreSQL instance that is experiencing high latency. They suspect a connection pooling issue. Which TWO configurations should be checked? (Choose two.)

Accepted Answer

Cloud SQL Auth Proxy configuration. Option A (Cloud SQL Auth Proxy configuration) is correct because the Auth Proxy is a common connection-pooling layer for Cloud SQL; misconfigured proxy settings such as connection limits, max connections, or idle timeouts can cause connection churn and high latency. Option B (max_connections database flag) is correct because this PostgreSQL flag caps concurrent connections; if it is set too low, clients queue or fail to connect, and if set too high, resource contention (memory, CPU) increases latency, so it must be checked when diagnosing pooling issues. Option C (Private IP assignment) is not directly related to connection pooling; it affects network path and security, not pool sizing or connection reuse. Option D (Database query insights) is a monitoring/observability feature for query performance, not a connection-pooling configuration. Option E (Database version) is not a pooling configuration, though version can affect features and behavior, it is not the specific setting to check for this scenario.

Answer

Private IP assignment

Answer

Database query insights

Answer

Database version