Google PCA Manage and provision cloud infrastructure Practice Test 7 — 15 Questions

Question 1

A Cloud Function fails to connect to a Cloud SQL instance. The Cloud SQL instance has a private IP. What should the developer check?

Accepted Answer

Ensure either Cloud SQL Proxy is running or a VPC connector is configured, and IAM permissions are correct.. A Cloud Function with a private IP Cloud SQL instance requires either the Cloud SQL Proxy (which uses the Cloud SQL Auth proxy to establish an encrypted connection via the public IP, but if the instance has only a private IP, the proxy must be run within the same VPC) or a VPC connector to enable private networking. Additionally, proper IAM permissions (e.g., Cloud SQL Client role) are necessary for the proxy or connector to authenticate and connect. Without both the network path and IAM permissions, the connection will fail.

Answer

Ensure the Cloud SQL Proxy is running and configured.

Answer

Verify the Cloud Function's network settings.

Answer

Configure a VPC connector for the Cloud Function.

Question 2

A company uses Shared VPC. A project admin in a service project tries to create a subnet in the shared VPC network but receives a permission denied error. What is the most likely cause?

Accepted Answer

The service project admin lacks the compute.subnetworks.create permission on the host project.. In a Shared VPC architecture, subnet creation is a privileged operation that can only be performed by a user with the compute.subnetworks.create permission on the host project. The service project admin, by default, does not have this permission in the host project, which is why the permission denied error occurs. Granting this permission to the service project admin at the host project level would resolve the issue.

Answer

Only the Shared VPC host project admin can create subnets.

Answer

The Shared VPC is not enabled for the service project.

Answer

Subnets must be created in the service project, not the host project.

Question 3

When creating a Compute Engine instance from a custom image stored in another project, which gcloud flag is required?

Accepted Answer

--image-project. When creating a Compute Engine instance from a custom image stored in another project, the `--image-project` flag is required to specify the project that contains the image. Without this flag, gcloud defaults to the current project and will not find the image. The `--image` flag is also required to specify the image name, but the question specifically highlights the cross-project situation, making `--image-project` the distinctive required flag.

Answer

--source-instance

Answer

--image

Answer

--image-family

Question 4

A web application running on Compute Engine behind a global HTTP(S) load balancer experiences high latency during traffic spikes. Which quick fix would best address this issue without changing the architecture?

Accepted Answer

Configure managed instance group autoscaling to add more instances.. Managed instance group (MIG) autoscaling dynamically adds more instances when CPU utilization or other metrics exceed a threshold, directly absorbing the increased traffic during spikes. This is the quickest fix because it requires no architectural changes—just configuring autoscaling parameters on the existing MIG. By scaling out horizontally, the load balancer can distribute requests across more backends, reducing per-instance load and latency.

Answer

Enable Cloud CDN on the load balancer.

Answer

Switch to a regional load balancer to reduce latency.

Answer

Increase the machine type of the backend instances.

Question 5

An organization needs to audit all changes to network firewall rules in a GCP project. Which service should be used to capture these changes?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify the configuration or metadata of resources, including changes to firewall rules. When a firewall rule is created, updated, or deleted, an audit log entry is automatically generated with details such as the user, timestamp, and the change made. This makes Cloud Audit Logs the correct service for auditing changes to network firewall rules in a GCP project.

Answer

Cloud Logging

Answer

Cloud Monitoring

Answer

VPC Flow Logs

Question 6

A company wants to minimize egress costs for data transferred between Compute Engine instances in the same region but different zones. What is the best practice?

Accepted Answer

Use internal IPs and ensure they are in the same VPC.. B is correct because data transfer between Compute Engine instances in the same region but different zones uses internal IP addresses within the same VPC, which incurs no egress costs. Google Cloud does not charge for traffic between instances using internal IPs within the same region, regardless of zone, as long as they are in the same VPC network. This is the most cost-effective approach for minimizing egress costs.

Answer

Use a VPN connection.

Answer

Use Cloud NAT.

Answer

Use external IPs for all instances.

Question 7

A company runs a web application on Compute Engine with an HTTP Load Balancer. Users report intermittent 502 Bad Gateway errors. What is the most likely cause?

Accepted Answer

Backend instances are unhealthy or overloaded.. The 502 Bad Gateway error from an HTTP Load Balancer typically indicates that the backend instances are failing to respond to the load balancer's health checks or are overwhelmed, causing the load balancer to consider them unhealthy and return a 502 error. This is the most common cause because the load balancer relies on healthy backends to forward traffic, and overloaded or failing instances cannot handle requests.

Answer

Load balancer quota exceeded.

Answer

Firewall rules block health checks.

Answer

SSL certificate expired.

Question 8

A company wants to migrate an on-premises Oracle database to Google Cloud. They need high availability and want to minimize application changes. Which service should they use?

Accepted Answer

Bare Metal Solution. Bare Metal Solution is correct because it provides dedicated physical servers for Oracle workloads, enabling high availability through Oracle RAC or Data Guard while preserving the existing Oracle database architecture. This minimizes application changes since the database remains Oracle-native, unlike managed services that require migration to a different database engine.

Answer

Cloud SQL for MySQL

Answer

Cloud Spanner

Answer

Compute Engine with Oracle license

Question 9

An organization requires that all Compute Engine instances in a project must have a specific tag for firewall rule compliance. How can they enforce this?

Accepted Answer

Use a mandatory tag via organization policy. Organization Policies in Google Cloud can enforce constraints that require resources, including Compute Engine instances, to have specific labels or tags. The `compute.requireOsLogin` or custom constraint `compute.requireInstanceTag` can be used to mandate that all instances must have a particular tag, and any instance creation that violates this policy will be denied at the API level, ensuring compliance without relying on user behavior.

Answer

Use IAM roles to restrict instance creation

Answer

Use a startup script to add the tag

Answer

Use Cloud Asset Inventory

Question 10

A company is migrating a monolithic application to microservices on Google Cloud. They need to manage service-to-service authentication and authorization. Which service should they use?

Accepted Answer

Service Mesh (Anthos). Service Mesh (Anthos) provides a dedicated infrastructure layer for managing service-to-service communication, including mutual TLS (mTLS) authentication, fine-grained authorization policies, and observability. It uses sidecar proxies (Envoy) to intercept traffic and enforce security policies without modifying application code, making it ideal for microservices authentication and authorization.

Answer

Cloud NAT

Answer

Cloud Identity-Aware Proxy

Answer

Cloud Endpoints

Question 11

A security team wants to audit all IAM role assignments in an organization. They need a historical record of changes. Which tool should they use?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify IAM policies, including role assignments. These logs are immutable and retained for the default retention period (400 days for Admin Activity logs), providing a historical record of changes. Cloud Asset Inventory (A) shows the current state but not historical changes, Access Transparency (B) logs Google staff access to your data, and Security Command Center (D) provides security findings and posture, not a change history.

Answer

Cloud Asset Inventory

Answer

Access Transparency

Answer

Security Command Center

Question 12

Which THREE are valid methods to connect an on-premises network to a Google Cloud VPC?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect (A) provides a direct physical connection between your on-premises network and Google Cloud, offering high bandwidth and a Service Level Agreement (SLA) of up to 99.99% availability. It uses a cross-connect in a colocation facility to attach your on-premises router to a Google Cloud router, enabling private, low-latency connectivity to your VPC without traversing the public internet.

Answer

Cloud Router

Answer

VPC peering

Question 13

Which THREE are best practices for designing a highly available application on Compute Engine?

Accepted Answer

Use managed instance groups with autoscaling. Option C is correct because a managed instance group (MIG) with autoscaling automatically maintains the desired number of healthy VM instances and replaces failed ones, which is fundamental to high availability on Compute Engine. Option D is correct because an external load balancer with health checks only routes traffic to healthy backends and removes unhealthy instances from rotation, preventing users from hitting failed VMs. Option E is correct because distributing instances across multiple zones protects the application from a single-zone failure, since zonal outages do not affect instances in other zones within the same region. Option A is not appropriate because local SSDs are ephemeral and tied to a single VM, so they cannot store durable stateful data for a highly available design. Option B is not appropriate because a single large machine type creates a single point of failure and cannot provide redundancy or fault tolerance.

Answer

Use local SSDs for stateful data

Answer

Use a single large machine type

Question 14

An organization is migrating a MySQL database to Cloud SQL. They require automatic failover with zero data loss in the event of a zone outage. Which configuration should they use?

Accepted Answer

Cloud SQL with high availability (HA) configuration.. Cloud SQL's high availability (HA) configuration uses a synchronous write to a standby instance in a different zone within the same region. This ensures that every transaction committed on the primary is also committed on the standby before acknowledging the client, guaranteeing zero data loss during a zone outage. Automatic failover to the standby occurs with no manual intervention, meeting both the automatic failover and zero data loss requirements.

Answer

Cloud SQL with a cross-region replica.

Answer

Cloud SQL with automated backups and binary logging.

Answer

Cloud SQL with a read replica in a different zone.

Question 15

A team manages a GKE cluster with node pools using different machine types. They plan to upgrade the cluster to a new Kubernetes version. What is the safest upgrade strategy to minimize application downtime?

Accepted Answer

Use a surge upgrade to add new nodes before removing old ones.. A surge upgrade in GKE adds new nodes with the desired Kubernetes version before removing old nodes, ensuring capacity is maintained throughout the process. This minimizes application downtime by allowing pods to be rescheduled onto new nodes before old nodes are drained, following a controlled rolling update pattern that respects PodDisruptionBudgets.

Answer

Perform a rolling upgrade by draining all nodes simultaneously.

Answer

Create a new cluster with the desired version and migrate workloads.

Answer

Upgrade the node pool configuration one by one.