Google PCA Managing and Provisioning a Solution Infrastructure Practice Test 7 — 15 Questions

Question 1

A company wants to automatically apply security patches to Compute Engine instances running Windows Server. They need a solution that can schedule patch installations and report compliance. Which service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

OS Config. OS Config (now part of VM Manager) provides patch management for Compute Engine instances, including Windows Server, with the ability to schedule patch jobs, define patch windows, and report compliance through the OS Config API and Cloud Console. It is the native Google Cloud service designed for OS patch deployment and compliance reporting across fleets of VMs.

Answer

Cloud Monitoring

Answer

Cloud Deploy

Answer

Cloud Build

Question 2

A company is migrating a legacy application that uses a file server to GCP. The application requires a shared file system that supports the NFS protocol and can be mounted by multiple Compute Engine instances. The team also needs to use Cloud NAT to allow the instances to download updates. Which TWO services should they use? (Choose 2)

Accepted Answer

Cloud NAT. Cloud Filestore (D) is correct because it is GCP's fully managed file storage service that natively supports the NFSv3 protocol and can be mounted simultaneously by multiple Compute Engine instances, which is exactly what the legacy application requires for its shared file system. Cloud NAT (A) is correct because it provides outbound internet access for instances without external IP addresses, allowing them to download updates while remaining unreachable from the internet. Cloud VPN (B) is not appropriate here because it establishes encrypted tunnels to on-premises or other networks, not a shared NFS file system or outbound NAT. Cloud Storage Fuse (C) is not correct because it mounts Cloud Storage buckets as a local file system via a FUSE adapter, which does not provide a true NFS-protocol shared file system for multiple instances. Private Google Access (E) is not correct because it only enables instances without external IPs to reach Google APIs and services, not general internet downloads, which is what Cloud NAT handles.

Answer

Cloud VPN

Answer

Cloud Storage Fuse

Answer

Private Google Access

Question 3

A company wants to implement a CI/CD pipeline for a Java application that will be deployed to Cloud Run. They use Cloud Build and Artifact Registry. The pipeline must compile the Java code, run unit tests, build a container image, and deploy to Cloud Run. Which THREE steps are required in the cloudbuild.yaml? (Choose 3)

Accepted Answer

Step with image 'docker' and args: ['build', '-t', '...']. Option B is correct because building the container image for the Java application requires a Docker build step (e.g., image 'docker' with args ['build', '-t', '...']), which produces the image that will later be pushed to Artifact Registry and deployed to Cloud Run. Option C is correct because compiling the Java code and running unit tests is done with Maven, so a step using the 'maven' image with args ['mvn', 'compile', 'test'] satisfies the compile-and-test requirement of the pipeline. Option E is correct because deploying the built image to Cloud Run requires a gcloud step invoking 'gcloud run deploy' with the appropriate service, image, region, and platform flags. Option A is not needed because 'gcloud container clusters get-credentials' configures kubectl access to a GKE cluster, which is irrelevant when the target is Cloud Run. Option D is not needed because an npm test step applies to Node.js projects, not a Java application built with Maven.

Answer

Step with image 'gcloud' and entrypoint: 'gcloud', args: ['container', 'clusters', 'get-credentials']

Answer

Step with image 'node' and entrypoint: 'npm', args: ['test']

Question 4

An organization requires that only container images signed by a trusted authority can be deployed on Google Kubernetes Engine (GKE). Which Google Cloud service should they implement?

Accepted Answer

Binary Authorization. Binary Authorization is a Google Cloud service that enforces deploy-time policies on GKE, allowing only container images signed by trusted authorities to be deployed. It integrates with Container Analysis and attestations to verify signatures before admission.

Answer

Artifact Registry

Answer

Secret Manager

Answer

Cloud Deploy

Question 5

A cloud architect is designing a CI/CD pipeline for a microservices application. Each service is deployed to Cloud Run. They want to use Cloud Build to automate building and deploying services only when changes occur in their respective directories. Which Cloud Build feature should they configure?

Accepted Answer

Build triggers with included files filter. Build triggers with an included files filter is correct because Cloud Build triggers support an 'includedFiles' field that uses glob patterns to fire a build only when files in specified paths change. This lets a monorepo deploy each microservice independently — for example, a trigger scoped to 'services/payments/**' runs only when payment-service code is modified. This is the native, supported mechanism for path-based CI/CD in Cloud Build.

Answer

Build steps in cloudbuild.yaml

Answer

Cloud Build's 'includedFiles' option in the build configuration

Answer

Artifact Registry triggers

Question 6

A company is migrating its on-premises MongoDB database to Google Cloud. They want a fully managed, highly available NoSQL database that is compatible with MongoDB drivers. Which Google Cloud service should they choose?

Accepted Answer

MongoDB Atlas on Google Cloud Marketplace. MongoDB Atlas on Google Cloud Marketplace is the correct choice because it is a fully managed MongoDB service that is wire-protocol compatible with native MongoDB drivers, allowing the company to migrate its on-premises MongoDB workload with minimal application changes. It provides high availability, automated backups, and scaling while running on Google Cloud infrastructure.

Answer

Cloud Firestore

Answer

Cloud Bigtable

Answer

Cloud SQL

Question 7

An organization wants to ensure that all Compute Engine instances in a project are patched with the latest security updates. They also want to enforce a custom configuration (e.g., disable root SSH login) across all instances. Which TWO Google Cloud services should they use together?

Accepted Answer

OS Config patch management. Option B, OS Config patch management, is correct because it is the Google Cloud service that lets you scan and automatically apply OS security patches to Compute Engine instances across a project, satisfying the requirement to keep all instances patched with the latest security updates. Option D, OS Config OS policies, is correct because it lets you define and enforce a custom desired-state configuration (such as disabling root SSH login via an OS policy assignment) across all instances in the project. Together, patch management handles patching while OS policies enforce the custom configuration, which is exactly the combined outcome the organization wants. Option A, Cloud Monitoring, is not correct because it only observes metrics, logs, and alerts; it does not patch or enforce configuration. Option C, Cloud Deployment Manager, is not correct because it is an infrastructure-as-code deployment tool for provisioning resources, not for ongoing OS patching or enforcing in-guest configuration. Option E, Cloud Asset Inventory, is not correct because it only inventories and tracks cloud assets and their metadata; it cannot patch instances or apply OS-level policies.

Answer

Cloud Monitoring

Answer

Cloud Deployment Manager

Answer

Cloud Asset Inventory

Question 8

A data engineering team wants to ingest streaming data from Pub/Sub, transform it using Apache Beam, and load it into BigQuery for real-time analytics. They need a fully managed solution that handles autoscaling and does not require managing servers. Which TWO Google Cloud services should they use?

Accepted Answer

Cloud Dataflow. Option B, Cloud Dataflow, is correct because it is Google Cloud's fully managed, serverless runner for Apache Beam pipelines, automatically handling autoscaling of worker instances and eliminating server management for the transform-and-load stage into BigQuery. Option E, Cloud Pub/Sub, is correct because it is the fully managed, serverless messaging service used to ingest the streaming data that Dataflow then reads and processes. Together, Pub/Sub provides the ingestion layer and Dataflow provides the managed Beam processing that writes results to BigQuery for real-time analytics. Option A, Cloud Dataproc, is not appropriate because it is a managed Spark/Hadoop cluster service that still requires cluster provisioning and management rather than being serverless. Option C, Cloud Dataprep, is a data-wrangling UI for preparing data, not a streaming Beam execution engine. Option D, Cloud Composer, is a managed Apache Airflow workflow orchestrator for scheduling batch pipelines, not a streaming data processing service.

Answer

Cloud Dataproc

Answer

Cloud Dataprep

Answer

Cloud Composer

Question 9

A company has a legacy application that runs on a single Compute Engine VM and expects to use a fixed IP address. They want to migrate the VM to a different region with minimal downtime. Which TWO actions should they take?

Accepted Answer

Reserve a static external IP address in the target region. Option D is correct because a static external IP address is region-scoped in Google Cloud, so to keep the legacy application's fixed IP behavior in the new region, a static external IP must be reserved in the target region and attached to the new VM. Option E is correct because creating a snapshot of the boot disk and then creating a new VM from that snapshot in the target region is the standard way to relocate a single Compute Engine VM's disk and data with minimal downtime. Option A is incorrect because gcloud compute instances move only moves an instance between zones within the same region, not to a different region. Option B is incorrect because deleting the original VM before creating the new one increases downtime and risks losing the working instance. Option C is incorrect because converting to a managed instance group changes the architecture and does not by itself provide a fixed IP or a cross-region migration path.

Answer

Use gcloud compute instances move command

Answer

Delete the original VM before creating the new one

Answer

Convert the VM to a managed instance group

Question 10

A security team wants to monitor and audit all changes to IAM policies in a Google Cloud organization. They need to set up real-time alerts when a new binding is added. Which THREE services should they combine to achieve this?

Accepted Answer

Cloud Pub/Sub. Cloud Audit Logs (D) is correct because Admin Activity audit logs automatically record IAM policy changes such as SetIamPolicy events, which capture when a new binding is added, providing the source of truth for auditing and monitoring. Cloud Pub/Sub (B) is correct because a log sink can route those filtered audit log entries to a Pub/Sub topic in real time, decoupling log ingestion from downstream processing. Cloud Functions (C) is correct because a function can be triggered by messages published to that Pub/Sub topic to evaluate the new binding and send real-time alerts. Cloud Scheduler (A) is not needed since it only runs jobs on a time schedule and does not provide event-driven, real-time reaction to IAM changes. Cloud Storage (E) is not needed because it is object storage for retaining or archiving data, not a real-time alerting or event-processing service.

Answer

Cloud Scheduler

Answer

Cloud Storage

Question 11

A cloud architect needs to implement a CI/CD pipeline for a team developing a Python-based microservice. The team uses GitHub as their source repository. The pipeline should automatically run unit tests and deploy the service to Cloud Run when changes are pushed to the main branch. Which THREE Google Cloud services should they use?

Accepted Answer

Artifact Registry. Cloud Build (E) is the correct CI/CD engine here: it can be triggered by GitHub pushes to the main branch, run the Python unit tests in a build step, and then deploy the resulting container to Cloud Run. Artifact Registry (A) is needed to store and version the container images that Cloud Build builds, since Cloud Run pulls its images from a registry rather than building them itself. Cloud Run (B) is the target compute platform for the microservice, hosting the containerized Python service that the pipeline deploys. Cloud Deploy (C) is not required because it is a managed continuous-delivery service for GKE and Cloud Run that adds release/pipeline abstractions, which is unnecessary for this simple test-and-deploy flow. Cloud Source Repositories (D) does not belong because the team already uses GitHub as its source repository, so a second Google-hosted Git repo is redundant.

Answer

Cloud Deploy

Answer

Cloud Source Repositories

Question 12

A healthcare company is migrating a legacy on-premises Oracle database to Google Cloud. The database is used for a patient records application that requires strong consistency, ACID transactions, and a relational schema with complex joins. The company wants a fully managed, highly available relational database service that minimizes administrative overhead while supporting their existing SQL workloads. Which Google Cloud service should they choose?

Accepted Answer

Cloud SQL for PostgreSQL. Cloud SQL for PostgreSQL is the best choice because it provides a fully managed relational database with ACID compliance, strong consistency, and support for complex SQL queries, matching the legacy Oracle workload's needs. It reduces operational burden with automated backups, replication, and high availability. Other options are either NoSQL databases lacking relational features or overly complex for the required scale.

Answer

Cloud Spanner

Answer

Bigtable

Answer

Firestore

Question 13

A retail company runs a stateful PostgreSQL database on a Compute Engine VM in project prod-db. The database writes nightly backups to a regional Cloud Storage bucket in a separate project, backup-archive. The security team requires that the VM's service account can upload objects but must not be able to delete or overwrite existing backups. Which IAM configuration should the architect implement?

Accepted Answer

Grant roles/storage.objectCreator on the bucket to the VM's service account.. The VM's service account needs write-only access to the backup bucket, which maps exactly to the storage.objects.create permission contained in the objectCreator role. Applying that role on the specific bucket limits the grant to backup-archive and prevents deletion or overwriting of existing backups. Broader roles such as objectAdmin or legacyBucketWriter include delete and overwrite permissions that violate the immutability requirement.

Answer

Grant roles/storage.legacyBucketWriter on the bucket to the VM's service account.

Answer

Grant roles/storage.objectViewer on the bucket to the VM's service account.

Answer

Grant roles/storage.objectAdmin on the bucket to the VM's service account.

Question 14

A media company streams video from a global user base. The architect must provision a load balancer that terminates TLS, routes requests by URL path to different backend services, and provides a single global anycast IP address. The backend services run on managed instance groups in three regions. Which Google Cloud load balancer should the architect deploy?

Accepted Answer

Global external Application Load Balancer. A single global anycast IP, edge TLS termination, and URL path routing to backends in three regions all point to the global external Application Load Balancer. Its layer 7 proxy architecture inspects HTTP requests and uses URL maps to direct traffic, while the Google front end absorbs TLS and distributes requests across regional managed instance groups without requiring a separate IP per region.

Answer

External passthrough Network Load Balancer

Answer

Regional external Application Load Balancer

Answer

Internal TCP/UDP Load Balancer

Question 15

A healthcare company must store patient documents in Cloud Storage. Compliance requires that the data be encrypted with keys the company controls and that key usage be centrally audited and revocable. The architect plans to use Cloud KMS. Which two actions should the architect take to meet these requirements? (Choose two.)

Accepted Answer

Create a Cloud KMS key ring and a customer-managed encryption key (CMEK) in the same region as the bucket, and configure the bucket to use that key as its default encryption key.. Meeting the compliance goals requires a customer-managed encryption key configured as the bucket's default encryption key, plus the Cloud Storage service agent holding cryptoKeyEncrypterDecrypter on that key. Together these ensure all objects are encrypted with a company-controlled key and that every key operation is recorded in Cloud Audit Logs, enabling auditing and revocation through Cloud KMS.

Answer

Create a customer-supplied encryption key (CSEK) and store it in Secret Manager for each object upload.

Answer

Enable Cloud External Key Manager (Cloud EKM) backed by keys held in a third-party HSM.

Answer

Enable uniform bucket-level access on the bucket to force CMEK usage.