Google PCA Manage and provision cloud infrastructure — Timed 10 Questions

Question 1

Which THREE components are required to set up a private connection between an on-premises network and a VPC using Cloud VPN? (Choose three.)

Accepted Answer

Peer VPN gateway (on-premises).. A Peer VPN gateway represents the on-premises VPN device that terminates the IPsec tunnel from the Cloud VPN gateway. This is a required component to establish the encrypted tunnel between your on-premises network and the VPC, as it defines the public IP address and configuration of the remote endpoint.

Answer

VPC Network Peering.

Answer

Cloud Router.

Question 2

An administrator creates a GKE cluster with the command above. After deployment, the cluster has 3 nodes, but the node pool autoscaler never scales up even under load. What is the most likely reason?

Accepted Answer

The cluster is zonal, but node locations include multiple zones.. The node pool autoscaler in GKE cannot scale up a cluster that uses multiple zones in a single zonal cluster. The autoscaler requires that all nodes in the pool be in the same zone to properly manage capacity; when node locations span multiple zones in a zonal cluster, the autoscaler is disabled and will not trigger scaling events, even under load.

Answer

The autoscaler minimum nodes is set to 1 and maximum to 5.

Answer

The disk size of 100 GB is insufficient.

Answer

The machine type e2-medium is too small for the workloads.

Question 3

A startup is deploying a microservices application on Google Kubernetes Engine (GKE) with a regional cluster. They have services that need to communicate with each other and also with external APIs. The cluster uses VPC-native routing. They have enabled Cloud NAT to allow outbound internet access for nodes without external IPs. However, the development team reports that some pods cannot reach the external APIs, while others can. All pods are in the same namespace and are not using any network policies. The pods that fail have the annotation 'cloud.google.com/gke-nat-ips' set to a list of static IP addresses. The pods that work do not have this annotation. What is the most likely cause of the failure?

Accepted Answer

The annotation 'cloud.google.com/gke-nat-ips' is not compatible with Cloud NAT for outbound traffic.. The annotation 'cloud.google.com/gke-nat-ips' is used to assign specific static IP addresses for outbound traffic from pods, but it is only compatible with the GKE Native Networking (formerly VPC-native) and the Cloud NAT gateway when the pods use the default NAT configuration. When this annotation is set, Cloud NAT is bypassed for those pods, and the traffic is sent directly from the specified static IPs, which may not be properly routed or may be blocked by the external API's firewall rules. In contrast, pods without the annotation use Cloud NAT's dynamic IPs, which are correctly routed and allowed.

Answer

Network policies are blocking outbound traffic for those pods.

Answer

The VPC-native routing is misconfigured for the pods with the annotation.

Answer

The annotation is used to assign static IPs for inbound traffic only.

Question 4

A company is migrating its on-premises application to Google Cloud. The application requires low-latency access to a shared filesystem that can be mounted by multiple Compute Engine instances across different zones. Which storage solution should they use?

Accepted Answer

Provision a Filestore instance and mount it on the instances.. Filestore provides a fully managed, NFS-based shared filesystem that can be mounted by multiple Compute Engine instances across different zones with low-latency access. It supports the required multi-writer, multi-mount scenario natively, making it the ideal choice for shared storage in a zonal-distributed architecture.

Answer

Create a Persistent Disk and attach it to all instances.

Answer

Attach Local SSD to each instance and replicate data between them.

Answer

Use Cloud Storage FUSE to mount a bucket on each instance.

Question 5

A company wants to enable a new DevOps team to have read-only access to logs in the default Cloud Logging bucket for their project, but prevent them from modifying log views or creating linked datasets in BigQuery. Which two IAM roles should be granted to the team?

Accepted Answer

roles/logging.viewAccessor. Option A, roles/logging.viewAccessor, is correct because it grants read access to log views, including the _Default view of the default Cloud Logging bucket, without allowing the team to modify views or create linked datasets. Option D, roles/logging.viewer, is correct because it provides read-only access to all logs in the project, including the default bucket, while excluding permissions to change logging configuration or create BigQuery linked datasets. Option B, roles/logging.configWriter, is not appropriate because it allows managing logging configuration such as sinks and views, which the team must not modify. Option C, roles/logging.admin, is too broad because it grants full control over logging resources, including creating and modifying views and linked datasets. Option E, roles/bigquery.dataViewer, is unrelated to Cloud Logging access and would not grant the required read-only log access.

Answer

roles/logging.configWriter

Answer

roles/logging.admin

Answer

roles/bigquery.dataViewer

Question 6

A company runs an e-commerce platform on Google Cloud. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster (us-central1, three zones). The frontend service is exposed via an HTTP Load Balancer with Cloud CDN. Recently, during a flash sale, users experienced high latency and occasional 502 errors. The backend service is a Java application that reads from Cloud Spanner. The team has observed that Spanner CPU utilization averaged 65% during the sale, with a few spikes to 80%. The number of frontend pods was auto-scaled to 50, each running on n1-standard-2 nodes. The node pool is set to autoscale up to 100 nodes. The errors appear to correlate with periods of high CPU on the nodes, but not always. What is the most likely cause and recommended action?

Accepted Answer

Change the backend service to use a multi-zone NEG that includes endpoints from all three zones, and ensure the load balancer is configured for cross-zone load balancing.. The high latency and 502 errors are likely caused by the HTTP Load Balancer sending requests to unhealthy backend pods due to zone-imbalanced traffic. A regional GKE cluster with a multi-zone NEG and cross-zone load balancing ensures that the load balancer distributes requests evenly across all pods in all three zones, preventing node CPU spikes in a single zone from causing errors. Option B directly addresses this by enabling proper traffic distribution, which is the most probable root cause given that node CPU spikes correlate with errors but not always.

Answer

Scale up the Cloud Spanner instance to handle higher peak CPU, as the 80% spikes indicate insufficient capacity.

Answer

Increase the CPU request for the frontend pods and set a higher target CPU utilization for the Horizontal Pod Autoscaler.

Answer

Increase the health check interval and timeout settings to give pods more time to respond before being marked unhealthy.

Question 7

A Cloud Router BGP session is flapping. The logs show 'Interface flapping due to changes in the underlying network'. What is the most likely cause?

Accepted Answer

MTU mismatch across the network path.. The log message 'Interface flapping due to changes in the underlying network' indicates that the BGP session is unstable because the physical or logical interface is going up and down. An MTU mismatch across the network path can cause packet fragmentation issues, leading to intermittent connectivity and interface flaps as the router detects and recovers from the problem. This is the most likely cause because it directly affects the stability of the underlying network path.

Answer

BGP MD5 authentication failure.

Answer

Incorrect local AS number in Cloud Router configuration.

Answer

BGP timer misconfiguration between peers.

Question 8

Which THREE factors should be considered when selecting a machine series for a Compute Engine instance running a memory-intensive batch job?

Accepted Answer

Network throughput.. Network throughput (A) is a critical factor for a memory-intensive batch job because such jobs often involve reading or writing large datasets from persistent storage or other sources over the network. The instance series must provide sufficient network bandwidth to avoid I/O bottlenecks that could extend job completion time, even if the compute and memory resources are adequate.

Answer

Sustained use discount.

Answer

GPU availability.

Question 9

Which TWO statements are true about Cloud Load Balancing?

Accepted Answer

Regional load balancing supports TCP/UDP traffic.. Regional load balancing (such as the external regional TCP/UDP Network Load Balancer) operates at Layer 4 and supports TCP and UDP traffic, making option B correct. Additionally, global load balancers like the external HTTP(S), SSL Proxy, and TCP Proxy load balancers can be associated with instance groups in multiple regions, allowing traffic distribution across regions for high availability and low latency. This makes option E correct. Options A, C, and D are incorrect because: A – not all load balancers require a regional forwarding rule (e.g., global load balancers use a global forwarding rule); C – global load balancers support not only HTTP/S but also TCP and UDP via the SSL Proxy and TCP Proxy load balancers; D – internal load balancing can also span across peered VPCs, not just the same VPC.

Answer

All load balancers require a regional forwarding rule.

Answer

Global load balancing supports only HTTP/S traffic.

Answer

Internal load balancing is only for traffic within the same VPC.

Question 10

A developer wants to automate the creation of a Google Cloud project with a specific VPC and firewall rules. Which tool should they use?

Accepted Answer

Deployment Manager. Deployment Manager is the correct tool because it allows you to define and manage Google Cloud resources, including projects, VPCs, and firewall rules, using declarative templates (YAML, Python, or Jinja2). This enables infrastructure-as-code (IaC) automation, which is essential for repeatable and version-controlled project creation. Unlike interactive tools, Deployment Manager handles the entire lifecycle of resources, including dependencies and updates, without manual intervention.

Answer

Cloud Shell

Answer

Cloud Console

Answer

Cloud SDK