Google PCA Ensure solution and operations reliability — 30 Questions

Question 1

Match each GCP networking concept to its definition.

Accepted Answer

VPC: A global, isolated virtual network that spans all regions.. The correct matches are A, B, C, and F. Option A correctly defines VPC as a global isolated virtual network. Option B correctly defines Subnet as a regional subnet within a VPC. Option C correctly defines Firewall Rules as traffic control rules. Option F correctly defines VPC Peering as a direct private connection. Options D and E are incorrect because their definitions are swapped: Cloud Router uses BGP for dynamic routing (not NAT), and Cloud NAT provides outbound internet access via NAT (not BGP). Therefore, D and E are wrong.

Answer

Cloud Router: A managed service that provides outbound internet access for private instances via NAT.

Answer

Cloud NAT: A managed service that dynamically exchanges routes between VPC and on-premises networks using BGP.

Question 2

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. During a traffic spike from a legitimate source, legitimate requests are being blocked. How should they tune the security policy to minimize false positives?

Accepted Answer

Enable adaptive protection with machine learning. Enabling adaptive protection with machine learning allows Cloud Armor to analyze traffic patterns and distinguish between legitimate and malicious requests, dynamically adjusting the security policy to reduce false positives during legitimate traffic spikes. Option B (increasing rate limiting threshold) is a static measure that may not adapt to changing traffic patterns. Option C (disabling WAF rules) removes protection entirely and is not a targeted solution. Option D (JWT authentication) is for validating token-based authentication, not for tuning DDoS protection to avoid false positives.

Answer

Increase the rate limiting threshold

Answer

Disable the Web Application Firewall (WAF) rules

Answer

Use the JSON Web Token (JWT) authentication to filter requests

Question 3

An organization deploys a microservices application on Google Kubernetes Engine (GKE) with multiple Deployments. They want to ensure that the application remains available during a cluster-wide upgrade. Which three best practices should they follow? (Choose three.)

Accepted Answer

Use multiple node pools across different zones.. To maintain availability during a GKE cluster upgrade, three best practices are: (1) Configure PodDisruptionBudgets (PDBs) for each deployment to limit the number of pods that can be disrupted simultaneously during voluntary disruptions like node upgrades. (2) Use multiple node pools across different zones to allow GKE to upgrade nodes one zone at a time, ensuring that replicas in other zones remain available. (3) Set up a load balancer with health checks so that traffic is only directed to healthy pods, automatically routing away from pods being terminated during the upgrade.

Answer

Enable cluster autoscaling.

Answer

Use StatefulSets instead of Deployments for all services.

Answer

Use node pools with multiple node types.

Question 4

A company uses Cloud Storage to store user-uploaded content. They want to ensure that the data is highly durable and protected against accidental deletion. Which two features should they enable? (Choose two.)

Accepted Answer

Object versioning.. Object versioning (C) preserves multiple versions of objects, allowing recovery if an object is accidentally deleted or overwritten. Bucket retention policy (D) enforces a minimum retention period, preventing deletion or modification of objects until the period ends. Lifecycle management (B) automates deletion or transition, which could cause accidental data loss rather than prevent it. Requester pays (A) is a billing feature, and uniform bucket-level access (E) controls access permissions—none of these protect against accidental deletion.

Answer

Requester pays.

Answer

Lifecycle management.

Answer

Uniform bucket-level access.

Question 5

A developer ran the above command to create a health check for a backend service. Which of the following should they do to resolve the error?

Accepted Answer

Use a different name for the health check.. The error indicates that a health check with the same name already exists. In Google Cloud, health check names must be unique within a project (or within a region for regional health checks). By using a different name, the developer can create a new health check without conflicting with the existing one.

Answer

Change the request-path to a different value.

Answer

Delete the existing health check and recreate it.

Answer

Add the --global flag to the command.

Answer

Use --load-balancer-type internal to create a new health check with the same name.

Question 6

A company has a Spanner instance for global transactions. They need to ensure reliability during a regional outage. What is the best approach?

Accepted Answer

Enable multi-region configuration with read-only replicas.. Spanner multi-region configurations with read-only replicas provide automatic failover. In the event of a regional outage, Spanner can promote a read-only replica to read-write to maintain availability, ensuring strong consistency and global transaction support. This is the best approach for reliability during a regional outage.

Answer

Spanner is already resilient across zones; use backup/restore for regions.

Answer

Use multiple instances in different regions.

Answer

Enable leader placement option.

Question 7

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) with autoscaling. During a traffic spike, some instances become unhealthy but are not automatically replaced. What is the most likely cause?

Accepted Answer

The autohealing health check is misconfigured.. The most likely cause is that the autohealing health check is misconfigured. In a managed instance group, autohealing relies on a health check to detect unhealthy instances and trigger replacement. If the health check is misconfigured (e.g., wrong port, path, or protocol), the MIG will not recognize instances as unhealthy and will not automatically replace them, even during a traffic spike.

Answer

The MIG is regional and one zone failed.

Answer

The instance template has a startup script error.

Answer

The HTTP load balancer's health check is failing.

Question 8

A company is designing a disaster recovery plan for a Cloud SQL for PostgreSQL instance. They want to failover to a different region with minimal data loss and recovery time under 10 minutes. The database is 500 GB and experiences 2,000 write transactions per second. Which solution should they use?

Accepted Answer

Create a cross-region read replica and promote it to primary during failover.. Both options B and C are valid solutions. Cloud SQL for PostgreSQL supports cross-region read replicas (also referred to as cross-region replicas) that are continuously updated via asynchronous replication. Promoting such a replica to a primary instance typically takes minutes, meeting the RTO under 10 minutes, while replication lag is usually a few seconds, meeting the requirement for minimal data loss. Option B explicitly describes creating a cross-region read replica and promoting it, which is a standard DR practice. Option C describes the same feature using the managed cross-region replication feature. Therefore, both are correct.

Answer

Export the database daily using gsutil and import in the other region using pg_restore.

Answer

Automated backups with point-in-time recovery to a new instance in the other region.

Question 9

A company uses Cloud Spanner for a global financial application. They experience increased latency and transaction aborts during peak hours. Which measure should they take first to improve reliability?

Accepted Answer

Optimize transactions to reduce lock contention.. Transaction aborts and latency in Cloud Spanner are most commonly caused by lock contention during peak hours. By optimizing transactions—such as reducing their scope, using read-only transactions where possible, and avoiding hot-spot writes—you directly address the root cause of contention without incurring additional cost or schema changes. This aligns with Google's best practices for Spanner reliability.

Answer

Increase the number of nodes in the Spanner instance.

Answer

Reduce the number of indexes on frequently updated columns.

Answer

Use interleaved tables to co-locate related data.

Question 10

A company deploys a microservices application on Google Kubernetes Engine (GKE). Pods in one deployment are frequently OOMKilled. The team sets memory requests and limits, but pods still crash. What is the most likely remaining cause?

Accepted Answer

The application has a memory leak that eventually exceeds the limit.. OOMKilled errors occur when a container exceeds its memory limit. Setting memory requests and limits prevents unbounded usage, but if the application has a memory leak, it will continue to consume memory until it hits the configured limit, causing the kernel's Out-Of-Memory (OOM) killer to terminate the pod. The fact that pods still crash after setting limits indicates the application itself is the root cause, not resource configuration.

Answer

CPU requests are too low, causing throttling and eventual crash.

Answer

The node pool is too small, causing memory pressure on the node.

Answer

Memory limits are set higher than the node's allocatable memory.

Question 11

An organization uses Cloud Functions (2nd gen) for event-driven processing. They notice that some functions fail with 'memory limit exceeded' errors during peak load. The function processes messages from Pub/Sub and writes to Firestore. What should they do to improve reliability without sacrificing throughput?

Accepted Answer

Increase the memory allocated to the Cloud Function.. The 'memory limit exceeded' error indicates that the function's allocated memory is insufficient for the workload during peak load. Increasing the memory allocation (Option B) directly resolves this by providing more RAM for processing larger messages or concurrent operations, without altering the invocation pattern or throughput. Cloud Functions (2nd gen) allow memory to be set up to 32 GiB, and this change does not reduce the number of events processed per second.

Answer

Increase the maximum number of concurrent function instances.

Answer

Enable Pub/Sub batching to reduce the number of function invocations.

Answer

Split the function into multiple smaller functions, each handling a subset of the data.

Question 12

A company deploys a stateful workload using StatefulSets on GKE. They want to ensure that if a pod is evicted, its persistent volume claim (PVC) is reattached to the replacement pod in the same zone. Which configuration achieves this?

Accepted Answer

Use a StatefulSet with a volumeClaimTemplate referencing a persistent disk in the same zone.. StatefulSets are designed for stateful workloads and guarantee stable network identities and persistent storage. When a pod is evicted, the StatefulSet controller ensures the replacement pod uses the same PVC, which is bound to a GCE Persistent Disk in the same zone as the original pod, provided the volumeClaimTemplate specifies a disk in that zone. This maintains data locality and avoids cross-zone reattachment.

Answer

Use a Deployment with a PVC that has allowedTopologies restricting to the desired zone.

Answer

Use a Deployment with a persistent volume that is manually attached after pod creation.

Answer

Use a StatefulSet with a persistent disk that has access mode ReadOnlyMany.

Question 13

A company monitors their application with Cloud Monitoring. They set up an alerting policy to notify the on-call team when the 99th percentile latency exceeds 500 ms for 5 minutes. However, they receive false positive alerts due to short bursts. How should they refine the policy?

Accepted Answer

Increase the evaluation window to 10 minutes.. Increasing the evaluation window to 10 minutes smooths out short bursts of high latency, ensuring the alert triggers only when the 99th percentile latency exceeds 500 ms for a sustained period. Cloud Monitoring evaluates metrics over the specified window, so a longer window reduces false positives from transient spikes while still detecting genuine degradation.

Answer

Set up alerting on each data point individually.

Answer

Decrease the threshold to 400 ms.

Answer

Change the metric to average latency instead of 99th percentile.

Question 14

A company runs a web application on Compute Engine behind an HTTP load balancer. They want to improve reliability by implementing failover across two regions. Which TWO actions should they take?

Accepted Answer

Deploy a global external HTTP load balancer with backends in both regions.. A global external HTTP load balancer is required for cross-region failover because it uses a single anycast IP address and routes traffic to the closest healthy backend. By deploying backends in both regions, the load balancer automatically fails over to the secondary region if the primary region's backends become unhealthy, improving reliability without DNS propagation delays.

Answer

Configure DNS-based failover using Cloud DNS with health checks.

Answer

Use an internal load balancer to route traffic between regions.

Answer

Use a regional external HTTP load balancer with a multi-region backend.

Question 15

A company uses Cloud CDN to accelerate content delivery. They notice that some users receive stale content even after purging the cache. Which THREE factors could cause this?

Accepted Answer

The purge request did not complete successfully.. A purge request that does not complete successfully will leave cached content intact, causing users to receive stale data. Cloud CDN processes purge requests asynchronously, and if the request fails (e.g., due to network issues or invalid paths), the cache is not invalidated. This directly explains why stale content persists despite an attempted purge.

Answer

The content is compressed with gzip.

Answer

The CDN is configured with signed URLs.

Question 16

A company deploys a critical application on Google Kubernetes Engine (GKE) and wants to ensure high availability during cluster upgrades. Which TWO practices should they follow?

Accepted Answer

Use multiple node pools across different zones within the cluster.. Deploying multiple node pools across different zones ensures that if one zone fails or is taken down for maintenance, the application can continue serving from the other zones. This aligns with GKE's best practice for high availability by distributing workloads across failure domains. Option C is correct because PodDisruptionBudgets (PDBs) define the minimum number of pods that must remain available during voluntary disruptions like cluster upgrades, preventing the upgrade from taking down too many replicas at once.

Answer

Use a single-zone node pool with multiple replicas.

Answer

Enable cluster autoscaling to add nodes during upgrades.

Answer

Enable regional clusters for multi-zone control plane.

Question 17

A company runs a multi-tier application on Google Cloud: a frontend on App Engine Standard, a backend on Cloud Run, and a Cloud SQL database. The application experiences intermittent 500 errors when users submit forms. The errors correlate with high CPU usage on the Cloud SQL instance (db-n1-standard-2, 7.5 GB memory). The Cloud Run service has a concurrency setting of 80 and a maximum of 10 instances. The App Engine service uses automatic scaling. The team has verified that the application code is not the issue. They suspect the database is hitting connection limits. Current max_connections on Cloud SQL is 250. The Cloud Run service uses a connection pool of 10 connections per instance. The App Engine service uses a connection pool of 5 connections per instance. They also have a few batch jobs that run occasionally, using up to 10 connections. The team wants to resolve the errors with minimal cost and complexity. Which course of action should they take?

Accepted Answer

Increase the max_connections parameter on Cloud SQL to 500.. The intermittent 500 errors are caused by the Cloud SQL instance hitting its max_connections limit of 250. With Cloud Run using 10 connections per instance and up to 10 instances (100 connections), App Engine using 5 connections per instance (unknown instance count but likely significant), and batch jobs using up to 10 connections, the total can easily exceed 250. Increasing max_connections to 500 directly addresses the connection limit without changing instance size or scaling behavior, which is the simplest and most cost-effective fix.

Answer

Increase the maximum number of Cloud Run instances to 20 to handle more requests.

Answer

Upgrade the Cloud SQL instance to db-n1-standard-4 (15 GB memory) to handle more connections.

Answer

Reduce the concurrency setting on Cloud Run from 80 to 40.

Question 18

A company runs a web application on Google Kubernetes Engine (GKE) with Cluster Autoscaler enabled. During a traffic spike, the application becomes slow and some requests timeout. The cluster has sufficient CPU and memory headroom. What is the most likely cause and solution?

Accepted Answer

Configure Horizontal Pod Autoscaler (HPA) based on CPU utilization or custom metrics.. The cluster has sufficient CPU and memory headroom, indicating that the issue is not about cluster capacity but about pod-level scaling. The Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU utilization or custom metrics, which directly addresses the application slowdown and timeouts during traffic spikes by distributing the load across more pods.

Answer

Increase the node pool's machine type to a larger size.

Answer

Enable Cluster Autoscaler to add more nodes.

Answer

Deploy the application in a regional cluster for higher availability.

Question 19

An organization is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single server with an on-premises database. The application is stateful and requires low-latency access to the database. The migration must minimize downtime and ensure high availability. Which architecture should the company adopt?

Accepted Answer

Deploy on Compute Engine with a regional persistent disk and use Cloud SQL for PostgreSQL with regional high availability.. It combines Compute Engine with a regional persistent disk for synchronous replication across zones, ensuring high availability with minimal downtime during a zonal failure. Cloud SQL for PostgreSQL with regional high availability provides a managed, low-latency database with automatic failover, meeting the stateful application's need for low-latency access and high availability without the complexity of container orchestration.

Answer

Deploy on GKE with StatefulSets and use Cloud Spanner for global consistency.

Answer

Deploy on App Engine Standard Environment and use Cloud Firestore in Datastore mode.

Answer

Deploy on Cloud Run and use Cloud SQL with read replicas.

Question 20

A company uses Cloud SQL for MySQL to host its production database. The database experiences high read traffic. The team wants to improve read performance without modifying the application. What should they do?

Accepted Answer

Add read replicas and configure the application to use them for read queries.. Adding read replicas offloads read queries from the primary Cloud SQL instance, distributing the read load across multiple replicas. This improves read performance without any application code changes, as the application can be configured to direct read queries to the replica endpoints. Cloud SQL for MySQL replicas use asynchronous replication, ensuring near-real-time data consistency for read-heavy workloads.

Answer

Increase the number of CPUs on the primary Cloud SQL instance.

Answer

Use Cloud SQL Proxy with connection pooling.

Answer

Enable automatic storage increase to allow more data.