Google PCA Manage and provision cloud infrastructure Practice Test 4 — 15 Questions

Question 1

A media company needs to store 500 TB of video files in Cloud Storage. The files are accessed frequently for the first 30 days after creation, then rarely accessed after 90 days. The company wants to minimize storage costs while ensuring immediate access when needed. They also require that objects remain in the same bucket and are not deleted. Which storage class should they use as the default for the bucket?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Autoclass. Autoclass is a Cloud Storage feature that automatically manages object storage classes based on access patterns. It sets the default class to Standard and transitions objects to cooler classes when they are not accessed. This eliminates the need for lifecycle policies and ensures cost savings while maintaining immediate access. The other options are static classes that do not adapt to changing access patterns.

Answer

Standard

Answer

Nearline

Answer

Coldline

Question 2

A financial services company runs a latency-sensitive trading application on a managed instance group in the us-central1 region. The application must be reachable from branch offices in North America and Europe over a single global anycast IP address. The company wants to minimize latency for all users and avoid managing individual regional load balancers. Which Google Cloud load balancing solution should they implement?

Accepted Answer

Global external Application Load Balancer with a backend service pointing to the managed instance group. The global external Application Load Balancer is the only option that provides a single global anycast IP, intelligent routing to the closest healthy backend, and cross-region failover. It meets the latency and management requirements for users in North America and Europe. The other options are either regional or internal, and cannot deliver the required global reach and low latency.

Answer

Internal passthrough Network Load Balancer with a global access policy

Answer

Regional external passthrough Network Load Balancer in us-central1 with a global forwarding rule

Answer

External proxy Network Load Balancer with a regional backend service in us-central1

Question 3

A financial services company needs to ensure that all outbound traffic from its Compute Engine instances in a VPC network goes through a centralized appliance for inspection. The instances are in multiple subnets across two regions. The company wants to minimize management overhead and ensure high availability. What should the architect implement?

Accepted Answer

Configure a custom static route in each subnet's route table pointing to an internal TCP/UDP load balancer fronting the inspection appliance.. A custom static route with the next hop set to an internal TCP/UDP load balancer enables centralized traffic inspection while providing high availability across zones. The load balancer distributes traffic to multiple appliance instances, and the route applies to all instances in the VPC. Other options either do not route traffic through the appliance or are designed for different traffic flows.

Answer

Use a global external HTTP(S) load balancer with a backend service pointing to the inspection appliance.

Answer

Assign external IP addresses to all instances and use Cloud NAT to route traffic through the appliance.

Answer

Create a VPC peering connection to a separate inspection VPC and use firewall rules to redirect traffic.

Question 4

A platform engineering team manages a fleet of Compute Engine instances that run stateless web frontends. They need to ensure that any instance can be replaced at any time without manual IP address reassignment, and that the frontends remain reachable through a single stable internal address. They also want the instances to scale automatically based on CPU utilization. Which combination of Google Cloud resources should they use?

Accepted Answer

Create a managed instance group with an instance template, attach a regional internal passthrough Network Load Balancer, and configure autoscaling based on CPU utilization.. The team needs a self-healing, autoscaling fleet and a stable internal address that does not change when instances are replaced. A managed instance group with an instance template provides that fleet, and a regional internal passthrough Network Load Balancer provides the stable internal IP. Autoscaling based on CPU utilization completes the scaling requirement.

Answer

Create a managed instance group with an instance template, attach an external passthrough Network Load Balancer, and configure autoscaling based on CPU utilization.

Answer

Create individual Compute Engine instances with static internal IP addresses, place them behind an external HTTP(S) load balancer, and configure a health check.

Answer

Create a managed instance group with an instance template, attach an internal HTTP(S) load balancer, and configure autoscaling based on CPU utilization.

Question 5

A media company is deploying a new video transcoding application on Google Kubernetes Engine (GKE). The application requires GPU acceleration for transcoding jobs and must scale down to zero when no jobs are pending to minimize cost. The company wants to use GKE Autopilot. Which TWO actions should the architect take to meet these requirements? (Choose two.)

Accepted Answer

Deploy the transcoding application as a Kubernetes Deployment with a node selector that requests GPU resources, and configure Horizontal Pod Autoscaling based on a custom metric.. In GKE Autopilot, you request GPU resources directly in the pod specification, and Autopilot provisions and removes GPU nodes automatically. Using a Deployment with Horizontal Pod Autoscaling or a Job with parallelism allows the workload to scale based on demand and scale to zero when idle, meeting both the GPU and cost requirements without manual node pool management.

Answer

Enable the cluster autoscaler on the Autopilot cluster and set the minimum node count to zero for the default node pool.

Answer

Configure a dedicated node pool with preemptible VMs and enable cluster autoscaling to scale between zero and ten nodes.

Answer

Create a node pool with GPU accelerators and enable cluster autoscaling with a minimum node count of zero.

Question 6

A retail company uses a shared VPC to provide network resources to multiple project teams. The security team requires that all outbound internet traffic from the service projects be routed through a central inspection VPC in the host project, where a third-party firewall appliance performs deep packet inspection. The service projects should not be able to bypass this inspection. Which configuration should the network architect implement?

Accepted Answer

In the host project, create a custom route with a next hop of the firewall appliance's internal IP address for the destination 0.0.0.0/0, and apply a firewall rule to allow traffic only from the service projects to the appliance.. In a shared VPC, the host project manages all routes. To force all outbound traffic through a central inspection VPC, you must create a custom default route in the host project that points to the firewall appliance. Firewall rules then ensure that only the appliance can access the internet, preventing service projects from bypassing inspection. This design centralizes security and meets the requirement.

Answer

Create a custom route in each service project with a next hop of the inspection VPC's firewall appliance, and remove the default internet gateway route.

Answer

Use VPC peering between the service projects and the inspection VPC, and set up a firewall rule to redirect traffic to the appliance.

Answer

Configure Cloud NAT in each service project to route traffic through the inspection VPC, and enable logging to monitor bypass attempts.

Question 7

A healthcare company stores sensitive patient data in Cloud Storage buckets. The security team requires that all data be encrypted with customer-managed encryption keys (CMEK) and that access be audited. They also need to ensure that data cannot be accessed by Google support without explicit approval. Which combination of Google Cloud services should the architect use?

Accepted Answer

Cloud KMS with CMEK, Cloud Audit Logs, and Access Transparency.. Cloud KMS with CMEK encrypts data with customer-managed keys, Cloud Audit Logs records access to the data, and Access Transparency provides logs of Google support access and requires approval. Access Approval is a separate service that controls support access, but Access Transparency is the logging component. The correct combination includes Access Transparency for the audit and approval workflow.

Answer

Cloud HSM with CMEK, VPC Service Controls, and Cloud Audit Logs.

Answer

Cloud KMS with CMEK, Cloud Audit Logs, and Access Approval.

Answer

Customer-supplied encryption keys (CSEK), Cloud Audit Logs, and Access Approval.

Question 8

A company is deploying a new three-tier application on Google Cloud. The web tier runs on managed instance groups, the application tier runs on Google Kubernetes Engine (GKE), and the database tier runs on Cloud SQL. The security team requires that the database tier accepts connections only from the application tier and that no tier can initiate connections to a less secure tier. Which two configurations should the company implement? (Choose two.)

Accepted Answer

Create a firewall rule that allows ingress to the application tier from the web tier's source IP ranges on the application port, and a firewall rule that allows ingress to the database tier from the application tier's source IP ranges on the database port.. The company needs to enforce least-privilege network access between tiers. Configuring Cloud SQL with a private IP and VPC peering allows the application tier to reach the database without public exposure. Firewall rules that allow only the web tier to reach the application tier and only the application tier to reach the database tier ensure that no tier can initiate connections to a less secure tier.

Answer

Create a firewall rule that allows ingress to the Cloud SQL instance from the application tier's source IP ranges on the database port.

Answer

Use Cloud VPN to connect the application tier to the database tier and configure firewall rules to allow all traffic between them.

Answer

Place all three tiers in the same VPC network and use a single firewall rule that allows ingress from 0.0.0.0/0 to all instances on all ports.

Question 9

A company runs a critical application on Compute Engine instances in a single project. The security team requires that all outbound internet traffic from the instances goes through a centralized inspection appliance for deep packet inspection. The appliance is deployed in a separate VPC network. The architect needs to implement this while minimizing latency and ensuring high availability. What should the architect do?

Accepted Answer

Implement a hub-and-spoke topology using Cloud VPN or Cloud Interconnect between the application VPC and the inspection VPC, and configure the inspection VPC as the next hop for the default route.. A hub-and-spoke topology using Cloud VPN or Cloud Interconnect enables centralized inspection by routing outbound traffic from the application VPC to the inspection VPC, where the appliance performs deep packet inspection. This approach supports high availability and minimizes latency by leveraging Google's private network. VPC peering alone cannot achieve this due to its non-transitive nature.

Answer

Use VPC Network Peering with custom routes and enable IP forwarding on the inspection appliance.

Answer

Configure a VPC peering connection between the application VPC and the inspection VPC, and set a default route in the application VPC to the inspection appliance's internal IP.

Answer

Deploy a Network Virtual Appliance (NVA) in the application VPC and configure a custom route to direct traffic to the NVA.

Question 10

A healthcare analytics team runs a stateful application on a single Compute Engine instance with a 2 TB SSD persistent disk. The compliance office requires that the application survive a full zone outage with no data loss and a recovery point objective of zero. The team cannot modify the application to write to a replicated datastore. Which configuration should the architect implement?

Accepted Answer

Convert the persistent disk to a regional persistent disk replicated between two zones in the region, and keep the instance attached to it.. Regional persistent disks replicate writes synchronously between two zones in the same region, so the data on the surviving replica is current at the moment of a zone failure. The disk can be force-attached to an instance in the secondary zone and the application resumes on the same block device. This delivers the zero recovery point objective the compliance office requires without changing the application's write path.

Answer

Create a disk clone in a second zone and configure a cron job to rsync the application data between the two disks every few minutes.

Answer

Move the SSD persistent disk to a Hyperdisk Balanced volume with multi-writer mode enabled and attach it to instances in both zones.

Answer

Schedule hourly disk snapshots to a multi-region Cloud Storage location and attach a new disk from the latest snapshot after a zone failure.

Question 11

A retail company runs a Kubernetes cluster on Google Kubernetes Engine (GKE) Standard. They need to ensure that pods can only be scheduled on nodes that meet specific security requirements, such as having a specific label and running a hardened OS image. They also want to prevent pods from being scheduled on nodes with public IP addresses. What should the architect configure?

Accepted Answer

Use node affinity and node anti-affinity rules.. Node affinity and anti-affinity rules allow you to constrain pod scheduling based on node labels. By labeling nodes with security attributes and public IP status, you can use affinity to require compliant nodes and anti-affinity to avoid non-compliant nodes. This directly addresses the need to schedule pods only on nodes with specific security properties.

Answer

Use GKE Sandbox and Binary Authorization.

Answer

Use PodSecurityPolicy and NetworkPolicy.

Answer

Use node taints and pod tolerations, and node affinity rules.

Question 12

A company is deploying a stateful web application on Compute Engine. The application requires a persistent disk that can be attached to multiple instances simultaneously for read-only access, and they also need to ensure that the disk can be quickly restored from a snapshot in a different zone. Which two actions should they take? (Choose two.)

Accepted Answer

Create a standard persistent disk and attach it to multiple instances in read-only mode.. Attaching a standard persistent disk in read-only mode to multiple instances is the supported method for shared read-only access. To restore the disk in a different zone, you create a new disk from a snapshot in that zone. The other options either do not provide read-only multi-attach or are not persistent disks. This combination meets both the sharing and restore requirements.

Answer

Use Cloud Storage buckets with FUSE to mount the data as a read-only file system on all instances.

Answer

Create a persistent disk with the multi-writer mode enabled and attach it to multiple instances in read-only mode.

Answer

Create a regional persistent disk and attach it to instances in multiple zones in read-only mode.

Question 13

A retail company is deploying a new microservices platform on Google Kubernetes Engine. Security requires that workloads run with the least privilege and that developers cannot deploy containers with elevated Linux capabilities. The platform team wants to enforce these controls centrally across all clusters without relying on individual namespace owners. Which two actions should the architect take? (Choose two.)

Accepted Answer

Enable Policy Controller with the Pod Security Policy or Pod Security Standards constraint library and enforce restricted-level constraints at the cluster level.. Central least-privilege enforcement on GKE combines admission control and identity. Policy Controller with the Pod Security constraint library blocks pods that request privileged mode, host namespaces, or added capabilities, and applying constraints at cluster scope prevents namespace owners from opting out. Workload Identity Federation for GKE gives each workload a distinct IAM identity with short-lived credentials, so pods no longer inherit broad node-level permissions.

Answer

Set the cluster's default node service account to the Compute Engine default service account so pods inherit consistent permissions.

Answer

Configure each developer namespace with a ResourceQuota that limits CPU and memory so privileged pods cannot be scheduled.

Answer

Create a Kubernetes NetworkPolicy that denies all ingress and egress in the default namespace to prevent privileged container deployment.

Question 14

A company is deploying a new application on Compute Engine. They need to ensure that the application can automatically recover from a zone failure. What is the best approach?

Accepted Answer

Create a managed instance group with instances in multiple zones.. A managed instance group (MIG) with instances in multiple zones provides automatic recovery from a zone failure by distributing instances across zones and using auto-healing to recreate failed instances. If one zone becomes unavailable, the load balancer routes traffic to healthy instances in other zones, ensuring high availability without manual intervention.

Answer

Use a global load balancer in front of a single instance.

Answer

Create a single VM in a single zone and rely on live migration.

Answer

Use Cloud Storage to store application state and restore from a snapshot.

Question 15

An organization has multiple projects in Google Cloud and wants to centralize logging and monitoring for all projects. They need to aggregate logs from all projects into a single project for analysis. Which approach should they use?

Accepted Answer

Create a logs sink in each project that exports logs to a BigQuery dataset in the central project.. Google Cloud's logs sink feature allows you to route logs from multiple source projects to a centralized BigQuery dataset in a single destination project. This approach aggregates logs efficiently without requiring agents or manual import steps, and it supports real-time log export for analysis.

Answer

Export logs from each project to a Cloud Storage bucket and then import them into BigQuery.

Answer

Enable Cloud Audit Logs for all projects and view them from the central project.

Answer

Install the Stackdriver agent on all VMs and point them to the central project.