Google PCA Managing Implementation and Ensuring Solution and Operations Reliability Practice Test 8 — 15 Questions

Question 1

A company wants to set up monitoring and alerting for their application running on GKE. They need to receive alerts via email and also trigger an automated remediation workflow. Which TWO components should they use? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Notification channels (email). Option A, Notification channels (email), is correct because in Cloud Monitoring a notification channel defines the destination and delivery mechanism for alerts, and an email-type channel is exactly what is needed to receive alert notifications via email. Option B, Alerting policies, is correct because alerting policies define the conditions (metrics, thresholds, filters) that determine when an alert fires and which notification channels are used, making them the core component for monitoring and alerting on the GKE application. Together, an alerting policy detects the condition and routes it to the email notification channel, satisfying the email alerting requirement. Option C, Cloud Shell, is just an interactive command-line environment and provides no monitoring or alerting capability. Option D, Cloud Logging, stores and queries logs but does not itself define alert conditions or deliver email notifications. Option E, Pub/Sub, can be used as a notification channel for automation, but it is not required to receive email alerts and is not one of the two components needed for the stated email alerting requirement.

Answer

Cloud Shell

Answer

Cloud Logging

Answer

Pub/Sub

Question 2

A company uses Cloud SQL for MySQL for its transactional database. They need to ensure automatic failover in case of a zonal outage with minimal data loss. What configuration should they use?

Question 3

An e-commerce platform uses Cloud Spanner in a multi-region configuration. They want to achieve the highest possible availability SLA. Which deployment configuration should they choose?

Question 4

An engineer needs to view the logs of a specific Compute Engine instance in near real-time from the command line. Which gcloud command should they use?

Question 5

A team needs to set up alerting for a production service. They want to receive notifications when the 99th percentile latency exceeds 500ms for 5 minutes. Which two Cloud Monitoring components are required? (Choose two.)

Question 6

A company wants to connect their on-premises network to Google Cloud with a 99.99% SLA using encrypted tunnels over the public internet. Which connectivity solution should they choose?

Accepted Answer

HA VPN. HA VPN provides a 99.99% SLA when configured with two VPN gateways and four tunnels over the public internet. Dedicated Interconnect is a private connection with higher bandwidth but not over the public internet. Partner Interconnect uses a partner's network, not the public internet. Standard VPN does not offer a 99.99% SLA.

Answer

Standard VPN with single tunnel

Answer

Partner Interconnect

Answer

Dedicated Interconnect

Question 7

Your organization runs a production Cloud SQL for PostgreSQL instance. You need to ensure that if the primary zone fails, the database automatically fails over to a standby with no data loss. Which configuration should you use?

Accepted Answer

Deploy a regional Cloud SQL instance with high availability. A regional Cloud SQL instance with high availability provisions a standby in a different zone within the same region and performs automatic failover via a regional persistent disk, with synchronous replication ensuring zero data loss (RPO ≈ 0). This is the only option that combines automatic failover with no data loss for a single-region production database.

Answer

Enable point-in-time recovery (PITR)

Answer

Configure a cross-region replica

Answer

Create a read replica and promote it on failure

Question 8

Your company runs a production microservices application on GKE Standard. The operations team wants to be notified when any pod in the cluster is repeatedly restarting, indicating a potential CrashLoopBackOff. They want to use Cloud Monitoring to create an alert that fires when a container restarts more than 5 times in a 10-minute window. Which metric should they use as the basis for the alerting policy?

Accepted Answer

kubernetes.io/container/restart_count. The kubernetes.io/container/restart_count metric directly tracks container restarts and is the correct choice for alerting on repeated restarts. It is a cumulative counter, so you must apply a rate or delta alignment to detect increases over time. Other metrics like CPU usage or pod status do not provide restart counts, and log-based metrics require extra setup and may be less reliable.

Answer

kubernetes.io/container/cpu/core_usage_time

Answer

kubernetes.io/pod/status

Answer

logging.googleapis.com/user/restart_count

Question 9

Your organization runs a global e-commerce platform on Google Kubernetes Engine (GKE). The security team requires that all container images deployed to the cluster are scanned for vulnerabilities and that deployments are blocked if critical vulnerabilities are found. They also want to minimize operational overhead. What should you do?

Accepted Answer

Enable Binary Authorization in the cluster and configure a policy that requires attestations from a vulnerability scanner before deployment.. Binary Authorization is a Google Cloud service that enforces deploy-time policies by requiring attestations. By integrating with Container Analysis, you can automatically attest only images that pass vulnerability scanning, and the policy blocks images without attestations. This automates enforcement and reduces manual review, satisfying both security and operational efficiency.

Answer

Configure a Kubernetes admission controller that calls the Container Analysis API to check for vulnerabilities and rejects pods with critical findings.

Answer

Enable Pod Security Policies to restrict images to those from trusted registries, and rely on registry scanning to prevent vulnerable images.

Answer

Use Cloud Build to scan images with Container Analysis, and manually review the scan results before approving each deployment.

Question 10

Your team is deploying a new version of a microservices application on Google Kubernetes Engine (GKE). You want to gradually shift traffic to the new version while monitoring key performance indicators (KPIs) such as error rate and latency. If KPIs degrade, you need to automatically roll back. Which approach should you use?

Accepted Answer

Implement a canary deployment using Istio with Flagger, which automates traffic shifting and rollback based on Prometheus metrics.. Flagger with Istio automates canary deployments by incrementally shifting traffic, analyzing Prometheus metrics, and rolling back automatically if KPIs degrade. This provides safe, gradual rollout with minimal manual intervention. Other options either lack automation, do not support gradual traffic shifting, or require manual monitoring.

Answer

Use GKE rolling updates with maxSurge and maxUnavailable set to 25%, and monitor KPIs manually.

Answer

Configure a GKE Ingress with two backends and use traffic splitting based on weights, then manually adjust weights based on monitoring.

Answer

Use Blue/Green deployment by creating a second deployment and switching the Service selector to the new version after manual testing.

Question 11

Your team runs a stateful analytics workload on a Managed Instance Group (MIG) of Compute Engine VMs. The VMs write intermediate results to local SSD scratch disks. During a recent incident, an autoscaling event terminated VMs and the intermediate data was lost, causing hours of recomputation. You need to change the deployment so that when a VM is terminated by the autoscaler, a shutdown script has enough time to flush the intermediate results to a Cloud Storage bucket before the VM is deleted. What should you do?

Accepted Answer

Configure the instance template with a shutdown script and set the instance's shutdown duration metadata key to a value that gives the script enough time to flush data.. The shutdown duration metadata key is the supported mechanism to extend the STOPPING state so a shutdown script can finish. Because the MIG creates instances from the instance template, placing the key in the template guarantees that autoscaler-created VMs inherit the behavior. Autoscaler tuning and disk-type changes do not bound the time between the shutdown signal and instance deletion.

Answer

Replace the local SSD scratch disks with Persistent Disk volumes and rely on the autoscaler to detach them before deleting the VM.

Answer

Enable live migration on the MIG and set the autoscaler to scale in only during off-peak hours.

Answer

Set the MIG autoscaler's scale-in control to a longer cool-down period, and increase the instance template's minimum CPU utilization target.

Question 12

Your company has a Service Level Objective (SLO) of 99.9% availability for a web application running on Google Cloud. You want to create an alert that notifies the on-call team when the error budget is being consumed too quickly. Which Google Cloud service should you use?

Accepted Answer

Cloud Monitoring with an SLO and a burn rate alert.. Cloud Monitoring supports defining SLOs and creating burn rate alerts. Burn rate alerts fire when the rate of error budget consumption is too high, helping teams respond before the budget is exhausted. This is the native, recommended way to alert on SLO violations.

Answer

Cloud Logging with a log-based metric and an alerting policy.

Answer

Cloud Monitoring with an alerting policy based on a metric threshold for error rate.

Answer

Cloud Trace with latency thresholds and alerts.

Question 13

Your organization operates a multi-project Google Cloud environment. A security team requires that any new Compute Engine instance created in the production folder must have OS Login enabled and must not use project-wide SSH keys. You want to enforce this centrally with the least operational overhead and ensure that non-compliant creation attempts are denied. What should you do?

Accepted Answer

Create an Organization Policy constraint for compute.requireOsLogin and compute.disableProjectSshKeys, and apply them at the production folder.. Organization Policy constraints applied at the folder level enforce configuration rules across all descendant projects. compute.requireOsLogin forces OS Login for instances, and compute.disableProjectSshKeys blocks adding project-wide SSH keys. Applying both at the production folder denies non-compliant creation centrally with minimal operational overhead, unlike audits or IAM restrictions that do not enforce the desired configuration.

Answer

Create an Organization Policy constraint for compute.requireOsLogin and compute.skipDefaultNetworkCreation, and apply it at the production folder.

Answer

Apply a custom IAM deny policy on compute.instances.create for all principals except the security team, and require them to create instances on behalf of others.

Answer

Grant the security team the Compute Security Admin role and schedule a Cloud Scheduler job that audits instances with project-wide SSH keys.

Question 14

Your organization runs a critical application on Google Cloud that uses Cloud SQL for PostgreSQL. The database is in us-central1. The business requires a recovery point objective (RPO) of 5 minutes and a recovery time objective (RTO) of 1 hour in case of a regional failure. What should you do?

Accepted Answer

Configure a cross-region read replica and promote it in case of regional failure.. A cross-region read replica asynchronously replicates data to a different region. In a regional failure, promoting the replica provides a recovery point close to the failure time (RPO within minutes) and can be done quickly (RTO under 1 hour). This is the standard solution for regional DR with Cloud SQL.

Answer

Use Cloud SQL point-in-time recovery (PITR) to restore to a specific time in another region.

Answer

Enable high availability (HA) for the Cloud SQL instance, which provides a standby in another zone.

Answer

Export the database to Cloud Storage every 5 minutes and import it into a new instance in another region during a disaster.

Question 15

Your team manages a production web application on Compute Engine behind an external Application Load Balancer. During a recent incident, the load balancer's backend service marked all instances as unhealthy because the health check endpoint returned HTTP 200 but the application was actually in a degraded state. You need Cloud Monitoring to alert the operations team when the application's error rate exceeds 5% over a 5-minute window. You also need to ensure that the alert does not fire during planned maintenance windows. Which approach should you take?

Accepted Answer

Create a log-based metric that counts HTTP 5xx responses from the load balancer logs, then create an alerting policy on that metric with a threshold of 5% error rate and configure a maintenance window for planned downtime.. The requirement is to alert on application error rate exceeding 5% over 5 minutes, with suppression during maintenance. A log-based metric from load balancer logs captures every request's status, enabling an accurate error rate calculation. Alerting policies on such metrics support threshold conditions and maintenance windows. The other options either alter health checks in a harmful way, rely on uptime checks that miss application-level errors, or use sampled trace data that is not representative.

Answer

Use Cloud Trace to sample requests and create an alerting policy based on the latency of traces that return errors, triggering when error traces exceed 5% of total traces.

Answer

Create an uptime check that sends HTTP requests to the application's health endpoint every minute and alerts when the check fails from more than one region.

Answer

Configure a custom health check on the load balancer that returns HTTP 500 when the application is degraded, and create an alerting policy on the backend service's unhealthy instance count.