Google PCA Manage and provision cloud infrastructure Practice Test 3 — 15 Questions

Question 1

What will happen to this instance during a Google-initiated maintenance event?

Accepted Answer

The instance will be terminated and then restarted after maintenance.. During a Google-initiated maintenance event, a standard (non-live-migratable) Compute Engine instance is terminated and then restarted on another host after the maintenance is complete. This behavior is controlled by the instance's 'onHostMaintenance' setting; when set to 'TERMINATE' (the default for instances with GPUs or certain configurations), the instance is stopped, the host undergoes maintenance, and then the instance is restarted. Option B correctly describes this termination-and-restart sequence.

Answer

The instance will be migrated and then restarted.

Answer

The instance will be preempted and deleted.

Answer

The instance will stop and remain stopped.

Answer

The instance will be live-migrated to another host.

Question 2

Given the IAM policy:

```json
{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:alice@example.com"],
      "condition": {
        "expression": "resource.name.startsWith('projects/_/buckets/bucket-x/objects/')",
        "title": "Restrict to bucket-x"
      }
    }
  ]
}
```
What does the condition in this IAM policy do?

Accepted Answer

It allows Alice to view objects only in bucket-x.. The condition in the IAM policy restricts the `storage.objects.get` action to the `projects/_/buckets/bucket-x/objects/*` resource, which means Alice can only view (read) objects within that specific bucket. The `storage.objects.list` action is also allowed on `bucket-x`, enabling her to list its contents. No other actions or buckets are permitted, making option B correct.

Answer

It denies Alice access to all buckets.

Answer

It allows Alice to view objects in any bucket.

Answer

It allows Alice to list all buckets in the project.

Answer

It allows Alice to view and delete objects in bucket-x.

Question 3

What is the networking mode of this GKE cluster?

Accepted Answer

VPC-native networking. A is correct because VPC-native networking is the default and recommended networking mode for GKE clusters, where the cluster uses alias IP ranges (RFC 6598) on the VPC network. This mode assigns pod IP addresses directly from the VPC subnet's secondary IP range, enabling native integration with VPC features like Cloud NAT, VPC Flow Logs, and firewall rules without requiring manual route management.

Answer

Hybrid networking

Answer

Standard networking

Answer

Routes-based networking

Answer

Private cluster networking

Question 4

A team uses Cloud Build to build container images and deploy to Cloud Run. They want to automate deployments whenever a new image is pushed to Container Registry. What is the best approach?

Accepted Answer

Configure a Cloud Build trigger that runs on a push to the container image in Container Registry. Cloud Build triggers can be configured to fire on a push to a container image in Container Registry, using the 'cloud-builds' Pub/Sub topic that Container Registry publishes to when an image is pushed. This allows Cloud Build to automatically run a build step (e.g., gcloud run deploy) to deploy the new image to Cloud Run without any polling or external infrastructure.

Answer

Use Cloud Deploy with a delivery pipeline that polls for new images

Answer

Create a Cloud Function that subscribes to Pub/Sub and calls Cloud Run deploy

Answer

Set up a Cloud Scheduler job to run a script that deploys the latest image

Question 5

A company is migrating a large on-premises SQL Server database to Cloud SQL for SQL Server. The database is 2 TB in size and must have minimal downtime. Which approach should they use?

Accepted Answer

Use Database Migration Service (DMS) for continuous one-way replication. Database Migration Service (DMS) supports continuous one-way replication from on-premises SQL Server to Cloud SQL for SQL Server using native SQL Server transaction log shipping or Always On availability group replication. This minimizes downtime by keeping the target synchronized during the migration cutover, which is critical for a 2 TB database where a full backup/restore would cause extended downtime.

Answer

Set up a Cloud SQL HA instance and replicate on-premises using Always On availability groups

Answer

Export the database to CSV files, then import using Cloud SQL import

Answer

Perform a full backup to Cloud Storage, then restore into Cloud SQL

Question 6

Which TWO methods can be used to restrict inbound traffic to a Compute Engine instance to only specific IP addresses without relying on instance-level firewall rules? (Choose 2)

Accepted Answer

Configure Cloud Armor policies. Option B (Configure Cloud Armor policies) is correct because Cloud Armor security policies attach to an external HTTP(S) load balancer (backend service) and enforce IP-based allow/deny rules at the edge, filtering inbound traffic before it reaches the Compute Engine instance without using instance-level firewall rules. Option C (Create firewall rules in the VPC network) is correct because VPC firewall rules are network-level constructs that filter ingress traffic by source IP range (and protocol/port) and apply to instances via network tags or service accounts, so they restrict inbound traffic to specific IP addresses independently of any instance-level firewall configuration. Option A (VPC Service Controls) is not correct here because it creates a service perimeter to prevent data exfiltration between Google Cloud services and is not an inbound IP-address filtering mechanism for Compute Engine instances. Option D (Assign a service account to the instance) is not correct because a service account controls the instance's identity and API permissions, not which external IP addresses can reach it. Option E (Use Identity-Aware Proxy for TCP forwarding) is not correct because IAP authenticates and authorizes users for access rather than restricting inbound traffic by specific source IP addresses.

Answer

Use VPC Service Controls

Answer

Assign a service account to the instance

Answer

Use Identity-Aware Proxy (IAP) for TCP forwarding

Question 7

A company runs a critical web application behind an external HTTPS load balancer. The backend consists of a managed instance group of Compute Engine instances. Users report intermittent 502 Bad Gateway errors. The load balancer logs show occasional health check failures for some instances. The instances have a custom health check endpoint that returns a 200 status code only if the application is fully healthy. The application logs do not show any errors, and CPU/memory usage on the instances is normal. What should be the first troubleshooting step to identify the root cause?

Accepted Answer

Check the application's logs on the instances to see why the health check endpoint sometimes returns non-200. The health check endpoint is custom and returns 200 only when the application is fully healthy. Since the instances show normal CPU/memory and application logs show no errors, the intermittent 502 errors and health check failures might be due to the health check endpoint itself returning non-200 sporadically. The first troubleshooting step is to examine the application logs on the instances to understand why the health check endpoint sometimes fails. This will pinpoint the specific condition causing the health check to fail. Option A is incorrect because a TCP check would not validate application health and could mask the problem. Option B is incorrect because increasing the interval and decreasing the unhealthy threshold would delay detection or make it more sensitive, not address the root cause. Option C is incorrect because adding instances does not fix the health check issue; it only spreads traffic if some instances are unhealthy.

Answer

Change the health check to a TCP check on the application's port

Answer

Increase the health check check interval and decrease the unhealthy threshold

Answer

Increase the number of instances in the managed instance group

Question 8

A company is migrating a monolithic e-commerce application to Google Cloud. The application has been refactored into microservices. Most services are stateless and can run on Cloud Run. However, the checkout service requires maintaining session state across multiple requests, and the session data must be available globally for low latency. The application will be deployed in multiple regions to serve a global user base. Which approach should the company take?

Accepted Answer

Deploy the checkout service on Cloud Run in multiple regions, and use Memorystore (Redis) with replication as the session store. Memorystore (Redis) with replication provides a globally accessible, low-latency session store that can be used by Cloud Run instances in multiple regions. Redis replication ensures data durability and high availability, while Cloud Run's stateless nature is complemented by externalizing session state to a managed caching layer. This architecture meets the requirement for global session data availability without coupling state to individual compute instances.

Answer

Run the checkout service on Compute Engine with regional managed instance groups and Cloud Filestore

Answer

Use Cloud Run with session affinity and in-memory caching within each instance

Answer

Deploy the checkout service on Google Kubernetes Engine using StatefulSets and regional persistent disks

Question 9

A company is designing a hybrid network architecture connecting an on-premises data center to Google Cloud. They need high availability (99.99% SLA) and bandwidth up to 10 Gbps. They also need to use their existing MPLS circuits. Which THREE components should they include in the design? (Choose three.)

Accepted Answer

Two VLAN attachments to two different edge availability domains.. The scenario requires a 99.99% SLA, up to 10 Gbps, and reuse of existing MPLS circuits, which points to Dedicated Interconnect with redundant connectivity. Option D is correct because Dedicated Interconnect supports 10 Gbps links and, with at least two redundant links in different edge availability domains, can meet the 99.99% availability target. Option A is correct because each 10 Gbps Interconnect link must terminate on a VLAN attachment, and placing two VLAN attachments in two different edge availability domains provides the redundancy needed for the SLA. Option B is correct because Cloud Router uses BGP to dynamically exchange routes between the on-premises MPLS routers and Google Cloud, and establishing BGP sessions from each on-premises router to each Cloud Router ensures failover and route propagation. Option C is not appropriate because Cloud CDN is an HTTP(S) caching service for external users, not a hybrid connectivity component. Option E is not appropriate because Cloud VPN over the internet does not use existing MPLS circuits and typically does not provide the required 10 Gbps bandwidth or the same 99.99% SLA as redundant Dedicated Interconnect.

Answer

Cloud CDN to cache content and reduce latency.

Answer

Cloud VPN tunnels with multiple gateways for failover.

Question 10

A company is deploying a web application on Google Kubernetes Engine. The application serves HTTP traffic and needs to scale based on CPU utilization. They also need to expose the application to the internet with a single global IP address. They create a Deployment with a HorizontalPodAutoscaler. However, the application is not receiving traffic from the internet. What should they do to expose the application correctly?

Accepted Answer

Create an Ingress resource with the GCE ingress controller.. The correct approach is to create an Ingress resource with the GCE ingress controller because it provides a single global IP address via an HTTP(S) load balancer, which is required for internet-facing traffic. The HorizontalPodAutoscaler scales the Deployment based on CPU utilization, but the application must be exposed through a Service (typically of type NodePort or ClusterIP) that the Ingress routes to. The GCE ingress controller automatically provisions a global HTTP(S) load balancer, satisfying the requirement for a single global IP address.

Answer

Create a Service of type NodePort and use a firewall rule to allow traffic.

Answer

Create a Service of type ClusterIP and a load balancer manually.

Answer

Define a Network Endpoint Group (NEG) and attach it to a backend service.

Question 11

A company runs a batch processing workload on Compute Engine instances. The workload is triggered every hour and runs for about 10 minutes. They want to reduce costs. They currently use preemptible VMs, but they notice that sometimes the workload fails because VMs are preempted before completion. They need a cost-effective solution that ensures the workload completes reliably. What should they do?

Accepted Answer

Create a custom machine type with minimal resources and use a managed instance group with preemptible VMs, combined with a startup script that retries on failure.. It combines the cost savings of preemptible VMs with reliability through a managed instance group (MIG) and a retry startup script. The MIG automatically recreates VMs if preempted, and the startup script ensures the batch workload restarts from where it left off or retries the entire job, guaranteeing completion at minimal cost.

Answer

Increase the machine size of the preemptible VMs to finish faster.

Answer

Provision a commitment-based discount for standard VMs.

Answer

Use standard (non-preemptible) VMs to avoid preemption.

Question 12

Your organization uses Cloud SQL for MySQL to host a production database. The database size is 500 GB. You need to create a read replica for reporting purposes. The read replica should be in a different region for disaster recovery. You have created the read replica in the us-west1 region. However, the replication lag is higher than expected, sometimes exceeding 5 minutes. What should you do to reduce replication lag?

Accepted Answer

Upgrade the primary instance to a higher machine type with more CPU and memory.. Replication lag in Cloud SQL for MySQL is often caused by the primary instance being unable to keep up with the write workload, especially when the replica is in a different region. Upgrading the primary to a higher machine type with more CPU and memory increases its capacity to process transactions and generate binary logs, reducing the backlog that causes lag. This directly addresses the root cause of high replication lag, unlike other options that target unrelated aspects.

Answer

Configure an external read replica using MySQL binary log replication.

Answer

Increase the disk size of the read replica.

Answer

Decrease the backup window on the primary instance.

Question 13

A company needs to connect two VPC networks in different Google Cloud regions. The VPCs are in separate projects under the same organization. The connection must use private IP addresses and support high throughput. Which TWO options meet these requirements? (Choose 2.)

Accepted Answer

VPC Network Peering. VPC Network Peering allows direct private IP connectivity between two VPCs in different projects and regions, using RFC 1918 addresses without internet gateways or VPNs. It supports high throughput because traffic stays within Google's network backbone and does not rely on encrypted tunnels that can introduce overhead.

Answer

HA VPN Gateway

Answer

Cloud NAT

Answer

Shared VPC

Question 14

A financial services company runs a latency-sensitive trading application on a managed instance group (MIG) of Compute Engine instances in us-central1. The company needs to distribute incoming traffic across the instances while preserving the client source IP address for auditing. The instances must also be able to scale automatically based on CPU utilization. Which load balancer configuration should the architect choose?

Accepted Answer

External TCP/UDP network load balancer with a regional managed instance group backend and autoscaling enabled.. The external TCP/UDP network load balancer is a layer 4 load balancer that preserves the client source IP address, which is critical for auditing in a trading application. It supports regional managed instance groups and autoscaling based on CPU utilization. The other load balancers either do not preserve source IP or are not externally accessible, making them unsuitable for this scenario.

Answer

External HTTP(S) load balancer with a managed instance group backend and autoscaling enabled.

Answer

Internal HTTP(S) load balancer with a managed instance group backend and autoscaling enabled.

Answer

Internal TCP/UDP load balancer with a regional managed instance group backend and autoscaling enabled.

Question 15

A retail company runs a legacy Java application on a single Compute Engine instance in us-central1-a. The application writes to a local SSD and is not replicated. The CIO wants to improve availability without modifying the application, and requires an RPO of 15 minutes and an RTO of 1 hour. The current instance uses a standard persistent disk. Which approach should the architect recommend?

Accepted Answer

Replace the local SSD with a regional persistent disk and attach it to the instance, then configure a snapshot schedule for backup.. A regional persistent disk is the correct choice because it synchronously replicates data across two zones, giving an RPO of zero for disk writes and allowing the disk to be reattached in the secondary zone during a failure. This satisfies the 15-minute RPO and 1-hour RTO without application changes, while snapshots provide additional backup protection.

Answer

Move the application to a sole-tenant node in another zone and configure live migration to handle zone failures.

Answer

Enable persistent disk snapshots on a schedule and create an instance template to recreate the instance in another zone if needed.

Answer

Create a managed instance group with a regional distribution across three zones and configure an autoscaling policy based on CPU utilization.