Google PCA Managing and Provisioning a Solution Infrastructure Practice Test 6 — 15 Questions

Question 1

An engineer needs to share a VPC network across multiple projects in an organization while maintaining centralized network administration. Which approach should they use?

Accepted Answer

Shared VPC. Shared VPC in Google Cloud lets an organization designate a host project whose VPC network is shared with multiple service projects. This centralizes network administration (subnets, firewall rules, routes managed in the host project) while allowing teams in service projects to deploy resources into the shared network. It is the canonical answer for cross-project network sharing with centralized control.

Answer

VPC peering between all projects

Answer

Private Google Access

Answer

Cloud VPN between projects

Question 2

Which Google Cloud service allows you to create alerting policies based on log entries?

Accepted Answer

Cloud Monitoring. Cloud Monitoring (formerly Stackdriver) is the Google Cloud service that lets you create alerting policies, including log-based alerts that trigger on specific log entries. You define a query against Cloud Logging data, and Cloud Monitoring evaluates it and fires alerts when matching entries appear. This is the correct service for alerting based on log content.

Answer

Cloud Logging

Answer

Cloud Audit Logs

Answer

Error Reporting

Question 3

A company wants to use Cloud Deploy to automate deployments to GKE. They need to configure an approval gate that requires manual approval before promoting a release to a production cluster. Where is this approval gate defined?

Accepted Answer

In the delivery pipeline YAML under the 'target' definition. In Google Cloud Deploy, approval gates are defined within the delivery pipeline configuration, specifically under the target definition. The target represents a deployment environment (e.g., production cluster) and can include a 'requireApproval' field to enforce manual approval before any release is promoted to that target. This ensures that promotions to sensitive environments are gated by human intervention.

Answer

In the Cloud Scheduler job

Answer

In the GKE cluster as a constraint

Answer

In the cloudbuild.yaml file

Question 4

An organization wants to export their Cloud Logging logs to a centralized BigQuery dataset for long-term analysis. They also need to exclude logs from a specific source (e.g., a test project) to reduce costs. How should they set this up?

Accepted Answer

Create a log sink to BigQuery and add a log exclusion filter that excludes the test project's logs. A log sink to BigQuery with an exclusion filter is the correct way to export logs to a centralized dataset while excluding logs from a specific source. The exclusion filter is applied at the sink level, so logs from the test project are not exported, reducing costs. This setup can be created at the organization level to aggregate logs from multiple projects.

Answer

Disable logging in the test project

Answer

Create two separate sinks: one for production logs to BigQuery and another for test logs to Cloud Storage

Answer

Create a log sink to BigQuery and use IAM to restrict access to the test project's logs

Question 5

A developer needs to store a database password securely and access it from a Cloud Run service. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is Google Cloud's dedicated service for storing, managing, and accessing sensitive data such as API keys, passwords, and certificates. It provides versioning, IAM-based access control, audit logging, and automatic rotation, and Cloud Run can mount secrets as environment variables or volumes. This makes it the correct choice for storing a database password securely.

Answer

Cloud Storage

Answer

Firestore

Answer

Cloud KMS

Question 6

A company wants to monitor the performance of their microservices deployed on Cloud Run. They need to capture request latencies and error rates, and also trace requests across services. Which TWO services should they use?

Accepted Answer

Cloud Trace. Cloud Trace (A) is correct because it is Google Cloud's distributed tracing service, which collects and correlates latency data across microservices so a single request can be followed from one Cloud Run service to the next. Cloud Monitoring (E) is correct because it ingests Cloud Run request metrics such as request count, latency, and error rates, and lets you build dashboards and alerting policies on them. Together they satisfy the stated requirements of capturing request latencies and error rates while tracing requests across services. Error Reporting (B) only aggregates and groups application exceptions, Cloud Profiler (C) analyzes CPU and memory usage of running code, and Cloud Logging (D) stores log entries; none of these provide distributed tracing or the request-level latency and error-rate metrics required here.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Logging

Question 7

A finance company needs to ensure that all compute instances in their VPC can only communicate with Google APIs (e.g., Cloud Storage) over internal IPs. Additionally, instances without external IPs should be able to access the internet for updates. Which TWO configurations should they implement?

Accepted Answer

Configure Cloud NAT. Option A (Configure Cloud NAT) is correct because Cloud NAT lets instances that have no external IP addresses initiate outbound connections to the internet for updates, while keeping them unreachable from inbound internet traffic. Option C (Enable Private Google Access on the subnet) is correct because it allows instances without external IPs to reach Google APIs and services such as Cloud Storage using internal IP addresses rather than public ones. Together these two settings satisfy both requirements: private access to Google APIs and outbound internet access without external IPs. Option B is not needed because a firewall egress rule to 0.0.0.0/0 only permits traffic and does not by itself provide NAT or a route to the internet for instances lacking external IPs. Option D is wrong because assigning external IPs contradicts the goal of using internal IPs for Google API access and exposes instances to the internet. Option E is wrong because VPC peering connects VPC networks to each other and does not provide access to Google's public APIs or general internet connectivity.

Answer

Create a firewall rule allowing egress to 0.0.0.0/0

Answer

Assign external IPs to all instances

Answer

Use VPC peering with Google's public network

Question 8

A team is deploying a stateful application on GKE. They want to ensure that the application's pods are distributed across different zones for high availability and that during cluster upgrades, at least one pod remains available. Which THREE features should they configure?

Accepted Answer

Pod topology spread constraints. Option A (Pod topology spread constraints) is correct because topologySpreadConstraints with topologyKey set to topology.kubernetes.io/zone (and a whenUnsatisfiable policy such as DoNotSchedule or ScheduleAnyway) explicitly spreads pods evenly across zones, which is exactly what the team needs for zonal high availability. Option B (StatefulSet) is correct because a stateful application requires stable network identities, ordered deployment/scaling, and persistent volume claims per replica, all of which StatefulSet provides via its governing Service and volumeClaimTemplates. Option E (PodDisruptionBudget) is correct because a PDB with minAvailable: 1 (or maxUnavailable: 0) ensures that during voluntary disruptions such as node drains in a cluster upgrade, at least one pod remains running. Option C (Cluster autoscaler) is not correct because it only adds or removes nodes based on pending pods and resource pressure; it does not control zonal pod distribution or guarantee availability during upgrades. Option D (Horizontal Pod Autoscaler) is not correct because it scales replica counts based on metrics like CPU or custom metrics, which addresses load-based scaling rather than zonal spreading or upgrade-time availability guarantees.

Answer

Cluster autoscaler

Answer

Horizontal Pod Autoscaler

Question 9

A DevOps team uses Cloud Build to deploy Docker images to GKE. They want to ensure that only images that have passed a vulnerability scan and been signed by a trusted authority can be deployed. Which service should they integrate with Cloud Build and GKE?

Accepted Answer

Binary Authorization. Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed to GKE. It integrates with Cloud Build to sign images after vulnerability scanning and with GKE to enforce policies that only allow signed images. This directly meets the requirement of ensuring only scanned and signed images are deployed.

Answer

Artifact Analysis

Answer

Cloud Security Scanner

Answer

Cloud Key Management Service

Question 10

A company uses Cloud Deploy for continuous delivery. They have a delivery pipeline with multiple targets: dev, staging, and prod. They want to require manual approval before deploying to prod. How should they configure this?

Accepted Answer

Configure an approval gate on the prod target in the delivery pipeline. Google Cloud Deploy supports approval gates on targets, which pause a rollout and require manual approval before proceeding to the next target. Configuring an approval gate on the prod target in the delivery pipeline enforces the manual approval requirement natively.

Answer

Add a Cloud Build trigger that pauses and waits for approval

Answer

Use IAM conditions to restrict deployment to prod

Answer

Set up a Pub/Sub notification and a Cloud Function to approve

Question 11

A developer is writing a Cloud Function that processes files uploaded to a Cloud Storage bucket. Which trigger should they use?

Accepted Answer

Cloud Storage trigger. To process files uploaded to a Cloud Storage bucket, the developer should use a Cloud Storage trigger. This trigger type is specifically designed to invoke a Cloud Function in response to events in a Cloud Storage bucket, such as object creation, deletion, or metadata updates.

Answer

HTTP trigger

Answer

Firestore trigger

Answer

Pub/Sub trigger

Question 12

A company has a Shared VPC with a service project hosting GKE clusters. The GKE nodes need to access Cloud SQL instances in the host project. The team wants to avoid public IP and use Private Service Access. They have configured a VPC peering between the host VPC and the service producer VPC for Cloud SQL. However, the GKE pods cannot reach the Cloud SQL instance. What is the most likely cause?

Accepted Answer

The service project is not authorized in the Cloud SQL instance. The most likely cause is that the service project is not authorized in the Cloud SQL instance. After configuring Private Service Access (VPC peering) between the host VPC and the service producer VPC, you must explicitly authorize the service project's VPC network in the Cloud SQL instance's private network configuration. Without this authorization, connection attempts from GKE pods will fail. Option B is incorrect because Private Service Connect is not required; VPC peering is sufficient for connectivity once authorization is granted. Option A is incorrect because the Cloud SQL instance is configured with a private IP via Private Service Access. Option D is incorrect because firewall rules in the host VPC do not block traffic over VPC peering by default; the issue is authorization, not firewall rules.

Answer

The Cloud SQL instance is not configured with a private IP

Answer

The service project needs a Private Service Connect endpoint to access the Cloud SQL instance

Answer

The firewall rules in the host VPC block egress from the service project

Question 13

A team wants to collect and analyze logs from multiple projects into a centralized BigQuery dataset for long-term retention and SQL querying. They want to exclude health check logs to reduce costs. Which approach should they use?

Accepted Answer

Create a log sink to BigQuery and add a log exclusion filter for health check logs. A log sink routes log entries from Cloud Logging to a destination such as BigQuery, and an exclusion filter on the sink prevents matching entries (health check logs) from being exported, reducing cost. This is the native, supported way to centralize logs in BigQuery while filtering out unwanted entries at the source. The sink can be created at the organization or folder level to aggregate multiple projects.

Answer

Use Cloud Monitoring to exclude health check logs

Answer

Create a log metric for health check logs and filter in BigQuery

Answer

Set up a Cloud Function to delete health check logs from BigQuery

Question 14

An organization runs a stateful application on GKE that must not lose data during cluster upgrades or node repairs. The application uses persistent volumes with ReadWriteOnce access mode. The team wants to ensure pods are not evicted simultaneously. Which Kubernetes resource should they configure?

Accepted Answer

PodDisruptionBudget. A PodDisruptionBudget (PDB) limits how many pods of a given workload can be voluntarily disrupted at once, ensuring that during node drains (cluster upgrades, node repairs) not all replicas of a stateful application are evicted simultaneously. By setting minAvailable or maxUnavailable, the PDB forces the eviction API to respect availability constraints, protecting data integrity for ReadWriteOnce volumes that cannot be mounted by multiple pods at once.

Answer

ClusterAutoscaler

Answer

HorizontalPodAutoscaler

Answer

VerticalPodAutoscaler

Question 15

A team wants to deploy a microservice on Cloud Run that needs to access a Cloud Memorystore for Redis instance in the same region. The Redis instance is in a VPC network. Which configuration is required for Cloud Run to reach the Redis instance?

Accepted Answer

Create a Serverless VPC Access connector and configure Cloud Run to use it. Cloud Run is serverless and runs outside the customer VPC by default. To reach a Memorystore Redis instance inside a VPC, you must create a Serverless VPC Access connector and attach it to the Cloud Run service, enabling egress to the VPC. This provides private IP connectivity to Redis.

Answer

Configure a Cloud NAT gateway

Answer

Use Private Google Access

Answer

Deploy Cloud Run within a VPC