Google PCA Manage and provision cloud infrastructure Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. Which statement is true about this Deployment Manager template?

Accepted Answer

The VM will have a public IP address.. Option C is correct because the Deployment Manager template in the exhibit includes the property `autoDelete: true` for the accessConfigs block, which configures a one-to-one NAT on the network interface. This automatically assigns an ephemeral external IP address to the VM, giving it a public IP address. The presence of `type: ONE_TO_ONE_NAT` under `accessConfigs` is the key indicator that a public IP is provisioned.

Answer

The VM will be created in the us-central1-b zone.

Answer

The VM will use a custom machine type.

Answer

The boot disk will not be deleted when the VM is deleted.

Question 2

A company has two VPC networks in the same project: vpc-a (us-central1) and vpc-b (us-east1). They want to allow communication between instances in these VPCs using internal IPs. Which action should they take?

Accepted Answer

Set up VPC Network Peering between vpc-a and vpc-b.. VPC Network Peering allows direct internal IP communication between two VPC networks, regardless of region, as long as they are in the same project or across projects. This is the simplest and most efficient method for enabling private RFC 1918 connectivity without requiring VPN tunnels or moving resources. Peering uses Google's internal infrastructure, so traffic stays within the Google network and does not traverse the public internet.

Answer

Move both VPCs to the same region.

Answer

Create a VPN tunnel between the VPCs.

Answer

Ensure firewall rules allow ingress from the other VPC's subnet ranges.

Question 3

An organization is migrating a MySQL database to Cloud SQL. They require automatic failover with zero data loss in the event of a zone outage. Which configuration should they use?

Accepted Answer

Cloud SQL with high availability (HA) configuration.. Option D is correct because Cloud SQL's high availability (HA) configuration uses a synchronous write to a standby instance in a different zone within the same region. This ensures that every transaction committed on the primary is also committed on the standby before acknowledging the client, guaranteeing zero data loss during a zone outage. Automatic failover to the standby occurs with no manual intervention, meeting both the automatic failover and zero data loss requirements.

Answer

Cloud SQL with a cross-region replica.

Answer

Cloud SQL with automated backups and binary logging.

Answer

Cloud SQL with a read replica in a different zone.

Question 4

A company uses a Shared VPC hosted in a common project (host project) to centralize network management. A service project team needs to create a Compute Engine instance with a specific static internal IP address from the Shared VPC subnet. What IAM permissions should be granted to the service project's Compute Engine default service account?

Accepted Answer

compute.subnetworks.use and compute.addresses.use on the subnet and static IP.. Option B is correct: To use a specific static internal IP from a Shared VPC, the service account needs compute.subnetworks.use and compute.addresses.use on the subnet or address resource. Option A is missing compute.addresses.use. Option C grants compute.instances.create but not the necessary subnet/address permissions. Option D is too broad and unnecessary.

Answer

compute.networkAdmin on the host project.

Answer

compute.subnetworks.use on the host project subnet.

Answer

compute.instances.create on the service project.

Question 5

A developer needs to grant public read access to all objects in a Cloud Storage bucket named 'my-public-assets'. What is the simplest way to achieve this?

Accepted Answer

Enable uniform bucket-level access and grant storage.objectViewer to AllUsers.. Option C is correct: AllUsers with storage.objectViewer on the bucket grants public read access to all objects. Option A requires setting ACLs per object. Option B is for uniform bucket-level access but that would require an additional step. Option D is wrong; bucket policy only is not sufficient without AllUsers.

Answer

Set a bucket policy that allows allUsers to read objects.

Answer

Grant storage.objectViewer to AllUsers on the bucket without enabling uniform bucket-level access.

Answer

Set an ACL on each object to allow public read.

Question 6

A team manages a GKE cluster with node pools using different machine types. They plan to upgrade the cluster to a new Kubernetes version. What is the safest upgrade strategy to minimize application downtime?

Accepted Answer

Use a surge upgrade to add new nodes before removing old ones.. Option C is correct because a surge upgrade in GKE adds new nodes with the desired Kubernetes version before removing old nodes, ensuring capacity is maintained throughout the process. This minimizes application downtime by allowing pods to be rescheduled onto new nodes before old nodes are drained, following a controlled rolling update pattern that respects PodDisruptionBudgets.

Answer

Perform a rolling upgrade by draining all nodes simultaneously.

Answer

Create a new cluster with the desired version and migrate workloads.

Answer

Upgrade the node pool configuration one by one.

Question 7

A company has Compute Engine instances that need to access the internet for updates but should not be reachable from the internet. They also need to access Google APIs and services like Cloud Storage. Which configuration meets these requirements?

Accepted Answer

Use Cloud NAT for outbound internet and enable Private Google Access on the subnet.. Cloud NAT provides outbound internet connectivity for instances without external IPs, while Private Google Access allows those same instances to reach Google APIs and services (like Cloud Storage) using internal IPs via the subnet's default route. This combination ensures instances can initiate outbound connections to the internet and Google services but remain unreachable from the internet, meeting both security and functional requirements.

Answer

Assign external IPs to all instances and configure firewall rules to block inbound traffic.

Answer

Configure a VPN tunnel to an on-premises proxy server for internet access.

Answer

Use Cloud NAT for outbound internet and use external IPs for Google API access.

Question 8

An administrator is configuring firewall rules in a VPC. Two rules apply to the same traffic: rule 1 allows ingress from 0.0.0.0/0 on TCP 80, rule 2 denies ingress from 10.0.0.0/8 on TCP 80. Rule 1 has priority 1000, rule 2 has priority 500. What is the effective behavior for traffic from 10.0.0.1?

Accepted Answer

Traffic is denied because rule 2 has higher priority.. In AWS VPC Network ACLs (NACLs), rules are evaluated in priority order, with lower numbers having higher priority. Rule 2 (priority 500) is evaluated before rule 1 (priority 1000), and since rule 2 explicitly denies traffic from 10.0.0.0/8 on TCP 80, traffic from 10.0.0.1 is denied regardless of rule 1's allow. NACLs are stateless and do not have an implicit override between allow and deny; the first matching rule determines the outcome.

Answer

The result is unpredictable without knowing the rule creation order.

Answer

Traffic is allowed because allow rules override deny rules.

Answer

Traffic is allowed because rule 1 has a lower priority number.

Question 9

A company is experiencing high latency in their VPC. They enabled VPC Flow Logs to capture metadata but need to analyze the logs for traffic patterns. Which Google Cloud service should they use to query and analyze VPC Flow Logs?

Accepted Answer

BigQuery. BigQuery is the correct service because VPC Flow Logs can be exported directly to BigQuery for querying and analyzing traffic patterns using SQL. BigQuery provides a serverless, highly scalable data warehouse that can handle large volumes of flow log metadata, enabling complex queries on source/destination IPs, ports, protocols, and packet counts. This allows the company to identify latency sources by analyzing traffic patterns over time.

Answer

Cloud Storage

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 10

An organization wants to enforce a policy that prohibits the creation of Cloud Storage buckets with uniform bucket-level access disabled. What should they use?

Accepted Answer

Organization policy with a list constraint.. Option C is correct: Organization policies can enforce constraints like constraints/storage.uniformBucketLevelAccess. Option A (IAM) does not prevent bucket creation with specific settings. Option B (Cloud Audit Logs) is for logging. Option D (Cloud Armor) is for security policies at the edge.

Answer

IAM roles with custom permissions to deny bucket creation.

Answer

Cloud Audit Logs to monitor bucket creation.

Answer

Cloud Armor security policies.

Question 11

Which TWO IAM predefined roles grant read-only access to Cloud Storage objects but not the ability to list buckets?

Accepted Answer

roles/storage.legacyBucketReader. Option A, roles/storage.legacyBucketReader, is correct because it grants read access to Cloud Storage objects (via the storage.objects.get permission) but does not include the storage.buckets.list permission, so users cannot list buckets. Option B, roles/storage.objectViewer, is correct because it provides read-only access to objects (storage.objects.get and storage.objects.list) without the ability to list buckets, as it lacks storage.buckets.list.

Answer

roles/storage.objectAdmin

Answer

roles/storage.viewer

Answer

roles/storage.admin

Question 12

Which TWO are best practices when designing a VPC network for a multi-tier application in Google Cloud?

Accepted Answer

Create separate subnets for each application tier.. Option B is correct because creating separate subnets for each application tier (e.g., web, application, database) allows you to apply granular firewall rules and routing policies per tier. This segmentation improves security by isolating traffic between tiers and aligns with Google Cloud's best practices for multi-tier architectures. It also simplifies network troubleshooting and scaling by keeping each tier's IP space distinct.

Answer

Disable VPC Flow Logs to reduce cost.

Answer

Use a single subnet for all tiers to simplify IP management.

Answer

Rely on the default priority of firewall rules to ensure proper ordering.

Question 13

Which THREE are valid Google Cloud Dedicated Interconnect connection options?

Accepted Answer

High availability (HA) with two 10 Gbps circuits.. Option A is correct because Google Cloud Dedicated Interconnect supports high availability configurations using two 10 Gbps circuits to provide redundancy and meet SLA requirements. This setup ensures that if one circuit fails, traffic can be rerouted through the other, maintaining connectivity.

Answer

IPsec VPN tunnel as a backup to the interconnect.

Answer

Partner Interconnect offering via a service provider.

Question 14

A developer notices that web-server-1 is preemptible. They want to ensure their application remains available even if this instance is terminated. What should they do?

Accepted Answer

Create a managed instance group for web-server-1 and set an autoscaler.. A managed instance group (MIG) with an autoscaler ensures that if the preemptible instance is terminated, the MIG automatically recreates it to maintain the desired number of instances. This provides resilience against preemption by restoring capacity without manual intervention. The load balancer can then distribute traffic across healthy instances in the group.

Answer

Modify the instance's preemptible flag to false.

Answer

Create a load balancer pointing to web-server-1's external IP.

Answer

Create a snapshot schedule for web-server-1.

Question 15

An organization policy at the organization level restricts project creation to only Project Creator role holders. The exhibit shows the IAM policy for the organization. A member of the group pm-team@example.com attempts to create a project but receives a permission denied error. What is the most likely cause?

Accepted Answer

An organization policy with a constraint to block project creation for non-allowlisted users is enforced.. Option B is correct because the organization policy explicitly restricts project creation to only users who hold the Project Creator role. The user is a member of pm-team@example.com but does not have the Project Creator role, so the policy denies the request. This is a common IAM constraint at the organization level that overrides any lower-level permissions.

Answer

The user's email domain is not allowed by the organization policy.

Answer

The group pm-team@example.com does not exist.

Answer

The IAM policy is missing the resourcemanager.projectCreator role.

Google PCA Manage and provision cloud infrastructure Practice Test 5 — 15 Questions

Exhibit

Google PCA Manage and provision cloud infrastructure Practice Test 5 — 15 Questions

Exhibit