Google PCA Managing and Provisioning a Solution Infrastructure Practice Test 3 — 15 Questions

Question 1

A development team wants to automate the process of building container images from their GitHub repository and storing them in Artifact Registry. Which Google Cloud service should they use to create a build trigger that runs on every push to the main branch?

Accepted Answer

Cloud Build. Cloud Build is the CI/CD service that can be configured with build triggers to automatically build images on source code changes and push them to Artifact Registry.

Answer

Container Registry

Answer

Artifact Registry

Answer

Cloud Deploy

Question 2

An organization wants to manage Google Cloud infrastructure as code using declarative configuration files. They need a solution that supports Python and Jinja templating languages. Which service should they choose?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager supports YAML templates with optional Python or Jinja helpers, making it the correct choice for declarative infrastructure management with those languages.

Answer

Cloud Composer

Answer

Terraform on Google Cloud

Answer

Cloud Build

Question 3

A company runs a critical application on Compute Engine instances. They want to automatically patch the operating system on a weekly schedule to meet compliance requirements. Which Google Cloud service should they use?

Accepted Answer

OS Config. OS Config, part of VM Manager, provides patch management capabilities including scheduled patching and compliance reporting.

Answer

Cloud Monitoring

Answer

Cloud Security Command Center

Answer

Cloud Build

Question 4

You need to create a private GKE cluster with Workload Identity enabled to allow pods to access Google Cloud APIs without static service account keys. What must you configure for the cluster?

Accepted Answer

Enable Workload Identity on the cluster and set the --workload-pool flag at cluster creation. Workload Identity requires a GKE cluster with Workload Identity enabled and a Google-managed service account for the node pool or individual pods.

Answer

Enable Binary Authorization on the cluster

Answer

Create a node pool with a service account that has the necessary IAM roles and assign that SA to pods

Answer

Use Cloud NAT to allow pods to communicate with Google APIs

Question 5

A Cloud Run service needs to access resources in a VPC network (e.g., a Cloud SQL instance). The service should be able to send requests to the VPC and receive responses. What is the correct configuration?

Accepted Answer

Create a VPC connector and configure the Cloud Run service to use it for egress. Cloud Run can use a VPC connector (Serverless VPC Access) to send requests to a VPC. It does not allow inbound traffic from the VPC without additional setup.

Answer

Place the Cloud Run service in a VPC subnet

Answer

Use Cloud NAT to allow Cloud Run to access the VPC

Answer

Use VPC peering between Cloud Run and the VPC

Question 6

Your organization requires all container images deployed to GKE to be signed by an approved authority. Which service enforces that only signed images are allowed to run?

Accepted Answer

Binary Authorization. Binary Authorization enforces policies that require images to be signed by trusted authorities before they can be deployed on GKE.

Answer

Cloud Asset Inventory

Answer

Artifact Registry

Answer

Container Analysis

Question 7

A team is using Cloud Functions with a Cloud Storage trigger. They notice that sometimes the function does not execute after a file is uploaded. What is the most likely cause?

Accepted Answer

The Cloud Functions region is different from the bucket region. Cloud Functions requires that the function be deployed in the same region as the Cloud Storage bucket for event-driven triggers. If the region of the function differs from the bucket's region, the trigger will not deliver events, causing the function not to execute. This is a common misconfiguration that is often overlooked.

Answer

The function's memory limit is too low

Answer

The Cloud Storage bucket has object versioning enabled which changes event semantics

Answer

The function has too many concurrent invocations

Question 8

You have a Cloud Deploy delivery pipeline with an approval gate. You want to automatically roll back a release if the rollout fails during the deploy step. How should you configure the pipeline?

Accepted Answer

Set an automatic rollback policy in the delivery pipeline definition. Cloud Deploy does have a built-in automatic rollback feature via the `rollback_policy` in the delivery pipeline definition. Setting this policy automatically rolls back a release if the rollout fails during the deploy step. Option B describes a custom solution that is unnecessary because the native policy exists. Option C is incorrect because approval gates are for manual approval and cannot automatically trigger a rollback. Option D is incorrect because no such global flag exists. Therefore, option A is correct.

Answer

Use a Cloud Build post-deploy hook to check the rollout status and roll back if needed

Answer

Configure the approval gate to reject the deployment if it fails

Answer

Enable the 'rollback on failure' flag in the pipeline

Question 9

A GKE cluster has a Horizontal Pod Autoscaler (HPA) configured for CPU utilization. The pods are not scaling up even though CPU usage is high. What could be the reason?

Accepted Answer

The pods do not have resource requests defined. The HPA may not have permissions to read metrics or the metrics server might be unavailable. Also, the target CPU utilization might be set incorrectly. Another common issue is that the HPA is using the wrong metric or the pod resource requests are not set.

Answer

The cluster autoscaler is disabled

Answer

The HPA is configured with the wrong metric name

Answer

The node pool is out of capacity

Question 10

Your organization uses a Shared VPC to centrally manage network resources. A project that is not the host project needs to create a Cloud SQL instance using a private IP in the Shared VPC. What must be configured?

Accepted Answer

Enable the Service Networking API and allocate an IP range for the Cloud SQL instance. For a service project to allocate private IP in a Shared VPC, the Shared VPC host project must grant the service project the 'compute.networkUser' role on the subnetwork. Additionally, the service project needs the Service Networking API enabled and a private service access connection.

Answer

Create a VPC peering between the service project and the host project

Answer

Grant the service project the 'compute.networkUser' role on the VPC network

Answer

Use Cloud NAT to allow the Cloud SQL instance to communicate

Question 11

You want to monitor the latency of an application running on Compute Engine and create an alert if the 99th percentile latency exceeds 500ms for more than 5 minutes. Which approach should you use?

Accepted Answer

Create a Metric Threshold alert using the 'Latency' metric with a percentile alignment. Cloud Monitoring can create alerting policies based on distribution metrics (like latency) using percentile aggregations. You can define a metric threshold with a rolling window.

Answer

Use Cloud Trace to analyze latency and set a trace-based alert

Answer

Use Error Reporting to capture latency errors

Answer

Create a log-based metric from application logs and set an alert on that metric

Question 12

A company needs to store secrets such as API keys and database passwords securely and access them from Compute Engine instances. Which service provides secret storage with built-in IAM integration and automatic rotation?

Accepted Answer

Secret Manager. Secret Manager is the correct service for storing secrets with IAM and versioning. It also supports rotation via Cloud Functions or Pub/Sub.

Answer

Cloud HSM

Answer

Cloud Storage

Answer

Cloud KMS

Question 13

Which TWO services can be used to create a CI/CD pipeline for a containerized application on Google Cloud? (Choose 2)

Accepted Answer

Cloud Deploy. Cloud Build builds and tests, and Cloud Deploy promotes releases. Both are essential for CI/CD.

Answer

Cloud Functions

Answer

Cloud Scheduler

Answer

Cloud Run

Question 14

You are designing a multi-region deployment for a critical application on GKE. The application must withstand a regional outage and automatically redirect traffic to the healthy region. Which THREE components must be configured? (Choose 3)

Accepted Answer

Cloud Spanner. Multi-region GKE with global load balancing, multi-cluster ingress, and a multi-region database like Spanner are required.

Answer

Regional Cloud SQL

Answer

Cloud NAT

Question 15

You need to collect and analyze logs from multiple projects in a centralized BigQuery dataset for auditing. Which THREE steps are required? (Choose 3)

Accepted Answer

Use an aggregated sink at the organization or folder level to collect logs from all projects. To centralize logs from multiple projects into a single BigQuery dataset for auditing, the required steps are: (1) Use an aggregated sink at the organization or folder level to collect logs from all projects (option B) – this allows a single sink to route logs from all child projects. (2) Grant the Cloud Logging service account the 'bigquery.dataEditor' role on the dataset (option C) to permit writing logs. (3) Create a log exclusion filter to remove sensitive data (option D) – this is necessary for compliance when auditing logs to prevent exporting personally identifiable or confidential information. Per-project sinks (option E) are an alternative to an aggregated sink, not an additional requirement. VPC Flow Logs (option A) are a separate log source and not specifically required for centralizing logs to BigQuery.

Answer

Enable VPC Flow Logs in all projects

Answer

Create a log sink in each project that exports to a shared BigQuery dataset