Google PCA Manage and provision cloud infrastructure Practice Test 5 — 15 Questions

Question 1

Which THREE are best practices for designing a highly available application on Compute Engine?

Accepted Answer

Use managed instance groups with autoscaling. Managed instance groups (MIGs) with autoscaling are a best practice for high availability because they automatically maintain a target number of healthy instances across zones, replacing failed instances and scaling based on load. This ensures the application can withstand instance failures and traffic spikes without manual intervention, directly supporting high availability.

Answer

Use local SSDs for stateful data

Answer

Use a single large machine type

Question 2

Refer to the exhibit. What is the effect of this IAM policy on a Cloud Storage bucket?

Accepted Answer

Alice and all users from example.com can view objects.. The IAM policy grants the `storage.objectViewer` role to both the user `alice@example.com` and the domain `example.com`. This means Alice and all authenticated users from the example.com domain (i.e., any Google account ending in @example.com) can view objects in the bucket. The correct answer is C because the policy explicitly includes both principals.

Answer

All users from example.com can view objects.

Answer

Only Alice can view objects.

Answer

Alice can view objects but not list buckets.

Question 3

Refer to the exhibit. A developer wants to SSH into instance-1 from their local machine. Which command should they use?

Accepted Answer

gcloud compute ssh instance-1 --zone us-central1-a. The `gcloud compute ssh` command requires the `--zone` flag when the zone is not set in the gcloud configuration or when the instance is in a different zone than the default. In this scenario, instance-1 is in zone us-central1-a, so specifying `--zone us-central1-a` ensures the SSH connection targets the correct instance. Without this flag, the command may fail or connect to the wrong instance if the default zone is different.

Answer

gcloud compute ssh instance-2

Answer

gcloud compute ssh instance-1 --project default

Answer

gcloud compute ssh instance-1 --internal-ip

Question 4

Refer to the exhibit. Which statement is true about this Deployment Manager template?

Accepted Answer

The VM will have a public IP address.. The Deployment Manager template includes the property `type: ONE_TO_ONE_NAT` under the `accessConfigs` block, which configures a NAT on the network interface and automatically assigns an ephemeral external IP address to the VM, giving it a public IP address.

Answer

The VM will be created in the us-central1-b zone.

Answer

The VM will use a custom machine type.

Answer

The boot disk will not be deleted when the VM is deleted.

Question 5

A company has two VPC networks in the same project: vpc-a (us-central1) and vpc-b (us-east1). They want to allow communication between instances in these VPCs using internal IPs. Which action should they take?

Accepted Answer

Set up VPC Network Peering between vpc-a and vpc-b.. VPC Network Peering allows direct internal IP communication between two VPC networks, regardless of region, as long as they are in the same project or across projects. This is the simplest and most efficient method for enabling private RFC 1918 connectivity without requiring VPN tunnels or moving resources. Peering uses Google's internal infrastructure, so traffic stays within the Google network and does not traverse the public internet.

Answer

Move both VPCs to the same region.

Answer

Create a VPN tunnel between the VPCs.

Answer

Ensure firewall rules allow ingress from the other VPC's subnet ranges.

Question 6

An organization is migrating a MySQL database to Cloud SQL. They require automatic failover with zero data loss in the event of a zone outage. Which configuration should they use?

Accepted Answer

Cloud SQL with high availability (HA) configuration.. Cloud SQL's high availability (HA) configuration uses a synchronous write to a standby instance in a different zone within the same region. This ensures that every transaction committed on the primary is also committed on the standby before acknowledging the client, guaranteeing zero data loss during a zone outage. Automatic failover to the standby occurs with no manual intervention, meeting both the automatic failover and zero data loss requirements.

Answer

Cloud SQL with a cross-region replica.

Answer

Cloud SQL with automated backups and binary logging.

Answer

Cloud SQL with a read replica in a different zone.

Question 7

A team manages a GKE cluster with node pools using different machine types. They plan to upgrade the cluster to a new Kubernetes version. What is the safest upgrade strategy to minimize application downtime?

Accepted Answer

Use a surge upgrade to add new nodes before removing old ones.. A surge upgrade in GKE adds new nodes with the desired Kubernetes version before removing old nodes, ensuring capacity is maintained throughout the process. This minimizes application downtime by allowing pods to be rescheduled onto new nodes before old nodes are drained, following a controlled rolling update pattern that respects PodDisruptionBudgets.

Answer

Perform a rolling upgrade by draining all nodes simultaneously.

Answer

Create a new cluster with the desired version and migrate workloads.

Answer

Upgrade the node pool configuration one by one.

Question 8

A company has Compute Engine instances that need to access the internet for updates but should not be reachable from the internet. They also need to access Google APIs and services like Cloud Storage. Which configuration meets these requirements?

Accepted Answer

Use Cloud NAT for outbound internet and enable Private Google Access on the subnet.. Cloud NAT provides outbound internet connectivity for instances without external IPs, while Private Google Access allows those same instances to reach Google APIs and services (like Cloud Storage) using internal IPs via the subnet's default route. This combination ensures instances can initiate outbound connections to the internet and Google services but remain unreachable from the internet, meeting both security and functional requirements.

Answer

Assign external IPs to all instances and configure firewall rules to block inbound traffic.

Answer

Configure a VPN tunnel to an on-premises proxy server for internet access.

Answer

Use Cloud NAT for outbound internet and use external IPs for Google API access.

Question 9

An administrator is configuring firewall rules in a VPC. Two rules apply to the same traffic: rule 1 allows ingress from 0.0.0.0/0 on TCP 80, rule 2 denies ingress from 10.0.0.0/8 on TCP 80. Rule 1 has priority 1000, rule 2 has priority 500. What is the effective behavior for traffic from 10.0.0.1?

Accepted Answer

Traffic is denied because rule 2 has higher priority.. In Google Cloud VPC firewall rules, rules are evaluated in priority order, with lower numbers having higher priority. Rule 2 (priority 500) is evaluated before rule 1 (priority 1000), and since rule 2 explicitly denies ingress from 10.0.0.0/8 on TCP 80, traffic from 10.0.0.1 is denied. Google Cloud firewall rules are stateful, and the first matching rule determines the outcome; there is no implicit override between allow and deny.

Answer

The result is unpredictable without knowing the rule creation order.

Answer

Traffic is allowed because allow rules override deny rules.

Answer

Traffic is allowed because rule 1 has a lower priority number.

Question 10

A company is experiencing high latency in their VPC. They enabled VPC Flow Logs to capture metadata but need to analyze the logs for traffic patterns. Which Google Cloud service should they use to query and analyze VPC Flow Logs?

Accepted Answer

BigQuery. BigQuery is the correct service because VPC Flow Logs can be exported directly to BigQuery for querying and analyzing traffic patterns using SQL. BigQuery provides a serverless, highly scalable data warehouse that can handle large volumes of flow log metadata, enabling complex queries on source/destination IPs, ports, protocols, and packet counts. This allows the company to identify latency sources by analyzing traffic patterns over time.

Answer

Cloud Storage

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 11

An organization wants to enforce a policy that prohibits the creation of Cloud Storage buckets with uniform bucket-level access disabled. What should they use?

Accepted Answer

Organization policy with a list constraint.. Organization policies can enforce constraints like constraints/storage.uniformBucketLevelAccess to require uniform bucket-level access. Option B (IAM roles with custom permissions) cannot deny bucket creation with specific settings. Option C (Cloud Audit Logs) is for logging, not enforcement. Option D (Cloud Armor) is for security policies at the edge.

Answer

IAM roles with custom permissions to deny bucket creation.

Answer

Cloud Audit Logs to monitor bucket creation.

Answer

Cloud Armor security policies.

Question 12

Which TWO IAM predefined roles grant read-only access to Cloud Storage objects but not the ability to list buckets?

Accepted Answer

roles/storage.legacyBucketReader. Roles/storage.legacyBucketReader, is correct because it grants read access to Cloud Storage objects (via the storage.objects.get permission) but does not include the storage.buckets.list permission, so users cannot list buckets. Option B, roles/storage.objectViewer, is correct because it provides read-only access to objects (storage.objects.get and storage.objects.list) without the ability to list buckets, as it lacks storage.buckets.list.

Answer

roles/storage.objectAdmin

Answer

roles/storage.viewer

Answer

roles/storage.admin

Question 13

Which TWO are best practices when designing a VPC network for a multi-tier application in Google Cloud?

Accepted Answer

Create separate subnets for each application tier.. Creating separate subnets for each application tier (e.g., web, application, database) allows you to apply granular firewall rules and routing policies per tier. This segmentation improves security by isolating traffic between tiers and aligns with Google Cloud's best practices for multi-tier architectures. It also simplifies network troubleshooting and scaling by keeping each tier's IP space distinct.

Answer

Disable VPC Flow Logs to reduce cost.

Answer

Use a single subnet for all tiers to simplify IP management.

Answer

Rely on the default priority of firewall rules to ensure proper ordering.

Question 14

Which THREE are valid Google Cloud Dedicated Interconnect connection options?

Accepted Answer

High availability (HA) with two 10 Gbps circuits.. Google Cloud Dedicated Interconnect supports high availability configurations using two 10 Gbps circuits to provide redundancy and meet SLA requirements. This setup ensures that if one circuit fails, traffic can be rerouted through the other, maintaining connectivity.

Answer

IPsec VPN tunnel as a backup to the interconnect.

Answer

Partner Interconnect offering via a service provider.

Question 15

A developer notices that web-server-1 is preemptible. They want to ensure their application remains available even if this instance is terminated. What should they do?

Accepted Answer

Create a managed instance group for web-server-1 and set an autoscaler.. A managed instance group (MIG) with an autoscaler ensures that if the preemptible instance is terminated, the MIG automatically recreates it to maintain the desired number of instances. This provides resilience against preemption by restoring capacity without manual intervention. The load balancer can then distribute traffic across healthy instances in the group.

Answer

Modify the instance's preemptible flag to false.

Answer

Create a load balancer pointing to web-server-1's external IP.

Answer

Create a snapshot schedule for web-server-1.