Google PCA Manage and provision cloud infrastructure Practice Test 6 — 15 Questions

Question 1

An organization policy at the organization level restricts project creation to only Project Creator role holders. The exhibit shows the IAM policy for the organization. A member of the group pm-team@example.com attempts to create a project but receives a permission denied error. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An organization policy with a constraint to block project creation for non-allowlisted users is enforced.. The organization policy explicitly restricts project creation to only users who hold the Project Creator role. The user is a member of pm-team@example.com but does not have the Project Creator role, so the policy denies the request. This is a common IAM constraint at the organization level that overrides any lower-level permissions.

Answer

The user's email domain is not allowed by the organization policy.

Answer

The group pm-team@example.com does not exist.

Answer

The IAM policy is missing the resourcemanager.projectCreator role.

Question 2

A user runs the gsutil command shown in the exhibit and gets an AccessDenied error. The user is not authenticated with gcloud. What should the user do first?

Accepted Answer

Run gcloud auth login to authenticate with their Google account.. The error occurs because the user is not authenticated with gcloud. The gsutil command requires valid authentication credentials to access Google Cloud Storage resources. Running `gcloud auth login` initiates the OAuth 2.0 flow, which authenticates the user with their Google account and generates the access token that gsutil uses for API calls. This is the prerequisite step before any gsutil operation can succeed.

Answer

Create a service account and download a JSON key.

Answer

Grant public write access to the bucket.

Answer

Use gcloud config set project my-project to set the project.

Question 3

A company wants to deploy a standard VM image with pre-installed software across multiple projects. Which Google Cloud solution should they use to automate this process?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager (option C) is the correct choice because it allows you to define a declarative template (in YAML, Jinja, or Python) that specifies the VM instance configuration, including the boot disk image with pre-installed software, and then deploy that template consistently across multiple projects. This automates the entire provisioning process, ensuring each VM is identical and reducing manual effort.

Answer

Cloud Build

Answer

Compute Engine

Answer

Cloud Shell

Answer

Artifact Registry

Question 4

A company has a production GKE cluster with a node pool using n1-standard-4 machine types. They need to change to e2-standard-4 without downtime. Which approach should be taken?

Accepted Answer

Create a new node pool with the new machine type, cordon and drain old nodes, then delete the old pool.. It ensures zero downtime by first creating a new node pool with the desired e2-standard-4 machine type, then cordoning and draining the old nodes to gracefully migrate workloads, and finally deleting the old pool. This approach leverages Kubernetes' native pod eviction and rescheduling mechanisms to maintain application availability throughout the migration.

Answer

Enable GKE Node Auto-Repair to automatically fix the issue.

Answer

Delete the existing node pool and create a new one with the new machine type.

Answer

Update the existing node pool's machine type via gcloud container node-pools update.

Answer

Use gcloud compute machine-types change on the nodes.

Question 5

A company runs a service on Cloud Run that needs to access a Cloud SQL instance via private IP. Both are in the same VPC network. The service cannot connect to the database. What is the most likely cause?

Accepted Answer

Cloud Run needs a Serverless VPC Access connector.. Cloud Run services run in a Google-managed environment and cannot directly reach resources on a VPC network via private IP. A Serverless VPC Access connector is required to bridge the serverless environment to the VPC, enabling private IP connectivity to Cloud SQL. Without this connector, the Cloud Run service cannot route traffic to the Cloud SQL private IP, even if both are in the same VPC network.

Answer

Cloud Run must be deployed in the same zone as Cloud SQL.

Answer

The IAM permissions for Cloud Run to access Cloud SQL are missing.

Answer

A firewall rule is blocking traffic.

Answer

The Cloud SQL instance needs a public IP assigned.

Question 6

A team wants to allow a service account to be used only on specific Compute Engine VMs. Which IAM condition should be applied to the service account's roles?

Accepted Answer

resource.name. The `resource.name` IAM condition allows you to restrict a service account's roles to specific Compute Engine VM instances by matching the VM's resource name (e.g., `projects/project-id/zones/zone/instances/instance-name`). This ensures the service account can only be used on designated VMs, enforcing fine-grained access control.

Answer

resource.service

Answer

resource.owner

Answer

resource.type

Answer

resource.labels

Question 7

A company is migrating hundreds of on-premises VMs to Compute Engine. They want to minimize manual effort and downtime. Which service should they use?

Accepted Answer

Migrate for Compute Engine. Migrate for Compute Engine (formerly Velostrata) is the correct choice because it is a fully managed service specifically designed for migrating large-scale VM workloads to Compute Engine with minimal downtime. It uses a streaming migration approach that moves the OS and application data while the source VM continues running, then performs a cutover with near-zero downtime, making it ideal for hundreds of VMs without manual effort.

Answer

Cloud Build

Answer

gcloud compute instances import

Answer

Transfer Appliance

Answer

CloudEndure

Question 8

An organization's security policy requires that all Compute Engine VMs have Shielded VM features enabled. How can this be enforced at the organization level?

Accepted Answer

Create an Organization Policy with the constraint compute.requireShieldedVm.. The Organization Policy constraint `compute.requireShieldedVm` is a Google Cloud-native mechanism that enforces Shielded VM features at the organization, folder, or project level. When this constraint is applied, any Compute Engine VM creation request that does not include Shielded VM settings (such as Secure Boot, vTPM, and Integrity Monitoring) is denied by the Organization Policy service, ensuring compliance without relying on user behavior or manual review.

Answer

Enable Cloud Audit Logs and review VM creations.

Answer

Use VPC Service Controls to restrict VM creation.

Answer

Assign a custom IAM role that only allows creation of Shielded VMs.

Answer

Use Deployment Manager templates that include Shielded VM.

Question 9

A developer wants to deploy a stateless web application that automatically scales based on HTTP traffic. The application should be cost-effective and require minimal configuration. Which compute option is best?

Accepted Answer

Cloud Run. Cloud Run is the best choice because it automatically scales to zero when idle, scales up to handle HTTP traffic spikes, and requires minimal configuration—just deploy a container. It is cost-effective as you pay only for resources used during request processing, and it supports stateless web applications natively without managing servers or clusters.

Answer

App Engine Standard Environment

Answer

Cloud Functions

Answer

Compute Engine managed instance group

Answer

Google Kubernetes Engine

Question 10

A company uses Terraform to manage Google Cloud infrastructure. They want to store the Terraform state file in a remote backend with state locking to prevent concurrent modifications. Which Google Cloud service supports this natively?

Accepted Answer

Cloud Storage. Google Cloud Storage (GCS) is the only option that natively supports Terraform's remote state backend with state locking. Terraform uses GCS's object versioning and a write-lock mechanism via a separate lock file (e.g., `default.tflock`) stored in the same bucket, leveraging GCS's strong consistency for atomic operations. This prevents concurrent `terraform apply` commands from corrupting the state.

Answer

Cloud Firestore

Answer

Cloud Spanner

Answer

Bigtable

Answer

Cloud SQL

Question 11

A company has a global web application deployed across multiple regions. They use an external HTTPS Load Balancer with backend services in us-central1 and europe-west1. They want users to be routed to the closest healthy backend. Which load balancing configuration is required?

Accepted Answer

External HTTPS Load Balancer with global backend. An External HTTPS Load Balancer with a global backend configuration uses Google Cloud's global anycast IP and the Premium Tier network to route users to the closest healthy backend based on latency and proximity. This setup ensures that traffic from users worldwide is directed to the nearest region (us-central1 or europe-west1) with a healthy instance group, providing optimal performance and failover.

Answer

Internal HTTP(S) Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

Classic Application Load Balancer

Answer

Regional external HTTPS Load Balancer

Question 12

Which TWO of the following are valid ways to deploy a Cloud Function? (Choose two.)

Accepted Answer

gcloud functions deploy. `gcloud functions deploy` is the primary command-line interface (CLI) method to deploy a Cloud Function directly from a local source or a specified source location. Option E is correct because Cloud Build triggers can be configured to automatically deploy a Cloud Function whenever a change is pushed to a repository (e.g., Cloud Source Repositories, GitHub), enabling continuous deployment.

Answer

Cloud Source Repositories

Answer

Cloud Run

Answer

Cloud Scheduler

Question 13

Which THREE of the following are best practices when using Deployment Manager to manage infrastructure? (Choose three.)

Accepted Answer

Use templates to define resources modularly.. Using templates promotes reusability and modularity. Imports allow you to define common resources across deployments. Composite types bundle related resources into a single entity. YAML files are basic, but using Python or Jinja allows dynamic generation. The three best practices are using templates, imports, and composite types.

Answer

Use raw REST API calls in templates.

Answer

Use only YAML configuration files.

Question 14

A company has a Cloud SQL for PostgreSQL instance that is experiencing high latency. They suspect a connection pooling issue. Which TWO configurations should be checked? (Choose two.)

Accepted Answer

Cloud SQL Auth Proxy configuration. The Cloud SQL Auth Proxy is a common source of connection pooling issues because it can become a bottleneck if not configured with enough connections or if its connection limit is reached. It acts as a local intermediary, and if it exhausts its available connections, it will queue or drop new requests, causing high latency. Checking its configuration (e.g., the `--max-connections` flag or the number of proxy instances) is essential to diagnose pooling problems.

Answer

Private IP assignment

Answer

Database query insights

Answer

Database version

Question 15

What will happen to this instance during a Google-initiated maintenance event?

Accepted Answer

The instance will be terminated and then restarted after maintenance.. During a Google-initiated maintenance event, a standard (non-live-migratable) Compute Engine instance is terminated and then restarted on another host after the maintenance is complete. This behavior is controlled by the instance's 'onHostMaintenance' setting; when set to 'TERMINATE' (the default for instances with GPUs or certain configurations), the instance is stopped, the host undergoes maintenance, and then the instance is restarted. Option B correctly describes this termination-and-restart sequence.

Answer

The instance will be migrated and then restarted.

Answer

The instance will be preempted and deleted.

Answer

The instance will stop and remain stopped.

Answer

The instance will be live-migrated to another host.