Google PCA Managing and Provisioning a Solution Infrastructure Practice Test 5 — 15 Questions

Question 1

A company wants to automate the creation and management of Google Cloud resources using an infrastructure-as-code tool that supports configuration drift detection and is Google Cloud-native. Which tool should they use?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager is Google Cloud's native infrastructure-as-code service that supports YAML, Python, and Jinja templates and can detect configuration drift.

Answer

Terraform

Answer

Cloud SDK

Answer

Cloud Build

Question 2

A DevOps team uses Cloud Build to deploy Docker images to GKE. They want to ensure that only images that have passed a vulnerability scan and been signed by a trusted authority can be deployed. Which service should they integrate with Cloud Build and GKE?

Accepted Answer

Binary Authorization. Binary Authorization enforces policies that require images to be signed by trusted authorities and verified before deployment on GKE.

Answer

Artifact Analysis

Answer

Cloud Security Scanner

Answer

Cloud Key Management Service

Question 3

An organization runs a Cloud Run service that processes incoming HTTP requests. Under heavy load, some requests timeout. The team wants to reduce cold starts and ensure consistent performance. They set min instances to 1, but the issue persists. Which additional configuration should they change?

Accepted Answer

Set CPU always allocated to true. Increasing CPU allocation ensures that even idle instances have CPU, reducing latency for incoming requests.

Answer

Reduce concurrency

Answer

Increase max instances

Answer

Increase request timeout

Question 4

A company uses Cloud Deploy for continuous delivery. They have a delivery pipeline with multiple targets: dev, staging, and prod. They want to require manual approval before deploying to prod. How should they configure this?

Accepted Answer

Configure an approval gate on the prod target in the delivery pipeline. Approval gates in Cloud Deploy are configured as phases within a delivery pipeline, where a required approval step blocks progression until manually approved.

Answer

Add a Cloud Build trigger that pauses and waits for approval

Answer

Use IAM conditions to restrict deployment to prod

Answer

Set up a Pub/Sub notification and a Cloud Function to approve

Question 5

A developer is writing a Cloud Function that processes files uploaded to a Cloud Storage bucket. Which trigger should they use?

Accepted Answer

Cloud Storage trigger. Cloud Functions can be triggered by Cloud Storage events such as object finalize, delete, etc.

Answer

HTTP trigger

Answer

Firestore trigger

Answer

Pub/Sub trigger

Question 6

A company has a Shared VPC with a service project hosting GKE clusters. The GKE nodes need to access Cloud SQL instances in the host project. The team wants to avoid public IP and use Private Service Access. They have configured a VPC peering between the host VPC and the service producer VPC for Cloud SQL. However, the GKE pods cannot reach the Cloud SQL instance. What is the most likely cause?

Accepted Answer

The service project is not authorized in the Cloud SQL instance. The most likely cause is that the service project is not authorized in the Cloud SQL instance. After configuring Private Service Access (VPC peering) between the host VPC and the service producer VPC, you must explicitly authorize the service project's VPC network in the Cloud SQL instance's private network configuration. Without this authorization, connection attempts from GKE pods will fail. Option B is incorrect because Private Service Connect is not required; VPC peering is sufficient for connectivity once authorization is granted. Option A is incorrect because the Cloud SQL instance is configured with a private IP via Private Service Access. Option D is incorrect because firewall rules in the host VPC do not block traffic over VPC peering by default; the issue is authorization, not firewall rules.

Answer

The Cloud SQL instance is not configured with a private IP

Answer

The service project needs a Private Service Connect endpoint to access the Cloud SQL instance

Answer

The firewall rules in the host VPC block egress from the service project

Question 7

A team wants to collect and analyze logs from multiple projects into a centralized BigQuery dataset for long-term retention and SQL querying. They want to exclude health check logs to reduce costs. Which approach should they use?

Accepted Answer

Create a log sink to BigQuery and add a log exclusion filter for health check logs. Log sinks can route logs to BigQuery, and exclusion filters can be applied to filter out specific logs before they are ingested.

Answer

Use Cloud Monitoring to exclude health check logs

Answer

Create a log metric for health check logs and filter in BigQuery

Answer

Set up a Cloud Function to delete health check logs from BigQuery

Question 8

An organization runs a stateful application on GKE that must not lose data during cluster upgrades or node repairs. The application uses persistent volumes with ReadWriteOnce access mode. The team wants to ensure pods are not evicted simultaneously. Which Kubernetes resource should they configure?

Accepted Answer

PodDisruptionBudget. PodDisruptionBudget (PDB) specifies the minimum number of available pods that must remain up during voluntary disruptions, such as node upgrades.

Answer

ClusterAutoscaler

Answer

HorizontalPodAutoscaler

Answer

VerticalPodAutoscaler

Question 9

A company has a GKE cluster with Workload Identity enabled. A pod needs to access a BigQuery dataset in a different project. The team has created a service account in the pod's project and granted it BigQuery Data Viewer on the dataset. They also created an IAM policy binding between the Kubernetes service account and the Google service account. The pod still gets permission denied. What is missing?

Accepted Answer

The Google service account needs the iam.workloadIdentityUser role on itself. Workload Identity requires the Google service account to be granted the iam.workloadIdentityUser role on the Google service account itself, not just on the Kubernetes service account.

Answer

The Kubernetes service account needs the iam.workloadIdentityUser role

Answer

The pod needs a node pool with Workload Identity enabled

Answer

The BigQuery dataset must be in the same project as the cluster

Question 10

A team wants to deploy a microservice on Cloud Run that needs to access a Cloud Memorystore for Redis instance in the same region. The Redis instance is in a VPC network. Which configuration is required for Cloud Run to reach the Redis instance?

Accepted Answer

Create a Serverless VPC Access connector and configure Cloud Run to use it. Cloud Run services can connect to a VPC using a Serverless VPC Access connector, which provides private network access.

Answer

Configure a Cloud NAT gateway

Answer

Use Private Google Access

Answer

Deploy Cloud Run within a VPC

Question 11

A company wants to automatically apply security patches to Compute Engine instances running Windows Server. They need a solution that can schedule patch installations and report compliance. Which service should they use?

Accepted Answer

OS Config. OS Config’s patch management feature allows scheduling and monitoring of OS patches across VM instances.

Answer

Cloud Monitoring

Answer

Cloud Deploy

Answer

Cloud Build

Question 12

A data science team wants to run training jobs on a GKE cluster. The jobs are resource-intensive and can tolerate interruptions. To reduce costs, the team wants to use preemptible VMs for the node pool. Which additional step should they take to ensure training jobs are not lost when nodes are preempted?

Accepted Answer

Enable cluster autoscaler on the node pool. A cluster autoscaler with a node pool of preemptible VMs will replace preempted nodes. For job resilience, the application should be designed to handle interruptions, but at the infrastructure level, enabling cluster autoscaler ensures new nodes are added.

Answer

Use a PodDisruptionBudget

Answer

Set up a Cloud Scheduler job to recreate nodes

Answer

Configure a Vertical Pod Autoscaler

Question 13

A company is migrating a legacy application that uses a file server to GCP. The application requires a shared file system that supports the NFS protocol and can be mounted by multiple Compute Engine instances. The team also needs to use Cloud NAT to allow the instances to download updates. Which TWO services should they use? (Choose 2)

Accepted Answer

Cloud NAT. Filestore provides NFS file shares, and Cloud NAT allows instances without public IPs to access the internet for updates.

Answer

Cloud VPN

Answer

Cloud Storage Fuse

Answer

Private Google Access

Question 14

A company wants to implement a CI/CD pipeline for a Java application that will be deployed to Cloud Run. They use Cloud Build and Artifact Registry. The pipeline must compile the Java code, run unit tests, build a container image, and deploy to Cloud Run. Which THREE steps are required in the cloudbuild.yaml? (Choose 3)

Accepted Answer

Step with image 'docker' and args: ['build', '-t', '...']. To compile Java, use a Maven or Gradle step. Build the image using docker build. Deploy to Cloud Run using gcloud run deploy.

Answer

Step with image 'gcloud' and entrypoint: 'gcloud', args: ['container', 'clusters', 'get-credentials']

Answer

Step with image 'node' and entrypoint: 'npm', args: ['test']

Question 15

A company wants to store application secrets such as API keys and database passwords securely and audit access. They also need to automatically rotate secrets periodically. Which TWO Google Cloud services should they use? (Choose 2)

Accepted Answer

Cloud Scheduler. Secret Manager stores secrets with versioning and IAM control, and Cloud Scheduler can trigger rotations.

Answer

Cloud Deployment Manager

Answer

Cloud Storage

Answer

Cloud Key Management Service