Google PCA Analysing and Optimising Technical and Business Processes Practice Test 7 — 15 Questions

Question 1

An enterprise is planning to migrate 200 on-premises VMs to Google Cloud. The CIO wants to ensure that the migration aligns with the business goal of reducing IT operational overhead by 30% while maintaining application performance. The team has already completed a technical assessment of the VMs. Which additional step should the cloud architect take to ensure the migration plan is aligned with the stated business goal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a business impact analysis to map each application to business processes and identify criticality and dependencies.. The business goal is to reduce IT operational overhead by 30% while maintaining performance. A business impact analysis (BIA) identifies which applications are critical, their dependencies, and how they support business processes. This allows the architect to prioritize migrations, retire redundant systems, and consolidate workloads, directly contributing to overhead reduction. Technical assessments alone do not ensure business alignment.

Answer

Perform a detailed network latency test between on-premises and Google Cloud to determine the best interconnect option.

Answer

Develop a detailed total cost of ownership (TCO) model comparing on-premises and Google Cloud costs for all 200 VMs.

Answer

Create a proof of concept for migrating a single non-critical VM to validate the migration process.

Question 2

A financial services company is designing a new application on Google Cloud. The application must comply with PCI DSS and internal policies that require strict separation of duties and least privilege. The security team wants to ensure that developers cannot modify production resources, but they need to deploy code frequently. Which approach should the cloud architect recommend to meet these requirements while supporting continuous deployment?

Accepted Answer

Create separate Google Cloud projects for development and production. Grant developers the roles/editor role in the development project and roles/viewer in the production project. Use Cloud Build with a service account that has the necessary permissions to deploy to production.. Separate projects provide strong isolation. Developers with editor in dev can work freely, but viewer in prod prevents direct modifications. Cloud Build with a least-privilege service account automates deployments, so developers cannot directly change production. This enforces separation of duties and least privilege while enabling frequent deployments via CI/CD.

Answer

Use Google Cloud Deploy to manage deployments. Grant developers the roles/clouddeploy.developer role in the production project, and configure approval gates before production deployment. Developers can approve their own deployments.

Answer

Use a single Google Cloud project with IAM conditions that restrict developers to only modify resources with a specific label (e.g., env=dev). Grant developers roles/editor, and use a Cloud Build service account with roles/owner to deploy to production.

Answer

Implement a CI/CD pipeline using Cloud Build and Artifact Registry. Grant developers the roles/cloudbuild.builds.editor role to trigger builds. Store production deployment credentials in Secret Manager and allow developers to access them.

Question 3

Your organization runs a critical application on Compute Engine. The monthly bill shows sustained use discounts but the finance team wants to reduce costs further. The workload runs 24/7 with predictable usage for at least the next 12 months. You need to achieve the maximum possible discount without affecting performance or availability. What should you do?

Accepted Answer

Purchase a 1-year commitment for the specific vCPU and memory machine types used.. Committed use discounts offer substantial savings for predictable workloads. Because the application runs continuously for at least a year, committing to the specific resources ensures the highest discount without impacting performance or availability. Other options either compromise reliability or do not provide additional savings beyond existing discounts.

Answer

Switch all instances to preemptible VMs to get the largest discount.

Answer

Enable automatic sustained use discounts by ensuring instances run for the full month.

Answer

Migrate the workload to a managed instance group with autoscaling.

Question 4

You are the architect for a company that runs a three-tier web application on Compute Engine. The CTO wants to reduce the monthly cloud bill without impacting performance or availability. You review the billing export in BigQuery and notice that the VMs are sized for peak load, but CPU utilization rarely exceeds 20% on weekdays and 5% on weekends. The application is stateless and uses an external Cloud SQL database. Which cost optimization strategy should you implement first?

Accepted Answer

Create a managed instance group with autoscaling and right-size the instance template based on actual utilization.. The application is stateless and overprovisioned, so the most effective first step is to right-size instances and use autoscaling to match capacity to demand. This reduces cost while maintaining performance and availability. Committed use discounts and long-term commitments only make sense after you have optimized the instance shape and quantity.

Answer

Purchase a 3-year commitment for the current VM sizes.

Answer

Move the application to Cloud Run.

Answer

Enable committed use discounts for the VMs.

Question 5

A company runs a microservices application on Google Kubernetes Engine (GKE). They want to ensure that each service can only communicate with the services it explicitly depends on, and they need to enforce this at the network layer without modifying application code. They also want to monitor allowed and denied traffic. What should they do?

Accepted Answer

Implement Kubernetes Network Policies and enable GKE network policy logging.. Kubernetes Network Policies provide pod-level network segmentation and are enforced by the container network interface (CNI) plugin. GKE supports network policy logging, which records allowed and denied connections. This approach does not require application code changes and operates at the network layer.

Answer

Use Istio service mesh with mutual TLS and authorization policies.

Answer

Use Anthos Service Mesh with access logging and policy enforcement.

Answer

Configure firewall rules in the VPC to allow only specific traffic between nodes.

Question 6

Your company uses Cloud Monitoring to track the performance of a microservices application. The SRE team wants to define an SLO for the latency of a critical API. They need to measure the proportion of requests that complete within 200 ms over a rolling 30-day window. Which approach should they use to implement this SLO?

Accepted Answer

Use Cloud Monitoring's SLO monitoring feature to define a latency SLO with a distribution cut based on a histogram metric.. Cloud Monitoring's SLO monitoring is designed for defining and tracking SLOs. Using a distribution cut on a histogram metric allows precise measurement of the proportion of requests within the latency threshold over a rolling period. It also provides error budget and alerting, which are essential for SRE practices.

Answer

Configure a log-based metric that counts requests with latency under 200 ms, then create an alert if the count drops.

Answer

Set up an uptime check that measures the API response time and alerts if it exceeds 200 ms.

Answer

Create a custom metric that logs each request latency, then use a dashboard to manually calculate the percentage within 200 ms.

Question 7

Your organization runs a microservices application on Google Kubernetes Engine (GKE). Each microservice has its own deployment and horizontal pod autoscaler. You want to implement a robust cost governance process that provides chargeback to each team and prevents budget overruns. You need to attribute costs accurately without modifying application code. What should you do?

Accepted Answer

Enable GKE cost allocation and use labels on namespaces to map costs to teams.. GKE cost allocation is designed to break down cluster costs by namespace and label, enabling accurate chargeback without code changes. By labeling namespaces with team identifiers, you can generate reports and budget alerts per team. Other options either increase cost, do not provide attribution, or require additional tooling.

Answer

Deploy a third-party cost monitoring agent as a DaemonSet on each node.

Answer

Create a separate GKE cluster for each team and enable billing export to BigQuery.

Answer

Use Kubernetes resource quotas and limit ranges to enforce budgets.

Question 8

Your company runs a microservices application on Google Kubernetes Engine (GKE). The development team complains that they lack visibility into which service is causing latency spikes during peak hours. You need to implement a solution that provides distributed tracing and service-level metrics without modifying application code. Which approach should you use?

Accepted Answer

Deploy Anthos Service Mesh and enable its built-in telemetry features, including Cloud Trace and Cloud Monitoring integration.. Anthos Service Mesh provides automatic telemetry collection, including distributed tracing and service-level metrics, without requiring changes to application code. It leverages sidecar proxies to capture traffic and integrates with Cloud Trace and Cloud Monitoring, giving the needed visibility into latency spikes. Other options either require code instrumentation or do not provide the necessary tracing and metrics.

Answer

Install the Cloud Logging agent on each node and create log-based metrics for latency.

Answer

Use Cloud Profiler to continuously profile the application and identify latency bottlenecks.

Answer

Enable Cloud Trace on the GKE cluster and instrument each service with the OpenTelemetry SDK.

Question 9

Your organization runs a customer-facing web application on a managed instance group of Compute Engine VMs behind an HTTP(S) load balancer. The monthly bill shows that the VMs are running at only 15% average CPU utilization, yet the team insists they need the current number of VMs to handle peak traffic. You want to reduce compute costs without risking performance during traffic spikes. What should you do?

Accepted Answer

Enable autoscaling on the managed instance group based on CPU utilization, and set the minimum number of instances to a lower value.. The managed instance group is overprovisioned for average load but sized for peak. Autoscaling with a lower minimum lets the group shrink during low demand and expand during spikes, aligning cost with actual usage. The other options either reduce peak capacity, lock in excess capacity, or remove redundancy, none of which solve the cost problem while preserving performance.

Answer

Move the application to a single large Compute Engine instance to reduce the number of VMs.

Answer

Purchase committed use discounts for all current VM instances for a one-year term.

Answer

Change the machine type of all instances to a smaller size that matches the average CPU utilization.

Question 10

A company wants to automate the deployment of their infrastructure on Google Cloud using a declarative approach. They need to manage resources such as VPCs, subnets, and Compute Engine instances in a repeatable and version-controlled manner. They also want to preview changes before applying them. Which tool should they use?

Accepted Answer

Terraform with the Google Cloud provider. Terraform is the industry-standard declarative infrastructure as code tool that supports version control and provides a plan phase to preview changes. The Google Cloud provider enables management of all relevant resources, ensuring repeatability and safety.

Answer

Ansible with the Google Cloud collection

Answer

Google Cloud Deployment Manager

Answer

Google Cloud Console and gcloud CLI scripts

Question 11

A company is migrating its on-premises data warehouse to BigQuery. They want to minimize the cost of storing large amounts of historical data that is rarely queried. The data must remain available for queries but can tolerate slightly longer query times. What should they do?

Accepted Answer

Store the data in BigQuery long-term storage by ensuring the table is not modified for 90 consecutive days.. BigQuery long-term storage automatically applies lower pricing to data that hasn't been modified for 90 days. This is the simplest and most cost-effective way to store rarely queried historical data while keeping it available for queries. Other options either make data unavailable, delete it, or address query costs instead of storage.

Answer

Export the data to Cloud Storage Nearline and delete it from BigQuery.

Answer

Partition the table by date and set a partition expiration to delete old data.

Answer

Use BigQuery's flexible pricing with flat-rate slots to reduce query costs.

Question 12

A company runs a critical application on Compute Engine. The operations team wants to improve the mean time to recovery (MTTR) for incidents. They currently use manual runbooks stored in a wiki. You need to recommend a solution that automates incident response and integrates with existing monitoring. What should you do?

Accepted Answer

Implement Cloud Monitoring alerting policies that trigger Cloud Functions to execute remediation steps.. Cloud Monitoring alerting policies can trigger Pub/Sub, which invokes Cloud Functions to perform automated remediation. This is a native, serverless, event-driven approach that integrates with existing monitoring and reduces MTTR. Other options either require architectural changes, are not event-driven, or add unnecessary complexity.

Answer

Deploy a third-party AIOps platform on Compute Engine.

Answer

Migrate the application to GKE and use liveness probes for automatic restarts.

Answer

Use Cloud Scheduler to run a script every 5 minutes that checks for issues and fixes them.

Question 13

Your company uses a CI/CD pipeline that builds container images and stores them in Artifact Registry. The images are deployed to Google Kubernetes Engine (GKE). You need to ensure that only images that have been scanned for vulnerabilities and approved by a security team can be deployed to the production GKE cluster. You want to enforce this policy automatically without modifying the CI/CD pipeline. What should you do?

Accepted Answer

Enable Binary Authorization on the GKE cluster and configure a policy that requires attestations from the security team's attestor.. Binary Authorization enforces deploy-time policies on GKE by requiring cryptographic attestations that prove an image was scanned and approved. The security team can sign attestations after scanning, and the GKE cluster will only admit images with valid attestations. This meets the requirement without altering the CI/CD pipeline and provides automated enforcement.

Answer

Configure a Kubernetes admission webhook that calls the security team's API to validate each image before deployment.

Answer

Restrict Artifact Registry permissions so that only the security team can push images to the production repository.

Answer

Use Container Analysis to scan images and set a vulnerability threshold that blocks deployment if any critical vulnerability is found.

Question 14

Your organization is adopting a multi-cloud strategy and wants to ensure consistent security policies across Google Cloud and another cloud provider. You need to centrally manage and enforce security policies, such as preventing public access to storage buckets, across both environments. What should you do?

Accepted Answer

Implement a third-party cloud security posture management (CSPM) tool that supports multi-cloud policy enforcement.. For multi-cloud security policy management, a third-party CSPM tool is designed to work across different cloud providers, offering centralized policy definition, monitoring, and enforcement. Google Cloud native tools like Organization Policy Service and VPC Service Controls are limited to Google Cloud, and Terraform is for provisioning, not continuous enforcement.

Answer

Use Google Cloud's Organization Policy Service to define constraints and apply them to all projects.

Answer

Configure VPC Service Controls in Google Cloud and replicate the same configuration in the other cloud.

Answer

Use Terraform to define infrastructure as code and apply the same policies to both clouds.

Question 15

A company operates a critical application on Google Cloud and wants to define a Service Level Objective (SLO) for its latency. They need to measure the proportion of requests that complete within 200 ms over a 28-day rolling window. They also want to alert when the error budget is being consumed too quickly. What should they use?

Accepted Answer

Cloud Monitoring SLOs with error budget burn rate alerts.. Cloud Monitoring SLOs allow you to define service level objectives based on metrics like latency, set a goal, and monitor error budgets. Burn rate alerts notify when the error budget is consumed faster than desired, enabling proactive response.

Answer

Cloud Trace with analysis reports and custom alerts.

Answer

Cloud Logging with log-based metrics and custom dashboards.

Answer

Cloud Monitoring with uptime checks and alerting policies based on latency thresholds.