Google PCA Managing and Provisioning a Solution Infrastructure — 50 Questions

Question 1

An engineer needs to provision a GKE cluster with a node pool that uses preemptible VMs to reduce costs. Which gcloud command should they use?

Accepted Answer

gcloud container node-pools create --preemptible. To create a node pool with preemptible VMs in GKE, the correct gcloud command is 'gcloud container node-pools create' with the '--preemptible' flag. This command creates a new node pool within an existing cluster, and the flag specifies that the nodes should be preemptible. This is the standard way to add a preemptible node pool to a GKE cluster.

Answer

gcloud container clusters update --preemptible

Answer

gcloud container clusters create --preemptible-nodes

Answer

gcloud compute instances create --preemptible

Question 2

A team wants to enforce that only container images signed by their CI/CD system can be deployed to GKE. They have enabled Binary Authorization with a policy that requires an attestor. What additional step must they take to bind the attestor to the image signing process?

Accepted Answer

Create a Container Analysis note and grant the attestor service account the containeranalysis.notes.attacher role. To bind an attestor to the image signing process, you must create a Container Analysis note that defines the attestation type and grant the attestor's service account the containeranalysis.notes.attacher role so it can create attestations. The attestor then uses this note to sign attestations that Binary Authorization verifies against the policy. Without the note and the attacher role, the attestor cannot produce valid attestations.

Answer

Add the attestor to the Binary Authorization policy as a required attestor

Answer

Create a Cloud Build step that signs the image and stores the signature in Cloud Storage

Answer

Configure the GKE cluster to require Binary Authorization with the --no-enforce flag

Question 3

An organization wants to ensure that all VMs in a project have the 'restricted-vm' tag to apply a firewall rule that allows only SSH from a bastion host. The VMs are created by multiple teams. Which approach ensures the tag is automatically applied to all new VMs?

Accepted Answer

Create a Cloud Function that listens to Compute Engine audit logs and adds the tag to new instances. OS Config can enforce OS policies, but tagging is done via instance templates or organization policies. Using a custom image with the tag is not automatic. A pre-create Cloud Function can detect VM creation and add the tag. Org policies cannot enforce tags directly.

Answer

Use a custom image that includes the tag in the instance metadata

Answer

Use an organization policy to require the tag

Answer

Configure OS Config with a software recipe to add the tag

Question 4

A company runs a stateful workload on GKE that requires at most one pod per node. They want to survive a zonal failure with minimal downtime. The application can be restarted on a new node. Which configuration should they use?

Accepted Answer

Use a StatefulSet with pod anti-affinity required and a regional cluster. A StatefulSet with required pod anti-affinity guarantees stable identity and ensures no two pods land on the same node, while a regional GKE cluster spreads nodes across three zones so a zonal outage only removes one replica's host. Because the workload can restart on a new node, the StatefulSet controller reschedules the affected pod to a surviving zone, giving minimal downtime. The regional control plane also remains available during a single-zone failure.

Answer

Use a Deployment with a PodDisruptionBudget set to maxUnavailable=0

Answer

Deploy a Deployment with a nodeSelector for one zone

Answer

Use a DaemonSet with node affinity

Question 5

A company uses Terraform to manage infrastructure. They want to store the Terraform state file remotely and enable state locking to prevent concurrent modifications. Which three Google Cloud services or features should they use? (Choose three.)

Accepted Answer

Object versioning on the state bucket. Cloud Storage (B) is the correct backend for remote Terraform state on Google Cloud, configured via a GCS backend block so the state file lives in a bucket rather than locally. Object versioning (A) on that state bucket is recommended because it preserves previous state file versions, allowing recovery from accidental corruption or overwrites of the state. Cloud KMS (E) is used to encrypt the state at rest with customer-managed encryption keys (CMEK), protecting sensitive values stored in the state file. Cloud NAT (C) is a networking service for outbound internet access from private instances and has nothing to do with state storage or locking. Cloud Shell (D) is only an interactive browser-based shell environment and does not provide remote state storage or locking.

Answer

Cloud NAT

Answer

Cloud Shell

Question 6

A data analytics team wants to build a pipeline that processes files from a Cloud Storage bucket, transforms the data, and loads it into BigQuery. They want to trigger the pipeline only when new files arrive. Which THREE services can be used together to achieve this? (Choose 3.)

Accepted Answer

Cloud Storage triggers for Cloud Functions. Option B is correct because Cloud Storage triggers for Cloud Functions fire on object events such as google.cloud.storage.object.v1.finalized, letting the pipeline start exactly when a new file lands in the bucket. Option D is correct because Cloud Workflows can be invoked by that event (e.g., via Eventarc/Cloud Functions) and orchestrate the transform-and-load steps, including calling BigQuery jobs, with retries and branching. Option E is correct because BigQuery Data Transfer Service supports Cloud Storage as a data source and can load the transformed files into BigQuery on a scheduled or managed basis, completing the load stage. Option A is not appropriate because Cloud Scheduler only emits time-based cron jobs, not event-driven triggers for arriving files. Option C is not appropriate because Cloud Build triggers respond to source repository events (e.g., pushes or pull requests) and are for CI/CD builds, not Cloud Storage object arrivals.

Answer

Cloud Scheduler

Answer

Cloud Build triggers

Question 7

A startup wants to store application secrets (e.g., API keys, database passwords) securely on Google Cloud. They need to support automatic rotation of secrets and fine-grained access control. Which TWO services should they use? (Choose 2.)

Accepted Answer

Secret Manager. Secret Manager (C) is the correct primary service because it is purpose-built for storing API keys, database passwords, and other application secrets, and it natively supports automatic rotation via rotation schedules and Pub/Sub notifications, plus fine-grained access control through IAM policies at the secret and version level. Cloud KMS (E) is also correct because it provides the encryption key management that underpins secrets at rest, and its key rotation capabilities (automatic rotation periods on symmetric keys) plus granular IAM permissions on key rings and keys satisfy the requirement for managed rotation and fine-grained access control over the cryptographic material. Together, Secret Manager stores and rotates the secrets while Cloud KMS manages and rotates the customer-managed encryption keys protecting them. Cloud Storage with object versioning (A) is not designed for secret storage or rotation and lacks secret-specific access controls. Cloud Functions (B) is a compute service that could trigger rotation logic but is not itself a secret store or access-control mechanism. Cloud IAM (D) is a supporting access-control layer used by Secret Manager and Cloud KMS, but it is not a standalone service for storing or rotating secrets.

Answer

Cloud Storage with object versioning

Answer

Cloud Functions

Answer

Cloud Identity and Access Management (IAM)

Question 8

A team is using Cloud Functions with a Cloud Storage trigger. They notice that sometimes the function does not execute after a file is uploaded. What is the most likely cause?

Accepted Answer

The Cloud Functions region is different from the bucket region. Cloud Functions requires that the function be deployed in the same region as the Cloud Storage bucket for event-driven triggers. If the region of the function differs from the bucket's region, the trigger will not deliver events, causing the function not to execute. This is a common misconfiguration that is often overlooked.

Answer

The function's memory limit is too low

Answer

The Cloud Storage bucket has object versioning enabled which changes event semantics

Answer

The function has too many concurrent invocations

Question 9

You have a Cloud Deploy delivery pipeline with an approval gate. You want to automatically roll back a release if the rollout fails during the deploy step. How should you configure the pipeline?

Accepted Answer

Set an automatic rollback policy in the delivery pipeline definition. Cloud Deploy does have a built-in automatic rollback feature via the `rollback_policy` in the delivery pipeline definition. Setting this policy automatically rolls back a release if the rollout fails during the deploy step. Option B describes a custom solution that is unnecessary because the native policy exists. Option C is incorrect because approval gates are for manual approval and cannot automatically trigger a rollback. Option D is incorrect because no such global flag exists. Therefore, option A is correct.

Answer

Use a Cloud Build post-deploy hook to check the rollout status and roll back if needed

Answer

Configure the approval gate to reject the deployment if it fails

Answer

Enable the 'rollback on failure' flag in the pipeline

Question 10

Your organization uses a Shared VPC to centrally manage network resources. A project that is not the host project needs to create a Cloud SQL instance using a private IP in the Shared VPC. What must be configured?

Accepted Answer

Enable the Service Networking API and allocate an IP range for the Cloud SQL instance. Cloud SQL private IP in a Shared VPC requires the Service Networking API and a dedicated IP range allocated via Private Service Access, which creates a VPC peering between the host project's VPC and Google's managed services network. The service project must also have the 'compute.networkUser' role, but the key configuration for private IP is enabling Service Networking and allocating the range. This is the standard requirement for Cloud SQL private IP connectivity in Shared VPC.

Answer

Create a VPC peering between the service project and the host project

Answer

Grant the service project the 'compute.networkUser' role on the VPC network

Answer

Use Cloud NAT to allow the Cloud SQL instance to communicate

Question 11

You need to collect and analyze logs from multiple projects in a centralized BigQuery dataset for auditing. Which THREE steps are required? (Choose 3)

Accepted Answer

Use an aggregated sink at the organization or folder level to collect logs from all projects. To centralize logs from multiple projects into a single BigQuery dataset for auditing, the required steps are: (1) Use an aggregated sink at the organization or folder level to collect logs from all projects (option B) – this allows a single sink to route logs from all child projects. (2) Grant the Cloud Logging service account the 'bigquery.dataEditor' role on the dataset (option C) to permit writing logs. (3) Create a log exclusion filter to remove sensitive data (option D) – this is necessary for compliance when auditing logs to prevent exporting personally identifiable or confidential information. Per-project sinks (option E) are an alternative to an aggregated sink, not an additional requirement. VPC Flow Logs (option A) are a separate log source and not specifically required for centralizing logs to BigQuery.

Answer

Enable VPC Flow Logs in all projects

Answer

Create a log sink in each project that exports to a shared BigQuery dataset

Question 12

A DevOps team wants to manage Google Cloud resources declaratively using Infrastructure as Code. They need to version control their configuration and automate deployments. Which two tools are natively supported by Google Cloud for this purpose?

Accepted Answer

Cloud Deployment Manager and Terraform. Cloud Deployment Manager uses YAML, Python, or Jinja templates, and Terraform is a popular IaC tool with a native Google Cloud provider. Both allow declarative management and version control.

Answer

Cloud Shell and gcloud CLI

Answer

AWS CloudFormation and Terraform

Answer

Ansible and Puppet

Question 13

An organization is using Cloud Build to build container images and push them to Artifact Registry. Which step in the cloudbuild.yaml file is necessary to tag and push the image?

Accepted Answer

A step that runs 'docker push' with the Artifact Registry URL. In a Cloud Build configuration, each step runs a container with a specific entrypoint. To push a Docker image to Artifact Registry, the standard approach is to use a step that executes `docker push` with the fully qualified Artifact Registry URL (e.g., `us-central1-docker.pkg.dev/PROJECT/REPO/IMAGE:TAG`). This step is necessary because Cloud Build does not automatically push images; you must explicitly define a push step after building and tagging the image. The `docker push` command authenticates using the credentials provided by the Cloud Build service account, which must have the necessary Artifact Registry permissions.

Answer

A step that runs 'gcloud container images push'

Answer

A step that runs 'gsutil cp' to upload the image

Answer

A step that runs 'kubectl apply'

Question 14

A team uses Cloud Functions triggered by Cloud Storage events to process uploaded images. They want to ensure that only HTTP-triggered functions can be invoked from outside the project. Which configuration should they apply?

Accepted Answer

Set --ingress-settings=internal-only on the HTTP function. For Cloud Functions (1st gen), setting --ingress-settings=internal-only restricts invocation to within the project. For Cloud Functions (2nd gen), using an ingress setting of 'all' allows external invocation; using 'internal-only' blocks external calls.

Answer

Add a VPC firewall rule to allow only internal traffic

Answer

Remove the Cloud Storage trigger function's trigger

Answer

Set --ingress-settings=all on the HTTP function

Question 15

A team is using GKE with cluster autoscaling enabled. They notice that some nodes are underutilized but the cluster autoscaler does not remove them. What could be the reason?

Accepted Answer

The node has pods with restrictive PodDisruptionBudgets. The cluster autoscaler will not remove a node if doing so would violate a PodDisruptionBudget (PDB). PDBs define the minimum number of pods that must remain available for a given workload during voluntary disruptions (like node draining). If a node hosts pods whose PDB would be violated by eviction, the autoscaler considers the node ineligible for scale-down. This is a safety mechanism to preserve application availability.

Answer

The node is in a different zone

Answer

The node has running pods that are part of a DaemonSet

Answer

The cluster autoscaler is not configured to scale down

Question 16

A company wants to automate the creation and management of Google Cloud resources using an infrastructure-as-code tool that supports configuration drift detection and is Google Cloud-native. Which tool should they use?

Accepted Answer

Cloud Deployment Manager. Google Cloud Deployment Manager is Google Cloud's native infrastructure-as-code service, using YAML or Python templates to define and manage resources. It supports configuration drift detection through its preview and update mechanisms and integrates directly with IAM and Cloud APIs. Because the requirement specifies a Google Cloud-native tool, Deployment Manager is the correct choice.

Answer

Terraform

Answer

Cloud SDK

Answer

Cloud Build

Question 17

An organization runs a Cloud Run service that processes incoming HTTP requests. Under heavy load, some requests timeout. The team wants to reduce cold starts and ensure consistent performance. They set min instances to 1, but the issue persists. Which additional configuration should they change?

Accepted Answer

Set CPU always allocated to true. Cloud Run's 'CPU always allocated' setting ensures the CPU is available even when the container is not processing requests, which is essential for background tasks and reducing cold-start latency. With min instances set to 1 but CPU throttled, the instance may still cold-start or be slow. Setting CPU always allocated to true keeps the instance warm and responsive.

Answer

Reduce concurrency

Answer

Increase max instances

Answer

Increase request timeout

Question 18

A company has a GKE cluster with Workload Identity enabled. A pod needs to access a BigQuery dataset in a different project. The team has created a service account in the pod's project and granted it BigQuery Data Viewer on the dataset. They also created an IAM policy binding between the Kubernetes service account and the Google service account. The pod still gets permission denied. What is missing?

Accepted Answer

The Google service account needs the iam.workloadIdentityUser role on itself. The missing piece is the IAM policy binding that grants the Kubernetes service account the ability to impersonate the Google service account. Specifically, the Google service account must have an IAM policy binding granting the roles/iam.workloadIdentityUser role to the Kubernetes service account (in the format serviceAccount:PROJECT_ID.svc.id.goog[K8S_NAMESPACE/KSA_NAME]). This binding is what allows the KSA to act as the GSA. Without it, the pod cannot obtain the GSA's credentials, resulting in permission denied.

Answer

The Kubernetes service account needs the iam.workloadIdentityUser role

Answer

The pod needs a node pool with Workload Identity enabled

Answer

The BigQuery dataset must be in the same project as the cluster

Question 19

A data science team wants to run training jobs on a GKE cluster. The jobs are resource-intensive and can tolerate interruptions. To reduce costs, the team wants to use preemptible VMs for the node pool. Which additional step should they take to ensure training jobs are not lost when nodes are preempted?

Accepted Answer

Enable cluster autoscaler on the node pool. Preemptible (or Spot) VMs in a GKE node pool can be terminated at any time, so the cluster must be able to replace those nodes to keep the training jobs running. Enabling the cluster autoscaler on the node pool ensures that when nodes are preempted and pods become unschedulable, the autoscaler provisions replacement nodes (of the same preemptible type) so the jobs can be rescheduled and continue.

Answer

Use a PodDisruptionBudget

Answer

Set up a Cloud Scheduler job to recreate nodes

Answer

Configure a Vertical Pod Autoscaler

Question 20

A company wants to store application secrets such as API keys and database passwords securely and audit access. They also need to automatically rotate secrets periodically. Which TWO Google Cloud services should they use? (Choose 2)

Accepted Answer

Cloud Scheduler. Secret Manager (E) is the correct primary service because it is purpose-built to store, version, and access application secrets such as API keys and database passwords, and it integrates with Cloud Audit Logs to record every access and administrative action. Cloud Scheduler (B) is also correct because it can trigger scheduled jobs (for example, via Pub/Sub or HTTP targets) that invoke the Secret Manager API to rotate secrets on a defined cron schedule, satisfying the periodic rotation requirement. Together they cover secure storage, auditing, and automated rotation. Cloud Deployment Manager (A) is an infrastructure-as-code provisioning tool, not a secrets store or rotation engine. Cloud Storage (C) can hold objects but lacks native secret versioning, access auditing tailored to secrets, and rotation features. Cloud Key Management Service (D) manages cryptographic keys and encryption, not application secret values, so it does not meet the secret storage and rotation requirement on its own.

Answer

Cloud Deployment Manager

Answer

Cloud Storage

Answer

Cloud Key Management Service