Google PCA Managing and Provisioning a Solution Infrastructure Practice Test 2 — 15 Questions

Question 1

A DevOps team wants to automate the deployment of infrastructure on Google Cloud using a declarative configuration language. They need to support Python and Jinja templates for reusable modules. Which service should they use?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager supports YAML, Python, and Jinja templates, making it the correct choice for declarative infrastructure as code. Terraform is also declarative but uses HCL, not Python/Jinja. Cloud Build is for CI/CD pipelines, not infrastructure provisioning. Config Connector is for Kubernetes-style resource management, not Python/Jinja templates.

Answer

Config Connector

Answer

Terraform on Google Cloud

Answer

Cloud Build

Question 2

A team is using Cloud Build to deploy a microservice to Cloud Run. They want to ensure that only containers built from a specific trusted branch in their source repository are deployed to production. Which Cloud Build feature should they use?

Accepted Answer

Cloud Build trigger branch filtering. Cloud Build triggers can be configured to respond only to specific branches (e.g., 'main' or 'release/*'). By setting the trigger's included files filter and branch regex, they can restrict builds to that branch. Artifact Registry controls access to container images, but does not restrict deployment by branch. Cloud Deploy is a separate service for progressive delivery. Binary Authorization enforces policies at deployment time but does not filter by branch.

Answer

Binary Authorization attestors

Answer

Cloud Deploy delivery pipeline approvals

Answer

Artifact Registry IAM permissions

Question 3

A company runs a stateful application on GKE that requires persistent storage. They want to ensure that during cluster upgrades, pods are not disrupted and storage is preserved. Which configuration should they use?

Accepted Answer

Use a StatefulSet with a PodDisruptionBudget. PodDisruptionBudgets (PDBs) ensure that a minimum number of pods remain available during voluntary disruptions like cluster upgrades. PersistentVolumeClaims with ReadWriteOnce access mode allow pods to persist data. Combining PDBs with StatefulSets provides ordered, graceful deployment and scaling while preserving storage. The cluster autoscaler only adjusts node count, not pod disruptions. HorizontalPodAutoscaler scales pods based on metrics but does not protect against disruptions.

Answer

Enable Cluster Autoscaler on the node pool

Answer

Use a Deployment with a HorizontalPodAutoscaler

Answer

Use PersistentVolumeClaims with ReadWriteMany access mode

Question 4

A security team wants to enforce that only container images signed by their internal CI/CD pipeline can run on GKE clusters. They also need to ensure that unsigned images are rejected at admission time. Which combination of services and configurations should they use?

Accepted Answer

Binary Authorization with Cloud KMS for signing. Binary Authorization enforces policy by requiring images to be signed by trusted signers (e.g., using Cloud KMS). It integrates with GKE admission control to block unsigned images. Cloud KMS creates and manages signing keys. Artifact Registry stores signed images but does not enforce policy. Cloud Build can be used to sign images during build, but the enforcement mechanism is Binary Authorization.

Answer

GKE PodSecurityPolicy with allowed registries

Answer

Cloud Build with Container Analysis

Answer

Artifact Registry vulnerability scanning and IAM roles

Question 5

A developer wants to deploy a containerized web application on Google Cloud that can scale to zero when not in use and charges only for resources consumed during request processing. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero when idle and charges per request, making it cost-effective for intermittent traffic. GKE requires at least one node to be running, so it cannot scale to zero. Compute Engine instances incur costs even when idle. App Engine Flexible Environment also runs at least one instance.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Flexible Environment

Answer

Compute Engine instance group

Question 6

A company has a Cloud Run service that processes high-throughput requests. They want to reduce latency by keeping a baseline of warm instances always ready to handle traffic. Which Cloud Run configuration parameters should they adjust?

Accepted Answer

Set min-instances to 10 and CPU to always-on. Setting min-instances to a value greater than 0 ensures that Cloud Run keeps at least that many instances warm, ready to serve requests without cold start latency. Max-instances sets an upper limit. Concurrency controls how many requests each instance can handle. CPU allocation can be set to always-on to reduce latency, but that is a separate setting.

Answer

Set min-instances to 0 and max-instances to 100

Answer

Set max-instances to a high value and concurrency to 1

Answer

Set max-instances to 0 (unlimited) and concurrency to 80

Question 7

A team is deploying a microservice on Cloud Run that needs to access a Cloud SQL database securely. They want to avoid using public IPs and ensure traffic stays within Google's network. Which configuration should they use?

Accepted Answer

Use Serverless VPC Access and assign a private IP to the Cloud SQL instance. Serverless VPC Access allows Cloud Run to connect to a VPC network via a VPC connector. Combined with Private Services Access, Cloud SQL can be configured with a private IP (within the VPC) and accessed without traversing the public internet. Cloud SQL Proxy is a sidecar pattern that can use public IP with SSL, but it does not keep traffic entirely within Google's network if the Cloud SQL instance uses a public IP. Private Google Access is for on-premises or VM access to Google APIs, not for Cloud Run to Cloud SQL.

Answer

Configure Cloud SQL with a public IP and use Cloud SQL Proxy in the Cloud Run service

Answer

Enable Private Google Access on the VPC subnet

Answer

Create a VPC network peering between the Cloud Run tenant project and the Cloud SQL project

Question 8

A financial services company requires that all audit logs be retained for 7 years in a cost-effective, immutable storage. They also need to run ad-hoc SQL queries on the logs. Which configuration should they use?

Accepted Answer

Create two log sinks: one to BigQuery for querying, and one to Cloud Storage with object retention policy for immutable storage. Logging can export logs to BigQuery for SQL querying, and BigQuery offers time-based partitioning and long-term retention. However, for immutable storage, Cloud Storage with retention policy is recommended. The best approach is to use a log sink to BigQuery for analysis, and another sink to Cloud Storage with a retention policy for long-term immutable storage. Option D combines both sinks correctly.

Answer

Create a log sink to BigQuery with a 7-year partition expiration and use BigQuery's SQL capabilities

Answer

Use Cloud Logging's default retention and set up a log-based metric to trigger a Cloud Function that copies logs to BigQuery

Answer

Export logs to Cloud Storage with a retention policy set to 7 years and use Cloud Storage SQL interface

Question 9

An organization wants to manage DNS records for a domain they own (e.g., example.com) and use Google Cloud for authoritative DNS. They also need to resolve internal hostnames for resources within their VPC. Which Cloud DNS configuration should they use?

Accepted Answer

Create a public managed zone for example.com and a private managed zone for internal VPC resources. Cloud DNS public zones manage public DNS records for internet-facing domains. Cloud DNS private zones are used for internal DNS resolution within VPCs. The correct approach is to create a public zone for example.com and a private zone for internal hostnames attached to the VPC.

Answer

Create a single public managed zone and use DNS peering for internal resolution

Answer

Create a single private managed zone for both external and internal DNS resolution

Answer

Use Google Groups DNS to manage both public and private records

Question 10

A company uses Cloud Build to deploy a Java application to Artifact Registry. They want to automatically trigger a build only when changes are pushed to the 'main' branch in their Cloud Source Repository. Which configuration should they use?

Accepted Answer

Create a Cloud Build trigger with an included branch filter set to '^main$'. Cloud Build triggers can be configured with a branch filter (regex) to trigger builds only on specific branches. The trigger is set to watch the repository and fire on push events matching the branch pattern. Using a Cloud Scheduler with Pub/Sub is an alternative for scheduled builds, but not for push-based triggers.

Answer

Configure a Cloud Function that listens for Pub/Sub messages from Cloud Source Repo and calls Cloud Build API

Answer

Create a Cloud Scheduler job that runs a Pub/Sub push to Cloud Build every hour

Answer

Use a Cloud Build build step that checks the branch name and aborts if not main

Question 11

A team is running a GKE cluster with a workload that has variable CPU and memory usage. They want to automatically adjust pod resource requests and limits based on historical usage to improve resource efficiency. Which feature should they use?

Accepted Answer

Vertical Pod Autoscaler (VPA). Vertical Pod Autoscaler (VPA) automatically adjusts CPU and memory requests and limits of pods based on historical usage, making it ideal for right-sizing. Horizontal Pod Autoscaler (HPA) scales the number of pods based on metrics, but does not modify resource requests. Cluster Autoscaler adjusts the number of nodes. PodDisruptionBudget controls pod disruptions during maintenance.

Answer

PodDisruptionBudget (PDB)

Answer

Horizontal Pod Autoscaler (HPA)

Answer

Cluster Autoscaler

Question 12

A company wants to grant a service account in Project A the ability to push containers to Artifact Registry in Project B. They want to follow the principle of least privilege. Which IAM roles should they assign?

Accepted Answer

Grant the service account the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B. To push containers, the service account needs the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B. The Storage Object Admin role is too broad. The Artifact Registry Admin role is overly permissive. The Viewer role only allows reading.

Answer

Grant the service account the Storage Object Admin role (roles/storage.objectAdmin) on Project B

Answer

Grant the service account the Artifact Registry Admin role (roles/artifactregistry.admin) on the repository in Project B

Answer

Grant the service account the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository in Project B

Question 13

A company is deploying a critical application on GKE and wants to ensure high availability during node upgrades and failures. Which TWO configurations should they implement? (Choose 2.)

Accepted Answer

Configure a PodDisruptionBudget for the deployment. PodDisruptionBudgets (PDBs) ensure that a minimum number of pods remain available during voluntary disruptions like node upgrades. Multi-zonal node pools distribute pods across zones, protecting against zone failures. Cluster Autoscaler adds nodes when needed but does not directly ensure availability. HPA scales pods but does not handle disruptions. Workload Identity is for authentication, not availability.

Answer

Enable Workload Identity for the service account

Answer

Use a HorizontalPodAutoscaler with high target utilization

Answer

Enable Cluster Autoscaler on the node pool

Question 14

A data analytics team wants to build a pipeline that processes files from a Cloud Storage bucket, transforms the data, and loads it into BigQuery. They want to trigger the pipeline only when new files arrive. Which THREE services can be used together to achieve this? (Choose 3.)

Accepted Answer

Cloud Storage triggers for Cloud Functions. Cloud Functions can be triggered by Cloud Storage events (e.g., object finalize). Cloud Workflows can orchestrate multiple steps. Cloud Build is for CI/CD, not event-driven data processing. Cloud Scheduler is for scheduled jobs, not event triggers. Cloud Run can be invoked by Cloud Functions or eventarc, but the direct trigger from storage is via Cloud Functions or Eventarc.

Answer

Cloud Scheduler

Answer

Cloud Build triggers

Question 15

A startup wants to store application secrets (e.g., API keys, database passwords) securely on Google Cloud. They need to support automatic rotation of secrets and fine-grained access control. Which TWO services should they use? (Choose 2.)

Accepted Answer

Secret Manager. Secret Manager is the primary service for storing secrets, with support for versioning, automatic rotation, and IAM. Cloud KMS can be used to encrypt secrets stored in Secret Manager, providing an additional layer of security. Cloud Key Management Service (KMS) is used for managing encryption keys, but Secret Manager already encrypts secrets at rest using Google-managed keys by default; using CMEK via Cloud KMS adds customer-managed key control. Cloud Storage is not designed for secrets. IAM alone does not provide secret storage. Cloud Functions can access secrets but is not a storage service.

Answer

Cloud Storage with object versioning

Answer

Cloud Functions

Answer

Cloud Identity and Access Management (IAM)