Google PCA Managing and Provisioning a Solution Infrastructure — Timed 20 Questions

Question 1

An engineer needs to provision a GKE cluster with a node pool that uses preemptible VMs to reduce costs. Which gcloud command should they use?

Accepted Answer

gcloud container node-pools create --preemptible. The --preemptible flag when creating a node pool makes all nodes in that pool preemptible. The other options either don't exist or are incorrect.

Answer

gcloud container clusters update --preemptible

Answer

gcloud container clusters create --preemptible-nodes

Answer

gcloud compute instances create --preemptible

Question 2

A company uses Cloud Deployment Manager to manage infrastructure. They want to roll back to a previous deployment state after a failed update. What is the recommended approach?

Accepted Answer

Run gcloud deployment-manager deployments update --config <previous_manifest>. Deployment Manager stores the deployment manifests. You can use an update with a previous manifest to revert to a known good state. Deleting and recreating is not a rollback. Partial updates are not supported directly.

Answer

Use gcloud deployment-manager deployments rollback --deployment <name>

Answer

Use the --update-policy=PARTIAL flag to selectively revert changes

Answer

Delete the deployment and recreate it from the previous template

Question 3

A team wants to enforce that only container images signed by their CI/CD system can be deployed to GKE. They have enabled Binary Authorization with a policy that requires an attestor. What additional step must they take to bind the attestor to the image signing process?

Accepted Answer

Create a Container Analysis note and grant the attestor service account the containeranalysis.notes.attacher role. After creating the attestor, you must create an AttestationAuthority note in Container Analysis and grant the attestor service account permission to bind attestations. Configuring Cloud Build to sign images is part of the process but not the binding step.

Answer

Add the attestor to the Binary Authorization policy as a required attestor

Answer

Create a Cloud Build step that signs the image and stores the signature in Cloud Storage

Answer

Configure the GKE cluster to require Binary Authorization with the --no-enforce flag

Question 4

An organization has multiple GCP projects managed by a central operations team. They want to define a common VPC configuration in a host project and allow service projects to use it. Which networking feature should they use?

Accepted Answer

Shared VPC. Shared VPC allows a host project to contain shared VPC networks that service projects can use. VPC peering is for connecting separate networks. Private Service Connect is for accessing managed services. Cloud VPN is for on-premises connectivity.

Answer

Private Service Connect

Answer

Cloud VPN

Answer

VPC peering

Question 5

A Cloud Run service needs to connect to a Cloud SQL MySQL instance privately without using public IP. What must be configured?

Accepted Answer

Deploy a VPC connector and attach it to the Cloud Run service. To privately connect Cloud Run to Cloud SQL, you need a Serverless VPC Access connector in the same VPC as the Cloud SQL instance, and then use the private IP of Cloud SQL. Private Google Access is for on-prem, not Cloud Run. Direct VPC is not available for Cloud Run.

Answer

Set up VPC Network Peering between Cloud Run and Cloud SQL

Answer

Enable Private Google Access on the VPC subnet

Answer

Use Cloud SQL Proxy as a sidecar container

Question 6

Which GCP service should be used to automatically scale a GKE cluster's number of nodes based on pending pods?

Accepted Answer

Cluster Autoscaler. The cluster autoscaler adjusts the number of nodes in node pools based on pod resource requests. HPA scales pods, not nodes. VPA adjusts pod resource requests. Node auto-provisioning is part of cluster autoscaler but the described functionality is cluster autoscaler.

Answer

Vertical Pod Autoscaler (VPA)

Answer

Node Auto-Provisioning

Answer

Horizontal Pod Autoscaler (HPA)

Question 7

An engineer is troubleshooting a Cloud Build trigger that fails with the error 'PERMISSION_DENIED: Cloud Build service account does not have permission to access Artifact Registry'. The build needs to push a Docker image to Artifact Registry. What is the correct IAM role to assign to the Cloud Build service account?

Accepted Answer

roles/artifactregistry.writer. The Cloud Build service account (usually project-number@cloudbuild.gserviceaccount.com) needs the Artifact Registry Writer role to push images. Editor role is too broad; Viewer is read-only; Storage Object Admin is for Cloud Storage, not Artifact Registry.

Answer

roles/artifactregistry.viewer

Answer

roles/editor

Answer

roles/storage.objectAdmin

Question 8

Which GCP service provides distributed tracing to help analyze latency in microservices applications?

Accepted Answer

Cloud Trace. Cloud Trace collects latency data from applications and provides near-real-time traces. Cloud Profiler provides continuous profiling. Cloud Monitoring provides metrics and dashboards. Cloud Logging provides log management.

Answer

Cloud Profiler

Answer

Cloud Logging

Answer

Cloud Monitoring

Question 9

A developer wants to deploy a Cloud Function that is triggered whenever a new object is created in a Cloud Storage bucket. Which trigger type should they choose?

Accepted Answer

Cloud Storage trigger. Cloud Functions can be triggered by Cloud Storage events such as google.storage.object.finalize (object creation). HTTP triggers are for HTTP requests. Pub/Sub triggers for messages. Firestore triggers for document changes.

Answer

Firestore trigger

Answer

Pub/Sub trigger

Answer

HTTP trigger

Question 10

An organization wants to ensure that all VMs in a project have the 'restricted-vm' tag to apply a firewall rule that allows only SSH from a bastion host. The VMs are created by multiple teams. Which approach ensures the tag is automatically applied to all new VMs?

Accepted Answer

Create a Cloud Function that listens to Compute Engine audit logs and adds the tag to new instances. OS Config can enforce OS policies, but tagging is done via instance templates or organization policies. Using a custom image with the tag is not automatic. A pre-create Cloud Function can detect VM creation and add the tag. Org policies cannot enforce tags directly.

Answer

Use a custom image that includes the tag in the instance metadata

Answer

Use an organization policy to require the tag

Answer

Configure OS Config with a software recipe to add the tag

Question 11

A company runs a stateful workload on GKE that requires at most one pod per node. They want to survive a zonal failure with minimal downtime. The application can be restarted on a new node. Which configuration should they use?

Accepted Answer

Use a StatefulSet with pod anti-affinity required and a regional cluster. A StatefulSet with pod anti-affinity required ensures one pod per node. A regional cluster with nodes in multiple zones allows rescheduling in another zone. A single-zone cluster would not survive a zonal failure. PDB limits disruption but does not handle zone failure.

Answer

Use a Deployment with a PodDisruptionBudget set to maxUnavailable=0

Answer

Deploy a Deployment with a nodeSelector for one zone

Answer

Use a DaemonSet with node affinity

Question 12

An engineer wants to store a database password securely and allow a Cloud Run service to access it. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets like passwords, API keys, and certificates. It integrates with Cloud Run via volume mounts or environment variables. Cloud KMS is for encryption keys. Cloud Storage is for objects. Firestore is a database.

Answer

Cloud Storage

Answer

Cloud Key Management Service (KMS)

Answer

Firestore

Question 13

A team is building a CI/CD pipeline for a Java application that will run on GKE. They want to automatically build the application, run unit tests, create a Docker image, push it to Artifact Registry, and deploy to GKE. Which two GCP services should be combined? (Choose two.)

Accepted Answer

Cloud Deploy. Cloud Build handles the build and test steps, builds the Docker image, and pushes to Artifact Registry. Cloud Deploy manages the deployment to GKE. Cloud Run is serverless; Cloud Functions is event-driven; Compute Engine is VMs.

Answer

Cloud Functions

Answer

Compute Engine

Answer

Cloud Run

Question 14

An organization wants to monitor and alert on custom application metrics from a GKE cluster. They also need to view logs in real-time and create metrics from log content. Which two GCP services should they use? (Choose two.)

Accepted Answer

Cloud Monitoring. Cloud Monitoring collects metrics and provides alerting. Cloud Logging collects logs and supports log-based metrics. Cloud Profiler is for profiling. Cloud Trace is for tracing. Error Reporting is for error grouping.

Answer

Error Reporting

Answer

Cloud Profiler

Answer

Cloud Trace

Question 15

A company uses Terraform to manage infrastructure. They want to store the Terraform state file remotely and enable state locking to prevent concurrent modifications. Which three Google Cloud services or features should they use? (Choose three.)

Accepted Answer

Object versioning on the state bucket. Cloud Storage is used as a backend for Terraform state. Object versioning provides history and locking via the storage object's generation number. Cloud KMS can encrypt the state file. Cloud NAT is for outbound connectivity. Cloud Shell is not required for state management. Secret Manager is for secrets, not state.

Answer

Cloud NAT

Answer

Cloud Shell

Question 16

A DevOps team wants to automate the deployment of infrastructure on Google Cloud using a declarative configuration language. They need to support Python and Jinja templates for reusable modules. Which service should they use?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager supports YAML, Python, and Jinja templates, making it the correct choice for declarative infrastructure as code. Terraform is also declarative but uses HCL, not Python/Jinja. Cloud Build is for CI/CD pipelines, not infrastructure provisioning. Config Connector is for Kubernetes-style resource management, not Python/Jinja templates.

Answer

Config Connector

Answer

Terraform on Google Cloud

Answer

Cloud Build

Question 17

A team is using Cloud Build to deploy a microservice to Cloud Run. They want to ensure that only containers built from a specific trusted branch in their source repository are deployed to production. Which Cloud Build feature should they use?

Accepted Answer

Cloud Build trigger branch filtering. Cloud Build triggers can be configured to respond only to specific branches (e.g., 'main' or 'release/*'). By setting the trigger's included files filter and branch regex, they can restrict builds to that branch. Artifact Registry controls access to container images, but does not restrict deployment by branch. Cloud Deploy is a separate service for progressive delivery. Binary Authorization enforces policies at deployment time but does not filter by branch.

Answer

Binary Authorization attestors

Answer

Cloud Deploy delivery pipeline approvals

Answer

Artifact Registry IAM permissions

Question 18

A company runs a stateful application on GKE that requires persistent storage. They want to ensure that during cluster upgrades, pods are not disrupted and storage is preserved. Which configuration should they use?

Accepted Answer

Use a StatefulSet with a PodDisruptionBudget. PodDisruptionBudgets (PDBs) ensure that a minimum number of pods remain available during voluntary disruptions like cluster upgrades. PersistentVolumeClaims with ReadWriteOnce access mode allow pods to persist data. Combining PDBs with StatefulSets provides ordered, graceful deployment and scaling while preserving storage. The cluster autoscaler only adjusts node count, not pod disruptions. HorizontalPodAutoscaler scales pods based on metrics but does not protect against disruptions.

Answer

Enable Cluster Autoscaler on the node pool

Answer

Use a Deployment with a HorizontalPodAutoscaler

Answer

Use PersistentVolumeClaims with ReadWriteMany access mode

Question 19

A security team wants to enforce that only container images signed by their internal CI/CD pipeline can run on GKE clusters. They also need to ensure that unsigned images are rejected at admission time. Which combination of services and configurations should they use?

Accepted Answer

Binary Authorization with Cloud KMS for signing. Binary Authorization enforces policy by requiring images to be signed by trusted signers (e.g., using Cloud KMS). It integrates with GKE admission control to block unsigned images. Cloud KMS creates and manages signing keys. Artifact Registry stores signed images but does not enforce policy. Cloud Build can be used to sign images during build, but the enforcement mechanism is Binary Authorization.

Answer

GKE PodSecurityPolicy with allowed registries

Answer

Cloud Build with Container Analysis

Answer

Artifact Registry vulnerability scanning and IAM roles

Question 20

A developer wants to deploy a containerized web application on Google Cloud that can scale to zero when not in use and charges only for resources consumed during request processing. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero when idle and charges per request, making it cost-effective for intermittent traffic. GKE requires at least one node to be running, so it cannot scale to zero. Compute Engine instances incur costs even when idle. App Engine Flexible Environment also runs at least one instance.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Flexible Environment

Answer

Compute Engine instance group