Google PCA Manage and provision cloud infrastructure Practice Test 8 — 15 Questions

Question 1

A company has Compute Engine instances that need to access the internet for updates but should not be reachable from the internet. They also need to access Google APIs and services like Cloud Storage. Which configuration meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud NAT for outbound internet and enable Private Google Access on the subnet.. Cloud NAT provides outbound internet connectivity for instances without external IPs, while Private Google Access allows those same instances to reach Google APIs and services (like Cloud Storage) using internal IPs via the subnet's default route. This combination ensures instances can initiate outbound connections to the internet and Google services but remain unreachable from the internet, meeting both security and functional requirements.

Answer

Assign external IPs to all instances and configure firewall rules to block inbound traffic.

Answer

Configure a VPN tunnel to an on-premises proxy server for internet access.

Answer

Use Cloud NAT for outbound internet and use external IPs for Google API access.

Question 2

An administrator is configuring firewall rules in a VPC. Two rules apply to the same traffic: rule 1 allows ingress from 0.0.0.0/0 on TCP 80, rule 2 denies ingress from 10.0.0.0/8 on TCP 80. Rule 1 has priority 1000, rule 2 has priority 500. What is the effective behavior for traffic from 10.0.0.1?

Accepted Answer

Traffic is denied because rule 2 has higher priority.. In Google Cloud VPC firewall rules, rules are evaluated in priority order, with lower numbers having higher priority. Rule 2 (priority 500) is evaluated before rule 1 (priority 1000), and since rule 2 explicitly denies ingress from 10.0.0.0/8 on TCP 80, traffic from 10.0.0.1 is denied. Google Cloud firewall rules are stateful, and the first matching rule determines the outcome; there is no implicit override between allow and deny.

Answer

The result is unpredictable without knowing the rule creation order.

Answer

Traffic is allowed because allow rules override deny rules.

Answer

Traffic is allowed because rule 1 has a lower priority number.

Question 3

An organization wants to enforce a policy that prohibits the creation of Cloud Storage buckets with uniform bucket-level access disabled. What should they use?

Accepted Answer

Organization policy with a list constraint.. Organization policies can enforce constraints like constraints/storage.uniformBucketLevelAccess to require uniform bucket-level access. Option B (IAM roles with custom permissions) cannot deny bucket creation with specific settings. Option C (Cloud Audit Logs) is for logging, not enforcement. Option D (Cloud Armor) is for security policies at the edge.

Answer

IAM roles with custom permissions to deny bucket creation.

Answer

Cloud Audit Logs to monitor bucket creation.

Answer

Cloud Armor security policies.

Question 4

Which TWO are best practices when designing a VPC network for a multi-tier application in Google Cloud?

Accepted Answer

Create separate subnets for each application tier.. Creating separate subnets for each application tier (e.g., web, application, database) allows you to apply granular firewall rules and routing policies per tier. This segmentation improves security by isolating traffic between tiers and aligns with Google Cloud's best practices for multi-tier architectures. It also simplifies network troubleshooting and scaling by keeping each tier's IP space distinct.

Answer

Disable VPC Flow Logs to reduce cost.

Answer

Use a single subnet for all tiers to simplify IP management.

Answer

Rely on the default priority of firewall rules to ensure proper ordering.

Question 5

A developer notices that web-server-1 is preemptible. They want to ensure their application remains available even if this instance is terminated. What should they do?

Accepted Answer

Create a managed instance group for web-server-1 and set an autoscaler.. A managed instance group (MIG) with an autoscaler ensures that if the preemptible instance is terminated, the MIG automatically recreates it to maintain the desired number of instances. This provides resilience against preemption by restoring capacity without manual intervention. The load balancer can then distribute traffic across healthy instances in the group.

Answer

Modify the instance's preemptible flag to false.

Answer

Create a load balancer pointing to web-server-1's external IP.

Answer

Create a snapshot schedule for web-server-1.

Question 6

A user runs the gsutil command shown in the exhibit and gets an AccessDenied error. The user is not authenticated with gcloud. What should the user do first?

Accepted Answer

Run gcloud auth login to authenticate with their Google account.. The error occurs because the user is not authenticated with gcloud. The gsutil command requires valid authentication credentials to access Google Cloud Storage resources. Running `gcloud auth login` initiates the OAuth 2.0 flow, which authenticates the user with their Google account and generates the access token that gsutil uses for API calls. This is the prerequisite step before any gsutil operation can succeed.

Answer

Create a service account and download a JSON key.

Answer

Grant public write access to the bucket.

Answer

Use gcloud config set project my-project to set the project.

Question 7

A company runs a service on Cloud Run that needs to access a Cloud SQL instance via private IP. Both are in the same VPC network. The service cannot connect to the database. What is the most likely cause?

Accepted Answer

Cloud Run needs a Serverless VPC Access connector.. Cloud Run services run in a Google-managed environment and cannot directly reach resources on a VPC network via private IP. A Serverless VPC Access connector is required to bridge the serverless environment to the VPC, enabling private IP connectivity to Cloud SQL. Without this connector, the Cloud Run service cannot route traffic to the Cloud SQL private IP, even if both are in the same VPC network.

Answer

Cloud Run must be deployed in the same zone as Cloud SQL.

Answer

The IAM permissions for Cloud Run to access Cloud SQL are missing.

Answer

A firewall rule is blocking traffic.

Answer

The Cloud SQL instance needs a public IP assigned.

Question 8

A developer wants to deploy a stateless web application that automatically scales based on HTTP traffic. The application should be cost-effective and require minimal configuration. Which compute option is best?

Accepted Answer

Cloud Run. Cloud Run is the best choice because it automatically scales to zero when idle, scales up to handle HTTP traffic spikes, and requires minimal configuration—just deploy a container. It is cost-effective as you pay only for resources used during request processing, and it supports stateless web applications natively without managing servers or clusters.

Answer

App Engine Standard Environment

Answer

Cloud Functions

Answer

Compute Engine managed instance group

Answer

Google Kubernetes Engine

Question 9

A company uses Terraform to manage Google Cloud infrastructure. They want to store the Terraform state file in a remote backend with state locking to prevent concurrent modifications. Which Google Cloud service supports this natively?

Accepted Answer

Cloud Storage. Google Cloud Storage (GCS) is the only option that natively supports Terraform's remote state backend with state locking. Terraform uses GCS's object versioning and a write-lock mechanism via a separate lock file (e.g., `default.tflock`) stored in the same bucket, leveraging GCS's strong consistency for atomic operations. This prevents concurrent `terraform apply` commands from corrupting the state.

Answer

Cloud Firestore

Answer

Cloud Spanner

Answer

Bigtable

Answer

Cloud SQL

Question 10

A company has a global web application deployed across multiple regions. They use an external HTTPS Load Balancer with backend services in us-central1 and europe-west1. They want users to be routed to the closest healthy backend. Which load balancing configuration is required?

Accepted Answer

External HTTPS Load Balancer with global backend. An External HTTPS Load Balancer with a global backend configuration uses Google Cloud's global anycast IP and the Premium Tier network to route users to the closest healthy backend based on latency and proximity. This setup ensures that traffic from users worldwide is directed to the nearest region (us-central1 or europe-west1) with a healthy instance group, providing optimal performance and failover.

Answer

Internal HTTP(S) Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

Classic Application Load Balancer

Answer

Regional external HTTPS Load Balancer

Question 11

Which THREE of the following are best practices when using Deployment Manager to manage infrastructure? (Choose three.)

Accepted Answer

Use templates to define resources modularly.. Option B is correct because Deployment Manager templates let you define resources modularly, so reusable building blocks (for example a VM template) can be instantiated multiple times with different properties instead of duplicating configuration. Option D is correct because imports allow a configuration or template to reference shared, external templates (such as a common network or firewall template), promoting reuse and consistent configuration across deployments. Option E is correct because composite types bundle multiple related resources into a single reusable type, which simplifies managing and repeating multi-resource patterns. Option A is not a best practice: raw REST API calls inside templates bypass the declarative template model and make configurations harder to maintain and reuse. Option C is not a best practice: Deployment Manager supports both YAML and Jinja/Python templates, so restricting yourself to only YAML configuration files unnecessarily limits templating and logic capabilities.

Answer

Use raw REST API calls in templates.

Answer

Use only YAML configuration files.

Question 12

A company runs a batch processing job that runs daily and can handle interruptions. The job runs on a single Compute Engine instance. Which machine configuration is the most cost-effective?

Accepted Answer

A preemptible n1-standard-4 VM. A preemptible VM costs significantly less than a standard VM (up to 80% discount) and is ideal for batch processing jobs that can handle interruptions. The job runs daily and can tolerate being stopped, so the lower cost of a preemptible instance provides the most cost-effective solution without sacrificing functionality.

Answer

A n2-standard-4 VM with sustained use discount

Answer

A standard n1-standard-4 VM

Answer

A n1-standard-4 VM with a GPU

Question 13

A Cloud Run service frequently fails with 502 errors when making requests to a backend service running on Compute Engine. The two services are in the same VPC network. The Cloud Run service is configured with a VPC connector. What is the most likely cause?

Accepted Answer

The VPC connector is not attached to the correct subnet, or the firewall rules are blocking traffic from the connector's IP range.. Cloud Run uses a VPC connector to send requests to resources in a VPC. If the connector is attached to the wrong subnet, its egress traffic may not reach the Compute Engine instance, or firewall rules may block traffic from the connector's IP range (e.g., 10.8.0.0/28). This results in 502 errors from the backend, as the Cloud Run service cannot establish a TCP connection to the Compute Engine instance.

Answer

The Cloud Run service needs to be peered with the VPC using VPC Network Peering.

Answer

The VPC connector is set to a low number of instances, causing traffic throttling.

Answer

The Cloud Run service's service account lacks the roles/compute.instanceAdmin role.

Question 14

A company runs a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage and low-latency access across multiple zones. The application needs to perform well even during zonal failures. Which storage solution should they use?

Accepted Answer

Regional persistent disk. Regional persistent disks (RPDs) synchronously replicate data across two zones in the same region, providing both the persistent storage and low-latency access required by the stateful application. This ensures that if one zone fails, the disk can be attached to a pod in the surviving zone without data loss or significant performance degradation, meeting the high-availability and multi-zone access requirements.

Answer

Zonal persistent disk with snapshots to another zone

Answer

Local SSDs attached to nodes

Answer

Cloud Filestore

Question 15

A user wants to store a database password that will be used by a Compute Engine instance. What is the most secure and manageable approach?

Accepted Answer

Use Secret Manager and grant the instance's service account access to the secret. Secret Manager is the most secure and manageable approach because it provides encrypted storage, automatic rotation, and fine-grained access control via IAM. By granting the Compute Engine instance's service account access to the secret, the password is never exposed in plaintext metadata, logs, or disk files, and access can be audited and revoked independently of the instance lifecycle.

Answer

Set the password as an environment variable in instance metadata

Answer

Store the password in Cloud Storage bucket metadata

Answer

Store the password in a file on the instance's boot disk