Google PCA Quick Quiz — 10 Questions

Question 1

Which THREE factors should be considered when choosing a Google Cloud region for deploying a low-latency application serving global users? (Choose three.)

Accepted Answer

Proximity to your user base to minimize network latency.. Options A, C, and D are correct. Latency to users, service availability, and data residency are key; cost is secondary, and number of zones is not a primary factor.

Answer

Pricing differences between regions due to variations in compute and storage costs.

Answer

Number of zones in the region to ensure high availability.

Question 2

A company has a requirement to store application logs for 7 years for compliance. They are using Cloud Logging. What is the most cost-effective way to retain logs?

Accepted Answer

Export logs to Cloud Storage with Object Lifecycle management to delete after 7 years. Cloud Logging's default retention is limited (e.g., 30 days for logs in the default _Default bucket, and up to 365 days for custom log buckets). To meet a 7-year compliance requirement cost-effectively, you should export logs to Cloud Storage and use Object Lifecycle Management to delete objects after 7 years. Cloud Storage offers lower long-term storage costs than retaining logs in Logging's _Required or custom buckets, and lifecycle rules automate deletion without ongoing compute costs.

Answer

Set the log bucket retention to 7 years

Answer

Export logs to BigQuery and run scheduled queries to delete old data

Answer

Use Cloud Logging's default retention and rely on backups

Question 3

A company is migrating a legacy monolithic application to Google Cloud. The application runs on a single VM and uses a local MySQL database. The goal is to minimize changes to the application code while improving availability. Which strategy should the company use?

Accepted Answer

Lift and shift the VM to Compute Engine, and migrate the database to Cloud SQL with a failover replica.. Option C is correct because it minimizes code changes by lifting the application VM to Compute Engine as-is, while migrating the local MySQL database to Cloud SQL with a failover replica. This improves availability through Cloud SQL's managed automatic failover to a standby replica in a different zone, without requiring application code changes to the database connection logic (the application can continue using the same MySQL protocol).

Answer

Use a managed instance group for the application VM and store the database on a persistent disk attached to the primary instance.

Answer

Re-architect the application into microservices and use Cloud Run for stateless components.

Answer

Containerize the application and deploy on Google Kubernetes Engine (GKE) with Cloud Spanner as the database.

Question 4

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

Accepted Answer

Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage. Option C is correct because enabling CMEK on Cloud SQL and Cloud Storage allows the company to use their own encryption keys, which is often required by PCI DSS to demonstrate control over key management. CMEK ensures data at rest is encrypted with keys managed via Cloud KMS, providing auditability and separation of duties beyond Google-managed default encryption.

Answer

Configure client-side encryption in the application code

Answer

Rely on Google-managed default encryption for all data

Answer

Use Cloud HSM with a key generated outside of Google Cloud

Question 5

A company is migrating its on-premises workloads to Google Cloud. They have strict compliance requirements that all data at rest must be encrypted with customer-managed encryption keys (CMEK). Which Google Cloud service should they use to manage the lifecycle of these keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct service because it provides centralized management of customer-managed encryption keys (CMEK) for Google Cloud services. It allows you to create, rotate, destroy, and set permissions on symmetric and asymmetric keys, and integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest with keys you control.

Answer

Secret Manager

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Cloud Hardware Security Module (Cloud HSM)

Question 6

A company wants to optimize their cloud spending on Google Cloud. They have a mix of workloads including batch processing, real-time analytics, and web serving. Which TWO strategies should they implement to reduce costs without significant architectural changes? (Choose two.)

Accepted Answer

Use preemptible VMs for batch processing jobs that are fault-tolerant.. Preemptible VMs are short-lived, fault-tolerant instances that cost significantly less than standard VMs, making them ideal for batch processing jobs that can handle interruptions. This strategy directly reduces compute costs without requiring architectural changes, as the workloads are already designed to be resilient to failures.

Answer

Use sustained use discounts for short-lived instances.

Answer

Right-size all Compute Engine instances by analyzing utilization metrics.

Answer

Migrate all web serving workloads to Cloud Functions to benefit from pay-per-use pricing.

Question 7

An organization wants to enforce that all Compute Engine VMs are created with specific disk encryption keys. Which policy mechanism should they use?

Accepted Answer

Organization policies with constraints/compute.restrictDiskEncryptionKeyTypes. Option A is correct because the Organization Policy constraint `constraints/compute.restrictDiskEncryptionKeyTypes` allows administrators to enforce that all Compute Engine VMs must use specific disk encryption key types (e.g., CMEK or CSEK). This policy is evaluated at resource creation time and blocks any VM that does not comply with the allowed key types, providing a preventive control rather than a reactive one.

Answer

IAM roles with compute.diskEncryptionKey permissions

Answer

VPC Service Controls

Answer

Cloud Scheduler to check compliance

Question 8

A company is designing a highly available architecture for a stateful application on Compute Engine. They need to protect against zonal failures. Which THREE steps should they take?

Accepted Answer

Use a global load balancer with health checks. To protect against zonal failures: use a managed instance group across multiple zones (A) to distribute instances; use regional persistent disks (B) that replicate data across zones; and use a global load balancer with health checks (C) to direct traffic to healthy instances. Storing session state in memory (D) is not durable. Using a single zone instance group (E) does not provide HA.

Answer

Store session state in memory

Answer

Use a single zone instance group

Question 9

An organization uses Cloud Deployment Manager to manage infrastructure as code. They need to ensure that changes to production resources are reviewed and approved before deployment. What should they do?

Accepted Answer

Integrate Cloud Deployment Manager with Cloud Build and add a manual approval step in the Cloud Build pipeline. Cloud Deployment Manager does not have built-in approval workflows. Using Cloud Build with a manual approval step in a CI/CD pipeline allows review before deployment. Terraform with Cloud Source Repositories doesn't enforce approval. Cloud Run for Anthos is irrelevant. Cloud Scheduler doesn't add review.

Answer

Use Cloud Scheduler to run deployment configs and review logs after deployment

Answer

Create a Cloud Deployment Manager preview deployment and manually approve it

Answer

Use Cloud Build with a trigger on a branch that requires pull request approval before merging

Question 10

A company runs a web application on Compute Engine behind an HTTP load balancer. They want to improve reliability by implementing failover across two regions. Which TWO actions should they take?

Accepted Answer

Deploy a global external HTTP load balancer with backends in both regions.. A global external HTTP load balancer is required for cross-region failover because it uses a single anycast IP address and routes traffic to the closest healthy backend. By deploying backends in both regions, the load balancer automatically fails over to the secondary region if the primary region's backends become unhealthy, improving reliability without DNS propagation delays.

Answer

Configure DNS-based failover using Cloud DNS with health checks.

Answer

Use an internal load balancer to route traffic between regions.

Answer

Use a regional external HTTP load balancer with a multi-region backend.