Google PCA Managing and Provisioning a Solution Infrastructure Practice Test 2 — 15 Questions

Question 1

A team is building a CI/CD pipeline for a Java application that will run on GKE. They want to automatically build the application, run unit tests, create a Docker image, push it to Artifact Registry, and deploy to GKE. Which two GCP services should be combined? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Deploy. Cloud Build handles the build and test steps, builds the Docker image, and pushes to Artifact Registry. Cloud Deploy manages the deployment to GKE. Cloud Run is serverless; Cloud Functions is event-driven; Compute Engine is VMs.

Answer

Cloud Functions

Answer

Compute Engine

Answer

Cloud Run

Question 2

An organization wants to monitor and alert on custom application metrics from a GKE cluster. They also need to view logs in real-time and create metrics from log content. Which two GCP services should they use? (Choose two.)

Accepted Answer

Cloud Monitoring. Cloud Monitoring collects metrics and provides alerting. Cloud Logging collects logs and supports log-based metrics. Cloud Profiler is for profiling. Cloud Trace is for tracing. Error Reporting is for error grouping.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Trace

Question 3

A company uses Terraform to manage infrastructure. They want to store the Terraform state file remotely and enable state locking to prevent concurrent modifications. Which three Google Cloud services or features should they use? (Choose three.)

Accepted Answer

Object versioning on the state bucket. Cloud Storage is used as a backend for Terraform state. Object versioning provides history and locking via the storage object's generation number. Cloud KMS can encrypt the state file. Cloud NAT is for outbound connectivity. Cloud Shell is not required for state management. Secret Manager is for secrets, not state.

Answer

Cloud NAT

Answer

Cloud Shell

Question 4

A DevOps team wants to automate the deployment of infrastructure on Google Cloud using a declarative configuration language. They need to support Python and Jinja templates for reusable modules. Which service should they use?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager supports YAML, Python, and Jinja templates, making it the correct choice for declarative infrastructure as code. Terraform is also declarative but uses HCL, not Python/Jinja. Cloud Build is for CI/CD pipelines, not infrastructure provisioning. Config Connector is for Kubernetes-style resource management, not Python/Jinja templates.

Answer

Config Connector

Answer

Terraform on Google Cloud

Answer

Cloud Build

Question 5

A team is using Cloud Build to deploy a microservice to Cloud Run. They want to ensure that only containers built from a specific trusted branch in their source repository are deployed to production. Which Cloud Build feature should they use?

Accepted Answer

Cloud Build trigger branch filtering. Cloud Build triggers can be configured to respond only to specific branches (e.g., 'main' or 'release/*'). By setting the trigger's included files filter and branch regex, they can restrict builds to that branch. Artifact Registry controls access to container images, but does not restrict deployment by branch. Cloud Deploy is a separate service for progressive delivery. Binary Authorization enforces policies at deployment time but does not filter by branch.

Answer

Binary Authorization attestors

Answer

Cloud Deploy delivery pipeline approvals

Answer

Artifact Registry IAM permissions

Question 6

A company runs a stateful application on GKE that requires persistent storage. They want to ensure that during cluster upgrades, pods are not disrupted and storage is preserved. Which configuration should they use?

Accepted Answer

Use a StatefulSet with a PodDisruptionBudget. PodDisruptionBudgets (PDBs) ensure that a minimum number of pods remain available during voluntary disruptions like cluster upgrades. PersistentVolumeClaims with ReadWriteOnce access mode allow pods to persist data. Combining PDBs with StatefulSets provides ordered, graceful deployment and scaling while preserving storage. The cluster autoscaler only adjusts node count, not pod disruptions. HorizontalPodAutoscaler scales pods based on metrics but does not protect against disruptions.

Answer

Enable Cluster Autoscaler on the node pool

Answer

Use a Deployment with a HorizontalPodAutoscaler

Answer

Use PersistentVolumeClaims with ReadWriteMany access mode

Question 7

A security team wants to enforce that only container images signed by their internal CI/CD pipeline can run on GKE clusters. They also need to ensure that unsigned images are rejected at admission time. Which combination of services and configurations should they use?

Accepted Answer

Binary Authorization with Cloud KMS for signing. Binary Authorization enforces policy by requiring images to be signed by trusted signers (e.g., using Cloud KMS). It integrates with GKE admission control to block unsigned images. Cloud KMS creates and manages signing keys. Artifact Registry stores signed images but does not enforce policy. Cloud Build can be used to sign images during build, but the enforcement mechanism is Binary Authorization.

Answer

GKE PodSecurityPolicy with allowed registries

Answer

Cloud Build with Container Analysis

Answer

Artifact Registry vulnerability scanning and IAM roles

Question 8

A developer wants to deploy a containerized web application on Google Cloud that can scale to zero when not in use and charges only for resources consumed during request processing. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero when idle and charges per request, making it cost-effective for intermittent traffic. GKE requires at least one node to be running, so it cannot scale to zero. Compute Engine instances incur costs even when idle. App Engine Flexible Environment also runs at least one instance.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Flexible Environment

Answer

Compute Engine instance group

Question 9

A company has a Cloud Run service that processes high-throughput requests. They want to reduce latency by keeping a baseline of warm instances always ready to handle traffic. Which Cloud Run configuration parameters should they adjust?

Accepted Answer

Set min-instances to 10 and CPU to always-on. Setting min-instances to a value greater than 0 ensures that Cloud Run keeps at least that many instances warm, ready to serve requests without cold start latency. Max-instances sets an upper limit. Concurrency controls how many requests each instance can handle. CPU allocation can be set to always-on to reduce latency, but that is a separate setting.

Answer

Set min-instances to 0 and max-instances to 100

Answer

Set max-instances to a high value and concurrency to 1

Answer

Set max-instances to 0 (unlimited) and concurrency to 80

Question 10

A team is deploying a microservice on Cloud Run that needs to access a Cloud SQL database securely. They want to avoid using public IPs and ensure traffic stays within Google's network. Which configuration should they use?

Accepted Answer

Use Serverless VPC Access and assign a private IP to the Cloud SQL instance. Serverless VPC Access allows Cloud Run to connect to a VPC network via a VPC connector. Combined with Private Services Access, Cloud SQL can be configured with a private IP (within the VPC) and accessed without traversing the public internet. Cloud SQL Proxy is a sidecar pattern that can use public IP with SSL, but it does not keep traffic entirely within Google's network if the Cloud SQL instance uses a public IP. Private Google Access is for on-premises or VM access to Google APIs, not for Cloud Run to Cloud SQL.

Answer

Configure Cloud SQL with a public IP and use Cloud SQL Proxy in the Cloud Run service

Answer

Enable Private Google Access on the VPC subnet

Answer

Create a VPC network peering between the Cloud Run tenant project and the Cloud SQL project

Question 11

A financial services company requires that all audit logs be retained for 7 years in a cost-effective, immutable storage. They also need to run ad-hoc SQL queries on the logs. Which configuration should they use?

Accepted Answer

Create two log sinks: one to BigQuery for querying, and one to Cloud Storage with object retention policy for immutable storage. Logging can export logs to BigQuery for SQL querying, and BigQuery offers time-based partitioning and long-term retention. However, for immutable storage, Cloud Storage with retention policy is recommended. The best approach is to use a log sink to BigQuery for analysis, and another sink to Cloud Storage with a retention policy for long-term immutable storage. Option D combines both sinks correctly.

Answer

Create a log sink to BigQuery with a 7-year partition expiration and use BigQuery's SQL capabilities

Answer

Use Cloud Logging's default retention and set up a log-based metric to trigger a Cloud Function that copies logs to BigQuery

Answer

Export logs to Cloud Storage with a retention policy set to 7 years and use Cloud Storage SQL interface

Question 12

An organization wants to manage DNS records for a domain they own (e.g., example.com) and use Google Cloud for authoritative DNS. They also need to resolve internal hostnames for resources within their VPC. Which Cloud DNS configuration should they use?

Accepted Answer

Create a public managed zone for example.com and a private managed zone for internal VPC resources. Cloud DNS public zones manage public DNS records for internet-facing domains. Cloud DNS private zones are used for internal DNS resolution within VPCs. The correct approach is to create a public zone for example.com and a private zone for internal hostnames attached to the VPC.

Answer

Create a single public managed zone and use DNS peering for internal resolution

Answer

Create a single private managed zone for both external and internal DNS resolution

Answer

Use Google Groups DNS to manage both public and private records

Question 13

A company uses Cloud Build to deploy a Java application to Artifact Registry. They want to automatically trigger a build only when changes are pushed to the 'main' branch in their Cloud Source Repository. Which configuration should they use?

Accepted Answer

Create a Cloud Build trigger with an included branch filter set to '^main$'. Cloud Build triggers can be configured with a branch filter (regex) to trigger builds only on specific branches. The trigger is set to watch the repository and fire on push events matching the branch pattern. Using a Cloud Scheduler with Pub/Sub is an alternative for scheduled builds, but not for push-based triggers.

Answer

Configure a Cloud Function that listens for Pub/Sub messages from Cloud Source Repo and calls Cloud Build API

Answer

Create a Cloud Scheduler job that runs a Pub/Sub push to Cloud Build every hour

Answer

Use a Cloud Build build step that checks the branch name and aborts if not main

Question 14

A team is running a GKE cluster with a workload that has variable CPU and memory usage. They want to automatically adjust pod resource requests and limits based on historical usage to improve resource efficiency. Which feature should they use?

Accepted Answer

Vertical Pod Autoscaler (VPA). Vertical Pod Autoscaler (VPA) automatically adjusts CPU and memory requests and limits of pods based on historical usage, making it ideal for right-sizing. Horizontal Pod Autoscaler (HPA) scales the number of pods based on metrics, but does not modify resource requests. Cluster Autoscaler adjusts the number of nodes. PodDisruptionBudget controls pod disruptions during maintenance.

Answer

PodDisruptionBudget (PDB)

Answer

Horizontal Pod Autoscaler (HPA)

Answer

Cluster Autoscaler

Question 15

A company wants to grant a service account in Project A the ability to push containers to Artifact Registry in Project B. They want to follow the principle of least privilege. Which IAM roles should they assign?

Accepted Answer

Grant the service account the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B. To push containers, the service account needs the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B. The Storage Object Admin role is too broad. The Artifact Registry Admin role is overly permissive. The Viewer role only allows reading.

Answer

Grant the service account the Storage Object Admin role (roles/storage.objectAdmin) on Project B

Answer

Grant the service account the Artifact Registry Admin role (roles/artifactregistry.admin) on the repository in Project B

Answer

Grant the service account the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository in Project B