Google PCA Ensure solution and operations reliability — 50 Questions

Question 1

A company is designing a disaster recovery plan for a Cloud SQL for PostgreSQL instance. They want to failover to a different region with minimal data loss and recovery time under 10 minutes. The database is 500 GB and experiences 2,000 write transactions per second. Which solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a cross-region read replica and promote it to primary during failover.. Both options B and C are valid solutions. Cloud SQL for PostgreSQL supports cross-region read replicas (also referred to as cross-region replicas) that are continuously updated via asynchronous replication. Promoting such a replica to a primary instance typically takes minutes, meeting the RTO under 10 minutes, while replication lag is usually a few seconds, meeting the requirement for minimal data loss. Option B explicitly describes creating a cross-region read replica and promoting it, which is a standard DR practice. Option C describes the same feature using the managed cross-region replication feature. Therefore, both are correct.

Answer

Export the database daily using gsutil and import in the other region using pg_restore.

Answer

Automated backups with point-in-time recovery to a new instance in the other region.

Question 2

A company deploys a stateful workload using StatefulSets on GKE. They want to ensure that if a pod is evicted, its persistent volume claim (PVC) is reattached to the replacement pod in the same zone. Which configuration achieves this?

Accepted Answer

Use a StatefulSet with a volumeClaimTemplate referencing a persistent disk in the same zone.. StatefulSets are designed for stateful workloads and guarantee stable network identities and persistent storage. When a pod is evicted, the StatefulSet controller ensures the replacement pod uses the same PVC, which is bound to a GCE Persistent Disk in the same zone as the original pod, provided the volumeClaimTemplate specifies a disk in that zone. This maintains data locality and avoids cross-zone reattachment.

Answer

Use a Deployment with a PVC that has allowedTopologies restricting to the desired zone.

Answer

Use a Deployment with a persistent volume that is manually attached after pod creation.

Answer

Use a StatefulSet with a persistent disk that has access mode ReadOnlyMany.

Question 3

A company runs a web application on Compute Engine behind an HTTP load balancer. They want to improve reliability by implementing failover across two regions. Which TWO actions should they take?

Accepted Answer

Deploy a global external HTTP load balancer with backends in both regions.. Option A is correct because a global external HTTP(S) load balancer uses Google's global anycast VIP and can distribute traffic across backends in multiple regions, providing automatic cross-region failover when a region's backends become unhealthy. Option B is correct because configuring a backend service with a failover policy (failoverRatio and a designated failover backend group) explicitly defines primary and secondary backends so traffic shifts to the secondary group when the primary group's healthy capacity drops below the threshold. Option C is not appropriate because Cloud DNS failover with health checks is a DNS-based approach and does not leverage the HTTP load balancer's native multi-region backend failover; it also introduces DNS TTL delays. Option D is wrong because an internal load balancer is for internal VPC traffic, not for serving external users of a web application. Option E is wrong because a regional external HTTP load balancer cannot span multiple regions with a multi-region backend; only a global external HTTP(S) load balancer supports cross-region backends.

Answer

Configure DNS-based failover using Cloud DNS with health checks.

Answer

Use an internal load balancer to route traffic between regions.

Answer

Use a regional external HTTP load balancer with a multi-region backend.

Question 4

A company uses Cloud CDN to accelerate content delivery. They notice that some users receive stale content even after purging the cache. Which THREE factors could cause this?

Accepted Answer

The purge request did not complete successfully.. Option B is correct because Cloud CDN invalidation (purge) is an asynchronous operation; if the invalidation request fails or is not fully propagated, edge caches continue serving the previously cached object, so users still see stale content. Option C is correct because Cloud CDN caches content at many Google edge locations (and possibly multiple cache tiers); an invalidation must be applied across all of them, and if some edge locations are not purged or have not yet processed the invalidation, those locations keep returning the stale response. Option E is correct because a long Cache-Control: max-age (or s-maxage) from the origin sets the object's freshness lifetime in the CDN; while Cloud CDN invalidation is designed to force eviction, if the origin's caching headers are not respected or the invalidation does not override the cached entry as expected, the CDN can continue serving the object until its max-age expires. Option A is not correct because gzip compression is just content encoding and does not by itself prevent or defeat cache invalidation. Option D is not correct because signed URLs only control access/authorization to the content; they do not cause stale content after a purge.

Answer

The content is compressed with gzip.

Answer

The CDN is configured with signed URLs.

Question 5

A company deploys a critical application on Google Kubernetes Engine (GKE) and wants to ensure high availability during cluster upgrades. Which TWO practices should they follow?

Accepted Answer

Use multiple node pools across different zones within the cluster.. Option B is correct because spreading node pools across multiple zones within a regional cluster ensures that when one zone's nodes are drained during an upgrade, workloads can still run on nodes in other zones, maintaining availability. Option C is correct because PodDisruptionBudgets (PDBs) constrain voluntary disruptions such as node drains during upgrades, ensuring that only a specified number or percentage of pods (e.g., minAvailable or maxUnavailable) are taken down at once, preserving application capacity. Option A is not suitable because a single-zone node pool places all nodes in one zone, so an upgrade or zone failure can disrupt all replicas simultaneously. Option D is incorrect because cluster autoscaling adds or removes nodes based on resource demand, not to guarantee availability during upgrades, and it does not prevent disruptions. Option E is not among the marked answers; while regional clusters provide a multi-zone control plane, the question asks for practices ensuring high availability during upgrades, which are specifically addressed by multi-zone node pools and PDBs.

Answer

Use a single-zone node pool with multiple replicas.

Answer

Enable cluster autoscaling to add nodes during upgrades.

Answer

Enable regional clusters for multi-zone control plane.

Question 6

A company runs a multi-tier application on Google Cloud: a frontend on App Engine Standard, a backend on Cloud Run, and a Cloud SQL database. The application experiences intermittent 500 errors when users submit forms. The errors correlate with high CPU usage on the Cloud SQL instance (db-n1-standard-2, 7.5 GB memory). The Cloud Run service has a concurrency setting of 80 and a maximum of 10 instances. The App Engine service uses automatic scaling. The team has verified that the application code is not the issue. They suspect the database is hitting connection limits. Current max_connections on Cloud SQL is 250. The Cloud Run service uses a connection pool of 10 connections per instance. The App Engine service uses a connection pool of 5 connections per instance. They also have a few batch jobs that run occasionally, using up to 10 connections. The team wants to resolve the errors with minimal cost and complexity. Which course of action should they take?

Accepted Answer

Increase the max_connections parameter on Cloud SQL to 500.. The intermittent 500 errors are caused by the Cloud SQL instance hitting its max_connections limit of 250. With Cloud Run using 10 connections per instance and up to 10 instances (100 connections), App Engine using 5 connections per instance (unknown instance count but likely significant), and batch jobs using up to 10 connections, the total can easily exceed 250. Increasing max_connections to 500 directly addresses the connection limit without changing instance size or scaling behavior, which is the simplest and most cost-effective fix.

Answer

Increase the maximum number of Cloud Run instances to 20 to handle more requests.

Answer

Upgrade the Cloud SQL instance to db-n1-standard-4 (15 GB memory) to handle more connections.

Answer

Reduce the concurrency setting on Cloud Run from 80 to 40.

Question 7

A company uses Cloud SQL for MySQL to host its production database. The database experiences high read traffic. The team wants to improve read performance without modifying the application. What should they do?

Accepted Answer

Add read replicas and configure the application to use them for read queries.. Adding read replicas offloads read queries from the primary Cloud SQL instance, distributing the read load across multiple replicas. This improves read performance without any application code changes, as the application can be configured to direct read queries to the replica endpoints. Cloud SQL for MySQL replicas use asynchronous replication, ensuring near-real-time data consistency for read-heavy workloads.

Answer

Increase the number of CPUs on the primary Cloud SQL instance.

Answer

Use Cloud SQL Proxy with connection pooling.

Answer

Enable automatic storage increase to allow more data.

Question 8

A company is running a critical application on Compute Engine. The application writes logs to a local persistent disk. The operations team wants to ensure logs are not lost if the VM fails. What should they do?

Accepted Answer

Configure the application to write logs to Cloud Logging using the Logging agent.. Cloud Logging with the Logging agent provides a centralized, durable, and managed log storage solution. The agent streams logs from the VM to Cloud Logging in near real-time, ensuring logs are preserved even if the VM or its local persistent disk fails. This decouples log storage from the VM's lifecycle, meeting the operations team's requirement for log durability.

Answer

Use a regional persistent disk to replicate data across zones.

Answer

Schedule persistent disk snapshots every 5 minutes.

Answer

Create a script to copy logs to a Cloud Storage bucket every minute.

Question 9

Which TWO options are best practices for ensuring high availability of an application running on Google Kubernetes Engine (GKE)?

Accepted Answer

Use pod anti-affinity to spread pods across multiple zones.. Pod anti-affinity ensures that pods from the same application are scheduled on different nodes across multiple zones, reducing the blast radius of a zonal failure. This is a key pattern for achieving high availability in GKE, as it prevents a single zone outage from taking down all replicas of your application.

Answer

Deploy all nodes in the same zone to simplify networking.

Answer

Prefer using preemptible VMs for cost savings.

Answer

Use a single zonal cluster to avoid cross-zone latency.

Question 10

A company runs a batch processing workload on Compute Engine that processes financial transactions. The workload runs daily and must complete within a 4-hour window. The application reads input data from Cloud Storage, processes it, and writes output to another Cloud Storage bucket. The current implementation uses a single VM with a 500 GB persistent disk. Recently, the data volume has increased, and the job is now taking over 6 hours, exceeding the SLA. The team is tasked with redesigning the solution to be faster and more reliable. They want to minimize costs and operational overhead. The data is critical and must not be lost. Which approach should they take?

Accepted Answer

Use Cloud Dataflow with autoscaling to process the data in parallel.. Cloud Dataflow with autoscaling is the correct choice because it provides a fully managed, serverless service for parallel data processing that can automatically scale resources based on the volume of data. This directly addresses the need to complete the batch workload within the 4-hour SLA, as Dataflow can distribute the processing across many workers, significantly reducing execution time. It also ensures reliability and data durability through checkpointing and exactly-once processing semantics, meeting the critical data loss prevention requirement.

Answer

Use a managed instance group with a startup script that processes data, and use Cloud Pub/Sub to coordinate.

Answer

Increase the VM to a high-CPU machine type with a regional persistent disk for HA.

Answer

Deploy the processing logic in Cloud Functions and trigger from Cloud Storage events.

Question 11

Your company runs an e-commerce platform on Google Cloud. The application is deployed on Compute Engine instances in a managed instance group (MIG) with autoscaling based on CPU utilization. The database uses Cloud SQL for MySQL with a single instance. During a recent flash sale, traffic spiked and the application became slow, resulting in a poor user experience. After analyzing the incident, you discovered that the MIG scaled up but the Cloud SQL instance reached its maximum connections limit, causing some requests to fail. You need to recommend a solution to improve the reliability of the application for future traffic spikes. What should you do?

Accepted Answer

Deploy the Cloud SQL Proxy on each Compute Engine instance to manage database connections more efficiently, and configure a connection pool size that matches the maximum connections of the Cloud SQL instance.. Deploying the Cloud SQL Proxy on each Compute Engine instance provides a secure, efficient way to manage database connections. The proxy can be configured with a connection pool size that matches the Cloud SQL instance's maximum connections, preventing the application from exhausting the database's connection limit. This approach also reduces the overhead of establishing new connections and improves connection reuse, directly addressing the bottleneck during traffic spikes.

Answer

Increase the maximum connections setting on the Cloud SQL instance and also increase the instance's tier to handle more concurrent connections.

Answer

Migrate the database to Cloud Spanner to provide unlimited scalability and automatic sharding.

Answer

Implement a connection pooling library in the application code to reuse database connections and reduce the number of new connections.

Question 12

Which TWO actions should you take to improve the reliability of a stateful application deployed on Compute Engine with regional persistent disks?

Accepted Answer

Use a regional persistent disk to replicate data across two zones.. Option A is correct because a regional persistent disk synchronously replicates data between two zones in the same region, so if the primary zone fails the disk can be failed over to the replica zone, directly improving reliability for a stateful workload. Option B is correct because deploying the application across multiple zones in a managed instance group with autohealing spreads instances over independent failure domains and automatically recreates unhealthy VMs, keeping the stateful app available during zone-level or instance-level failures. Option C is not appropriate because preemptible VMs can be terminated at any time, which reduces rather than improves reliability. Option D does not belong because an HTTP(S) load balancer distributes traffic and provides health checking but does not by itself make a stateful application's data more reliable. Option E is not the best fit because scheduled snapshots provide point-in-time backups with potential data loss between snapshots, whereas regional persistent disks provide continuous synchronous replication.

Answer

Use preemptible VMs to reduce costs.

Answer

Place an HTTP(S) load balancer in front of the application.

Answer

Schedule regular snapshots of the persistent disk to Cloud Storage.

Question 13

Match each GCP networking concept to its definition.

Accepted Answer

VPC: A global, isolated virtual network that spans all regions.. The correct matches are A, B, C, and F. Option A correctly defines VPC as a global isolated virtual network. Option B correctly defines Subnet as a regional subnet within a VPC. Option C correctly defines Firewall Rules as traffic control rules. Option F correctly defines VPC Peering as a direct private connection. Options D and E are incorrect because their definitions are swapped: Cloud Router uses BGP for dynamic routing (not NAT), and Cloud NAT provides outbound internet access via NAT (not BGP). Therefore, D and E are wrong.

Answer

Cloud Router: A managed service that provides outbound internet access for private instances via NAT.

Answer

Cloud NAT: A managed service that dynamically exchanges routes between VPC and on-premises networks using BGP.

Question 14

An application uses Cloud Pub/Sub for asynchronous processing. Subscribers occasionally fail to acknowledge messages within the ack deadline, causing redelivery. How to improve reliability and prevent message buildup?

Accepted Answer

Implement exponential backoff in the subscriber retry logic. Implementing exponential backoff in the subscriber retry logic allows the subscriber to gradually increase the delay between retries when messages are not acknowledged, reducing the likelihood of overwhelming the system and preventing message buildup. This approach aligns with Cloud Pub/Sub's recommended practices for handling transient failures, as it gives the subscriber time to recover without exhausting the ack deadline or causing excessive redelivery.

Answer

Increase the ack deadline to the maximum value

Answer

Set max delivery attempts to 1 to avoid redelivery

Answer

Use a dead-letter topic to capture failed messages

Question 15

A global application uses Cloud Spanner with a multi-region configuration. During a regional outage, some transactions are failing. What is the recommended approach to maintain write availability?

Accepted Answer

Configure Spanner with leader-based replication and rely on automatic failover. Cloud Spanner's multi-region configuration uses leader-based replication, where each region has a leader for its read-write replicas. During a regional outage, Spanner automatically fails over the leader to another region, ensuring write availability without manual intervention. This is the recommended approach because it leverages Spanner's built-in synchronous replication and automatic failover to maintain consistency and availability.

Answer

Implement application-level retry with exponential backoff

Answer

Use a single-region Spanner instance with a standby in a different zone

Answer

Manually failover to a different region using a script

Question 16

A startup uses Cloud Functions for event-driven processing. They notice some functions are timing out. How to increase reliability without changing the business logic?

Accepted Answer

Enable retry on failure for the event-driven function. Enabling retry on failure for event-driven Cloud Functions allows the platform to automatically retry the invocation when a function times out or fails, without modifying the business logic. This leverages the built-in retry mechanism for background functions, which uses exponential backoff to handle transient failures and improve reliability.

Answer

Increase the function timeout to the maximum allowed

Answer

Use Cloud Tasks to decouple and retry synchronously

Answer

Refactor the function to reduce complexity

Question 17

An organization wants to define an SLO for their API hosted on Cloud Endpoints. Which metric should they use as a Service Level Indicator (SLI) for availability?

Accepted Answer

Ratio of HTTP 200 responses to total requests. For an availability SLO, the SLI must measure the proportion of successful requests. In Cloud Endpoints, availability is defined as the ratio of successful (HTTP 200) responses to total requests, as this directly reflects whether the API is functioning correctly. Option C is correct because it captures the fraction of requests that completed without error, which is the standard definition of availability in service-level monitoring.

Answer

Number of HTTP 5xx errors

Answer

Request latency at the 99th percentile

Answer

CPU utilization of backend instances

Question 18

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. During a traffic spike from a legitimate source, legitimate requests are being blocked. How should they tune the security policy to minimize false positives?

Accepted Answer

Enable adaptive protection with machine learning. Enable adaptive protection with machine learning. Cloud Armor's Adaptive Protection uses ML to analyze traffic patterns and automatically suggest or apply tuning to WAF rules, which helps distinguish legitimate traffic spikes from actual attacks and reduces false positives. Increasing the rate limiting threshold (B) only addresses volumetric rate-based rules and may not fix false positives caused by signature-based WAF rules. Disabling WAF rules (C) removes protection entirely and is not a tuning approach. JWT authentication (D) is an application-layer access control mechanism and does not tune Cloud Armor's DDoS/WAF policy to reduce false positives.

Answer

Increase the rate limiting threshold

Answer

Disable the Web Application Firewall (WAF) rules

Answer

Use the JSON Web Token (JWT) authentication to filter requests

Question 19

After a data corruption incident, a company needs to restore their Cloud SQL for PostgreSQL instance from a backup. What is the correct procedure to minimize downtime?

Accepted Answer

Restore the backup directly to the existing Cloud SQL instance. Restoring a backup directly to the existing Cloud SQL instance is the fastest method to minimize downtime because it overwrites the current data in-place without requiring DNS propagation, connection string changes, or reconfiguration of applications. Cloud SQL supports in-place restore from automated or on-demand backups, which typically completes within minutes for most instance sizes, as the operation leverages the underlying storage layer to apply the backup snapshot directly to the existing persistent disk.

Answer

Create a new instance from the backup, then rename and delete the old instance

Answer

Use point-in-time recovery to restore to a time before corruption

Answer

Export the backup to Cloud Storage and import into the existing instance

Question 20

A company is deploying a critical application on Compute Engine with an HTTP load balancer. They want to ensure that if an instance health check fails, traffic is automatically rerouted to healthy instances. Which configuration should they implement?

Accepted Answer

Use an HTTP(S) load balancer with a backend service configured with a health check and enable connection draining.. An HTTP(S) load balancer with a backend service configured with a health check automatically monitors instance health and reroutes traffic away from unhealthy instances. Enabling connection draining ensures that in-flight requests to an unhealthy instance are given time to complete before the instance is removed from the load balancing pool, preventing disruption to active sessions.

Answer

Use an internal load balancer with a backend service configured with a health check.

Answer

Use a network load balancer with a health check configured on the target pool.

Answer

Use an HTTP(S) load balancer with a backend service configured with a health check and enable session affinity.

Answer

Use a TCP proxy load balancer with a backend service configured with a health check.