Google PCA Managing and Provisioning a Solution Infrastructure Practice Test 8 — 15 Questions

Question 1

A retail company runs a stateless web tier on a managed instance group (MIG) of Compute Engine VMs behind an external Application Load Balancer. Traffic spikes every evening and the operations team currently resizes the MIG manually. They want the group to add and remove VMs automatically based on CPU utilization without changing the instance template. What should the architect configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An autoscaling policy on the managed instance group using a CPU utilization target.. A managed instance group autoscaling policy is the native mechanism for adding and removing Compute Engine VMs in response to load signals such as CPU utilization. Because the web tier is stateless and already behind a load balancer, horizontal scaling is safe and does not require rebuilding the instance template.

Answer

A Cloud Scheduler job that calls the Compute Engine API to resize the managed instance group every evening.

Answer

A network endpoint group (NEG) that automatically registers new VM instances when CPU usage rises.

Answer

A preemptible VM pool that the load balancer adds to the backend service during peak hours.

Question 2

A startup wants to deploy a containerized web application that must scale automatically based on incoming request concurrency. The team wants to avoid managing Kubernetes nodes or clusters and prefers a fully managed serverless platform with per-request billing. Which Google Cloud service should the architect recommend?

Accepted Answer

Cloud Run. Cloud Run is the managed serverless container platform that scales on request concurrency, scales to zero, and bills per request, with no cluster or node administration. It accepts standard container images, so the startup can deploy its existing artifact directly while gaining automatic scaling and usage-based pricing that the other options cannot provide.

Answer

Google Kubernetes Engine Autopilot

Answer

Compute Engine managed instance group with autoscaling

Answer

App Engine standard environment

Question 3

A healthcare analytics company must store patient records in Cloud Storage. Compliance requires that the data be encrypted with keys the company generates and rotates itself, and that the company retain the ability to revoke access by disabling the key. The data must remain readable by authorized applications in the same project. What should the architect implement?

Accepted Answer

Customer-managed encryption keys (CMEK) in Cloud KMS, referenced by the bucket's default encryption configuration.. Customer-managed encryption keys in Cloud KMS give the organization ownership of key material, rotation control, and the ability to disable a key to revoke access. Setting the bucket default encryption to a CMEK key applies that key to newly written objects, and IAM on the key governs which applications can decrypt.

Answer

Customer-supplied encryption keys (CSEK) passed with every object write and read request.

Answer

Google-managed encryption keys, relying on Cloud Storage default encryption.

Answer

Client-side encryption performed by the analytics application before uploading objects to Cloud Storage.

Question 4

A retail company runs a stateless web front end on a managed instance group of Compute Engine VMs behind an external Application Load Balancer. Traffic has grown, and the operations team wants to reduce the cost of idle capacity while still absorbing sharp, unpredictable spikes in user requests. They also want to avoid managing a separate autoscaling policy for each instance group. Which provisioning approach should the architect recommend?

Accepted Answer

Deploy the front end on Cloud Run with a serverless network endpoint group as the Application Load Balancer backend, letting Cloud Run scale instances automatically from zero request-based capacity.. The requirement is to cut idle capacity cost while absorbing unpredictable spikes without maintaining per-group autoscaling policies. Cloud Run provides request-driven autoscaling that can scale to zero and back out rapidly, and a serverless network endpoint group lets the existing external Application Load Balancer keep fronting the service. This removes idle VM cost and centralizes elasticity in the platform rather than in hand-tuned policies.

Answer

Configure the existing managed instance group with a CPU utilization autoscaling policy and set the minimum replicas to the peak observed load.

Answer

Create a second managed instance group in a different region and use an external proxy Network Load Balancer to split traffic manually.

Answer

Replace the managed instance group with a single large Compute Engine VM using a committed use discount to lower the hourly rate.

Question 5

A media company stores finished video masters in a Cloud Storage bucket. Legal requires that every object be retained for exactly seven years and that no user, including project owners, be able to delete or overwrite an object before that period ends. Which bucket configuration should the architect apply?

Accepted Answer

Apply a bucket lock with a retention policy of seven years and grant users the Storage Object Creator role.. Immutability for a fixed period is delivered by a bucket retention policy, and locking the bucket makes that policy irreversible so no principal can shorten it or delete protected objects early. Seven years expressed as a retention duration plus restricted write access satisfies the legal hold while still permitting new masters to be uploaded to the bucket.

Answer

Enable Uniform Bucket-Level Access and grant the Storage Object Admin role only to the security team.

Answer

Enable Object Versioning on the bucket and grant users only the Storage Object Viewer role.

Answer

Configure a lifecycle rule that moves objects to Archive storage after 30 days and deletes them after 2,555 days.

Question 6

A healthcare analytics team must run a stateless containerized API on Google Cloud. The platform must scale to zero when there is no traffic, expose an HTTPS endpoint with a managed certificate, and require no cluster or node management by the team. The architect is choosing among Google Cloud container platforms. Which two characteristics make Cloud Run the appropriate choice here? (Choose two.)

Accepted Answer

Cloud Run scales the service to zero instances when no requests arrive, and bills only for resources consumed while handling requests.. Cloud Run fits because it scales to zero when idle, charging only for request-driven consumption, and because it fully abstracts the compute layer so no cluster or node administration is needed. Those two properties align with the stateless, low-traffic API and the team's desire to avoid managing infrastructure.

Answer

Cloud Run allows the team to choose and manage the operating system image and patch cadence of the worker nodes running the containers.

Answer

Cloud Run supports persistent local SSD storage attached to each instance for stateful session data across requests.

Answer

Cloud Run requires a GKE cluster in the same project so the service can schedule pods onto managed node pools.

Question 7

A healthcare analytics company stores sensitive patient datasets in a Cloud Storage bucket in the us-central1 region. A new regulation requires that the data never leave the United States and that access be restricted to a defined set of projects. The security team wants a guardrail that prevents any future project from reading the bucket unless it is explicitly authorized, while keeping administration simple. What should the architect implement?

Accepted Answer

Create a VPC Service Controls perimeter around the authorized projects with the Cloud Storage bucket as a protected resource, and grant access only through the perimeter.. The regulation requires both a location boundary and a hard restriction on which projects may read the data. VPC Service Controls builds a perimeter that denies access to protected services from outside the perimeter, so even a project that later receives an IAM role cannot read the bucket unless it is inside the perimeter. This gives a centralized guardrail that IAM or resource location constraints alone cannot provide.

Answer

Create an organization policy with the constraints/gcp.resourceLocations constraint set to allow only us-central1, and attach it to the organization node.

Answer

Enable Object Versioning and a retention policy on the bucket, then share the bucket with the authorized projects using signed URLs.

Answer

Apply a bucket-level IAM policy that grants roles/storage.objectViewer only to the authorized projects' service accounts and enable uniform bucket-level access.

Question 8

A global logistics company runs a three-tier application on Compute Engine in a single region. The database tier must survive the loss of an entire zone without data loss, and the application tier must continue serving traffic with minimal disruption during a zonal failure. The architect wants the smallest operational change that satisfies both requirements. Which design should the architect implement?

Accepted Answer

Deploy the application tier in a regional managed instance group across three zones and move the database to a Cloud SQL for PostgreSQL instance with high availability enabled.. A regional managed instance group spreads application instances across zones and self-heals when a zone fails, while Cloud SQL high availability keeps a synchronized standby in another zone and fails over automatically without losing committed transactions. That pairing satisfies both continuity and durability with minimal change to the existing three-tier design.

Answer

Deploy the application tier in a zonal managed instance group and replicate the database to a read replica in a second zone using asynchronous replication.

Answer

Deploy the application tier in a regional managed instance group across three zones and keep the database on a single-zone Cloud SQL instance with daily automated backups.

Answer

Deploy the application tier in a zonal managed instance group and configure Cloud SQL with automated backups and point-in-time recovery enabled.

Question 9

A logistics company is deploying a new three-tier application on Google Cloud. The architecture team must choose a managed database for the order-processing tier that provides automatic failover across zones with no application connection string changes, and they must also ensure that the database can scale read traffic independently of writes. (Choose two.)

Accepted Answer

Use Cloud SQL for PostgreSQL with a regional instance and a high-availability configuration.. A regional Cloud SQL instance with high availability keeps a standby in a second zone and fails over automatically while the application continues using the same connection endpoint. Adding read replicas lets reporting and read-heavy queries run against separate copies, scaling reads independently of writes. Together these two choices meet the failover, connection stability, and read-scaling requirements without over-engineering the deployment.

Answer

Use a Memorystore for Redis instance as the primary order database and persist snapshots to Cloud Storage.

Answer

Use Cloud SQL for MySQL with a single-zone instance and configure a read replica in another zone for failover.

Answer

Use Cloud Spanner with a regional configuration and rely on its built-in replication for failover.

Question 10

A healthcare company runs a three-tier application on Compute Engine. The database tier must be reachable only from the application tier, and the application tier must be reachable from the web tier. All tiers are in the same VPC in project prod-apps. The security team requires that rules be evaluated by source identity rather than IP ranges, and that no instance can reach the database unless explicitly allowed. Which configuration should the architect use?

Accepted Answer

Assign each tier a unique service account and create ingress firewall rules that specify those service accounts as sources, along with the appropriate target service accounts.. VPC firewall rules support service accounts as source and target selectors, so attaching a distinct service account to each tier and referencing those accounts in ingress rules authorizes traffic by workload identity. This enforces that only the application tier can reach the database and only the web tier can reach the application tier, without relying on IP ranges or tags.

Answer

Use VPC firewall rules with target tags and source tags, assigning matching tags to instances in each tier.

Answer

Deploy all tiers into a single managed instance group and use instance group membership as the source selector in firewall rules.

Answer

Create ingress firewall rules using source IP ranges for each tier, and apply them with network tags on the instances.

Question 11

A media startup wants to give its data science team isolated environments for experimentation while keeping billing and user management under one organization. Each environment must have its own quotas and IAM boundary, and the team wants to add or remove environments quickly without renegotiating billing. Which Google Cloud resource hierarchy construct should the architect use for each environment?

Accepted Answer

A folder under the organization, with one project per environment and IAM policies inherited from the folder.. Folders sit between the organization and projects and let administrators apply IAM and organization policies that projects inherit, giving each environment a consistent administrative boundary. Each project supplies its own quotas, APIs, and resource namespace, so experiments stay isolated. Because everything remains inside one organization and billing account, environments can be spun up or torn down quickly without touching billing or identity setup.

Answer

A single project with separate VPC networks and firewall rules for each environment.

Answer

A separate Google Cloud organization for each environment, each linked to its own billing account.

Answer

A standalone project not attached to the organization, with billing enabled directly on the project.

Question 12

A healthcare analytics company stores protected health information in Cloud Storage buckets. Auditors require that data be encrypted with customer-managed encryption keys (CMEK) and that key usage be logged separately from data access. The security team wants the ability to revoke access to the data by disabling a single key without deleting the data. Which configuration should the architect recommend?

Accepted Answer

Create a Cloud KMS key ring and key in the same region as the bucket, set the bucket's default KMS key to that key, and enable Cloud KMS Data Access audit logs.. Customer-managed encryption keys in Cloud KMS let the organization control key lifecycle, and setting a bucket's default KMS key applies CMEK to every object automatically. Cloud KMS Data Access audit logs capture cryptographic operations independently of Cloud Storage access logs, meeting the separation requirement. Disabling the key version immediately makes objects unreadable, achieving revocation without deleting data, which is exactly the auditor's ask.

Answer

Enable Bucket Lock on the bucket and configure a retention policy, then use Google-managed keys with Object Lifecycle Management to transition objects to Coldline storage.

Answer

Use Google-managed encryption keys and enable Data Access audit logs on the bucket to record every object read and write.

Answer

Store the data in a Cloud Storage bucket encrypted with a customer-supplied encryption key (CSEK) and rotate the key by re-uploading all objects with a new key each quarter.

Question 13

A media company runs a batch transcoding job on Compute Engine. The job pulls source files from a Cloud Storage bucket in the same project. Security policy forbids assigning external IP addresses to any VM. The VMs must reach the Cloud Storage API without traversing the public internet. What should the architect configure?

Accepted Answer

Enable Private Google Access on the subnet used by the VMs and ensure the VMs have no external IP addresses.. Private Google Access allows instances that only have internal IP addresses to reach Google APIs and services such as Cloud Storage over Google's internal network. Enabling it on the subnet is the supported, low-overhead way to let the transcoding VMs read source objects while complying with the no-external-IP policy, without introducing NAT or custom routing.

Answer

Create a Cloud NAT gateway and route all VM egress through it.

Answer

Assign the VMs an internal IP address and add a static route to the default internet gateway for the Cloud Storage IP ranges.

Answer

Configure the VMs to use the restricted.googleapis.com VIP and add a firewall rule allowing egress to 199.36.153.4/30.

Question 14

A startup wants to deploy a stateless containerized API that must scale automatically from zero and be billed only when requests are processed. The team has no Kubernetes expertise and wants minimal operational overhead. Which Google Cloud service should the architect recommend?

Accepted Answer

Cloud Run with the container image deployed as a service.. Cloud Run is the managed serverless container platform that scales to zero, bills per request and resource consumption, and removes cluster and node operations. Deploying the container image as a Cloud Run service gives the startup an HTTPS endpoint with automatic scaling and no idle cost, matching the stateless API, minimal operations, and pay-per-use requirements.

Answer

App Engine flexible environment with automatic scaling.

Answer

Compute Engine managed instance group behind an external Application Load Balancer.

Answer

Google Kubernetes Engine with a cluster autoscaler and Horizontal Pod Autoscaler.

Question 15

A startup runs a batch analytics job on a single Compute Engine instance that takes about nine hours and reads 2 TB from a Cloud Storage bucket each run. The team wants to reduce cost without changing the application code, and the job can be interrupted and resumed from checkpoints. Which machine configuration should the architect recommend?

Accepted Answer

A Spot VM with local SSD scratch space, since the job reads data from Cloud Storage and can resume from checkpoints.. Spot VMs provide the largest discount available on Compute Engine and are appropriate when a workload can tolerate preemption and resume from checkpoints. Because the job reads its source data from Cloud Storage and only uses local SSD as scratch, losing the instance mid-run does not corrupt results, so the cost reduction comes with acceptable risk.

Answer

A sole-tenant node with a custom machine type sized to the job's peak memory usage.

Answer

A standard predefined machine type with a balanced persistent disk, billed on demand.

Answer

A committed use discount for a one-year term on a memory-optimized machine type.