Google PCA Managing Implementation and Ensuring Solution and Operations Reliability Practice Test 9 — 15 Questions

Question 1

A retail company runs an e-commerce platform on GKE. The SRE team wants to measure the error budget for a service level objective (SLO) defined as the proportion of requests served with HTTP 2xx or 3xx status over a 28-day window. They need a monitoring configuration that computes the burn rate and alerts when the budget is being consumed too quickly, while avoiding noisy alerts during brief spikes. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud Monitoring SLO monitoring to define the request-based SLO, then create a multi-window, multi-burn-rate alerting policy on that SLO.. Cloud Monitoring SLO monitoring natively models request-based SLOs, tracks error budgets, and supports burn-rate alerting. Multi-window, multi-burn-rate policies combine a short window for fast detection with a longer window for confirmation, which filters out brief spikes. This is the supported, least-effort way to alert on rapid budget consumption for a 28-day SLO.

Answer

Create an alerting policy on a log-based metric that counts 5xx responses and alert when the count exceeds a static threshold.

Answer

Export request metrics to BigQuery and run a scheduled query that emails the team when the 28-day success ratio drops below the target.

Answer

Create a Cloud Monitoring uptime check on the service endpoint and alert when two consecutive checks fail.

Question 2

A startup deploys a containerized web application on Cloud Run. They want to release a new revision to a small percentage of users before promoting it to all traffic, and they need the ability to roll back instantly if errors increase. Which Cloud Run feature should they use?

Accepted Answer

Deploy the new revision with --no-traffic, then use traffic splitting to send a percentage of requests to it, and adjust or roll back by changing the traffic allocation.. Cloud Run revisions are immutable and traffic can be split by percentage across them. Deploying with no traffic, then assigning a small percentage, implements a canary, and setting the previous revision to 100 percent rolls back instantly. This built-in capability avoids external load balancers or delivery pipelines for a straightforward canary and rollback.

Answer

Use Cloud Deploy with a canary deployment strategy targeting the Cloud Run service and rely on its automatic rollback on failure.

Answer

Enable session affinity on the Cloud Run service and deploy the new revision so existing sessions stay on the old revision.

Answer

Create a second Cloud Run service for the new version and use a global external HTTP(S) load balancer with weighted backends to split traffic.

Question 3

Your team operates a production e-commerce application on a managed instance group (MIG) that serves traffic through a global external Application Load Balancer. During a new release, the team wants to deploy the new version to a small subset of instances and then progressively increase traffic to it while monitoring error rates, with the ability to immediately roll back if errors spike. The new version is already built as a custom image. Which approach should you use?

Accepted Answer

Create a second MIG with the new image, add it as a backend to the existing backend service with a small capacity, and gradually shift traffic between the two MIGs using weighted traffic distribution in the backend service.. The requirement is a controlled canary with progressive traffic shifting and fast rollback. Weighted traffic distribution on a backend service allows two MIGs, each running a different image, to receive defined percentages of live traffic. You can start small, watch error rates, increase the weight, and set it back to zero if problems appear. Other approaches either replace instances in place or rely on DNS, which lacks the precision and quick reversibility needed.

Answer

Create a new global external Application Load Balancer with a separate backend service pointing only to the new image, and use Cloud DNS weighted routing to send 10% of users to the new load balancer.

Answer

Perform an in-place update of the MIG template to the new image with a very small maxUnavailable, and rely on the load balancer health checks to remove unhealthy instances automatically.

Answer

Use a rolling update with maxSurge and maxUnavailable set to 50% so that half the instances are replaced at once, then wait for health checks to pass before continuing.

Question 4

A financial services company runs a latency-sensitive trading application on Compute Engine. The operations team needs to detect performance regressions and correlate them with recent deployments without instrumenting application code. They want to use Cloud Monitoring and Cloud Logging features that work automatically for Compute Engine VMs. (Choose two.)

Accepted Answer

Create log-based metrics in Cloud Logging from VM logs and chart them alongside metrics in Cloud Monitoring dashboards.. The Ops Agent provides automatic host metrics and log collection for Compute Engine, and log-based metrics let those logs be charted and alerted in Cloud Monitoring. Together they deliver the telemetry to detect performance regressions and correlate them with deployments without touching application code. Tracing, profiling, and audit logs either require code changes or capture different data than runtime performance.

Answer

Install the Cloud Profiler agent on each VM to capture CPU and memory profiles of the application.

Answer

Enable Data Access audit logs for Compute Engine and analyze them to identify slow API calls.

Answer

Enable Cloud Trace auto-instrumentation by setting the GOOGLE_CLOUD_TRACE environment variable on each VM.

Question 5

A financial services company runs a payment API on Compute Engine behind an internal passthrough Network Load Balancer. The compliance team requires that all administrative actions on the project be attributable to a named human, that production changes be reviewed before taking effect, and that no single engineer can delete the production database. Which combination of Google Cloud controls should the cloud architect implement?

Accepted Answer

Assign least-privilege predefined roles to engineers, require all production changes to go through a CI/CD pipeline that uses a dedicated service account in a separate project, and protect the production database with a resource-level deny policy and separation of duties.. The compliance demands map to preventive controls: least privilege to limit permissions, a reviewed CI/CD pipeline with a dedicated service account in a separate project to enforce change review and attribution, and a resource-level deny policy plus separation of duties to stop any one engineer from deleting the production database. Detective measures like audit logging and alerting are useful but insufficient on their own. The combination of IAM restrictions, automation, and deny policies satisfies all three requirements.

Answer

Require all engineers to use hardware security keys for two-factor authentication, enable Identity-Aware Proxy for SSH access to instances, and create an alerting policy that notifies the security team when the database is deleted.

Answer

Grant the Project Owner role to all senior engineers, enable Cloud Audit Logs for Admin Activity, and require them to use a shared break-glass account for emergency changes.

Answer

Enable VPC Service Controls around the production project, grant engineers the Editor role, and configure Cloud Logging sinks to export audit logs to a separate project for long-term retention.

Question 6

Your organization requires that all production changes to Google Cloud resources be auditable and that you can identify who made a change and when. You need to configure logging to meet this requirement. What should you do?

Accepted Answer

Enable Admin Activity audit logs, which are enabled by default, and export them to a centralized logging project or Cloud Storage bucket with retention policies.. Admin Activity audit logs are enabled by default and record administrative changes, including the identity of the caller and the timestamp. Exporting these logs to a centralized project or Cloud Storage with retention policies ensures they are preserved for auditing. This satisfies the requirement to audit production changes.

Answer

Configure VPC Flow Logs to capture network traffic and analyze it for unauthorized changes.

Answer

Enable Data Access audit logs for all services and export them to Cloud Storage for long-term retention.

Answer

Use Cloud Monitoring to create alerting policies for resource changes and send notifications to a team email.

Question 7

A media company runs a video transcoding service on GKE Standard. The service experiences sudden traffic spikes, and the operations team wants to ensure that the cluster can scale nodes automatically and that pods are rescheduled quickly when a node fails. The team also wants to monitor and alert on resource saturation. Which two actions should the cloud architect take to meet these requirements? (Choose two.)

Accepted Answer

Enable cluster autoscaler on the node pools and set appropriate minimum and maximum node counts based on expected peak load.. Automatic node scaling requires cluster autoscaler on the node pools, and it works correctly only when pods declare accurate resource requests and limits so the scheduler and autoscaler can size capacity. Together these ensure nodes are added during spikes and pods are placed and rescheduled efficiently. Pod disruption budgets, Cloud CDN, and HorizontalPodAutoscaler address different concerns and do not provide node-level scaling or rapid recovery from node failure.

Answer

Create a HorizontalPodAutoscaler based on CPU utilization for the transcoding deployment to add more pods when demand increases.

Answer

Enable Cloud CDN in front of the transcoding service to cache video segments and reduce load on the GKE pods.

Answer

Configure pod disruption budgets for the transcoding deployment to guarantee a minimum number of available pods during voluntary disruptions.

Question 8

Your company runs a stateful application on Compute Engine instances in a managed instance group (MIG). The application writes data to a persistent disk attached to each instance. You need to ensure that the application can automatically recover from a zone failure by recreating instances in another zone with their persistent disks. You also want to minimize data loss. Which configuration should you implement?

Accepted Answer

Create a regional MIG with instances distributed across multiple zones in the region, and configure each instance to use a regional persistent disk that is replicated across those zones.. A regional MIG spreads instances across multiple zones and can automatically recreate instances in healthy zones if one zone fails. Regional persistent disks are replicated across two zones, ensuring that data is available in another zone with minimal loss. Together, they provide automatic recovery and data redundancy. Zonal MIGs cannot move instances across zones, and standard persistent disks are not replicated.

Answer

Create a zonal MIG in a single zone and use a snapshot schedule to back up persistent disks every hour to a multi-region bucket. In case of zone failure, manually restore the snapshots to new instances in another zone.

Answer

Create a regional MIG and attach a standard persistent disk to each instance. Configure the MIG to recreate instances in other zones, and rely on the persistent disk's automatic replication across zones.

Answer

Create a zonal MIG and configure an autoscaler to add instances in other zones when the primary zone fails. Use a Cloud Storage bucket to store application data instead of persistent disks.

Question 9

A healthcare company runs a critical application on Google Kubernetes Engine (GKE) that processes patient data. The compliance team requires that all container images be scanned for vulnerabilities before deployment, and that only images from a trusted registry be allowed. The security team wants to enforce this policy across all clusters in the organization. They also need to audit any attempts to deploy untrusted images. Which combination of Google Cloud services should they use?

Accepted Answer

Use Binary Authorization with a policy that requires attestations from a trusted authority, and enable audit logging for GKE.. Binary Authorization is the Google Cloud service designed to enforce deploy-time policies on GKE by requiring attestations. By setting a policy that requires attestations from a trusted authority, the company ensures that only images that have been built and scanned by trusted processes are admitted. Enabling audit logging provides a record of all deployment attempts, including those that violate the policy. This satisfies both the enforcement and auditing requirements across all clusters in the organization.

Answer

Enable GKE Sandbox on all nodes and use Anthos Config Management to apply a policy that restricts image registries.

Answer

Use Container Analysis to scan images and configure a GKE admission controller to reject images with vulnerabilities.

Answer

Use Artifact Registry with vulnerability scanning enabled and configure IAM policies to restrict which projects can pull images.

Question 10

You are responsible for ensuring the reliability of a high-traffic web application running on Google Kubernetes Engine (GKE). You need to implement a monitoring strategy that alerts you when the application's error rate exceeds 1% over a 5-minute window. You want to minimize false positives and ensure alerts are actionable. What should you do?

Accepted Answer

Create a Cloud Monitoring alerting policy based on the HTTP load balancer's 5xx error rate metric, with a threshold of 1% and a duration of 5 minutes.. Using the HTTP(S) load balancer's 5xx error rate metric provides a direct measure of errors as seen by clients. An alerting policy with a 1% threshold over 5 minutes aligns with the requirement. This approach is managed, reliable, and minimizes false positives because it uses a consistent metric from the load balancer, not application logs or internal metrics.

Answer

Configure a log-based metric in Cloud Logging that counts log entries with severity ERROR, and create an alerting policy if the count exceeds a threshold.

Answer

Use Prometheus to scrape application metrics and configure an alert in Prometheus Alertmanager for error rate > 1% over 5 minutes.

Answer

Create an uptime check in Cloud Monitoring that checks the application's health endpoint and alerts if it fails for 5 minutes.

Question 11

A financial services company runs a latency-sensitive trading application on GKE. The platform team must guarantee that the application can be recovered within a 15-minute recovery time objective (RTO) and a 5-minute recovery point objective (RPO) after a regional failure. They use a multi-region Cloud Storage bucket for configuration and a regional GKE cluster. Which additional design element is required to meet both objectives?

Accepted Answer

Deploy a second regional GKE cluster in another region and use a multi-region Cloud Storage bucket for shared configuration, with a documented failover runbook.. Meeting a 15-minute RTO and 5-minute RPO after a regional failure requires compute capacity and configuration data available outside the failed region. A standby GKE cluster in another region supplies the compute, while a multi-region Cloud Storage bucket keeps configuration accessible. A rehearsed failover runbook ensures the team can switch over quickly enough to satisfy the RTO.

Answer

Enable GKE cluster autoscaling and configure a horizontal pod autoscaler for the trading pods.

Answer

Configure the existing regional GKE cluster with a node pool in each of the three zones of its region and enable pod anti-affinity.

Answer

Use Anthos Config Management to sync configurations to the existing cluster and enable Binary Authorization for the trading images.

Question 12

A retail company runs a web application on Compute Engine instances behind an external HTTP(S) load balancer. During a flash sale, the operations team notices that the load balancer is returning HTTP 502 errors for a subset of requests. The backend service health checks are passing, and the instances are not under heavy CPU load. The team wants to identify the root cause quickly and prevent recurrence. Which action should they take first?

Accepted Answer

Review the load balancer's logs in Cloud Logging for HTTP 502 status codes and examine the backend service's health check logs.. The most effective first step is to use Cloud Logging to examine load balancer logs and health check logs. These logs provide detailed information about the 502 errors, including which backend instances are involved and any error messages. By analyzing this data, the team can pinpoint the root cause, such as a misconfigured backend, an application error, or a network issue. Only after identifying the cause should they take corrective action to prevent recurrence.

Answer

Configure a Cloud Armor security policy to block traffic from suspicious IP addresses.

Answer

Enable Cloud CDN on the backend service to cache static content and reduce load on the instances.

Answer

Increase the backend service's timeout setting from 30 seconds to 60 seconds.

Question 13

A startup runs a customer-facing web application on Cloud Run. The operations team needs to know when the service's request latency exceeds a threshold so they can respond before users complain. They want to be notified by email and also want a record of the incident for later review. Which Google Cloud service should they use to define the alerting policy?

Accepted Answer

Cloud Monitoring alerting policies with a notification channel for email.. Cloud Monitoring alerting policies are designed to evaluate metrics like request latency against thresholds and to notify through channels such as email. They also track incidents over time, satisfying the need for both immediate notification and a reviewable record. Log-based alerts, Cloud Trace reports, and traffic splitting serve different purposes and do not provide threshold-based latency alerting with email notification.

Answer

Cloud Trace analysis reports scheduled to run daily and emailed to the operations team.

Answer

Cloud Run revision traffic splitting combined with a health check endpoint that returns an error when latency is high.

Answer

Cloud Logging log-based alerts with a notification channel for email.

Question 14

You are responsible for operations reliability of a production service running on Google Cloud. The service is deployed on GKE and exposes an external HTTPS endpoint through an external Application Load Balancer. You need to implement monitoring that detects when the service is unhealthy from the user's perspective and alerts the on-call team. (Choose two.)

Accepted Answer

Set up an alerting policy on the load balancer's 5xx error rate and on backend latency, with thresholds tied to the service level objective.. Detecting user-facing unhealthiness requires probing the service as users reach it and monitoring the error and latency signals that reflect their experience. An uptime check from multiple locations validates the public endpoint and response content, while alerting on load balancer 5xx rates and backend latency ties detection to SLO thresholds. Together they catch both total outages and degraded performance.

Answer

Create an alerting policy on the Application Load Balancer's request count metric to fire when traffic drops below a static threshold.

Answer

Enable Cloud Trace on the GKE workloads and alert when the number of spans per minute exceeds a fixed value.

Answer

Configure a log-based alert on GKE node system logs for the keyword 'OOMKilled'.

Question 15

A healthcare company runs a critical patient portal on Google Kubernetes Engine. The security team requires that all container images be scanned for vulnerabilities before deployment, that only images from a trusted registry be admitted to the cluster, and that any attempt to deploy an untrusted image be blocked and logged. Which Google Cloud feature should the cloud architect implement to enforce these admission requirements?

Accepted Answer

Binary Authorization with a policy that requires attestations from a trusted vulnerability scanner and allows only images from the approved registry, integrated with GKE admission control.. Binary Authorization is the GKE-native admission control that enforces policies at deploy time using attestations. A policy can require that images be attested by a trusted scanner and originate from an approved registry, and violations are denied and logged. Vulnerability scanning alone detects but does not block, network policies do not govern kubelet image pulls, and sandboxing hardens runtime without validating provenance.

Answer

GKE network policies that restrict egress from the cluster to only the trusted registry, preventing pods from pulling images from unapproved sources.

Answer

GKE Sandbox with gVisor runtime enabled on all node pools to isolate containers and reduce the impact of vulnerable images.

Answer

Artifact Registry vulnerability scanning with automatic scanning enabled on push for all repositories.