Google PCA Managing and Provisioning a Solution Infrastructure — 15 Questions

Question 1

A team is using Cloud Functions with a Cloud Storage trigger. They notice that sometimes the function does not execute after a file is uploaded. What is the most likely cause?

Accepted Answer

The Cloud Functions region is different from the bucket region. Cloud Functions requires that the function be deployed in the same region as the Cloud Storage bucket for event-driven triggers. If the region of the function differs from the bucket's region, the trigger will not deliver events, causing the function not to execute. This is a common misconfiguration that is often overlooked.

Answer

The function's memory limit is too low

Answer

The Cloud Storage bucket has object versioning enabled which changes event semantics

Answer

The function has too many concurrent invocations

Question 2

You need to collect and analyze logs from multiple projects in a centralized BigQuery dataset for auditing. Which THREE steps are required? (Choose 3)

Accepted Answer

Use an aggregated sink at the organization or folder level to collect logs from all projects. To centralize logs from multiple projects into a single BigQuery dataset for auditing, the required steps are: (1) Use an aggregated sink at the organization or folder level to collect logs from all projects (option B) – this allows a single sink to route logs from all child projects. (2) Grant the Cloud Logging service account the 'bigquery.dataEditor' role on the dataset (option C) to permit writing logs. (3) Create a log exclusion filter to remove sensitive data (option D) – this is necessary for compliance when auditing logs to prevent exporting personally identifiable or confidential information. Per-project sinks (option E) are an alternative to an aggregated sink, not an additional requirement. VPC Flow Logs (option A) are a separate log source and not specifically required for centralizing logs to BigQuery.

Answer

Enable VPC Flow Logs in all projects

Answer

Create a log sink in each project that exports to a shared BigQuery dataset

Question 3

A company has a Shared VPC with a service project hosting GKE clusters. The GKE nodes need to access Cloud SQL instances in the host project. The team wants to avoid public IP and use Private Service Access. They have configured a VPC peering between the host VPC and the service producer VPC for Cloud SQL. However, the GKE pods cannot reach the Cloud SQL instance. What is the most likely cause?

Accepted Answer

The service project is not authorized in the Cloud SQL instance. The most likely cause is that the service project is not authorized in the Cloud SQL instance. After configuring Private Service Access (VPC peering) between the host VPC and the service producer VPC, you must explicitly authorize the service project's VPC network in the Cloud SQL instance's private network configuration. Without this authorization, connection attempts from GKE pods will fail. Option B is incorrect because Private Service Connect is not required; VPC peering is sufficient for connectivity once authorization is granted. Option A is incorrect because the Cloud SQL instance is configured with a private IP via Private Service Access. Option D is incorrect because firewall rules in the host VPC do not block traffic over VPC peering by default; the issue is authorization, not firewall rules.

Answer

The Cloud SQL instance is not configured with a private IP

Answer

The service project needs a Private Service Connect endpoint to access the Cloud SQL instance

Answer

The firewall rules in the host VPC block egress from the service project

Question 4

An engineer needs to provision a GKE cluster with a node pool that uses preemptible VMs to reduce costs. Which gcloud command should they use?

Accepted Answer

gcloud container node-pools create --preemptible. The --preemptible flag when creating a node pool makes all nodes in that pool preemptible. The other options either don't exist or are incorrect.

Answer

gcloud container clusters update --preemptible

Answer

gcloud container clusters create --preemptible-nodes

Answer

gcloud compute instances create --preemptible

Question 5

A company uses Cloud Deployment Manager to manage infrastructure. They want to roll back to a previous deployment state after a failed update. What is the recommended approach?

Accepted Answer

Run gcloud deployment-manager deployments update --config <previous_manifest>. Deployment Manager stores the deployment manifests. You can use an update with a previous manifest to revert to a known good state. Deleting and recreating is not a rollback. Partial updates are not supported directly.

Answer

Use gcloud deployment-manager deployments rollback --deployment <name>

Answer

Use the --update-policy=PARTIAL flag to selectively revert changes

Answer

Delete the deployment and recreate it from the previous template

Question 6

A team wants to enforce that only container images signed by their CI/CD system can be deployed to GKE. They have enabled Binary Authorization with a policy that requires an attestor. What additional step must they take to bind the attestor to the image signing process?

Accepted Answer

Create a Container Analysis note and grant the attestor service account the containeranalysis.notes.attacher role. After creating the attestor, you must create an AttestationAuthority note in Container Analysis and grant the attestor service account permission to bind attestations. Configuring Cloud Build to sign images is part of the process but not the binding step.

Answer

Add the attestor to the Binary Authorization policy as a required attestor

Answer

Create a Cloud Build step that signs the image and stores the signature in Cloud Storage

Answer

Configure the GKE cluster to require Binary Authorization with the --no-enforce flag

Question 7

An organization has multiple GCP projects managed by a central operations team. They want to define a common VPC configuration in a host project and allow service projects to use it. Which networking feature should they use?

Accepted Answer

Shared VPC. Shared VPC allows a host project to contain shared VPC networks that service projects can use. VPC peering is for connecting separate networks. Private Service Connect is for accessing managed services. Cloud VPN is for on-premises connectivity.

Answer

Private Service Connect

Answer

Cloud VPN

Answer

VPC peering

Question 8

A Cloud Run service needs to connect to a Cloud SQL MySQL instance privately without using public IP. What must be configured?

Accepted Answer

Deploy a VPC connector and attach it to the Cloud Run service. To privately connect Cloud Run to Cloud SQL, you need a Serverless VPC Access connector in the same VPC as the Cloud SQL instance, and then use the private IP of Cloud SQL. Private Google Access is for on-prem, not Cloud Run. Direct VPC is not available for Cloud Run.

Answer

Set up VPC Network Peering between Cloud Run and Cloud SQL

Answer

Enable Private Google Access on the VPC subnet

Answer

Use Cloud SQL Proxy as a sidecar container

Question 9

Which GCP service should be used to automatically scale a GKE cluster's number of nodes based on pending pods?

Accepted Answer

Cluster Autoscaler. The cluster autoscaler adjusts the number of nodes in node pools based on pod resource requests. HPA scales pods, not nodes. VPA adjusts pod resource requests. Node auto-provisioning is part of cluster autoscaler but the described functionality is cluster autoscaler.

Answer

Vertical Pod Autoscaler (VPA)

Answer

Node Auto-Provisioning

Answer

Horizontal Pod Autoscaler (HPA)

Question 10

An engineer is troubleshooting a Cloud Build trigger that fails with the error 'PERMISSION_DENIED: Cloud Build service account does not have permission to access Artifact Registry'. The build needs to push a Docker image to Artifact Registry. What is the correct IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/artifactregistry.writer. The Cloud Build service account (usually project-number@cloudbuild.gserviceaccount.com) needs the Artifact Registry Writer role to push images. Editor role is too broad; Viewer is read-only; Storage Object Admin is for Cloud Storage, not Artifact Registry.

Answer

roles/artifactregistry.viewer

Answer

roles/editor

Answer

roles/storage.objectAdmin

Question 11

Which GCP service provides distributed tracing to help analyze latency in microservices applications?

Accepted Answer

Cloud Trace. Cloud Trace collects latency data from applications and provides near-real-time traces. Cloud Profiler provides continuous profiling. Cloud Monitoring provides metrics and dashboards. Cloud Logging provides log management.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 12

A developer wants to deploy a Cloud Function that is triggered whenever a new object is created in a Cloud Storage bucket. Which trigger type should they choose?

Accepted Answer

Cloud Storage trigger. Cloud Functions can be triggered by Cloud Storage events such as google.storage.object.finalize (object creation). HTTP triggers are for HTTP requests. Pub/Sub triggers for messages. Firestore triggers for document changes.

Answer

Firestore trigger

Answer

Pub/Sub trigger

Answer

HTTP trigger

Question 13

An organization wants to ensure that all VMs in a project have the 'restricted-vm' tag to apply a firewall rule that allows only SSH from a bastion host. The VMs are created by multiple teams. Which approach ensures the tag is automatically applied to all new VMs?

Accepted Answer

Create a Cloud Function that listens to Compute Engine audit logs and adds the tag to new instances. OS Config can enforce OS policies, but tagging is done via instance templates or organization policies. Using a custom image with the tag is not automatic. A pre-create Cloud Function can detect VM creation and add the tag. Org policies cannot enforce tags directly.

Answer

Use a custom image that includes the tag in the instance metadata

Answer

Use an organization policy to require the tag

Answer

Configure OS Config with a software recipe to add the tag

Question 14

A company runs a stateful workload on GKE that requires at most one pod per node. They want to survive a zonal failure with minimal downtime. The application can be restarted on a new node. Which configuration should they use?

Accepted Answer

Use a StatefulSet with pod anti-affinity required and a regional cluster. A StatefulSet with pod anti-affinity required ensures one pod per node. A regional cluster with nodes in multiple zones allows rescheduling in another zone. A single-zone cluster would not survive a zonal failure. PDB limits disruption but does not handle zone failure.

Answer

Use a Deployment with a PodDisruptionBudget set to maxUnavailable=0

Answer

Deploy a Deployment with a nodeSelector for one zone

Answer

Use a DaemonSet with node affinity

Question 15

An engineer wants to store a database password securely and allow a Cloud Run service to access it. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets like passwords, API keys, and certificates. It integrates with Cloud Run via volume mounts or environment variables. Cloud KMS is for encryption keys. Cloud Storage is for objects. Firestore is a database.

Answer

Cloud Storage

Answer

Cloud Key Management Service (KMS)

Answer

Firestore