Google PCA Manage and provision cloud infrastructure Practice Test 7 — 15 Questions

Question 1

Given the IAM policy:

```json
{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:alice@example.com"],
      "condition": {
        "expression": "resource.name.startsWith('projects/_/buckets/bucket-x/objects/')",
        "title": "Restrict to bucket-x"
      }
    }
  ]
}
```
What does the condition in this IAM policy do?

Accepted Answer

It allows Alice to view objects only in bucket-x.. The condition in the IAM policy restricts the `storage.objects.get` action to the `projects/_/buckets/bucket-x/objects/*` resource, which means Alice can only view (read) objects within that specific bucket. The `storage.objects.list` action is also allowed on `bucket-x`, enabling her to list its contents. No other actions or buckets are permitted, making option B correct.

Answer

It denies Alice access to all buckets.

Answer

It allows Alice to view objects in any bucket.

Answer

It allows Alice to list all buckets in the project.

Answer

It allows Alice to view and delete objects in bucket-x.

Question 2

What is the networking mode of this GKE cluster?

Accepted Answer

VPC-native networking. A is correct because VPC-native networking is the default and recommended networking mode for GKE clusters, where the cluster uses alias IP ranges (RFC 6598) on the VPC network. This mode assigns pod IP addresses directly from the VPC subnet's secondary IP range, enabling native integration with VPC features like Cloud NAT, VPC Flow Logs, and firewall rules without requiring manual route management.

Answer

Hybrid networking

Answer

Standard networking

Answer

Routes-based networking

Answer

Private cluster networking

Question 3

A company runs a batch processing job that runs daily and can handle interruptions. The job runs on a single Compute Engine instance. Which machine configuration is the most cost-effective?

Accepted Answer

A preemptible n1-standard-4 VM. A preemptible VM costs significantly less than a standard VM (up to 80% discount) and is ideal for batch processing jobs that can handle interruptions. The job runs daily and can tolerate being stopped, so the lower cost of a preemptible instance provides the most cost-effective solution without sacrificing functionality.

Answer

A n2-standard-4 VM with sustained use discount

Answer

A standard n1-standard-4 VM

Answer

A n1-standard-4 VM with a GPU

Question 4

A Cloud Run service frequently fails with 502 errors when making requests to a backend service running on Compute Engine. The two services are in the same VPC network. The Cloud Run service is configured with a VPC connector. What is the most likely cause?

Accepted Answer

The VPC connector is not attached to the correct subnet, or the firewall rules are blocking traffic from the connector's IP range.. Cloud Run uses a VPC connector to send requests to resources in a VPC. If the connector is attached to the wrong subnet, its egress traffic may not reach the Compute Engine instance, or firewall rules may block traffic from the connector's IP range (e.g., 10.8.0.0/28). This results in 502 errors from the backend, as the Cloud Run service cannot establish a TCP connection to the Compute Engine instance.

Answer

The Cloud Run service needs to be peered with the VPC using VPC Network Peering.

Answer

The VPC connector is set to a low number of instances, causing traffic throttling.

Answer

The Cloud Run service's service account lacks the roles/compute.instanceAdmin role.

Question 5

A company runs a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage and low-latency access across multiple zones. The application needs to perform well even during zonal failures. Which storage solution should they use?

Accepted Answer

Regional persistent disk. Regional persistent disks (RPDs) synchronously replicate data across two zones in the same region, providing both the persistent storage and low-latency access required by the stateful application. This ensures that if one zone fails, the disk can be attached to a pod in the surviving zone without data loss or significant performance degradation, meeting the high-availability and multi-zone access requirements.

Answer

Zonal persistent disk with snapshots to another zone

Answer

Local SSDs attached to nodes

Answer

Cloud Filestore

Question 6

A user wants to store a database password that will be used by a Compute Engine instance. What is the most secure and manageable approach?

Accepted Answer

Use Secret Manager and grant the instance's service account access to the secret. Secret Manager is the most secure and manageable approach because it provides encrypted storage, automatic rotation, and fine-grained access control via IAM. By granting the Compute Engine instance's service account access to the secret, the password is never exposed in plaintext metadata, logs, or disk files, and access can be audited and revoked independently of the instance lifecycle.

Answer

Set the password as an environment variable in instance metadata

Answer

Store the password in Cloud Storage bucket metadata

Answer

Store the password in a file on the instance's boot disk

Question 7

A company has two VPC networks in the same project: 'vpc-prod' and 'vpc-dev'. They want to allow communication between instances in both VPCs. What is the simplest method?

Accepted Answer

Create a VPC Network Peering connection between them. VPC Network Peering is the simplest method because it directly connects two VPCs using Google's internal infrastructure, allowing private RFC 1918 IP communication across the networks without requiring external gateways, VPN tunnels, or additional bandwidth costs. It requires no routes to be manually configured—Google automatically adds the necessary routes for each peered VPC's subnets—and only a single firewall rule to permit traffic between the instances.

Answer

Set up a Cloud VPN tunnel between the two VPCs

Answer

Configure a custom route in each VPC pointing to the other's subnet

Answer

Add firewall rules allowing traffic between the VPCs

Question 8

A global e-commerce site uses an external HTTPS load balancer with a backend service pointing to a managed instance group. Some users report 503 errors during peak traffic. The backend instances are healthy and not overloaded. What is the most likely cause?

Accepted Answer

The load balancer's max rate per backend is configured too low. A 503 error from an external HTTPS load balancer with healthy backends typically indicates that the load balancer is throttling requests. The 'max rate per backend' setting limits the number of requests per second that the load balancer forwards to each backend instance. When this limit is exceeded, the load balancer returns 503 errors even though the instances themselves are not overloaded, which matches the scenario of peak traffic.

Answer

The CDN cache is not warming up properly

Answer

The backend service's health check interval is too short

Answer

The SSL certificate is expired

Question 9

A service account needs to be able to start and stop Compute Engine instances in a specific project. Which IAM role should be assigned at the project level?

Accepted Answer

roles/compute.instanceAdmin.v1. Roles/compute.instanceAdmin.v1, because this role grants the necessary permissions to start, stop, and manage Compute Engine instances, including operations like instances.start and instances.stop, at the project level. This role is specifically designed for managing compute resources without granting broader project-level access like editing all resources.

Answer

roles/iam.serviceAccountUser

Answer

roles/editor

Answer

roles/compute.viewer

Question 10

A team uses Cloud Build to build container images and deploy to Cloud Run. They want to automate deployments whenever a new image is pushed to Container Registry. What is the best approach?

Accepted Answer

Configure a Cloud Build trigger that runs on a push to the container image in Container Registry. Cloud Build triggers can be configured to fire on a push to a container image in Container Registry, using the 'cloud-builds' Pub/Sub topic that Container Registry publishes to when an image is pushed. This allows Cloud Build to automatically run a build step (e.g., gcloud run deploy) to deploy the new image to Cloud Run without any polling or external infrastructure.

Answer

Use Cloud Deploy with a delivery pipeline that polls for new images

Answer

Create a Cloud Function that subscribes to Pub/Sub and calls Cloud Run deploy

Answer

Set up a Cloud Scheduler job to run a script that deploys the latest image

Question 11

A company is migrating a large on-premises SQL Server database to Cloud SQL for SQL Server. The database is 2 TB in size and must have minimal downtime. Which approach should they use?

Accepted Answer

Use Database Migration Service (DMS) for continuous one-way replication. Database Migration Service (DMS) supports continuous one-way replication from on-premises SQL Server to Cloud SQL for SQL Server using native SQL Server transaction log shipping or Always On availability group replication. This minimizes downtime by keeping the target synchronized during the migration cutover, which is critical for a 2 TB database where a full backup/restore would cause extended downtime.

Answer

Set up a Cloud SQL HA instance and replicate on-premises using Always On availability groups

Answer

Export the database to CSV files, then import using Cloud SQL import

Answer

Perform a full backup to Cloud Storage, then restore into Cloud SQL

Question 12

Which TWO are required to allow on-premises hosts to access Google APIs using internal IP addresses (Private Google Access)? (Choose 2)

Accepted Answer

A Cloud Interconnect or Cloud VPN connection between on-premises and VPC. A Cloud Interconnect or Cloud VPN connection is required to establish private, encrypted connectivity between on-premises hosts and a VPC network. This provides the network path for on-premises traffic to reach Google APIs using internal IP addresses, bypassing the public internet. Without this direct connection, on-premises hosts cannot leverage Private Google Access, which only applies to traffic originating within Google Cloud subnets.

Answer

A Cloud Router instance configured in the on-premises network

Answer

VPC Service Controls enabled

Answer

A private DNS zone for googleapis.com

Question 13

Which THREE are required to configure Workload Identity for a GKE cluster? (Choose 3)

Accepted Answer

Create a Google Cloud service account. A Google Cloud service account (GSA) is required to authenticate to Google Cloud APIs from within GKE. Workload Identity maps a Kubernetes service account (KSA) to a GSA, allowing pods to inherit the GSA's IAM permissions without managing static keys. The GSA must be created first to define the identity that workloads will assume.

Answer

Bind the Kubernetes service account to the Google Cloud service account using a Kubernetes RoleBinding

Answer

Use a node pool that has Workload Identity enabled

Question 14

A company runs a microservices application on Google Kubernetes Engine (GKE). Each service is deployed as a Deployment with resource requests and limits. After deploying a new version of a service, the pods start crashing with OOMKilled. The team increased the memory limits in the Deployment manifest, but the pods still crash after a few minutes. The cluster has cluster autoscaling enabled. The node pool has sufficient capacity. What is the most likely cause of the issue?

Accepted Answer

The application has a memory leak. The pods are crashing with OOMKilled even after increasing memory limits, and the node pool has sufficient capacity. This indicates the application itself has a memory leak, where memory usage grows unbounded over time until it exceeds the new limit, causing the OOMKiller to terminate the pod. Increasing limits only delays the crash if the leak persists.

Answer

The Horizontal Pod Autoscaler is configured with a wrong target metric

Answer

The cluster autoscaler is not scaling up quickly enough

Answer

The pods are hitting the node's ephemeral storage limit

Question 15

A company runs a critical web application behind an external HTTPS load balancer. The backend consists of a managed instance group of Compute Engine instances. Users report intermittent 502 Bad Gateway errors. The load balancer logs show occasional health check failures for some instances. The instances have a custom health check endpoint that returns a 200 status code only if the application is fully healthy. The application logs do not show any errors, and CPU/memory usage on the instances is normal. What should be the first troubleshooting step to identify the root cause?

Accepted Answer

Check the application's logs on the instances to see why the health check endpoint sometimes returns non-200. The health check endpoint is custom and returns 200 only when the application is fully healthy. Since the instances show normal CPU/memory and application logs show no errors, the intermittent 502 errors and health check failures might be due to the health check endpoint itself returning non-200 sporadically. The first troubleshooting step is to examine the application logs on the instances to understand why the health check endpoint sometimes fails. This will pinpoint the specific condition causing the health check to fail. Option A is incorrect because a TCP check would not validate application health and could mask the problem. Option B is incorrect because increasing the interval and decreasing the unhealthy threshold would delay detection or make it more sensitive, not address the root cause. Option C is incorrect because adding instances does not fix the health check issue; it only spreads traffic if some instances are unhealthy.

Answer

Change the health check to a TCP check on the application's port

Answer

Increase the health check check interval and decrease the unhealthy threshold

Answer

Increase the number of instances in the managed instance group