Google PCA Managing and Provisioning a Solution Infrastructure Practice Test 3 — 15 Questions

Question 1

A company runs a public-facing web application on Compute Engine instances behind an external Application Load Balancer. Security requires that the backend instances accept traffic only from the load balancer and never from arbitrary internet clients, while still allowing health checks. Which configuration should the architect apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a firewall rule allowing ingress on ports 80 and 443 from 130.211.0.0/22 and 35.191.0.0/16, and apply a network tag to the backend instances so the rule targets only them.. External Application Load Balancer traffic reaches backends from the Google Front End proxy and health check ranges, so a firewall rule permitting only 130.211.0.0/22 and 35.191.0.0/16 closes direct internet access while preserving proxied client requests and health probes. Tagging the backends confines the rule to the intended instances.

Answer

Configure the backend service with a Cloud Armor security policy that blocks all source IP addresses except the load balancer, and leave the default allow-all ingress rule in place.

Answer

Create a firewall rule allowing ingress on ports 80 and 443 from 0.0.0.0/0, and rely on the load balancer to drop malicious requests before they reach the instances.

Answer

Create a firewall rule allowing ingress on ports 80 and 443 from the health check source ranges and from 130.211.0.0/22 and 35.191.0.0/16, and remove any rule permitting 0.0.0.0/0.

Question 2

A company is deploying a new internal API on Cloud Run. The API must be reachable only from the corporate VPC network and must not be accessible from the public internet. The company already has a VPC with a subnet and wants to avoid exposing a public endpoint. What should the architect configure?

Accepted Answer

Deploy the Cloud Run service with ingress set to internal and internal and external (including load balancer) traffic restricted, and invoke it through a Serverless VPC Access connector.. Restricting Cloud Run ingress to internal removes the public endpoint and limits reachability to the VPC network and authorized internal sources. A Serverless VPC Access connector provides the private network path the service needs to reach and be reached by internal resources, meeting the requirement without exposing the API to the internet.

Answer

Deploy the Cloud Run service with a static external IP address reserved and a firewall rule that allows only corporate CIDR ranges.

Answer

Deploy the Cloud Run service with ingress set to internal and attach an external Application Load Balancer with a public IP address.

Answer

Deploy the Cloud Run service with the default ingress setting and rely on IAM to block unauthenticated callers.

Question 3

A healthcare company stores patient imaging data in a Cloud Storage bucket in the us-central1 region. Auditors require that the data be readable within 30 days of a loss event and that a copy exist in the europe-west4 region. The architect must minimize storage cost while meeting both requirements. What should the architect do?

Accepted Answer

Create a dual-region bucket with the us-central1 and europe-west4 regions and enable turbo replication.. A dual-region bucket places redundant object copies in two specified regions and provides automatic, continuous replication, so the europe-west4 copy exists without custom jobs. Turbo replication reduces the recovery point objective to about 15 minutes, comfortably inside the 30-day readability window. This integrated redundancy is the intended low-touch, cost-effective way to meet cross-region durability and availability requirements for a fixed pair of regions.

Answer

Set the bucket's default storage class to Nearline and enable Autoclass.

Answer

Create a multi-region bucket in the EU and configure a lifecycle rule to copy objects to us-central1.

Answer

Keep the regional bucket and schedule a daily Storage Transfer Service job to a bucket in europe-west4.

Question 4

A media company stores 400 TB of video archives in a Cloud Storage bucket in the us multi-region. Compliance requires that the data be readable only by services running inside a specific VPC network in project media-prod, and that access never traverse the public internet. The team wants to avoid managing proxy VMs or VPN appliances. Which approach should the architect choose?

Accepted Answer

Configure VPC Service Controls with a service perimeter around project media-prod that includes Cloud Storage, and restrict access with ingress and egress rules.. VPC Service Controls creates a service perimeter that includes Cloud Storage, so API requests originating outside the perimeter are blocked even when IAM would otherwise permit them. This confines reads to workloads inside the protected project boundary and prevents access over the public internet, without needing proxy VMs, VPN appliances, or unsupported endpoint configurations.

Answer

Deploy a Shared VPC and move the bucket into the host project so that only host project resources can access it.

Answer

Create a Private Service Connect endpoint for Cloud Storage in the VPC, and configure the bucket's IAM policy to grant access only to the service accounts used by workloads in that VPC.

Answer

Enable Private Google Access on the subnet and remove the default internet gateway route so that instances cannot reach public endpoints.

Question 5

A financial services firm runs a latency-sensitive trading application on Compute Engine instances in a single region. The application must be resilient to the loss of an entire zone, and the recovery must not depend on a human operator approving a failover. The firm also wants to avoid re-architecting the application, which stores session state on local SSD. What should the architect recommend?

Accepted Answer

Deploy a regional managed instance group with instances distributed across zones, and configure an application-based health check with automatic instance replacement.. A regional managed instance group distributes instances across zones and uses health checking to detect and replace failed instances automatically, so the loss of one zone triggers self-healing in the remaining zones without human action. Because the workload stays on Compute Engine instances, the application does not need to be re-architected, satisfying the constraint about session state stored on local SSD.

Answer

Deploy instances in two zones and use a global external Application Load Balancer with a failover backend bucket that serves a static maintenance page.

Answer

Deploy a zonal managed instance group and use a scheduled Cloud Scheduler job to resize the group when monitoring detects a zone outage.

Answer

Create a custom image of the application instance and document a runbook for rebuilding instances in another zone after an outage is declared.

Question 6

A retail company runs a batch inventory synchronization job on Compute Engine that writes to Cloud SQL for PostgreSQL. The job runs nightly for about 90 minutes and currently runs on a single large VM. The team wants to reduce the job's wall-clock time by splitting the work across multiple VMs while ensuring that the database is not overwhelmed by concurrent connections. Which approach should the architect recommend?

Accepted Answer

Deploy the job on multiple VMs that write to Cloud SQL through a connection pooler such as PgBouncer, and shard the inventory ranges across the VMs.. Splitting the inventory ranges across several VMs parallelizes the batch work and cuts the 90-minute runtime. Routing those connections through PgBouncer multiplexes client sessions onto a bounded set of server connections, so Cloud SQL for PostgreSQL is not overwhelmed as the fleet scales. Together, sharding plus connection pooling meet both the performance and the database-protection goals without over-provisioning the instance.

Answer

Use a Dataproc cluster with a JDBC connector to Cloud SQL, letting Spark executors write in parallel directly to the database.

Answer

Increase the Cloud SQL instance size to the largest machine type and run the job from a single VM with a higher vCPU count.

Answer

Create a managed instance group of VMs that each connect directly to Cloud SQL using the Cloud SQL Auth Proxy, and let each VM process a shard of the inventory data.

Question 7

A logistics company is planning a migration of 60 on-premises VMware virtual machines to Google Cloud. The architect must choose a migration approach that minimizes application changes, supports cutover with a short downtime window, and allows the team to test the migrated workloads before committing. Which two approaches should the architect recommend? (Choose two.)

Accepted Answer

Perform a lift-and-shift by exporting each VM as an OVA and importing it with the gcloud compute images import command into a custom image for Compute Engine.. Migrate to Virtual Machines provides continuous replication with test clones and a short cutover, while exporting OVAs and importing them as Compute Engine images delivers a true lift-and-shift that preserves guest applications for pre-cutover validation. Both avoid re-platforming and keep downtime bounded, unlike cold image copies or containerization efforts.

Answer

Use Storage Transfer Service to copy VM disk images to Cloud Storage, then create instances from those images after the source VMs are powered off.

Answer

Re-architect each application into Cloud Run services and migrate the databases to Firestore before decommissioning the on-premises hosts.

Answer

Deploy Anthos clusters on VMware on-premises and register them to Google Cloud so the VMs run unchanged in a hybrid control plane.

Question 8

A financial services firm runs a three-tier application in a Shared VPC. The host project contains the shared network, and each environment (dev, test, prod) is a separate service project. The security team wants to ensure that a compromised dev VM cannot initiate connections to prod database instances, even though both are attached to the same Shared VPC. What should the architect implement?

Accepted Answer

Use VPC firewall policies with hierarchical rules applied to the host project and service projects to enforce environment-level egress and ingress controls.. VPC firewall policies apply hierarchically and can be associated with projects in a Shared VPC, so rules defined at the organization or folder level are inherited by all service projects. An egress rule that blocks the dev project from reaching prod database instances enforces segmentation by project identity rather than by mutable VM tags, which is more robust and centrally managed than per-VM firewall rules.

Answer

Move each environment into its own VPC network and peer them with the host project using VPC Network Peering.

Answer

Create a firewall rule in the host project that denies ingress to prod database tags from the dev subnet range, with a higher priority number than the allow rules.

Answer

Enable VPC Flow Logs on all subnets and create an alerting policy for dev-to-prod traffic.

Question 9

A company uses Cloud Deployment Manager to manage infrastructure. They want to roll back to a previous deployment state after a failed update. What is the recommended approach?

Accepted Answer

Run gcloud deployment-manager deployments update --config . Cloud Deployment Manager does not provide a native rollback command; the documented way to revert to a prior state is to re-run an update using the previous configuration and manifest files. Running 'gcloud deployment-manager deployments update --config ' reapplies the earlier desired state, effectively rolling the deployment back to that point.

Answer

Use gcloud deployment-manager deployments rollback --deployment <name>

Answer

Use the --update-policy=PARTIAL flag to selectively revert changes

Answer

Delete the deployment and recreate it from the previous template

Question 10

An organization has multiple GCP projects managed by a central operations team. They want to define a common VPC configuration in a host project and allow service projects to use it. Which networking feature should they use?

Accepted Answer

Shared VPC. Shared VPC allows an organization to designate a host project that owns the VPC network and subnets, and then attach service projects so their resources (VMs, GKE clusters, etc.) can use that shared network. This centralizes network administration under the operations team while letting service teams deploy workloads in their own projects. It is the canonical GCP feature for exactly this host-project/service-project pattern.

Answer

Private Service Connect

Answer

Cloud VPN

Answer

VPC peering

Question 11

A Cloud Run service needs to connect to a Cloud SQL MySQL instance privately without using public IP. What must be configured?

Accepted Answer

Deploy a VPC connector and attach it to the Cloud Run service. To connect a Cloud Run service to a Cloud SQL instance privately without using public IP, you must deploy a Serverless VPC Access connector and attach it to the Cloud Run service. This connector allows Cloud Run to route traffic to the VPC network, where Cloud SQL's private IP resides. The connection uses the VPC's internal IP range, ensuring private communication.

Answer

Set up VPC Network Peering between Cloud Run and Cloud SQL

Answer

Enable Private Google Access on the VPC subnet

Answer

Use Cloud SQL Proxy as a sidecar container

Question 12

Which GCP service should be used to automatically scale a GKE cluster's number of nodes based on pending pods?

Accepted Answer

Cluster Autoscaler. The GKE Cluster Autoscaler watches for pods that cannot be scheduled due to insufficient node capacity and automatically adds nodes to the node pool (and removes underutilized nodes). This is exactly the behavior described — scaling the cluster's node count based on pending pods.

Answer

Vertical Pod Autoscaler (VPA)

Answer

Node Auto-Provisioning

Answer

Horizontal Pod Autoscaler (HPA)

Question 13

An engineer is troubleshooting a Cloud Build trigger that fails with the error 'PERMISSION_DENIED: Cloud Build service account does not have permission to access Artifact Registry'. The build needs to push a Docker image to Artifact Registry. What is the correct IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/artifactregistry.writer. Cloud Build's service account needs to push images to Artifact Registry, which requires write access to repositories. The predefined role roles/artifactregistry.writer grants exactly the permissions needed to upload and delete artifacts (including Docker image push) within Artifact Registry repositories. Assigning this role to the Cloud Build service account resolves the PERMISSION_DENIED error while following least privilege.

Answer

roles/artifactregistry.viewer

Answer

roles/editor

Answer

roles/storage.objectAdmin

Question 14

Which GCP service provides distributed tracing to help analyze latency in microservices applications?

Accepted Answer

Cloud Trace. Cloud Trace is Google Cloud's distributed tracing service, designed to collect latency data across microservices and display it as traces and spans. It helps identify performance bottlenecks in distributed applications. Cloud Profiler, Logging, and Monitoring serve different observability roles and do not provide distributed tracing.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 15

A developer wants to deploy a Cloud Function that is triggered whenever a new object is created in a Cloud Storage bucket. Which trigger type should they choose?

Accepted Answer

Cloud Storage trigger. A Cloud Storage trigger is specifically designed to invoke a Cloud Function in response to object events in a Cloud Storage bucket, such as object creation (google.storage.object.finalize). This is the direct and native trigger type for 'new object created in a bucket' scenarios. It eliminates the need for additional event routing or polling.

Answer

Firestore trigger

Answer

Pub/Sub trigger

Answer

HTTP trigger