Google PCA Managing and Provisioning a Solution Infrastructure Practice Test 3 — 15 Questions

Question 1

A company is deploying a critical application on GKE and wants to ensure high availability during node upgrades and failures. Which TWO configurations should they implement? (Choose 2.)

Accepted Answer

Configure a PodDisruptionBudget for the deployment. PodDisruptionBudgets (PDBs) ensure that a minimum number of pods remain available during voluntary disruptions like node upgrades. Multi-zonal node pools distribute pods across zones, protecting against zone failures. Cluster Autoscaler adds nodes when needed but does not directly ensure availability. HPA scales pods but does not handle disruptions. Workload Identity is for authentication, not availability.

Answer

Enable Workload Identity for the service account

Answer

Use a HorizontalPodAutoscaler with high target utilization

Answer

Enable Cluster Autoscaler on the node pool

Question 2

A data analytics team wants to build a pipeline that processes files from a Cloud Storage bucket, transforms the data, and loads it into BigQuery. They want to trigger the pipeline only when new files arrive. Which THREE services can be used together to achieve this? (Choose 3.)

Accepted Answer

Cloud Storage triggers for Cloud Functions. Cloud Functions can be triggered by Cloud Storage events (e.g., object finalize). Cloud Workflows can orchestrate multiple steps. Cloud Build is for CI/CD, not event-driven data processing. Cloud Scheduler is for scheduled jobs, not event triggers. Cloud Run can be invoked by Cloud Functions or eventarc, but the direct trigger from storage is via Cloud Functions or Eventarc.

Answer

Cloud Scheduler

Answer

Cloud Build triggers

Question 3

A startup wants to store application secrets (e.g., API keys, database passwords) securely on Google Cloud. They need to support automatic rotation of secrets and fine-grained access control. Which TWO services should they use? (Choose 2.)

Accepted Answer

Secret Manager. Secret Manager is the primary service for storing secrets, with support for versioning, automatic rotation, and IAM. Cloud KMS can be used to encrypt secrets stored in Secret Manager, providing an additional layer of security. Cloud Key Management Service (KMS) is used for managing encryption keys, but Secret Manager already encrypts secrets at rest using Google-managed keys by default; using CMEK via Cloud KMS adds customer-managed key control. Cloud Storage is not designed for secrets. IAM alone does not provide secret storage. Cloud Functions can access secrets but is not a storage service.

Answer

Cloud Storage with object versioning

Answer

Cloud Functions

Answer

Cloud Identity and Access Management (IAM)

Question 4

A development team wants to automate the process of building container images from their GitHub repository and storing them in Artifact Registry. Which Google Cloud service should they use to create a build trigger that runs on every push to the main branch?

Accepted Answer

Cloud Build. Cloud Build is the CI/CD service that can be configured with build triggers to automatically build images on source code changes and push them to Artifact Registry.

Answer

Container Registry

Answer

Artifact Registry

Answer

Cloud Deploy

Question 5

An organization wants to manage Google Cloud infrastructure as code using declarative configuration files. They need a solution that supports Python and Jinja templating languages. Which service should they choose?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager supports YAML templates with optional Python or Jinja helpers, making it the correct choice for declarative infrastructure management with those languages.

Answer

Cloud Composer

Answer

Terraform on Google Cloud

Answer

Cloud Build

Question 6

A company runs a critical application on Compute Engine instances. They want to automatically patch the operating system on a weekly schedule to meet compliance requirements. Which Google Cloud service should they use?

Accepted Answer

OS Config. OS Config, part of VM Manager, provides patch management capabilities including scheduled patching and compliance reporting.

Answer

Cloud Monitoring

Answer

Cloud Security Command Center

Answer

Cloud Build

Question 7

You need to create a private GKE cluster with Workload Identity enabled to allow pods to access Google Cloud APIs without static service account keys. What must you configure for the cluster?

Accepted Answer

Enable Workload Identity on the cluster and set the --workload-pool flag at cluster creation. Workload Identity requires a GKE cluster with Workload Identity enabled and a Google-managed service account for the node pool or individual pods.

Answer

Enable Binary Authorization on the cluster

Answer

Create a node pool with a service account that has the necessary IAM roles and assign that SA to pods

Answer

Use Cloud NAT to allow pods to communicate with Google APIs

Question 8

A Cloud Run service needs to access resources in a VPC network (e.g., a Cloud SQL instance). The service should be able to send requests to the VPC and receive responses. What is the correct configuration?

Accepted Answer

Create a VPC connector and configure the Cloud Run service to use it for egress. Cloud Run can use a VPC connector (Serverless VPC Access) to send requests to a VPC. It does not allow inbound traffic from the VPC without additional setup.

Answer

Place the Cloud Run service in a VPC subnet

Answer

Use Cloud NAT to allow Cloud Run to access the VPC

Answer

Use VPC peering between Cloud Run and the VPC

Question 9

Your organization requires all container images deployed to GKE to be signed by an approved authority. Which service enforces that only signed images are allowed to run?

Accepted Answer

Binary Authorization. Binary Authorization enforces policies that require images to be signed by trusted authorities before they can be deployed on GKE.

Answer

Cloud Asset Inventory

Answer

Artifact Registry

Answer

Container Analysis

Question 10

You have a Cloud Deploy delivery pipeline with an approval gate. You want to automatically roll back a release if the rollout fails during the deploy step. How should you configure the pipeline?

Accepted Answer

Set an automatic rollback policy in the delivery pipeline definition. Cloud Deploy does have a built-in automatic rollback feature via the `rollback_policy` in the delivery pipeline definition. Setting this policy automatically rolls back a release if the rollout fails during the deploy step. Option B describes a custom solution that is unnecessary because the native policy exists. Option C is incorrect because approval gates are for manual approval and cannot automatically trigger a rollback. Option D is incorrect because no such global flag exists. Therefore, option A is correct.

Answer

Use a Cloud Build post-deploy hook to check the rollout status and roll back if needed

Answer

Configure the approval gate to reject the deployment if it fails

Answer

Enable the 'rollback on failure' flag in the pipeline

Question 11

A GKE cluster has a Horizontal Pod Autoscaler (HPA) configured for CPU utilization. The pods are not scaling up even though CPU usage is high. What could be the reason?

Accepted Answer

The pods do not have resource requests defined. The HPA may not have permissions to read metrics or the metrics server might be unavailable. Also, the target CPU utilization might be set incorrectly. Another common issue is that the HPA is using the wrong metric or the pod resource requests are not set.

Answer

The cluster autoscaler is disabled

Answer

The HPA is configured with the wrong metric name

Answer

The node pool is out of capacity

Question 12

Your organization uses a Shared VPC to centrally manage network resources. A project that is not the host project needs to create a Cloud SQL instance using a private IP in the Shared VPC. What must be configured?

Accepted Answer

Enable the Service Networking API and allocate an IP range for the Cloud SQL instance. For a service project to allocate private IP in a Shared VPC, the Shared VPC host project must grant the service project the 'compute.networkUser' role on the subnetwork. Additionally, the service project needs the Service Networking API enabled and a private service access connection.

Answer

Create a VPC peering between the service project and the host project

Answer

Grant the service project the 'compute.networkUser' role on the VPC network

Answer

Use Cloud NAT to allow the Cloud SQL instance to communicate

Question 13

You want to monitor the latency of an application running on Compute Engine and create an alert if the 99th percentile latency exceeds 500ms for more than 5 minutes. Which approach should you use?

Accepted Answer

Create a Metric Threshold alert using the 'Latency' metric with a percentile alignment. Cloud Monitoring can create alerting policies based on distribution metrics (like latency) using percentile aggregations. You can define a metric threshold with a rolling window.

Answer

Use Cloud Trace to analyze latency and set a trace-based alert

Answer

Use Error Reporting to capture latency errors

Answer

Create a log-based metric from application logs and set an alert on that metric

Question 14

A company needs to store secrets such as API keys and database passwords securely and access them from Compute Engine instances. Which service provides secret storage with built-in IAM integration and automatic rotation?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing secrets with IAM and versioning. It also supports rotation via Cloud Functions or Pub/Sub.

Answer

Cloud HSM

Answer

Cloud Storage

Answer

Cloud KMS

Question 15

Which TWO services can be used to create a CI/CD pipeline for a containerized application on Google Cloud? (Choose 2)

Accepted Answer

Cloud Deploy. Cloud Build builds and tests, and Cloud Deploy promotes releases. Both are essential for CI/CD.

Answer

Cloud Functions

Answer

Cloud Scheduler

Answer

Cloud Run