Google PCA Managing and Provisioning a Solution Infrastructure — 15 Questions

Question 1

An engineer needs to provision a GKE cluster with a node pool that uses preemptible VMs to reduce costs. Which gcloud command should they use?

Accepted Answer

gcloud container node-pools create --preemptible. The --preemptible flag when creating a node pool makes all nodes in that pool preemptible. The other options either don't exist or are incorrect.

Answer

gcloud container clusters update --preemptible

Answer

gcloud container clusters create --preemptible-nodes

Answer

gcloud compute instances create --preemptible

Question 2

A company uses Cloud Deployment Manager to manage infrastructure. They want to roll back to a previous deployment state after a failed update. What is the recommended approach?

Accepted Answer

Run gcloud deployment-manager deployments update --config <previous_manifest>. Deployment Manager stores the deployment manifests. You can use an update with a previous manifest to revert to a known good state. Deleting and recreating is not a rollback. Partial updates are not supported directly.

Answer

Use gcloud deployment-manager deployments rollback --deployment <name>

Answer

Use the --update-policy=PARTIAL flag to selectively revert changes

Answer

Delete the deployment and recreate it from the previous template

Question 3

A team wants to enforce that only container images signed by their CI/CD system can be deployed to GKE. They have enabled Binary Authorization with a policy that requires an attestor. What additional step must they take to bind the attestor to the image signing process?

Accepted Answer

Create a Container Analysis note and grant the attestor service account the containeranalysis.notes.attacher role. After creating the attestor, you must create an AttestationAuthority note in Container Analysis and grant the attestor service account permission to bind attestations. Configuring Cloud Build to sign images is part of the process but not the binding step.

Answer

Add the attestor to the Binary Authorization policy as a required attestor

Answer

Create a Cloud Build step that signs the image and stores the signature in Cloud Storage

Answer

Configure the GKE cluster to require Binary Authorization with the --no-enforce flag

Question 4

An organization has multiple GCP projects managed by a central operations team. They want to define a common VPC configuration in a host project and allow service projects to use it. Which networking feature should they use?

Accepted Answer

Shared VPC. Shared VPC allows a host project to contain shared VPC networks that service projects can use. VPC peering is for connecting separate networks. Private Service Connect is for accessing managed services. Cloud VPN is for on-premises connectivity.

Answer

Private Service Connect

Answer

Cloud VPN

Answer

VPC peering

Question 5

A Cloud Run service needs to connect to a Cloud SQL MySQL instance privately without using public IP. What must be configured?

Accepted Answer

Deploy a VPC connector and attach it to the Cloud Run service. To privately connect Cloud Run to Cloud SQL, you need a Serverless VPC Access connector in the same VPC as the Cloud SQL instance, and then use the private IP of Cloud SQL. Private Google Access is for on-prem, not Cloud Run. Direct VPC is not available for Cloud Run.

Answer

Set up VPC Network Peering between Cloud Run and Cloud SQL

Answer

Enable Private Google Access on the VPC subnet

Answer

Use Cloud SQL Proxy as a sidecar container

Question 6

Which GCP service should be used to automatically scale a GKE cluster's number of nodes based on pending pods?

Accepted Answer

Cluster Autoscaler. The cluster autoscaler adjusts the number of nodes in node pools based on pod resource requests. HPA scales pods, not nodes. VPA adjusts pod resource requests. Node auto-provisioning is part of cluster autoscaler but the described functionality is cluster autoscaler.

Answer

Vertical Pod Autoscaler (VPA)

Answer

Node Auto-Provisioning

Answer

Horizontal Pod Autoscaler (HPA)

Question 7

An engineer is troubleshooting a Cloud Build trigger that fails with the error 'PERMISSION_DENIED: Cloud Build service account does not have permission to access Artifact Registry'. The build needs to push a Docker image to Artifact Registry. What is the correct IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/artifactregistry.writer. The Cloud Build service account (usually project-number@cloudbuild.gserviceaccount.com) needs the Artifact Registry Writer role to push images. Editor role is too broad; Viewer is read-only; Storage Object Admin is for Cloud Storage, not Artifact Registry.

Answer

roles/artifactregistry.viewer

Answer

roles/editor

Answer

roles/storage.objectAdmin

Question 8

Which GCP service provides distributed tracing to help analyze latency in microservices applications?

Accepted Answer

Cloud Trace. Cloud Trace collects latency data from applications and provides near-real-time traces. Cloud Profiler provides continuous profiling. Cloud Monitoring provides metrics and dashboards. Cloud Logging provides log management.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 9

A developer wants to deploy a Cloud Function that is triggered whenever a new object is created in a Cloud Storage bucket. Which trigger type should they choose?

Accepted Answer

Cloud Storage trigger. Cloud Functions can be triggered by Cloud Storage events such as google.storage.object.finalize (object creation). HTTP triggers are for HTTP requests. Pub/Sub triggers for messages. Firestore triggers for document changes.

Answer

Firestore trigger

Answer

Pub/Sub trigger

Answer

HTTP trigger

Question 10

An organization wants to ensure that all VMs in a project have the 'restricted-vm' tag to apply a firewall rule that allows only SSH from a bastion host. The VMs are created by multiple teams. Which approach ensures the tag is automatically applied to all new VMs?

Accepted Answer

Create a Cloud Function that listens to Compute Engine audit logs and adds the tag to new instances. OS Config can enforce OS policies, but tagging is done via instance templates or organization policies. Using a custom image with the tag is not automatic. A pre-create Cloud Function can detect VM creation and add the tag. Org policies cannot enforce tags directly.

Answer

Use a custom image that includes the tag in the instance metadata

Answer

Use an organization policy to require the tag

Answer

Configure OS Config with a software recipe to add the tag

Question 11

A company runs a stateful workload on GKE that requires at most one pod per node. They want to survive a zonal failure with minimal downtime. The application can be restarted on a new node. Which configuration should they use?

Accepted Answer

Use a StatefulSet with pod anti-affinity required and a regional cluster. A StatefulSet with pod anti-affinity required ensures one pod per node. A regional cluster with nodes in multiple zones allows rescheduling in another zone. A single-zone cluster would not survive a zonal failure. PDB limits disruption but does not handle zone failure.

Answer

Use a Deployment with a PodDisruptionBudget set to maxUnavailable=0

Answer

Deploy a Deployment with a nodeSelector for one zone

Answer

Use a DaemonSet with node affinity

Question 12

An engineer wants to store a database password securely and allow a Cloud Run service to access it. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets like passwords, API keys, and certificates. It integrates with Cloud Run via volume mounts or environment variables. Cloud KMS is for encryption keys. Cloud Storage is for objects. Firestore is a database.

Answer

Cloud Storage

Answer

Cloud Key Management Service (KMS)

Answer

Firestore

Question 13

A team is building a CI/CD pipeline for a Java application that will run on GKE. They want to automatically build the application, run unit tests, create a Docker image, push it to Artifact Registry, and deploy to GKE. Which two GCP services should be combined? (Choose two.)

Accepted Answer

Cloud Deploy. Cloud Build handles the build and test steps, builds the Docker image, and pushes to Artifact Registry. Cloud Deploy manages the deployment to GKE. Cloud Run is serverless; Cloud Functions is event-driven; Compute Engine is VMs.

Answer

Cloud Functions

Answer

Compute Engine

Answer

Cloud Run

Question 14

An organization wants to monitor and alert on custom application metrics from a GKE cluster. They also need to view logs in real-time and create metrics from log content. Which two GCP services should they use? (Choose two.)

Accepted Answer

Cloud Monitoring. Cloud Monitoring collects metrics and provides alerting. Cloud Logging collects logs and supports log-based metrics. Cloud Profiler is for profiling. Cloud Trace is for tracing. Error Reporting is for error grouping.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Trace

Question 15

A company uses Terraform to manage infrastructure. They want to store the Terraform state file remotely and enable state locking to prevent concurrent modifications. Which three Google Cloud services or features should they use? (Choose three.)

Accepted Answer

Object versioning on the state bucket. Cloud Storage is used as a backend for Terraform state. Object versioning provides history and locking via the storage object's generation number. Cloud KMS can encrypt the state file. Cloud NAT is for outbound connectivity. Cloud Shell is not required for state management. Secret Manager is for secrets, not state.

Answer

Cloud NAT

Answer

Cloud Shell