Google PCA Manage and provision cloud infrastructure Practice Test 5 — 15 Questions

Question 1

A developer needs to deploy a containerized application on Google Kubernetes Engine (GKE) with minimal operational overhead. They want to automatically scale the number of pods based on CPU utilization. Which GKE feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Horizontal Pod Autoscaler.. The Horizontal Pod Autoscaler (HPA) is the correct choice because it automatically scales the number of pod replicas in a GKE deployment based on observed CPU utilization (or other custom metrics). This directly meets the requirement of scaling pods with minimal operational overhead, as HPA is a native Kubernetes resource that requires no manual intervention once configured.

Answer

Node auto-repair.

Answer

Vertical Pod Autoscaler.

Answer

Cluster Autoscaler.

Question 2

A company is deploying a web application on Compute Engine behind a global HTTP(S) load balancer. They want to restrict access to only traffic from specific IP ranges. Which load balancer feature should they use?

Accepted Answer

Cloud Armor security policies.. Cloud Armor security policies are the correct choice because they allow you to define IP-based allow/deny rules at the edge of Google's network, directly integrated with the global HTTP(S) load balancer. This provides granular access control based on source IP ranges before traffic reaches your backend instances, which is exactly what the requirement specifies.

Answer

VPC firewall rules.

Answer

Identity-Aware Proxy (IAP).

Answer

Cloud CDN.

Question 3

A company has a production database running on Cloud SQL. They need to ensure high availability with automatic failover in the event of a zone outage. What should they do?

Accepted Answer

Enable Cloud SQL High Availability (HA) configuration.. Enabling Cloud SQL High Availability (HA) configuration provisions a standby instance in a different zone within the same region, using synchronous replication to ensure zero data loss. In the event of a zone outage, Cloud SQL automatically fails over to the standby instance, typically within 60 seconds, providing high availability without manual intervention.

Answer

Export the database to Cloud Storage and import in another region.

Answer

Create a cross-region read replica.

Answer

Configure automated backups.

Question 4

A developer wants to store and retrieve non-relational data with flexible schema and automatic scaling. Which Google Cloud service should they use?

Accepted Answer

Firestore.. Firestore is a NoSQL document database that supports flexible schema and automatic scaling, making it ideal for non-relational data. It offers real-time synchronization, offline support, and serverless scaling, which aligns with the requirement for storing and retrieving data without manual sharding or capacity planning.

Answer

Cloud Bigtable.

Answer

Cloud SQL.

Answer

Cloud Spanner.

Question 5

A company wants to migrate on-premises workloads to Google Cloud. They need to assess the existing infrastructure, plan the migration, and track progress. Which tool should they use?

Accepted Answer

Migrate for Compute Engine.. Migrate for Compute Engine (formerly Velostrata) is the correct tool because it is specifically designed to assess, plan, and migrate on-premises workloads to Google Cloud. It provides discovery of existing infrastructure, generates migration plans, and tracks progress through a dashboard, directly addressing the need for assessment, planning, and tracking.

Answer

Cloud Endpoints.

Answer

Cloud Deployment Manager.

Answer

Cloud Foundation Toolkit.

Question 6

A company is using Cloud Storage to store sensitive data. They need to enforce that objects are deleted exactly 30 days after creation. Which object lifecycle rule should they configure?

Accepted Answer

Delete action with condition age: 30.. The 'Delete action with condition age: 30' directly instructs Cloud Storage to remove objects 30 days after their creation time. The 'age' condition is measured from the object's creation timestamp, which aligns perfectly with the requirement to delete objects exactly 30 days after creation.

Answer

AbortIncompleteMultipartUpload after 30 days.

Answer

Delete action with condition daysFromNonCurrentTime: 30.

Answer

SetStorageClass to Nearline after 30 days.

Question 7

Which TWO options are valid ways to connect an on-premises network to a VPC in Google Cloud? (Choose two.)

Accepted Answer

Cloud VPN.. Cloud VPN is a valid way to connect an on-premises network to a VPC in Google Cloud. It uses IPsec (IKEv1 or IKEv2) to create an encrypted tunnel over the public internet between your on-premises VPN gateway and a Cloud VPN gateway in your VPC. This allows secure communication between your on-premises resources and your VPC subnets, making it a standard hybrid connectivity option.

Answer

Cloud NAT.

Answer

VPC Network Peering.

Answer

Private Google Access.

Question 8

Which TWO statements about Google Cloud VPC networks are true? (Choose two.)

Accepted Answer

Subnets are regional resources.. Subnets in Google Cloud VPC are regional resources. When you create a subnet, you specify a region and a CIDR block, and the subnet spans all zones within that region. This allows resources in different zones of the same region to use the same subnet without additional configuration.

Answer

VPC networks are project-level resources.

Answer

Firewall rules are regional.

Answer

Subnets are zonal resources.

Question 9

A developer runs the command above. The instance is created successfully, but cannot be reached via HTTP from the internet. What is the most likely cause?

Accepted Answer

There is no firewall rule allowing ingress traffic on ports 80 and 443.. The most likely cause is that there is no firewall rule allowing ingress traffic on ports 80 and 443. By default, Google Cloud Platform (GCP) firewall rules block all incoming traffic from the internet. Even though the instance is created successfully, HTTP/HTTPS traffic cannot reach it unless a firewall rule explicitly permits ingress on TCP ports 80 and 443, typically via a target tag like 'http-server' or 'https-server'.

Answer

The machine type n1-standard-2 is not suitable for HTTP.

Answer

The image family debian-10 does not support HTTP.

Answer

The boot disk type pd-standard is too slow.

Question 10

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) across three zones in us-central1. The application uses a Cloud Spanner database. Recently, the application experienced increased latency and timeouts during peak hours. The operations team noticed that the MIG's CPU utilization is consistently above 80% during peak hours, and the autoscaler is configured to scale based on CPU utilization with a target of 60%. However, the autoscaler is not adding new instances quickly enough, causing performance degradation. The team also observed that new instances take over 5 minutes to become healthy and serve traffic. The health check is a simple TCP check on port 8080. The application startup script downloads large configuration files from Cloud Storage. What should the team do to improve the autoscaling response time and reduce latency?

Accepted Answer

Create a custom Compute Engine image that includes the application and configuration, and use it in the MIG.. The primary bottleneck is the long instance startup time (over 5 minutes) caused by downloading large configuration files from Cloud Storage at boot. By creating a custom Compute Engine image that bakes the application and configuration into the image, new instances can start serving traffic almost immediately, drastically reducing the time before they become healthy and the autoscaler can consider them in scaling decisions. This directly addresses the root cause of slow autoscaling response, as the autoscaler cannot add instances faster than they become healthy.

Answer

Increase the minimum number of instances in the MIG to handle peak load.

Answer

Reduce the autoscaler target CPU utilization to 40% so it scales earlier.

Answer

Change the health check to HTTP and reduce the initial delay and check intervals.

Question 11

An organization has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They launched a Compute Engine instance in subnet-a with an internal IP 10.0.1.2 and a public IP. They want the instance to only allow HTTPS traffic from the internet. Which firewall rule should they create?

Accepted Answer

Ingress rule: allow tcp:443, source 0.0.0.0/0, target tag 'https-server'. The instance needs to accept incoming HTTPS traffic (TCP port 443) from the internet. An ingress firewall rule with source 0.0.0.0/0 allows traffic from any external IP, and applying it to instances with the target tag 'https-server' ensures only tagged instances are affected. This matches the requirement to allow only HTTPS from the internet.

Answer

Ingress rule: allow tcp:0-65535, source 0.0.0.0/0, target tag 'https-server'

Answer

Egress rule: allow tcp:443, destination 0.0.0.0/0, target tag 'https-server'

Answer

Ingress rule: allow tcp:443, source 10.0.0.0/16, target tag 'https-server'

Question 12

A developer needs to programmatically create and manage Compute Engine instances. Which Google Cloud service should they use to authenticate and authorize service accounts?

Accepted Answer

Cloud IAM. Cloud IAM is the correct service because it provides the identity and access management framework for authenticating and authorizing service accounts. When a developer creates Compute Engine instances, they must attach a service account and grant IAM roles (e.g., roles/compute.instanceAdmin) to define what actions that service account can perform. Cloud IAM handles the authentication via OAuth 2.0 tokens and authorization via role-based access control (RBAC), making it the foundational service for managing service account permissions.

Answer

Cloud Audit Logs

Answer

Cloud Key Management Service (KMS)

Answer

Cloud Scheduler

Question 13

A company deploys a web application on Compute Engine behind a Global HTTPS Load Balancer. They need to restrict access to the application based on the client's IP address. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides IP-based access control at the edge of Google's network, integrated directly with the Global HTTPS Load Balancer. It allows you to create security policies with IP allow/deny rules that are evaluated before traffic reaches your Compute Engine instances, making it the appropriate service for client IP restriction at the load balancer level.

Answer

VPC firewall rules

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Question 14

An organization uses Cloud SQL for MySQL in a production environment. They need to ensure high availability with automatic failover in case of a zonal failure. Which configuration should they use?

Accepted Answer

Create a regional Cloud SQL instance with automatic failover.. A regional Cloud SQL instance with automatic failover uses a primary and a standby zone within the same region, with synchronous replication between them. If the primary zone fails, Cloud SQL automatically promotes the standby to primary, ensuring high availability without data loss. This configuration meets the requirement for automatic failover during a zonal failure.

Answer

Create a read replica in a different region.

Answer

Export the database daily and import into a new instance if failure occurs.

Answer

Deploy Cloud SQL across multiple regions using cross-region replication.

Question 15

Which TWO statements are true about Google Cloud VPC networks? (Select exactly 2.)

Accepted Answer

Subnets are regional resources and can span zones.. Google Cloud VPC subnets are regional resources that can span multiple zones within the same region. This allows resources in different zones to use the same subnet without requiring additional routing or VPN configuration, providing high availability and fault tolerance within a region.

Answer

Each VPC network is regional in scope.

Answer

By default, no firewall rules are created in a new VPC.

Answer

VPC Peering supports transitive routing.