Google PCA Manage and provision cloud infrastructure Practice Test 4 — 15 Questions

Question 1

A company uses Shared VPC. A project admin in a service project tries to create a subnet in the shared VPC network but receives a permission denied error. What is the most likely cause?

Accepted Answer

The service project admin lacks the compute.subnetworks.create permission on the host project.. In a Shared VPC architecture, subnet creation is a privileged operation that can only be performed by a user with the compute.subnetworks.create permission on the host project. The service project admin, by default, does not have this permission in the host project, which is why the permission denied error occurs. Granting this permission to the service project admin at the host project level would resolve the issue.

Answer

Only the Shared VPC host project admin can create subnets.

Answer

The Shared VPC is not enabled for the service project.

Answer

Subnets must be created in the service project, not the host project.

Question 2

When creating a Compute Engine instance from a custom image stored in another project, which gcloud flag is required?

Accepted Answer

--image-project. When creating a Compute Engine instance from a custom image stored in another project, the `--image-project` flag is required to specify the project that contains the image. Without this flag, gcloud defaults to the current project and will not find the image. The `--image` flag is also required to specify the image name, but the question specifically highlights the cross-project situation, making `--image-project` the distinctive required flag.

Answer

--source-instance

Answer

--image

Answer

--image-family

Question 3

A web application running on Compute Engine behind a global HTTP(S) load balancer experiences high latency during traffic spikes. Which quick fix would best address this issue without changing the architecture?

Accepted Answer

Configure managed instance group autoscaling to add more instances.. Managed instance group (MIG) autoscaling dynamically adds more instances when CPU utilization or other metrics exceed a threshold, directly absorbing the increased traffic during spikes. This is the quickest fix because it requires no architectural changes—just configuring autoscaling parameters on the existing MIG. By scaling out horizontally, the load balancer can distribute requests across more backends, reducing per-instance load and latency.

Answer

Enable Cloud CDN on the load balancer.

Answer

Switch to a regional load balancer to reduce latency.

Answer

Increase the machine type of the backend instances.

Question 4

An organization needs to audit all changes to network firewall rules in a GCP project. Which service should be used to capture these changes?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify the configuration or metadata of resources, including changes to firewall rules. When a firewall rule is created, updated, or deleted, an audit log entry is automatically generated with details such as the user, timestamp, and the change made. This makes Cloud Audit Logs the correct service for auditing changes to network firewall rules in a GCP project.

Answer

Cloud Logging

Answer

Cloud Monitoring

Answer

VPC Flow Logs

Question 5

A company wants to minimize egress costs for data transferred between Compute Engine instances in the same region but different zones. What is the best practice?

Accepted Answer

Use internal IPs and ensure they are in the same VPC.. B is correct because data transfer between Compute Engine instances in the same region but different zones uses internal IP addresses within the same VPC, which incurs no egress costs. Google Cloud does not charge for traffic between instances using internal IPs within the same region, regardless of zone, as long as they are in the same VPC network. This is the most cost-effective approach for minimizing egress costs.

Answer

Use a VPN connection.

Answer

Use Cloud NAT.

Answer

Use external IPs for all instances.

Question 6

A developer wants to automate the creation of a Google Cloud project with a specific VPC and firewall rules. Which tool should they use?

Accepted Answer

Deployment Manager. Deployment Manager is the correct tool because it allows you to define and manage Google Cloud resources, including projects, VPCs, and firewall rules, using declarative templates (YAML, Python, or Jinja2). This enables infrastructure-as-code (IaC) automation, which is essential for repeatable and version-controlled project creation. Unlike interactive tools, Deployment Manager handles the entire lifecycle of resources, including dependencies and updates, without manual intervention.

Answer

Cloud Shell

Answer

Cloud Console

Answer

Cloud SDK

Question 7

An organization needs to ensure that only Compute Engine instances with a specific label can access a Cloud Storage bucket. Which policy type should be used?

Accepted Answer

IAM policy. IAM policies are the correct mechanism to control access to Cloud Storage buckets based on identity and conditions. By attaching an IAM policy to the bucket with a condition that checks for a specific label on the requesting Compute Engine instance (e.g., using `resource.labels.tag`), you can restrict access to only those instances that have that label. This is the native Google Cloud way to implement attribute-based access control (ABAC) for storage resources.

Answer

Organization policy

Answer

Firewall rule

Answer

Signed URL

Question 8

A company runs a web application on Compute Engine with an HTTP Load Balancer. Users report intermittent 502 Bad Gateway errors. What is the most likely cause?

Accepted Answer

Backend instances are unhealthy or overloaded.. The 502 Bad Gateway error from an HTTP Load Balancer typically indicates that the backend instances are failing to respond to the load balancer's health checks or are overwhelmed, causing the load balancer to consider them unhealthy and return a 502 error. This is the most common cause because the load balancer relies on healthy backends to forward traffic, and overloaded or failing instances cannot handle requests.

Answer

Load balancer quota exceeded.

Answer

Firewall rules block health checks.

Answer

SSL certificate expired.

Question 9

A company wants to migrate an on-premises Oracle database to Google Cloud. They need high availability and want to minimize application changes. Which service should they use?

Accepted Answer

Bare Metal Solution. Bare Metal Solution is correct because it provides dedicated physical servers for Oracle workloads, enabling high availability through Oracle RAC or Data Guard while preserving the existing Oracle database architecture. This minimizes application changes since the database remains Oracle-native, unlike managed services that require migration to a different database engine.

Answer

Cloud SQL for MySQL

Answer

Cloud Spanner

Answer

Compute Engine with Oracle license

Question 10

A DevOps engineer notices that a GKE cluster has nodes that are frequently preempted. They want to reduce costs but maintain resilience. What should they do?

Accepted Answer

Use a regional cluster with multiple zones. A regional cluster with multiple zones distributes workloads across zones, so if nodes in one zone are preempted, the cluster remains resilient by using nodes in other zones. This reduces costs by allowing the use of preemptible VMs (which are cheaper) while maintaining high availability, as the cluster can tolerate zone-level failures. The key is that regional clusters provide a managed control plane and node distribution across zones, which is essential for resilience against preemption.

Answer

Use node auto-repair

Answer

Use preemptible VMs for all nodes

Answer

Use committed use discounts

Question 11

An organization requires that all Compute Engine instances in a project must have a specific tag for firewall rule compliance. How can they enforce this?

Accepted Answer

Use a mandatory tag via organization policy. Organization Policies in Google Cloud can enforce constraints that require resources, including Compute Engine instances, to have specific labels or tags. The `compute.requireOsLogin` or custom constraint `compute.requireInstanceTag` can be used to mandate that all instances must have a particular tag, and any instance creation that violates this policy will be denied at the API level, ensuring compliance without relying on user behavior.

Answer

Use IAM roles to restrict instance creation

Answer

Use a startup script to add the tag

Answer

Use Cloud Asset Inventory

Question 12

A company is migrating a monolithic application to microservices on Google Cloud. They need to manage service-to-service authentication and authorization. Which service should they use?

Accepted Answer

Service Mesh (Anthos). Service Mesh (Anthos) provides a dedicated infrastructure layer for managing service-to-service communication, including mutual TLS (mTLS) authentication, fine-grained authorization policies, and observability. It uses sidecar proxies (Envoy) to intercept traffic and enforce security policies without modifying application code, making it ideal for microservices authentication and authorization.

Answer

Cloud NAT

Answer

Cloud Identity-Aware Proxy

Answer

Cloud Endpoints

Question 13

A security team wants to audit all IAM role assignments in an organization. They need a historical record of changes. Which tool should they use?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify IAM policies, including role assignments. These logs are immutable and retained for the default retention period (400 days for Admin Activity logs), providing a historical record of changes. Cloud Asset Inventory (A) shows the current state but not historical changes, Access Transparency (B) logs Google staff access to your data, and Security Command Center (D) provides security findings and posture, not a change history.

Answer

Cloud Asset Inventory

Answer

Access Transparency

Answer

Security Command Center

Question 14

Which TWO features help reduce costs for batch processing workloads on Compute Engine?

Accepted Answer

Preemptible VMs. Preemptible VMs are short-lived, low-cost instances that can be terminated at any time by Compute Engine, making them ideal for batch processing workloads that are fault-tolerant and can handle interruptions. They offer up to 80% cost savings compared to standard VMs, directly reducing costs for batch jobs that can checkpoint and resume.

Answer

GPU accelerators

Answer

Sole-tenant nodes

Answer

Committed use discounts

Question 15

Which THREE are valid methods to connect an on-premises network to a Google Cloud VPC?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect (A) provides a direct physical connection between your on-premises network and Google Cloud, offering high bandwidth and a Service Level Agreement (SLA) of up to 99.99% availability. It uses a cross-connect in a colocation facility to attach your on-premises router to a Google Cloud router, enabling private, low-latency connectivity to your VPC without traversing the public internet.

Answer

Cloud Router

Answer

VPC peering