Google PCA Managing and Provisioning a Solution Infrastructure Practice Test 4 — 15 Questions

Question 1

A DevOps team wants to manage Google Cloud resources declaratively using Infrastructure as Code. They need to version control their configuration and automate deployments. Which two tools are natively supported by Google Cloud for this purpose?

Accepted Answer

Cloud Deployment Manager and Terraform. Cloud Deployment Manager uses YAML, Python, or Jinja templates, and Terraform is a popular IaC tool with a native Google Cloud provider. Both allow declarative management and version control.

Answer

Cloud Shell and gcloud CLI

Answer

AWS CloudFormation and Terraform

Answer

Ansible and Puppet

Question 2

An organization is using Cloud Build to build container images and push them to Artifact Registry. Which step in the cloudbuild.yaml file is necessary to tag and push the image?

Accepted Answer

A step that runs 'docker push' with the Artifact Registry URL. The 'docker push' step with the destination in Artifact Registry is required to push the built image to a registry.

Answer

A step that runs 'gcloud container images push'

Answer

A step that runs 'gsutil cp' to upload the image

Answer

A step that runs 'kubectl apply'

Question 3

A company wants to deploy a microservice on Cloud Run that requires high throughput and low latency. The service processes requests that can spike unpredictably. The team wants to minimize cold starts and ensure availability during traffic bursts. Which combination of Cloud Run settings should they configure?

Accepted Answer

min-instances = 1, max-instances = 100, concurrency = 80. Setting min instances to 1 ensures at least one instance is always warm, eliminating cold starts. Max instances should be high to handle bursts. Concurrency should be set to the maximum the container can handle to maximize throughput.

Answer

min-instances = 1, max-instances = 1, concurrency = 80

Answer

min-instances = 0, max-instances = 100, concurrency = 1

Answer

min-instances = 0, max-instances = 10, concurrency = 80

Question 4

A team uses Cloud Functions triggered by Cloud Storage events to process uploaded images. They want to ensure that only HTTP-triggered functions can be invoked from outside the project. Which configuration should they apply?

Accepted Answer

Set --ingress-settings=internal-only on the HTTP function. For Cloud Functions (1st gen), setting --ingress-settings=internal-only restricts invocation to within the project. For Cloud Functions (2nd gen), using an ingress setting of 'all' allows external invocation; using 'internal-only' blocks external calls.

Answer

Add a VPC firewall rule to allow only internal traffic

Answer

Remove the Cloud Storage trigger function's trigger

Answer

Set --ingress-settings=all on the HTTP function

Question 5

What is the purpose of a Pod Disruption Budget (PDB) in GKE?

Accepted Answer

To ensure a minimum number of pods are always available during voluntary disruptions. A PDB limits the number of pods of a replicated application that can be down simultaneously from voluntary disruptions (e.g., node upgrades, cluster autoscaler evictions).

Answer

To automatically scale pods based on CPU usage

Answer

To distribute pods across different zones

Answer

To prevent any pod from being terminated

Question 6

A company wants to enforce that only container images built and signed by their CI/CD pipeline can be deployed in their GKE cluster. Which Google Cloud service should they use?

Accepted Answer

Binary Authorization. Binary Authorization enforces that only trusted images (signed by authorities) are deployed. It integrates with GKE and Cloud Build to verify signatures.

Answer

Artifact Analysis

Answer

Cloud Audit Logs

Answer

Cloud Security Command Center

Question 7

An engineer needs to share a VPC network across multiple projects in an organization while maintaining centralized network administration. Which approach should they use?

Accepted Answer

Shared VPC. Shared VPC allows a host project to share its VPC network with service projects, enabling centralized network administration. VPC peering connects separate VPCs but does not allow centralized administration.

Answer

VPC peering between all projects

Answer

Private Google Access

Answer

Cloud VPN between projects

Question 8

Which Google Cloud service allows you to create alerting policies based on log entries?

Accepted Answer

Cloud Monitoring. Cloud Monitoring is the service that manages alerting policies, including those triggered by log-based metrics. While Cloud Logging provides the interface to create log-based metrics from log entries, the alerting policy itself is created and managed in Cloud Monitoring. Therefore, the correct service for creating alerting policies based on log entries is Cloud Monitoring.

Answer

Cloud Logging

Answer

Cloud Audit Logs

Answer

Error Reporting

Question 9

A company wants to use Cloud Deploy to automate deployments to GKE. They need to configure an approval gate that requires manual approval before promoting a release to a production cluster. Where is this approval gate defined?

Accepted Answer

In the delivery pipeline YAML under the 'target' definition. In Cloud Deploy, approval gates are defined per target in the delivery pipeline configuration. The target resource specifies whether an approval is required.

Answer

In the Cloud Scheduler job

Answer

In the GKE cluster as a constraint

Answer

In the cloudbuild.yaml file

Question 10

An organization wants to export their Cloud Logging logs to a centralized BigQuery dataset for long-term analysis. They also need to exclude logs from a specific source (e.g., a test project) to reduce costs. How should they set this up?

Accepted Answer

Create a log sink to BigQuery and add a log exclusion filter that excludes the test project's logs. A log sink exports logs to BigQuery. To exclude logs from a test project, create a log exclusion filter that matches the test project's logs and apply it to the sink or the project's logs bucket.

Answer

Disable logging in the test project

Answer

Create two separate sinks: one for production logs to BigQuery and another for test logs to Cloud Storage

Answer

Create a log sink to BigQuery and use IAM to restrict access to the test project's logs

Question 11

A team is using GKE with cluster autoscaling enabled. They notice that some nodes are underutilized but the cluster autoscaler does not remove them. What could be the reason?

Accepted Answer

The node has pods with restrictive PodDisruptionBudgets. The cluster autoscaler does not remove a node if there are pods that cannot be rescheduled elsewhere. This can happen due to PodDisruptionBudgets, local storage, or node-specific constraints.

Answer

The node is in a different zone

Answer

The node has running pods that are part of a DaemonSet

Answer

The cluster autoscaler is not configured to scale down

Question 12

A developer needs to store a database password securely and access it from a Cloud Run service. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager securely stores secrets like passwords, API keys, and certificates. It integrates with Cloud Run via volume mounts or environment variables.

Answer

Cloud Storage

Answer

Firestore

Answer

Cloud KMS

Question 13

A company wants to monitor the performance of their microservices deployed on Cloud Run. They need to capture request latencies and error rates, and also trace requests across services. Which TWO services should they use?

Accepted Answer

Cloud Trace. Cloud Monitoring collects metrics like latency and error rates and can create dashboards and alerts. Cloud Trace collects latency data across services for distributed tracing.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Logging

Question 14

A finance company needs to ensure that all compute instances in their VPC can only communicate with Google APIs (e.g., Cloud Storage) over internal IPs. Additionally, instances without external IPs should be able to access the internet for updates. Which TWO configurations should they implement?

Accepted Answer

Configure Cloud NAT. Private Google Access allows VMs to use internal IPs to access Google APIs. Cloud NAT enables outbound internet access for instances without external IPs.

Answer

Create a firewall rule allowing egress to 0.0.0.0/0

Answer

Assign external IPs to all instances

Answer

Use VPC peering with Google's public network

Question 15

A team is deploying a stateful application on GKE. They want to ensure that the application's pods are distributed across different zones for high availability and that during cluster upgrades, at least one pod remains available. Which THREE features should they configure?

Accepted Answer

Pod topology spread constraints. Pod topology spread constraints distribute pods across zones. PodDisruptionBudget ensures minimum available pods during voluntary disruptions. Cluster autoscaler is not directly for availability, but for scaling nodes. StatefulSet is for stateful workloads but doesn't guarantee zone distribution without constraints.

Answer

Cluster autoscaler

Answer

Horizontal Pod Autoscaler