Google PCA Multiple Select — 30 Questions

Question 1

A company deploys a critical application on Google Kubernetes Engine (GKE) and wants to ensure high availability during cluster upgrades. Which TWO practices should they follow?

Accepted Answer

Use multiple node pools across different zones within the cluster.. Deploying multiple node pools across different zones ensures that if one zone fails or is taken down for maintenance, the application can continue serving from the other zones. This aligns with GKE's best practice for high availability by distributing workloads across failure domains. Option C is correct because PodDisruptionBudgets (PDBs) define the minimum number of pods that must remain available during voluntary disruptions like cluster upgrades, preventing the upgrade from taking down too many replicas at once.

Answer

Use a single-zone node pool with multiple replicas.

Answer

Enable cluster autoscaling to add nodes during upgrades.

Answer

Enable regional clusters for multi-zone control plane.

Question 2

A company is using BigQuery for data analytics. They want to optimize costs while maintaining query performance. Which TWO actions should they take? (Choose 2.)

Accepted Answer

Partition tables by date.. Partitioning tables by date (Option C) is correct because it allows BigQuery to prune partitions during query execution, scanning only the relevant date ranges instead of the entire table. This reduces the amount of data processed, directly lowering query costs under on-demand pricing while maintaining performance through reduced I/O.

Answer

Use reserved slots with flat-rate pricing.

Answer

Always use SELECT *.

Answer

Materialize frequently used queries as tables.

Question 3

A security team needs to detect and redact personally identifiable information (PII) in documents stored in Cloud Storage before sharing them with external partners. Which two Google Cloud services should they use together? (Choose two.)

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud DLP can scan Cloud Storage for PII and de-identify the data. The scanned and de-identified results can be written back to Cloud Storage. Cloud Dataflow is not needed for this simple use case; Cloud Function can trigger DLP jobs.

Answer

Cloud KMS

Answer

Cloud Dataflow

Answer

Cloud NAT

Question 4

A company runs a latency-sensitive web application on Compute Engine in us-east1. They want to improve response times for users in Europe and Asia without changing the application architecture. Which TWO actions should they take? (Choose 2.)

Accepted Answer

Enable Cloud CDN on the load balancer. Cloud CDN caches static content at edge locations globally, reducing latency for users worldwide. Placing a load balancer in multiple regions (multi-region load balancing with proximity-based routing) directs users to the nearest backend region. Using only us-west1 would still leave European users far away. Cloud Armor is for security, not performance. Spot VMs are for cost savings, not latency.

Answer

Use preemptible VMs to reduce cost

Answer

Deploy additional instances in us-west1

Answer

Use Cloud Armor to block high-latency requests

Question 5

An organization wants to protect an HTTPS load-balanced web application from common web attacks, such as SQL injection and cross-site scripting (XSS), as well as rate-limit traffic from specific IPs. Which three capabilities should they use together? (Choose three.)

Accepted Answer

Cloud Armor rate limiting. Cloud Armor provides WAF rules (preconfigured rules for SQLi, XSS, etc.), rate limiting, and IP blacklisting/whitelisting. All three are part of Cloud Armor security policies.

Answer

Cloud CDN

Answer

Cloud Load Balancing logging

Question 6

A company wants to use a multi-cloud strategy to avoid vendor lock-in and run workloads on both Google Cloud and AWS. They need to manage Kubernetes clusters across both environments consistently. Which TWO Google Cloud services can help achieve this?

Accepted Answer

Config Sync. Anthos (now GKE Enterprise) provides a consistent Kubernetes platform across on-premises and multiple clouds, including AWS. Config Sync is a component of Anthos that enables configuration management across clusters. BigQuery Omni allows querying data across clouds but is for analytics. Cloud Run is serverless and not for multi-cloud Kubernetes management. GKE on AWS is deprecated; Anthos is the recommended approach.

Answer

Cloud Run

Answer

BigQuery Omni

Answer

GKE on AWS

Question 7

A team is building a CI/CD pipeline for a Java application that will run on GKE. They want to automatically build the application, run unit tests, create a Docker image, push it to Artifact Registry, and deploy to GKE. Which two GCP services should be combined? (Choose two.)

Accepted Answer

Cloud Deploy. Cloud Build handles the build and test steps, builds the Docker image, and pushes to Artifact Registry. Cloud Deploy manages the deployment to GKE. Cloud Run is serverless; Cloud Functions is event-driven; Compute Engine is VMs.

Answer

Cloud Functions

Answer

Compute Engine

Answer

Cloud Run

Question 8

A company needs to store and serve large media files (each up to 5 GB) to users globally. The files are accessed infrequently (once a quarter) but must be available with low latency. Which THREE Cloud Storage classes and features should they consider? (Choose three.)

Accepted Answer

Cloud CDN. Nearline is suitable for data accessed less than once a month. Cloud CDN caches content at edge locations for low latency. Object lifecycle management can transition objects to colder storage automatically. Standard is for frequently accessed data. Coldline is for data accessed less than once a quarter. Archive is for data accessed less than once a year.

Answer

Coldline storage class

Answer

Standard storage class

Question 9

A team is designing a disaster recovery (DR) plan for a critical application. Which THREE components are essential for a robust DR plan? (Choose 3)

Accepted Answer

Failover procedures and runbooks. Failover procedures and runbooks (A) are essential because they provide step-by-step instructions for executing a controlled transition to the secondary site, ensuring minimal downtime and consistent recovery actions. Without documented runbooks, teams risk misconfigurations during a disaster, which can extend recovery time objectives (RTO) beyond acceptable limits.

Answer

A single-region deployment for consistency

Answer

Load testing to validate performance

Question 10

A company wants to implement a disaster recovery strategy for a critical application running on Compute Engine with state stored on persistent disks. They need an RTO of less than 15 minutes and an RPO of less than 1 hour. Which TWO steps should they take? (Choose two.)

Accepted Answer

Use regional persistent disks for the application data. Regional persistent disks replicate data synchronously across zones, providing low RPO. A managed instance group with a health check and auto-healing enables fast failover for low RTO. Snapshots have higher RPO. Cloud DNS is for DNS failover, not for compute failover. Global load balancer is for traffic distribution, not stateful failover.

Answer

Set up scheduled snapshots to a multi-regional Cloud Storage bucket

Answer

Use Cloud DNS with a failover policy

Answer

Configure a global HTTP(S) load balancer in front of the application

Question 11

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

Accepted Answer

Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage. Enabling CMEK on Cloud SQL and Cloud Storage allows the company to use their own encryption keys, which is often required by PCI DSS to demonstrate control over key management. CMEK ensures data at rest is encrypted with keys managed via Cloud KMS, providing auditability and separation of duties beyond Google-managed default encryption.

Answer

Configure client-side encryption in the application code

Answer

Rely on Google-managed default encryption for all data

Answer

Use Cloud HSM with a key generated outside of Google Cloud

Question 12

Your organization is moving a legacy monolithic application to Google Kubernetes Engine (GKE). The application currently runs on a single virtual machine with a local MySQL database. You need to design a cloud-native architecture that improves scalability and reliability. Which two actions should you take? (Choose TWO.)

Accepted Answer

Refactor the application into microservices and deploy each as a separate deployment in GKE.. Refactoring the monolithic application into microservices and deploying each as a separate Deployment in GKE aligns with cloud-native principles, enabling independent scaling, fault isolation, and easier updates. This approach improves scalability and reliability by allowing each microservice to scale horizontally based on demand, and failures in one service do not cascade to others.

Answer

Deploy the entire application in a single container with a large custom machine type to handle load.

Answer

Expose the application using a simple Service of type LoadBalancer with round-robin distribution.

Answer

Use a single Pod with multiple containers that communicate via localhost to reduce latency.

Question 13

Which TWO methods can be used to provide secure access to a private Google Kubernetes Engine (GKE) cluster from the internet? (Choose two.)

Accepted Answer

Use Cloud VPN to connect from an on-premises network that has internet access.. Cloud VPN establishes an encrypted tunnel (using IPsec) from an on-premises network to a VPC in Google Cloud, allowing secure access to a private GKE cluster master endpoint without exposing it to the public internet. Option E is correct because Identity-Aware Proxy (IAP) with TCP forwarding enables authenticated and authorized access to the private cluster master endpoint via a bastion-like tunnel, without requiring a public IP on the master or a VPN.

Answer

Expose the cluster via an internal load balancer.

Answer

Configure a Cloud NAT to allow inbound connections from the internet.

Answer

Assign a public IP address to the cluster master endpoint.

Question 14

A startup wants to store application secrets (e.g., API keys, database passwords) securely on Google Cloud. They need to support automatic rotation of secrets and fine-grained access control. Which TWO services should they use? (Choose 2.)

Accepted Answer

Secret Manager. Secret Manager is the primary service for storing secrets, with support for versioning, automatic rotation, and IAM. Cloud KMS can be used to encrypt secrets stored in Secret Manager, providing an additional layer of security. Cloud Key Management Service (KMS) is used for managing encryption keys, but Secret Manager already encrypts secrets at rest using Google-managed keys by default; using CMEK via Cloud KMS adds customer-managed key control. Cloud Storage is not designed for secrets. IAM alone does not provide secret storage. Cloud Functions can access secrets but is not a storage service.

Answer

Cloud Storage with object versioning

Answer

Cloud Functions

Answer

Cloud Identity and Access Management (IAM)

Question 15

A company needs to design a disaster recovery strategy for a critical application running on Cloud SQL for PostgreSQL. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 30 minutes. Which THREE actions should they take to meet these objectives? (Choose THREE.)

Accepted Answer

Configure cross-region replication for the Cloud SQL instance. Cross-region replication with failover replicas can achieve RPO of a few seconds and RTO of minutes. Point-in-time recovery and automated backups provide additional recovery options but may not meet RPO as low as 5 minutes alone.

Answer

Take regular on-demand exports to Cloud Storage

Answer

Create a failover replica in the same region

Question 16

A company is migrating a monolithic application to a microservices architecture on GCP. They want to use an event-driven approach to decouple services and ensure reliable message delivery. Which TWO services should they use for inter-service communication? (Choose TWO.)

Accepted Answer

Eventarc. Pub/Sub is a fully managed messaging service for asynchronous event-driven communication between services. Eventarc allows routing events from various sources to services like Cloud Run, enabling event-driven architecture.

Answer

Cloud Scheduler

Answer

Cloud Functions

Answer

Cloud Tasks

Question 17

A company is moving a legacy monolithic application to a microservices architecture on Google Cloud. They want to minimize operational overhead and automatically scale each service independently. Which TWO compute services should they consider? (Choose two.)

Accepted Answer

Cloud Run. Cloud Run and GKE Autopilot both offer automatic scaling and reduced operational overhead. Cloud Run is serverless for containers; GKE Autopilot manages the cluster infrastructure. Compute Engine requires manual scaling. Cloud Functions is for functions, not full services. GKE Standard requires node management.

Answer

Compute Engine with managed instance groups

Answer

Google Kubernetes Engine (GKE) Standard

Answer

Cloud Functions

Question 18

A company has set up an external HTTP(S) load balancer with a backend service pointing to a managed instance group. Some instances are failing health checks. Which TWO actions should the company take to troubleshoot the issue?

Accepted Answer

Ensure the health check path specified in the backend service returns a 200 OK status.. The HTTP(S) load balancer's health check probes the specified path on each backend instance. If the path does not return a 200 OK status, the load balancer marks the instance as unhealthy and stops sending traffic to it. Ensuring the health check path returns a 200 OK is the first step in verifying that the health check is configured correctly.

Answer

Disable session affinity to allow better distribution of traffic.

Answer

Change the health check interval from 5 seconds to 30 seconds.

Answer

Increase the number of instances in the instance group to distribute the load.

Question 19

A company is migrating a legacy Java application to GCP. The application currently runs on a single on-premises server with a MySQL database. They want to minimize changes to the application code but take advantage of GCP managed services. Which TWO approaches should they consider? (Choose 2)

Accepted Answer

Lift and shift the application to Compute Engine and use Cloud SQL for MySQL.. Lift-and-shift (migrating the application to Compute Engine as-is) and re-platform (using Cloud SQL for MySQL) are the best approaches to minimize code changes. Re-architecting as microservices would require significant code changes. Cloud Functions and Firebase are not suitable for a legacy Java application.

Answer

Use Firebase Realtime Database to replace MySQL.

Answer

Use Cloud Functions to replace the application logic.

Answer

Re-architect the application as a set of microservices on GKE.

Question 20

An engineering team is deploying a microservices application on Google Cloud. They want to use a service mesh for observability, traffic management, and security. They are considering Anthos Service Mesh (ASM). Which THREE components are part of ASM? (Choose THREE.)

Accepted Answer

Envoy sidecar proxies. ASM uses Istio as the control plane, Envoy as the sidecar proxy, and integrates with Google Cloud's operations suite (formerly Stackdriver) for telemetry. GKE is the platform, but not a component of ASM. Cloud Endpoints is a separate API management service.

Answer

Cloud Endpoints

Answer

Google Kubernetes Engine (GKE)