Google PCA Manage and provision cloud infrastructure Practice Test 9 — 15 Questions

Question 1

A company has two VPC networks in the same project: 'vpc-prod' and 'vpc-dev'. They want to allow communication between instances in both VPCs. What is the simplest method?

Accepted Answer

Create a VPC Network Peering connection between them. VPC Network Peering is the simplest method because it directly connects two VPCs using Google's internal infrastructure, allowing private RFC 1918 IP communication across the networks without requiring external gateways, VPN tunnels, or additional bandwidth costs. It requires no routes to be manually configured—Google automatically adds the necessary routes for each peered VPC's subnets—and only a single firewall rule to permit traffic between the instances.

Answer

Set up a Cloud VPN tunnel between the two VPCs

Answer

Configure a custom route in each VPC pointing to the other's subnet

Answer

Add firewall rules allowing traffic between the VPCs

Question 2

A global e-commerce site uses an external HTTPS load balancer with a backend service pointing to a managed instance group. Some users report 503 errors during peak traffic. The backend instances are healthy and not overloaded. What is the most likely cause?

Accepted Answer

The load balancer's max rate per backend is configured too low. A 503 error from an external HTTPS load balancer with healthy backends typically indicates that the load balancer is throttling requests. The 'max rate per backend' setting limits the number of requests per second that the load balancer forwards to each backend instance. When this limit is exceeded, the load balancer returns 503 errors even though the instances themselves are not overloaded, which matches the scenario of peak traffic.

Answer

The CDN cache is not warming up properly

Answer

The backend service's health check interval is too short

Answer

The SSL certificate is expired

Question 3

A service account needs to be able to start and stop Compute Engine instances in a specific project. Which IAM role should be assigned at the project level?

Accepted Answer

roles/compute.instanceAdmin.v1. Roles/compute.instanceAdmin.v1, because this role grants the necessary permissions to start, stop, and manage Compute Engine instances, including operations like instances.start and instances.stop, at the project level. This role is specifically designed for managing compute resources without granting broader project-level access like editing all resources.

Answer

roles/iam.serviceAccountUser

Answer

roles/editor

Answer

roles/compute.viewer

Question 4

Which TWO are required to allow on-premises hosts to access Google APIs using internal IP addresses (Private Google Access)? (Choose 2)

Accepted Answer

A Cloud Interconnect or Cloud VPN connection between on-premises and VPC. Option A is correct because Private Google Access for on-premises hosts requires a hybrid connectivity path — either Cloud Interconnect or Cloud VPN — to carry traffic from the on-premises network into the VPC, where it can then reach Google APIs via internal IP addresses. Option D is correct because Private Google Access must be enabled on the specific subnet that the on-premises traffic will use; this setting allows resources in that subnet to reach Google APIs using internal IP addresses rather than external ones. Option B is incorrect because Cloud Router is a Google Cloud resource used for dynamic routing (e.g., BGP) within the VPC, not something configured in the on-premises network. Option C is incorrect because VPC Service Controls is a security perimeter feature for mitigating data exfiltration, not a requirement for Private Google Access. Option E is incorrect because a private DNS zone for googleapis.com is not required; Google provides the necessary DNS resolution for private.googleapis.com and restricted.googleapis.com automatically when Private Google Access is configured.

Answer

A Cloud Router instance configured in the on-premises network

Answer

VPC Service Controls enabled

Answer

A private DNS zone for googleapis.com

Question 5

Which THREE are required to configure Workload Identity for a GKE cluster? (Choose 3)

Accepted Answer

Create a Google Cloud service account. A Google Cloud service account (GSA) is required to authenticate to Google Cloud APIs from within GKE. Workload Identity maps a Kubernetes service account (KSA) to a GSA, allowing pods to inherit the GSA's IAM permissions without managing static keys. The GSA must be created first to define the identity that workloads will assume.

Answer

Bind the Kubernetes service account to the Google Cloud service account using a Kubernetes RoleBinding

Answer

Use a node pool that has Workload Identity enabled

Question 6

A company runs a microservices application on Google Kubernetes Engine (GKE). Each service is deployed as a Deployment with resource requests and limits. After deploying a new version of a service, the pods start crashing with OOMKilled. The team increased the memory limits in the Deployment manifest, but the pods still crash after a few minutes. The cluster has cluster autoscaling enabled. The node pool has sufficient capacity. What is the most likely cause of the issue?

Accepted Answer

The application has a memory leak. The pods are crashing with OOMKilled even after increasing memory limits, and the node pool has sufficient capacity. This indicates the application itself has a memory leak, where memory usage grows unbounded over time until it exceeds the new limit, causing the OOMKiller to terminate the pod. Increasing limits only delays the crash if the leak persists.

Answer

The Horizontal Pod Autoscaler is configured with a wrong target metric

Answer

The cluster autoscaler is not scaling up quickly enough

Answer

The pods are hitting the node's ephemeral storage limit

Question 7

A company is migrating a stateful application to Google Cloud. The application requires persistent disks with low latency and high IOPS for database workloads. They plan to use Compute Engine instances with SSD persistent disks. However, the database performance is lower than expected. Which action should the company take to improve disk performance?

Accepted Answer

Use local SSDs with RAID 0 configuration for the database data.. Local SSDs provide the highest IOPS and lowest latency of any disk option on Compute Engine, and striping them with RAID 0 aggregates their performance. This directly addresses the need for high IOPS and low latency for database workloads, unlike persistent disks which have performance ceilings tied to disk size and instance limits.

Answer

Change the persistent disk type to standard persistent disk.

Answer

Increase the disk size to increase baseline IOPS.

Answer

Enable disk encryption to improve I/O throughput.

Question 8

A DevOps team is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the pods can securely access Google Cloud APIs (e.g., Cloud Storage) without managing service account keys. Which TWO steps should they take? (Choose two.)

Accepted Answer

Create a dedicated GCP service account with necessary roles and bind it to Kubernetes service accounts via Workload Identity.. Option A is correct because Workload Identity requires creating a dedicated Google Cloud service account with the necessary IAM roles and binding it to a Kubernetes service account (via an IAM policy binding with roles/iam.workloadIdentityUser), which lets the pod impersonate the GCP service account without keys. Option D is correct because Workload Identity must first be enabled on the GKE cluster (e.g., with gcloud container clusters update --workload-pool=PROJECT_ID.svc.id.goog), which sets up the cluster's identity pool and OIDC issuer so Kubernetes service accounts can federate to Google Cloud IAM. Option B is wrong because using the Compute Engine default service account on nodes grants broad, shared credentials to every pod and does not provide per-pod identity or keyless access. Option C is wrong because storing service account keys in Vault still involves managing long-lived keys, which is exactly what the team wants to avoid. Option E is wrong because mounting service account keys from a Kubernetes Secret also relies on static, manually managed credentials rather than keyless Workload Identity.

Answer

Use the Compute Engine default service account on each node.

Answer

Use a secrets management solution like HashiCorp Vault to store service account keys and retrieve them at runtime.

Answer

Store service account keys in a Kubernetes Secret and mount them into pods.

Question 9

Your company runs a critical application on Compute Engine instances in us-central1. The application requires low latency between instances that are all in the same region. You notice that network latency between instances varies and sometimes spikes. You want to ensure consistent low-latency communication. You currently use external IP addresses for communication between instances. What should you do?

Accepted Answer

Use internal IP addresses instead of external IPs for inter-instance communication.. Using internal IP addresses (RFC 1918) for inter-instance communication avoids the overhead of NAT, external routing, and potential egress bottlenecks. Traffic stays within Google's internal network fabric, reducing latency variability and eliminating spikes caused by external internet path fluctuations.

Answer

Move instances to the same zone to reduce network hops.

Answer

Upgrade to larger machine types to improve network bandwidth.

Answer

Set up a Cloud VPN connection between instances.

Question 10

Your company is using Cloud Storage to store sensitive customer data. The security team requires that all objects be encrypted with a customer-managed encryption key (CMEK) and that the key be automatically rotated every 90 days. You need to implement this without changing the application code. You have created a Cloud KMS key ring and a key with rotation period set to 90 days. What additional configuration is required?

Accepted Answer

Set the default encryption key of the Cloud Storage bucket to the Cloud KMS key.. Setting the default encryption key of the Cloud Storage bucket to the Cloud KMS key ensures that all objects written to the bucket are automatically encrypted with that CMEK, without requiring any application code changes. The Cloud KMS key's rotation period of 90 days is already configured, so the key will be rotated automatically, meeting the security team's requirement.

Answer

Set a bucket lifecycle rule to transition objects to a different storage class.

Answer

Create a custom customer-supplied encryption key (CSEK) and provide it in each request.

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account.

Question 11

Your company runs a global e-commerce platform on Google Cloud. The application is deployed across multiple regions for low latency. You use Cloud SQL for transactional data and Cloud Spanner for global consistency of inventory. Recently, the operations team reported that the application is experiencing increased latency during peak hours, and the monthly cloud bill has risen significantly. Upon investigation, you find that the Cloud SQL instance is underutilized (CPU < 20%) while Cloud Spanner split utilization is over 80%. The application instances are fronted by a global external HTTPS load balancer. Network egress costs are high. Which course of action would best address both the latency and cost issues?

Accepted Answer

Increase the number of splits in Cloud Spanner to reduce hot spots, and configure Cloud CDN in front of the load balancer to cache static content.. The primary performance issue is Cloud Spanner split utilization over 80%, indicating hot spots that cause increased latency. Increasing the number of splits redistributes load across more nodes, reducing contention. Additionally, configuring Cloud CDN caches static content at edge locations, reducing network egress costs and latency by serving content closer to users.

Answer

Reduce the Cloud SQL instance tier to a lower machine type to save costs, and add read replicas in other regions for failover.

Answer

Add more nodes to the Cloud SQL instance and enable automatic storage increase to handle peak loads.

Answer

Move the transactional database to Cloud Spanner and decommission Cloud SQL to reduce complexity.

Question 12

A company runs a three-tier web application on Compute Engine. The database tier must be reachable only from the application tier, and the application tier must be reachable from the web tier on TCP port 8080. The company wants to enforce these requirements at the network level with minimal administrative overhead and without relying on instance-level firewall software. What should they do?

Accepted Answer

Create a VPC firewall rule that allows TCP port 8080 from the web tier's network tag to the application tier's network tag, and another rule that allows the database port from the application tier's network tag to the database tier's network tag.. Tag-based VPC firewall rules are the standard way to enforce tier-to-tier access on Compute Engine. By allowing only TCP 8080 from the web tier tag to the application tier tag, and only the database port from the application tier tag to the database tier tag, the company implements least-privilege network segmentation centrally. This avoids instance-level firewall software and keeps administration simple.

Answer

Place the database tier in a separate VPC and use VPC Network Peering to connect it to the application tier's VPC, then allow all traffic between the peered networks.

Answer

Configure each instance with iptables rules that permit only the required traffic, and disable VPC firewall rules for the project.

Answer

Create a single VPC firewall rule that allows all TCP traffic between all instances in the VPC, and rely on the application code to restrict access.

Question 13

A healthcare company stores sensitive patient data in Cloud Storage buckets. The company must ensure that data is encrypted at rest with keys that are automatically rotated every 90 days and that the keys are managed by the company itself, not by Google. The company also needs to maintain full control over key lifecycle and access policies. Which encryption option should the architect recommend?

Accepted Answer

Customer-managed encryption keys (CMEK) using Cloud KMS with a 90-day rotation schedule.. Customer-managed encryption keys (CMEK) in Cloud KMS allow the healthcare company to manage its own encryption keys, set a 90-day rotation schedule, and control access via IAM. This satisfies the requirements for encryption at rest, automatic key rotation, and full control over key lifecycle. Other options either do not provide self-management or lack automatic rotation.

Answer

Cloud External Key Manager (Cloud EKM) with keys stored in a third-party HSM.

Answer

Google-managed encryption keys (GMEK) with default encryption.

Answer

Customer-supplied encryption keys (CSEK) provided with each request.

Question 14

A company is deploying a microservices application on Google Kubernetes Engine (GKE). The architect needs to ensure that the cluster can automatically scale nodes based on pod resource requests and that pods are scheduled efficiently across nodes. The company also wants to minimize costs by scaling down when demand is low. Which two configurations should the architect implement? (Choose two.)

Accepted Answer

Enable Cluster Autoscaler on the node pool with a minimum and maximum node count.. Cluster Autoscaler scales the number of nodes in a node pool based on pending pod resource requests, and setting pod resource requests ensures that the scheduler and autoscaler have accurate information to make scaling decisions. Together, they enable automatic node scaling and efficient scheduling while allowing scale-down to reduce costs. The other options either address pod scaling, add unnecessary complexity, or improve availability without meeting the core requirements.

Answer

Configure Horizontal Pod Autoscaler (HPA) based on CPU utilization.

Answer

Use a regional cluster with multiple zones.

Answer

Enable node auto-provisioning for the cluster.

Question 15

A financial services company runs a three-tier web application on Compute Engine across three zones in us-central1. Their security team mandates that database traffic must never traverse the public internet, and that the database subnet must be reachable only from the application subnet. The network team has already created a custom VPC named fin-vpc with separate subnets for web, app, and db tiers. Which combination of controls should the architect implement to satisfy these requirements?

Accepted Answer

Create a firewall rule on fin-vpc that allows ingress to the db subnet only from the app subnet's CIDR range, and do not assign external IP addresses to the database instances.. Restricting access at the subnet level with a VPC firewall rule that permits ingress only from the application tier's CIDR, combined with withholding external IP addresses from database instances, directly implements both the least-privilege reachability requirement and the no-public-internet mandate. No additional networking products are needed because VPC firewall rules already scope traffic by source range and target, and internal-only addressing keeps the tier off the public internet.

Answer

Create a second VPC for the database tier and peer it to fin-vpc, then rely on the default firewall rules to block non-app traffic.

Answer

Enable Private Google Access on the db subnet and remove external IPs from the database instances so all traffic stays internal to Google's network.

Answer

Assign internal IP addresses to the databases and place them behind an external TCP proxy load balancer so only the app tier can resolve the backend.