Google PCA Manage and provision cloud infrastructure Practice Test 6 — 15 Questions

Question 1

Which THREE are best practices for managing secrets (e.g., API keys, passwords) in Google Cloud? (Select exactly 3.)

Accepted Answer

Rotate secrets regularly and automatically where possible.. Regular, automated rotation of secrets limits the window of exposure if a secret is compromised. Secret Manager supports automatic rotation policies with a rotation period and next rotation time, and can trigger a Cloud Function or Cloud Run service to generate a new secret version, ensuring secrets are rotated without manual intervention.

Answer

Encrypt secrets and store them in source code repositories.

Answer

Pass secrets as environment variables to Compute Engine instances.

Question 2

Your company runs a stateful web application on Compute Engine instances in a managed instance group (MIG) with autoscaling based on CPU utilization. The application maintains session state in memory on each instance. Recently, users have been experiencing session timeouts and data loss during scaling events. Additionally, the application's performance degrades under load due to frequent database queries for session data. You need to design a solution that ensures session persistence, improves performance, and minimizes application changes. The application is written in Java and uses Tomcat. Which of the following should you do?

Accepted Answer

Deploy Cloud Memorystore for Redis as a session store, and configure Tomcat to use Redis-backed session persistence using the Redisson or Spring Session framework.. It introduces an external, highly available, in-memory session store (Cloud Memorystore for Redis) that decouples session state from individual Compute Engine instances. This eliminates session loss during autoscaling events and reduces database load by serving session data from fast Redis memory, all while requiring minimal application changes via Tomcat's built-in session persistence or Spring Session integration.

Answer

Rewrite the application to be stateless by moving all state to the frontend using JWT tokens, eliminating the need for server-side sessions.

Answer

Configure the load balancer to use session affinity (sticky sessions) and increase the instance size to handle more sessions per instance.

Answer

Store session data in Cloud SQL using Spring Session JDBC, and configure the application to retrieve sessions from the database.

Question 3

A company is migrating a legacy monolithic application to Google Cloud. The application runs on a single VM and uses a local MySQL database. The goal is to minimize changes to the application code while improving availability. Which strategy should the company use?

Accepted Answer

Lift and shift the VM to Compute Engine, and migrate the database to Cloud SQL with a failover replica.. It minimizes code changes by lifting the application VM to Compute Engine as-is, while migrating the local MySQL database to Cloud SQL with a failover replica. This improves availability through Cloud SQL's managed automatic failover to a standby replica in a different zone, without requiring application code changes to the database connection logic (the application can continue using the same MySQL protocol).

Answer

Use a managed instance group for the application VM and store the database on a persistent disk attached to the primary instance.

Answer

Re-architect the application into microservices and use Cloud Run for stateless components.

Answer

Containerize the application and deploy on Google Kubernetes Engine (GKE) with Cloud Spanner as the database.

Question 4

A company is designing a highly available web application on Google Cloud. The application consists of stateless compute instances behind a global HTTP(S) Load Balancer. The compute instances must be able to handle sudden spikes in traffic. Which TWO strategies should the company implement? (Choose two.)

Accepted Answer

Use a managed instance group with autoscaling based on CPU utilization.. Option B is correct because a managed instance group (MIG) with autoscaling based on CPU utilization automatically adds or removes VM instances in response to traffic spikes, which directly satisfies the requirement that stateless compute instances handle sudden load increases. Option D is correct because a global HTTP(S) Load Balancer with backends in multiple regions distributes traffic across regional MIGs, providing high availability and resilience if one region fails, and it is the appropriate front end for stateless instances. Option A is not correct because Cloud CDN caches content at edge locations but does not by itself provide compute autoscaling or high availability for dynamic application responses, and caching all responses is not a general HA strategy. Option C is not correct because a single instance in a single zone is a single point of failure and cannot scale horizontally. Option E is not correct because vertical scaling (larger machine type) has limits, requires downtime or restart, and does not provide the elasticity or multi-zone availability needed for sudden traffic spikes.

Answer

Use Cloud CDN to cache all responses from the application servers.

Answer

Use a single Compute Engine instance in a single zone with a large machine type.

Answer

Use vertical scaling by selecting a machine type with more vCPUs and memory.

Question 5

Drag and drop the steps to migrate a Compute Engine VM to a different region using a snapshot into the correct order.

Accepted Answer

Create a snapshot of the existing disk, then create a new disk in the target region from the snapshot, then create a new VM in the target region using that disk.. Snapshots are global resources, but disks are regional. Create the disk in the target region, then create the VM.

Answer

Create a new disk in the target region, then create a snapshot of the existing disk, then create a new VM in the target region using the new disk.

Answer

Create a snapshot of the existing disk, then create a new VM in the target region, then create a new disk in the target region from the snapshot.

Answer

Create a new VM in the target region, then create a snapshot of the existing disk, then create a new disk in the target region from the snapshot.

Question 6

Drag and drop the steps to configure IAM roles for a service account to access Cloud Storage from a Compute Engine instance into the correct order.

Accepted Answer

Create the service account, then grant the necessary IAM roles, then attach the service account to the Compute Engine instance.. The service account must be attached to the instance before it can be used. Granting roles is done on the service account.

Answer

Grant the necessary IAM roles, then attach the service account to the Compute Engine instance, then create the service account.

Answer

Attach the service account to the Compute Engine instance, then create the service account, then grant the necessary IAM roles.

Answer

Create the service account, then attach it to the Compute Engine instance, then grant the necessary IAM roles.

Question 7

Match each GCP storage service to its typical use case.

Accepted Answer

Cloud Storage: Object storage for unstructured data. Cloud Storage is for unstructured object storage, Cloud SQL for relational data, Cloud Bigtable for wide-column NoSQL analytics, and Firestore for document NoSQL apps. Common confusions involve mixing storage types with database services.

Answer

Cloud Storage: Relational database for transactional workloads

Answer

Cloud SQL: Object storage for media files

Question 8

Match each GCP monitoring/logging tool to its purpose.

Accepted Answer

Cloud Monitoring: Provides visibility into performance, uptime, and health of applications and infrastructure.. Correct matches: Cloud Monitoring monitors performance, Cloud Logging manages logs, Error Reporting tracks errors. Confusion often arises between logging and monitoring roles.

Answer

Cloud Monitoring: Real-time log management and analysis for applications and services.

Answer

Cloud Logging: Counts, analyzes, and aggregates errors in cloud services.

Question 9

A developer needs to pass a startup script to a Compute Engine instance during creation. Which method should be used to ensure the script runs on first boot?

Accepted Answer

Use gcloud compute instances create with --metadata=startup-script=.... The `--metadata=startup-script=...` flag on `gcloud compute instances create` passes the script as instance metadata. Compute Engine automatically executes the value of the `startup-script` metadata key on every boot, including the first boot. This is the standard, documented method for providing a startup script at instance creation time.

Answer

Create a custom image with the script baked in.

Answer

Use gcloud compute instances add-metadata after creating the instance.

Answer

Use gcloud compute instances create with --startup-script flag.

Question 10

A company has Compute Engine instances in us-east1-a and us-east1-b zones. They want to allow communication between these instances with minimal latency and no additional cost. What is the best networking approach?

Accepted Answer

Use a single VPC network that includes both zones.. A single VPC network spans all regions and zones, allowing instances in different zones (us-east1-a and us-east1-b) to communicate using internal IP addresses with low latency and no additional cost. This is because VPC networks provide flat, global networking by default, and traffic between zones within the same VPC uses Google's internal backbone without incurring egress charges.

Answer

Configure VPC Network Peering between two separate VPC networks.

Answer

Create a new subnet in each zone and use Cloud NAT.

Answer

Set up a Cloud VPN between the zones.

Question 11

Which TWO actions are required to allow a private GKE cluster to pull container images from Artifact Registry in the same project?

Accepted Answer

Enable Private Google Access on the subnet where the GKE nodes are deployed.. Private Google Access enables GKE nodes with only internal IP addresses to reach Google APIs and services, including Artifact Registry, over Google's private network rather than the public internet. Option E is correct because the GKE node's service account must have the Artifact Registry Reader role (roles/artifactregistry.reader) to authenticate and pull container images from the registry.

Answer

Create a firewall rule allowing outbound traffic to Artifact Registry IP ranges.

Answer

Set up VPC Network Peering with the Artifact Registry service.

Answer

Configure Cloud NAT for the GKE cluster.

Question 12

Refer to the exhibit. A user reports that the instance 'batch-vm' is unavailable. Based on the output, what is the most likely cause of the unavailability?

Accepted Answer

The preemptible VM was terminated by Google due to its preemptible nature.. The exhibit shows the instance 'batch-vm' with a status of 'TERMINATED' and the 'preemptible' flag set to 'true'. Preemptible VMs in Google Cloud have a maximum runtime of 24 hours and can be terminated at any time by Google Compute Engine due to resource constraints. The termination reason is typically 'preemption', which matches the scenario of a user reporting unavailability without manual intervention.

Answer

The VM was stopped manually by a user.

Answer

The VM lost its external IP address.

Answer

The VM crashed due to an out-of-memory error.

Question 13

Refer to the exhibit. A Cloud Deployment Manager deployment fails with the error 'Resource 'my-firewall' already exists'. What is the most likely cause?

Accepted Answer

A firewall rule with the name 'my-firewall' already exists in the project.. The error message 'Resource 'my-firewall' already exists' directly indicates that a firewall rule with the exact name 'my-firewall' is already present in the project. Cloud Deployment Manager creates resources by name, and if a resource with the same name exists (even if it was created outside the deployment), the deployment will fail unless the deployment is configured to adopt or manage that existing resource. The error is not about permissions, network references, or missing delete policies—it is a name collision.

Answer

The user lacks IAM permissions to create firewall rules.

Answer

The network reference in the firewall rule is incorrect.

Answer

The deployment does not include a 'delete' policy for existing resources.

Question 14

Refer to the exhibit. A user (ops@example.com) is unable to create a new VPC network in the project. What should the administrator verify first?

Accepted Answer

The user has appropriate IAM roles such as roles/compute.networkAdmin.. To create a VPC network in Google Cloud, the user needs the compute.networks.create permission. The roles/compute.networkAdmin IAM role includes this permission, along with others needed to manage VPC networks. Option D correctly identifies that the user must have appropriate IAM roles, specifically roles/compute.networkAdmin or a custom role with the necessary compute.networks.create permission.

Answer

The user has been granted roles/compute.admin.

Answer

The user has the project owner role.

Answer

The user has the roles/storage.admin role.

Question 15

A company wants to provision multiple similar environments (dev, test, prod) with consistent networking configurations. Which approach is a best practice for infrastructure as code?

Accepted Answer

Use a single Terraform configuration with workspaces.. Terraform workspaces allow you to manage multiple distinct environments (e.g., dev, test, prod) from a single configuration by maintaining separate state files. This ensures consistent networking configurations across environments while avoiding duplication of code, which is a core best practice for infrastructure as code.

Answer

Use Ansible playbooks to run ad-hoc commands.

Answer

Run separate gcloud commands for each environment.

Answer

Use Cloud Deployment Manager templates with environment-specific parameters.