Google PCA Ensure solution and operations reliability Practice Test 2 — 15 Questions

Question 1

A startup uses Cloud Functions for event-driven processing. They notice some functions are timing out. How to increase reliability without changing the business logic?

Accepted Answer

Enable retry on failure for the event-driven function. Enabling retry on failure for event-driven Cloud Functions allows the platform to automatically retry the invocation when a function times out or fails, without modifying the business logic. This leverages the built-in retry mechanism for background functions, which uses exponential backoff to handle transient failures and improve reliability.

Answer

Increase the function timeout to the maximum allowed

Answer

Use Cloud Tasks to decouple and retry synchronously

Answer

Refactor the function to reduce complexity

Question 2

An organization wants to define an SLO for their API hosted on Cloud Endpoints. Which metric should they use as a Service Level Indicator (SLI) for availability?

Accepted Answer

Ratio of HTTP 200 responses to total requests. For an availability SLO, the SLI must measure the proportion of successful requests. In Cloud Endpoints, availability is defined as the ratio of successful (HTTP 200) responses to total requests, as this directly reflects whether the API is functioning correctly. Option C is correct because it captures the fraction of requests that completed without error, which is the standard definition of availability in service-level monitoring.

Answer

Number of HTTP 5xx errors

Answer

Request latency at the 99th percentile

Answer

CPU utilization of backend instances

Question 3

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. During a traffic spike from a legitimate source, legitimate requests are being blocked. How should they tune the security policy to minimize false positives?

Accepted Answer

Enable adaptive protection with machine learning. Enable adaptive protection with machine learning. Cloud Armor's Adaptive Protection uses ML to analyze traffic patterns and automatically suggest or apply tuning to WAF rules, which helps distinguish legitimate traffic spikes from actual attacks and reduces false positives. Increasing the rate limiting threshold (B) only addresses volumetric rate-based rules and may not fix false positives caused by signature-based WAF rules. Disabling WAF rules (C) removes protection entirely and is not a tuning approach. JWT authentication (D) is an application-layer access control mechanism and does not tune Cloud Armor's DDoS/WAF policy to reduce false positives.

Answer

Increase the rate limiting threshold

Answer

Disable the Web Application Firewall (WAF) rules

Answer

Use the JSON Web Token (JWT) authentication to filter requests

Question 4

After a data corruption incident, a company needs to restore their Cloud SQL for PostgreSQL instance from a backup. What is the correct procedure to minimize downtime?

Accepted Answer

Restore the backup directly to the existing Cloud SQL instance. Restoring a backup directly to the existing Cloud SQL instance is the fastest method to minimize downtime because it overwrites the current data in-place without requiring DNS propagation, connection string changes, or reconfiguration of applications. Cloud SQL supports in-place restore from automated or on-demand backups, which typically completes within minutes for most instance sizes, as the operation leverages the underlying storage layer to apply the backup snapshot directly to the existing persistent disk.

Answer

Create a new instance from the backup, then rename and delete the old instance

Answer

Use point-in-time recovery to restore to a time before corruption

Answer

Export the backup to Cloud Storage and import into the existing instance

Question 5

A company is deploying a critical application on Compute Engine with an HTTP load balancer. They want to ensure that if an instance health check fails, traffic is automatically rerouted to healthy instances. Which configuration should they implement?

Accepted Answer

Use an HTTP(S) load balancer with a backend service configured with a health check and enable connection draining.. An HTTP(S) load balancer with a backend service configured with a health check automatically monitors instance health and reroutes traffic away from unhealthy instances. Enabling connection draining ensures that in-flight requests to an unhealthy instance are given time to complete before the instance is removed from the load balancing pool, preventing disruption to active sessions.

Answer

Use an internal load balancer with a backend service configured with a health check.

Answer

Use a network load balancer with a health check configured on the target pool.

Answer

Use an HTTP(S) load balancer with a backend service configured with a health check and enable session affinity.

Answer

Use a TCP proxy load balancer with a backend service configured with a health check.

Question 6

A financial services company runs a stateful backend service on Google Kubernetes Engine (GKE) using StatefulSets with Persistent Volumes. They observe that after a node failure, the pod is rescheduled on a different node but the Persistent Volume cannot be attached because it is still "released" and not "available". What is the most likely cause and solution?

Accepted Answer

The PersistentVolume has retain policy "Retain"; manually delete and recreate the volume.. When a PersistentVolume (PV) has a reclaim policy of 'Retain', after the PersistentVolumeClaim (PVC) is deleted, the PV enters a 'Released' state and is not automatically recycled for reuse. The underlying storage resource (e.g., a Compute Engine persistent disk) still exists but the PV cannot be re-attached until an administrator manually deletes the PV and recreates it, or edits the PV to remove the claim reference. This explains why the pod rescheduled on a new node cannot attach the volume.

Answer

The PersistentVolume has reclaim policy "Recycle"; it is not supported in GKE.

Answer

The PersistentVolumeClaim was not created with the correct storage class; recreate with reclaim policy "Delete".

Answer

The PersistentVolumeClaim's access mode is ReadWriteOnce, which prevents attachment to a new node; change to ReadWriteMany.

Answer

The PersistentVolume has reclaim policy "Retain" and the previous pod's volume attachment is not cleared; use a StatefulSet with volumeClaimTemplates and reclaim policy "Delete".

Question 7

A startup runs a web application on App Engine standard environment. They want to ensure the application can handle sudden traffic spikes without manual intervention. Which App Engine feature should they configure?

Accepted Answer

Automatic scaling with a maximum number of idle instances.. App Engine's automatic scaling with a maximum number of idle instances is designed to handle sudden traffic spikes by dynamically creating and removing instances based on request load. This configuration allows the application to scale up quickly when traffic increases, ensuring responsiveness without manual intervention, while the maximum idle instances setting prevents over-provisioning and controls costs.

Answer

Manual scaling with a fixed number of instances.

Answer

Basic scaling with automatic instance creation.

Answer

Resident instances with a minimum number of always-on instances.

Answer

Custom scaling based on CPU utilization.

Question 8

A company uses Cloud Storage for backups of on-premises databases. They want to ensure that data is protected against accidental deletion or modification by users. Which combination of features should they enable?

Accepted Answer

Object versioning and bucket locking with retention policy.. Object versioning protects against accidental deletion or modification by preserving all versions of an object, while a bucket lock with a retention policy enforces a minimum retention period, preventing premature deletion or alteration. Together, they provide both recoverability and immutable compliance, which is essential for backup data integrity.

Answer

Object versioning and lifecycle management to delete old versions.

Answer

Bucket locking with retention policy and bucket-level IAM restrictions.

Answer

Bucket locking with retention policy and object holds.

Answer

Object versioning and IAM conditions restricting access to specific IP ranges.

Question 9

A company uses Cloud NAT to allow private instances to access the internet. They notice intermittent connectivity issues. What should they check first?

Accepted Answer

Cloud NAT gateway has at least one NAT IP address configured.. Intermittent connectivity issues when using Cloud NAT are most commonly caused by a lack of NAT IP addresses. Cloud NAT uses source network address translation (SNAT) to map private instance traffic to a public IP address; if the gateway has no NAT IP addresses configured, or if the number of concurrent connections exceeds the available port capacity of the assigned NAT IPs, packets are dropped, leading to intermittent failures. Checking that at least one NAT IP address is assigned is the first and most critical troubleshooting step.

Answer

Cloud NAT router has a configured IP address range.

Answer

Cloud NAT gateway is in the same region as the instances.

Answer

The VPC subnet has private Google access enabled.

Answer

The instances have external IP addresses assigned.

Question 10

A company needs to deploy a stateless web application that can handle variable traffic. Which compute option is the most cost-effective and scales automatically?

Accepted Answer

App Engine standard environment with automatic scaling.. App Engine standard environment with automatic scaling is the most cost-effective and automatically scales to zero when there is no traffic, making it ideal for variable traffic stateless web applications. It abstracts infrastructure management, charges only for resources used, and handles scaling instantly without provisioning overhead.

Answer

Google Kubernetes Engine (GKE) with cluster autoscaling.

Answer

Compute Engine with managed instance groups and autoscaling.

Answer

Compute Engine with preemptible VMs.

Answer

Cloud Run with CPU always allocated.

Question 11

A company uses Cloud Interconnect to connect on-premises network to GCP. They want to ensure that if one interconnect link fails, traffic is automatically rerouted to another link. Which configuration should they implement?

Accepted Answer

Create a second interconnect in a different metro and use BGP with MED.. Using a second interconnect in a different metro with BGP MED (Multi-Exit Discriminator) allows you to influence inbound traffic path selection and provides true geographic redundancy. If one interconnect link fails, BGP withdraws the routes, and traffic automatically fails over to the remaining interconnect via the alternate path, ensuring high availability without relying on a single point of failure.

Answer

Configure BGP sessions with equal-cost multi-path (ECMP) over multiple interconnect links.

Answer

Use a VPN as backup for the interconnect.

Answer

Use a single VLAN attachment with multiple interconnect links.

Answer

Use multiple VLAN attachments with the same interconnect.

Question 12

A company runs a batch process every night that loads data into BigQuery. They want to ensure that if the job fails, it is retried automatically up to 3 times. Which configuration should they use?

Accepted Answer

Cloud Composer (Airflow) tasks with retries.. Cloud Composer (Airflow) natively supports task-level retries via the `retries` parameter in task definitions, allowing you to specify up to 3 automatic retries on failure. This is the appropriate choice for orchestrating a batch process that loads data into BigQuery, as Airflow provides robust retry logic, dependency management, and monitoring for complex workflows.

Answer

Cloud Run jobs with --max-retries=3.

Answer

Cloud Scheduler with retry policy.

Answer

BigQuery load job with maximum retries setting.

Answer

Cloud Functions with error handling.

Question 13

A company runs a critical application on a Compute Engine instance. They want to ensure that the application remains available even if the instance crashes. Which two GCP features should they use? (Choose two.)

Accepted Answer

Instance template with automatic restart.. An instance template with automatic restart enables Compute Engine to automatically restart a VM instance if it crashes or is terminated due to a non-user-initiated failure. This feature is configured at the instance level and ensures that the application recovers quickly without manual intervention, improving availability for a single-instance workload.

Answer

Regular snapshots of the persistent disk.

Answer

A load balancer distributing traffic to a single instance.

Answer

A Cloud CDN to cache static content.

Question 14

An organization deploys a microservices application on Google Kubernetes Engine (GKE) with multiple Deployments. They want to ensure that the application remains available during a cluster-wide upgrade. Which three best practices should they follow? (Choose three.)

Accepted Answer

Use multiple node pools across different zones.. Option C is correct because spreading node pools across multiple zones gives the cluster regional redundancy, so a cluster-wide upgrade that drains or recreates nodes in one zone does not take down all replicas at once. Option E is correct because a load balancer with health checks only routes traffic to Ready pods, so during a rolling upgrade unhealthy or terminating pods are removed from rotation and the service stays reachable. The option marked CORRECT for PodDisruptionBudgets is right because a PDB (for example minAvailable or maxUnavailable) constrains voluntary disruptions such as node drains during upgrades, ensuring a minimum number of pods remain available for each Deployment. Option A is not required here because cluster autoscaling only adds or removes nodes based on pending pods and does not by itself guarantee availability during an upgrade. Option B is not appropriate because StatefulSets are for stateful workloads needing stable identities and ordered operations, not a blanket replacement for Deployments. Option D is not a best practice for upgrade availability because mixing node types does not provide the zonal or disruption-budget protection needed during a cluster-wide upgrade.

Answer

Enable cluster autoscaling.

Answer

Use StatefulSets instead of Deployments for all services.

Answer

Use node pools with multiple node types.

Question 15

After deploying the above configuration, the application is not receiving traffic from the Kubernetes Service. The Service is correctly configured to target port 8080. What is the most likely issue?

Accepted Answer

The readiness probe is using HTTP but the container may not be ready on that path; change to TCP.. The readiness probe is configured as an HTTP GET request, but the application container may not be serving traffic on the specified HTTP path at startup. If the application listens on a TCP port but does not respond to HTTP GET on that path, the readiness probe will fail, causing the Service to not route traffic to the Pod. Changing the readiness probe to a TCP socket check ensures the probe only verifies that the port is open, which is more reliable when the application does not expose an HTTP endpoint for health checks.

Answer

The initialDelaySeconds for readiness probe is too short; increase it.

Answer

The port name is not defined; add a name to the container port.

Answer

The image pull policy is not set to Always; new pods may use stale image.

Answer

The liveness probe uses tcpSocket; it should be HTTPGet.