Google PCA Managing Implementation and Ensuring Solution and Operations Reliability Practice Test 2 — 15 Questions

Question 1

Your company has a production Cloud SQL for PostgreSQL instance in us-central1 with automated backups enabled. You need to ensure that if the zone fails, the database automatically fails over to a standby in a different zone with minimal downtime. What should you do?

Accepted Answer

Configure the instance as a highly available (regional) instance.. Cloud SQL high availability (HA) configuration creates a standby instance in a different zone. The primary and standby use synchronous replication, and automatic failover occurs if the primary zone fails. Enabling deletion protection does not provide HA. Read replicas are for read scaling, not automatic failover. Automated backups alone do not provide failover.

Answer

Enable deletion protection on the instance.

Answer

Create a cross-region read replica and manually promote it during a failure.

Answer

Enable point-in-time recovery (PITR) and keep 30 days of transaction logs.

Question 2

An organization wants to connect their on-premises data center to Google Cloud with a dedicated 10 Gbps link. They require high availability and have budget for two physically diverse connections. Which solution should they choose?

Accepted Answer

Provision two Cloud Dedicated Interconnect connections from diverse peering points.. Cloud Dedicated Interconnect provides direct physical connections between on-premises and Google Cloud. For high availability, two separate circuits (each 10 Gbps or 100 Gbps) from diverse peering points are recommended. HA VPN is software-defined and lower bandwidth. Partner Interconnect uses a service provider but Dedicated Interconnect is preferred for dedicated bandwidth.

Answer

Use Partner Interconnect with a single 10 Gbps connection.

Answer

Configure a single Dedicated Interconnect connection and use Cloud VPN as backup.

Answer

Deploy a single HA VPN tunnel.

Question 3

Your team uses Cloud Deploy to manage canary deployments on GKE. You want to automatically roll back a release if the error rate increases by more than 5% within 10 minutes after the canary receives 10% of traffic. Which approach meets this requirement?

Accepted Answer

Use the Cloud Deploy rollout strategy with a canary phase and set the 'failurePolicy' to 'ROLLBACK' with a metric threshold.. Cloud Deploy supports canary deployments with automatic rollback based on Cloud Monitoring metrics. You can define a rollout strategy with a canary phase and attach an alert policy that triggers a rollback. Cloud Deploy integrates with Cloud Monitoring to watch metrics. Manual verification or Cloud Build does not provide automatic rollback based on metrics.

Answer

Configure a Cloud Build trigger to run a script that checks logs and rolls back if error rate exceeds threshold.

Answer

Set up a Cloud Monitoring alert with a notification to the SRE team and have them manually roll back.

Answer

Use GKE blue-green deployment with a manual verification step before switching traffic.

Question 4

You are designing a disaster recovery plan for a Cloud SQL for MySQL instance. The instance is in us-east1. You need to be able to recover the database to a specific second in time within the past 7 days in the event of a regional outage. What should you do?

Accepted Answer

Enable point-in-time recovery and create a cross-region read replica. If needed, promote and recover the replica to the desired point in time.. Cloud SQL point-in-time recovery (PITR) allows recovery to any second within the backup retention period. For regional disaster recovery, you need cross-region replicas. Enabling PITR on the primary and creating a cross-region replica (which also supports PITR) allows you to recover the replica to a specific point in time. Automated backups alone cannot restore to a specific second.

Answer

Enable automated backups and transaction log retention for 7 days. Restore the backup in a new instance in a different region.

Answer

Use Cloud SQL's built-in replication to create a cross-region replica, and enable failover. Failover automatically recovers to the latest transaction.

Answer

Export the database daily using gcloud sql export and store in Cloud Storage with versioning.

Question 5

A developer needs to view the last 100 lines of logs from a specific Compute Engine instance in real time to debug an application issue. Which command should they use?

Accepted Answer

gcloud logging read "resource.type=gce_instance AND resource.labels.instance_id=INSTANCE_ID" --limit=100 --freshness=1h. The gcloud logging read command can filter logs and tail them with the --freshness flag. gcloud compute instances get-serial-port-output retrieves serial console output, not application logs. gcloud app logs read is for App Engine. gcloud beta logging tail streams logs in real time.

Answer

gcloud beta logging tail

Answer

gcloud app logs read --limit=100

Answer

gcloud compute instances get-serial-port-output INSTANCE_NAME

Question 6

Your company runs a multi-region Cloud Spanner instance for a global financial application. The SLA requirement is 99.999% availability. You need to ensure that the database remains available during a regional outage. What configuration should you use?

Accepted Answer

Use a multi-region configuration (e.g., nam3) with automatic replication across multiple regions.. Cloud Spanner multi-region configurations (e.g., nam3, eur3) automatically replicate data across regions within a continent. They provide 99.999% availability SLA. A single-region configuration offers 99.99% SLA. Read replicas (as in Cloud SQL) are not a concept in Spanner. Multi-region configs use multiple read-write regions.

Answer

Use a dual-region configuration with two regions but only one for writes.

Answer

Use a single-region configuration with a read replica in another region.

Answer

Configure a single-region instance and create periodic backups to restore in another region.

Question 7

Your organization uses Cloud Logging to collect logs from all GCP projects. The security team wants to be alerted when a specific IAM policy change (e.g., granting roles/compute.admin to a user) occurs in any project. They need near real-time notification via email and a ticketing system. What should you do?

Accepted Answer

Create a log-based alert in Cloud Logging with a filter for SetIamPolicy and configure a Pub/Sub notification channel. Use a Cloud Function subscribed to that topic to create a ticket in the ticketing system.. Log-based alerts in Cloud Logging can monitor logs for a specific filter (e.g., protoPayload.methodName=SetIamPolicy) and send notifications to multiple channels (email, Pub/Sub). Pub/Sub can then trigger a Cloud Function to create a ticket. Alerting policies can also use log-based metrics. Cloud Audit Logs logs IAM changes. The correct approach is to create a log-based alert with a Pub/Sub notification channel.

Answer

Use Cloud Asset Inventory to monitor IAM policy changes and set up a notification to Pub/Sub.

Answer

Export all logs to BigQuery and run a scheduled query every hour to detect changes. If found, send an email using Cloud Scheduler.

Answer

Create a Cloud Monitoring alert policy based on a metric from the Cloud Audit Logs, with email and SMS notifications.

Question 8

A company wants to perform load testing on a new microservice deployed on GKE. They need to simulate thousands of concurrent users with realistic traffic patterns. They also want to monitor latency and error rates during the test. Which Google Cloud tool should they use?

Accepted Answer

Cloud Load Testing. Cloud Load Testing (formerly known as Cloud Load Testing) is a managed service for creating load tests with distributed agents. It can simulate thousands of users and integrates with Cloud Monitoring. Locust is an open-source tool but not managed by GCP. Cloud Deploy is for continuous delivery. Cloud Shell is a command-line environment.

Answer

Locust

Answer

Cloud Deploy

Answer

Cloud Shell

Question 9

You need to automatically roll back a GKE deployment if a new version causes a spike in 5xx errors. The deployment uses a canary strategy with Istio traffic splitting. What should you do?

Accepted Answer

Use Cloud Monitoring to watch the canary's error rate and trigger a Cloud Function that updates the Istio VirtualService to route all traffic back to the stable version.. Istio allows traffic splitting between versions. By integrating with Cloud Monitoring, you can create an alert that triggers a rollback via a Cloud Function or through a CI/CD pipeline that monitors the canary's error rate. Istio itself does not have built-in rollback; you need external automation. Cloud Deploy can manage canary with automatic rollback, but the question mentions Istio traffic splitting, so a combination of monitoring and automation is needed.

Answer

Set the canary's traffic weight to 0 in the Istio VirtualService if errors exceed threshold using a Kubernetes Job.

Answer

Use GKE's built-in auto-repair feature to replace unhealthy pods.

Answer

Configure an Istio VirtualService with a retry policy that automatically redirects traffic on errors.

Question 10

Your company runs a stateful application on GKE that stores data in persistent volumes backed by Compute Engine persistent disks. You need to back up the application data and the Kubernetes resource configurations (deployments, services, etc.) for disaster recovery. Which tool should you use?

Accepted Answer

Velero. Velero (formerly Heptio Ark) is an open-source tool for backing up and restoring Kubernetes cluster resources and persistent volumes. It supports GCP as a storage destination (Cloud Storage). Cloud Storage versioning can back up files but not Kubernetes resources. gcloud container clusters create does not back up. Cloud SQL is for relational databases.

Answer

gcloud container clusters create --async

Answer

Cloud SQL for MySQL

Answer

Cloud Storage with object versioning and lifecycle policies

Question 11

An e-commerce platform uses Cloud Spanner for order processing. The operations team notices that a recent schema change caused a spike in latency. They need to quickly revert to the previous schema without losing any data. What is the fastest way to achieve this?

Accepted Answer

Restore the database from a backup taken before the schema change, using point-in-time recovery.. Cloud Spanner does not support automatic schema rollback. The best approach is to use database migration tools like Skipper or use versioned migrations. However, Spanner supports creating a new table with the old schema and copying data. The fastest way to revert a schema change is to restore from a backup that was taken before the change. Cloud Spanner supports point-in-time recovery (PITR) within the retention period (7 days). If a backup exists, restore it to a new database and redirect traffic. Rolling back via DDL statements is possible but may be complex if data has been added or altered.

Answer

Manually write DDL statements to revert the schema, and use a script to fix any data inconsistencies.

Answer

Export the database, drop and recreate the database with the old schema, and import the data.

Answer

Use Cloud Spanner's built-in DDL rollback feature to revert the schema change.

Question 12

Your company uses HA VPN to connect on-premises to Google Cloud. You need to ensure the VPN connection meets a 99.99% SLA. Which configuration is required?

Accepted Answer

Two Cloud VPN gateways in different regions, each with two tunnels to the same on-premises peer gateway.. HA VPN provides 99.99% SLA when configured with two Cloud VPN gateways (one per region) and two tunnels per gateway (four tunnels total) from each gateway to the on-premises peer gateway. Each gateway uses a different external IP. A single VPN gateway with two tunnels does not meet the SLA requirement because the gateway itself is a single point of failure.

Answer

A single Cloud VPN gateway with two tunnels to the same on-premises peer gateway.

Answer

Two Cloud VPN gateways in the same region, each with one tunnel.

Answer

One Cloud VPN gateway with four tunnels to the same on-premises peer gateway.

Question 13

Your company uses Cloud Storage to store critical documents. You need to prevent accidental deletion or modification of objects for a retention period of 5 years. Which TWO features should you use?

Accepted Answer

Object versioning. Object versioning preserves previous versions of objects, allowing recovery from accidental deletion or overwrite. Retention policies (bucket-level) enforce a minimum retention period for all objects. Bucket Lock makes the retention policy immutable. Object holds are per-object and can be removed. Lifecycle policies manage object transitions/deletion, not retention enforcement.

Answer

Object hold

Answer

Requester pays

Answer

Lifecycle rule to delete objects older than 5 years

Question 14

Your organization runs a microservices application on GKE Autopilot. You want to implement a gradual rollout of a new version with the ability to compare performance metrics between the old and new versions. Which TWO approaches should you combine?

Accepted Answer

Configure A/B testing with Traffic Director by routing based on request headers.. A canary deployment gradually shifts traffic to the new version. Traffic Director provides service mesh capabilities including traffic splitting and metrics. Istio can also be used. A/B testing requires routing rules based on headers or other criteria; Traffic Director can do this. Cloud Deploy supports canary but does not handle A/B testing natively. The combination of canary deployment (via Traffic Director) and A/B testing (with Traffic Director's routing rules) allows gradual rollout and comparison.

Answer

Use Cloud Deploy's rollout strategy with a canary phase.

Answer

Use Cloud Load Balancing to gradually shift traffic from old to new version.

Answer

Use GKE blue-green deployment and manually compare metrics.

Question 15

You need to set up monitoring and alerting for a critical service that must maintain an error rate below 0.1%. You want to be notified if the error rate exceeds this threshold over a 5-minute window. Which THREE components should you configure?

Accepted Answer

Service Level Indicator (SLI) based on error rate. A service-level objective (SLO) defines the target (99.9% error-free). A service-level indicator (SLI) measures the actual error rate. An alerting policy triggers when the SLO is breached. Notification channels send alerts. Log-based alerts are for log content, not metrics. The correct combination: SLO, SLI, alerting policy with notification channels.

Answer

Log-based alert with filter for all errors

Answer

Cloud Audit Logs sink to BigQuery