Google PCA Quick Quiz — 10 Questions

Question 1

A DevOps team is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the pods can securely access Google Cloud APIs (e.g., Cloud Storage) without managing service account keys. Which TWO steps should they take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a dedicated GCP service account with necessary roles and bind it to Kubernetes service accounts via Workload Identity.. Option A is correct because Workload Identity requires creating a dedicated Google Cloud service account with the necessary IAM roles and binding it to a Kubernetes service account (via an IAM policy binding with roles/iam.workloadIdentityUser), which lets the pod impersonate the GCP service account without keys. Option D is correct because Workload Identity must first be enabled on the GKE cluster (e.g., with gcloud container clusters update --workload-pool=PROJECT_ID.svc.id.goog), which sets up the cluster's identity pool and OIDC issuer so Kubernetes service accounts can federate to Google Cloud IAM. Option B is wrong because using the Compute Engine default service account on nodes grants broad, shared credentials to every pod and does not provide per-pod identity or keyless access. Option C is wrong because storing service account keys in Vault still involves managing long-lived keys, which is exactly what the team wants to avoid. Option E is wrong because mounting service account keys from a Kubernetes Secret also relies on static, manually managed credentials rather than keyless Workload Identity.

Answer

Use the Compute Engine default service account on each node.

Answer

Use a secrets management solution like HashiCorp Vault to store service account keys and retrieve them at runtime.

Answer

Store service account keys in a Kubernetes Secret and mount them into pods.

Question 2

A cloud architect is designing a CI/CD pipeline for a microservices application. Each service is deployed to Cloud Run. They want to use Cloud Build to automate building and deploying services only when changes occur in their respective directories. Which Cloud Build feature should they configure?

Accepted Answer

Build triggers with included files filter. Build triggers with an included files filter is correct because Cloud Build triggers support an 'includedFiles' field that uses glob patterns to fire a build only when files in specified paths change. This lets a monorepo deploy each microservice independently — for example, a trigger scoped to 'services/payments/**' runs only when payment-service code is modified. This is the native, supported mechanism for path-based CI/CD in Cloud Build.

Answer

Build steps in cloudbuild.yaml

Answer

Cloud Build's 'includedFiles' option in the build configuration

Answer

Artifact Registry triggers

Question 3

An enterprise is planning to migrate 200 on-premises VMs to Google Cloud. The CIO wants to ensure that the migration aligns with the business goal of reducing IT operational overhead by 30% while maintaining application performance. The team has already completed a technical assessment of the VMs. Which additional step should the cloud architect take to ensure the migration plan is aligned with the stated business goal?

Accepted Answer

Conduct a business impact analysis to map each application to business processes and identify criticality and dependencies.. The business goal is to reduce IT operational overhead by 30% while maintaining performance. A business impact analysis (BIA) identifies which applications are critical, their dependencies, and how they support business processes. This allows the architect to prioritize migrations, retire redundant systems, and consolidate workloads, directly contributing to overhead reduction. Technical assessments alone do not ensure business alignment.

Answer

Perform a detailed network latency test between on-premises and Google Cloud to determine the best interconnect option.

Answer

Develop a detailed total cost of ownership (TCO) model comparing on-premises and Google Cloud costs for all 200 VMs.

Answer

Create a proof of concept for migrating a single non-critical VM to validate the migration process.

Question 4

An organization wants to receive alerts when their Cloud SQL instance's CPU utilization exceeds 80% for 5 minutes. They want to send the alert to both email and a Pub/Sub topic for further processing. What should they do?

Accepted Answer

Create a Cloud Monitoring alerting policy with a metric threshold condition on CPU utilization and add both email and Pub/Sub notification channels. Cloud Monitoring alerting policies support metric threshold conditions (e.g., CPU utilization > 80% for 5 minutes) and allow multiple notification channels, including email and Pub/Sub. Creating an alerting policy with a metric threshold condition on the Cloud SQL CPU metric and adding both email and Pub/Sub channels satisfies the requirement directly. This is the native, event-driven approach in Google Cloud.

Answer

Configure a Cloud Scheduler job to check CPU utilization and publish to Pub/Sub

Answer

Create a log-based alert for CPU utilization using Logging and route to email and Pub/Sub

Answer

Use Cloud Functions to poll the Cloud Monitoring API every minute and send notifications

Question 5

A team wants to define an SLO for a service that requires 99.9% availability over a 30-day window. They need to measure the ratio of successful requests to total requests. Which SLI should they use?

Accepted Answer

Request success rate. An SLI is a measure of service performance. For availability, the standard SLI is the proportion of successful requests (e.g., HTTP 2xx) to total requests. Latency SLI measures response times. Error budget is derived from SLO. SRE is the practice.

Answer

SRE

Answer

Request latency

Answer

Error budget

Question 6

An engineer is designing a Bigtable schema for time-series data consisting of sensor readings. Each sensor emits a reading every second. The access pattern is to retrieve all readings for a specific sensor within a time range. Which row key design will provide the best performance?

Accepted Answer

Use row key: [sensor_id]#[reverse_timestamp]. Bigtable stores rows sorted by key. A row key structured as [sensor_id]#[reverse_timestamp] ensures that all data for a sensor is contiguous, and sorting by reverse timestamp allows recent data to be retrieved first. A single row key per sensor with column qualifiers would cause hotspots and limit scalability.

Answer

Use a single row per sensor with column qualifiers as timestamps

Answer

Use timestamp as the row key and sensor ID as column qualifier

Answer

Use a random prefix to distribute writes evenly

Question 7

A company wants to migrate a MySQL database running on-premises to Cloud SQL with minimal downtime. Which GCP service should they use?

Accepted Answer

Database Migration Service. Database Migration Service (DMS) is purpose-built for migrating MySQL, PostgreSQL, and SQL Server databases to Cloud SQL with minimal downtime. It handles continuous replication and cutover, which is exactly what's needed for a live database migration.

Answer

Migrate for Compute Engine

Answer

Storage Transfer Service

Answer

Transfer Appliance

Question 8

A company is migrating an on-premises PostgreSQL database (5 TB) to Cloud SQL. They need minimal downtime and automated schema conversion if needed. Which GCP service should they use?

Accepted Answer

Database Migration Service (DMS). Database Migration Service (DMS) is the correct choice because it is a fully managed GCP service designed to migrate databases to Cloud SQL with minimal downtime, supporting continuous replication and automated schema conversion via the Database Migration Service conversion workspace. It handles homogeneous migrations like PostgreSQL to Cloud SQL for PostgreSQL and can perform schema conversion when needed. Datastream is a change data capture service, not a full migration tool, and the other options are for different migration scenarios.

Answer

Datastream

Answer

Migrate for Compute Engine (formerly Velostrata)

Answer

Transfer Appliance

Question 9

Your company has a production Cloud SQL for PostgreSQL instance in us-central1 with automated backups enabled. You need to ensure that if the zone fails, the database automatically fails over to a standby in a different zone with minimal downtime. What should you do?

Accepted Answer

Configure the instance as a highly available (regional) instance.. Configuring the Cloud SQL instance as a highly available (regional) instance provisions a standby in a different zone within the same region and automatically fails over during a zone failure with minimal downtime. This is the native HA mechanism for Cloud SQL and directly satisfies the requirement.

Answer

Enable deletion protection on the instance.

Answer

Create a cross-region read replica and manually promote it during a failure.

Answer

Enable point-in-time recovery (PITR) and keep 30 days of transaction logs.

Question 10

A company is building a microservices architecture on Google Kubernetes Engine (GKE) and needs to ensure each microservice can only access specific Cloud Storage buckets. IAM permissions should be assigned at the pod level, not at the node level. What is the recommended approach?

Accepted Answer

Use Workload Identity to bind a Kubernetes service account to a GCP service account. Workload Identity is the recommended approach because it allows you to bind a Kubernetes service account (KSA) to a Google Cloud service account (GSA), enabling pods to authenticate to Google Cloud APIs without managing or storing service account keys. This satisfies the requirement for pod-level IAM permissions, as each pod can inherit the GSA's roles (e.g., roles/storage.objectViewer) for specific Cloud Storage buckets, while avoiding node-level assignment.

Answer

Store service account keys in Kubernetes secrets and mount them into each pod

Answer

Use a CSI driver to mount IAM credentials into pods

Answer

Assign a service account to each node pool and configure pod security policies