Google PCA Manage and provision cloud infrastructure Practice Test 3 — 15 Questions

Question 1

Drag and drop the steps to migrate a Compute Engine VM to a different region using a snapshot into the correct order.

Accepted Answer

Create a snapshot of the existing disk, then create a new disk in the target region from the snapshot, then create a new VM in the target region using that disk.. Snapshots are global resources, but disks are regional. Create the disk in the target region, then create the VM.

Answer

Create a new disk in the target region, then create a snapshot of the existing disk, then create a new VM in the target region using the new disk.

Answer

Create a snapshot of the existing disk, then create a new VM in the target region, then create a new disk in the target region from the snapshot.

Answer

Create a new VM in the target region, then create a snapshot of the existing disk, then create a new disk in the target region from the snapshot.

Question 2

Drag and drop the steps to configure IAM roles for a service account to access Cloud Storage from a Compute Engine instance into the correct order.

Accepted Answer

Create the service account, then grant the necessary IAM roles, then attach the service account to the Compute Engine instance.. The service account must be attached to the instance before it can be used. Granting roles is done on the service account.

Answer

Grant the necessary IAM roles, then attach the service account to the Compute Engine instance, then create the service account.

Answer

Attach the service account to the Compute Engine instance, then create the service account, then grant the necessary IAM roles.

Answer

Create the service account, then attach it to the Compute Engine instance, then grant the necessary IAM roles.

Question 3

Match each GCP storage service to its typical use case.

Accepted Answer

Cloud Storage: Object storage for unstructured data. Cloud Storage is for unstructured object storage, Cloud SQL for relational data, Cloud Bigtable for wide-column NoSQL analytics, and Firestore for document NoSQL apps. Common confusions involve mixing storage types with database services.

Answer

Cloud Storage: Relational database for transactional workloads

Answer

Cloud SQL: Object storage for media files

Question 4

Match each GCP monitoring/logging tool to its purpose.

Accepted Answer

Cloud Monitoring: Provides visibility into performance, uptime, and health of applications and infrastructure.. Correct matches: Cloud Monitoring monitors performance, Cloud Logging manages logs, Error Reporting tracks errors. Confusion often arises between logging and monitoring roles.

Answer

Cloud Monitoring: Real-time log management and analysis for applications and services.

Answer

Cloud Logging: Counts, analyzes, and aggregates errors in cloud services.

Question 5

A developer needs to pass a startup script to a Compute Engine instance during creation. Which method should be used to ensure the script runs on first boot?

Accepted Answer

Use gcloud compute instances create with --metadata=startup-script=.... The `--metadata=startup-script=...` flag on `gcloud compute instances create` passes the script as instance metadata. Compute Engine automatically executes the value of the `startup-script` metadata key on every boot, including the first boot. This is the standard, documented method for providing a startup script at instance creation time.

Answer

Create a custom image with the script baked in.

Answer

Use gcloud compute instances add-metadata after creating the instance.

Answer

Use gcloud compute instances create with --startup-script flag.

Question 6

A company has Compute Engine instances in us-east1-a and us-east1-b zones. They want to allow communication between these instances with minimal latency and no additional cost. What is the best networking approach?

Accepted Answer

Use a single VPC network that includes both zones.. A single VPC network spans all regions and zones, allowing instances in different zones (us-east1-a and us-east1-b) to communicate using internal IP addresses with low latency and no additional cost. This is because VPC networks provide flat, global networking by default, and traffic between zones within the same VPC uses Google's internal backbone without incurring egress charges.

Answer

Configure VPC Network Peering between two separate VPC networks.

Answer

Create a new subnet in each zone and use Cloud NAT.

Answer

Set up a Cloud VPN between the zones.

Question 7

A Cloud Router BGP session is flapping. The logs show 'Interface flapping due to changes in the underlying network'. What is the most likely cause?

Accepted Answer

MTU mismatch across the network path.. The log message 'Interface flapping due to changes in the underlying network' indicates that the BGP session is unstable because the physical or logical interface is going up and down. An MTU mismatch across the network path can cause packet fragmentation issues, leading to intermittent connectivity and interface flaps as the router detects and recovers from the problem. This is the most likely cause because it directly affects the stability of the underlying network path.

Answer

BGP MD5 authentication failure.

Answer

Incorrect local AS number in Cloud Router configuration.

Answer

BGP timer misconfiguration between peers.

Question 8

Which TWO actions are required to allow a private GKE cluster to pull container images from Artifact Registry in the same project?

Accepted Answer

Enable Private Google Access on the subnet where the GKE nodes are deployed.. Private Google Access enables GKE nodes with only internal IP addresses to reach Google APIs and services, including Artifact Registry, over Google's private network rather than the public internet. Option E is correct because the GKE node's service account must have the Artifact Registry Reader role (roles/artifactregistry.reader) to authenticate and pull container images from the registry.

Answer

Create a firewall rule allowing outbound traffic to Artifact Registry IP ranges.

Answer

Set up VPC Network Peering with the Artifact Registry service.

Answer

Configure Cloud NAT for the GKE cluster.

Question 9

Which THREE factors should be considered when selecting a machine series for a Compute Engine instance running a memory-intensive batch job?

Accepted Answer

Network throughput.. Network throughput (A) is a critical factor for a memory-intensive batch job because such jobs often involve reading or writing large datasets from persistent storage or other sources over the network. The instance series must provide sufficient network bandwidth to avoid I/O bottlenecks that could extend job completion time, even if the compute and memory resources are adequate.

Answer

Sustained use discount.

Answer

GPU availability.

Question 10

Which TWO statements are true about Cloud Load Balancing?

Accepted Answer

Regional load balancing supports TCP/UDP traffic.. Regional load balancing (such as the external regional TCP/UDP Network Load Balancer) operates at Layer 4 and supports TCP and UDP traffic, making option B correct. Additionally, global load balancers like the external HTTP(S), SSL Proxy, and TCP Proxy load balancers can be associated with instance groups in multiple regions, allowing traffic distribution across regions for high availability and low latency. This makes option E correct. Options A, C, and D are incorrect because: A – not all load balancers require a regional forwarding rule (e.g., global load balancers use a global forwarding rule); C – global load balancers support not only HTTP/S but also TCP and UDP via the SSL Proxy and TCP Proxy load balancers; D – internal load balancing can also span across peered VPCs, not just the same VPC.

Answer

All load balancers require a regional forwarding rule.

Answer

Global load balancing supports only HTTP/S traffic.

Answer

Internal load balancing is only for traffic within the same VPC.

Question 11

Refer to the exhibit. A user reports that the instance 'batch-vm' is unavailable. Based on the output, what is the most likely cause of the unavailability?

Accepted Answer

The preemptible VM was terminated by Google due to its preemptible nature.. The exhibit shows the instance 'batch-vm' with a status of 'TERMINATED' and the 'preemptible' flag set to 'true'. Preemptible VMs in Google Cloud have a maximum runtime of 24 hours and can be terminated at any time by Google Compute Engine due to resource constraints. The termination reason is typically 'preemption', which matches the scenario of a user reporting unavailability without manual intervention.

Answer

The VM was stopped manually by a user.

Answer

The VM lost its external IP address.

Answer

The VM crashed due to an out-of-memory error.

Question 12

Refer to the exhibit. A Cloud Deployment Manager deployment fails with the error 'Resource 'my-firewall' already exists'. What is the most likely cause?

Accepted Answer

A firewall rule with the name 'my-firewall' already exists in the project.. The error message 'Resource 'my-firewall' already exists' directly indicates that a firewall rule with the exact name 'my-firewall' is already present in the project. Cloud Deployment Manager creates resources by name, and if a resource with the same name exists (even if it was created outside the deployment), the deployment will fail unless the deployment is configured to adopt or manage that existing resource. The error is not about permissions, network references, or missing delete policies—it is a name collision.

Answer

The user lacks IAM permissions to create firewall rules.

Answer

The network reference in the firewall rule is incorrect.

Answer

The deployment does not include a 'delete' policy for existing resources.

Question 13

Refer to the exhibit. A user (ops@example.com) is unable to create a new VPC network in the project. What should the administrator verify first?

Accepted Answer

The user has appropriate IAM roles such as roles/compute.networkAdmin.. To create a VPC network in Google Cloud, the user needs the compute.networks.create permission. The roles/compute.networkAdmin IAM role includes this permission, along with others needed to manage VPC networks. Option D correctly identifies that the user must have appropriate IAM roles, specifically roles/compute.networkAdmin or a custom role with the necessary compute.networks.create permission.

Answer

The user has been granted roles/compute.admin.

Answer

The user has the project owner role.

Answer

The user has the roles/storage.admin role.

Question 14

A company wants to provision multiple similar environments (dev, test, prod) with consistent networking configurations. Which approach is a best practice for infrastructure as code?

Accepted Answer

Use a single Terraform configuration with workspaces.. Terraform workspaces allow you to manage multiple distinct environments (e.g., dev, test, prod) from a single configuration by maintaining separate state files. This ensures consistent networking configurations across environments while avoiding duplication of code, which is a core best practice for infrastructure as code.

Answer

Use Ansible playbooks to run ad-hoc commands.

Answer

Run separate gcloud commands for each environment.

Answer

Use Cloud Deployment Manager templates with environment-specific parameters.

Question 15

A Cloud Function fails to connect to a Cloud SQL instance. The Cloud SQL instance has a private IP. What should the developer check?

Accepted Answer

Ensure either Cloud SQL Proxy is running or a VPC connector is configured, and IAM permissions are correct.. A Cloud Function with a private IP Cloud SQL instance requires either the Cloud SQL Proxy (which uses the Cloud SQL Auth proxy to establish an encrypted connection via the public IP, but if the instance has only a private IP, the proxy must be run within the same VPC) or a VPC connector to enable private networking. Additionally, proper IAM permissions (e.g., Cloud SQL Client role) are necessary for the proxy or connector to authenticate and connect. Without both the network path and IAM permissions, the connection will fail.

Answer

Ensure the Cloud SQL Proxy is running and configured.

Answer

Verify the Cloud Function's network settings.

Answer

Configure a VPC connector for the Cloud Function.