Google PCA Ensure solution and operations reliability Practice Test 4 — 15 Questions

Question 1

A company uses Cloud Storage for backups of on-premises databases. They want to ensure that data is protected against accidental deletion or modification by users. Which combination of features should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Object versioning and bucket locking with retention policy.. Object versioning protects against accidental deletion or modification by preserving all versions of an object, while a bucket lock with a retention policy enforces a minimum retention period, preventing premature deletion or alteration. Together, they provide both recoverability and immutable compliance, which is essential for backup data integrity.

Answer

Object versioning and lifecycle management to delete old versions.

Answer

Bucket locking with retention policy and bucket-level IAM restrictions.

Answer

Bucket locking with retention policy and object holds.

Answer

Object versioning and IAM conditions restricting access to specific IP ranges.

Question 2

A company uses Cloud Logging to monitor their application logs. They notice that some logs from their Compute Engine instances are missing. The instances have the required logging permission. What is the most likely cause?

Accepted Answer

The logging agent is not configured to send logs to Cloud Logging.. Compute Engine instances do not automatically send logs to Cloud Logging. They require the Cloud Logging agent (based on fluentd) to be installed and configured to forward logs. Even with correct IAM permissions, without the agent, logs will not be collected. Option B correctly identifies this missing agent as the most likely cause.

Answer

The log sink is not configured correctly.

Answer

The instances are using a custom image without the logging agent.

Answer

The log bucket is in a different project.

Answer

The log entries are being filtered by the exclusion filter.

Question 3

A company uses Cloud NAT to allow private instances to access the internet. They notice intermittent connectivity issues. What should they check first?

Accepted Answer

Cloud NAT gateway has at least one NAT IP address configured.. Intermittent connectivity issues when using Cloud NAT are most commonly caused by a lack of NAT IP addresses. Cloud NAT uses source network address translation (SNAT) to map private instance traffic to a public IP address; if the gateway has no NAT IP addresses configured, or if the number of concurrent connections exceeds the available port capacity of the assigned NAT IPs, packets are dropped, leading to intermittent failures. Checking that at least one NAT IP address is assigned is the first and most critical troubleshooting step.

Answer

Cloud NAT router has a configured IP address range.

Answer

Cloud NAT gateway is in the same region as the instances.

Answer

The VPC subnet has private Google access enabled.

Answer

The instances have external IP addresses assigned.

Question 4

A company needs to deploy a stateless web application that can handle variable traffic. Which compute option is the most cost-effective and scales automatically?

Accepted Answer

App Engine standard environment with automatic scaling.. App Engine standard environment with automatic scaling is the most cost-effective and automatically scales to zero when there is no traffic, making it ideal for variable traffic stateless web applications. It abstracts infrastructure management, charges only for resources used, and handles scaling instantly without provisioning overhead.

Answer

Google Kubernetes Engine (GKE) with cluster autoscaling.

Answer

Compute Engine with managed instance groups and autoscaling.

Answer

Compute Engine with preemptible VMs.

Answer

Cloud Run with CPU always allocated.

Question 5

A company uses Cloud Interconnect to connect on-premises network to GCP. They want to ensure that if one interconnect link fails, traffic is automatically rerouted to another link. Which configuration should they implement?

Accepted Answer

Create a second interconnect in a different metro and use BGP with MED.. Using a second interconnect in a different metro with BGP MED (Multi-Exit Discriminator) allows you to influence inbound traffic path selection and provides true geographic redundancy. If one interconnect link fails, BGP withdraws the routes, and traffic automatically fails over to the remaining interconnect via the alternate path, ensuring high availability without relying on a single point of failure.

Answer

Configure BGP sessions with equal-cost multi-path (ECMP) over multiple interconnect links.

Answer

Use a VPN as backup for the interconnect.

Answer

Use a single VLAN attachment with multiple interconnect links.

Answer

Use multiple VLAN attachments with the same interconnect.

Question 6

A company runs a batch process every night that loads data into BigQuery. They want to ensure that if the job fails, it is retried automatically up to 3 times. Which configuration should they use?

Accepted Answer

Cloud Composer (Airflow) tasks with retries.. Cloud Composer (Airflow) natively supports task-level retries via the `retries` parameter in task definitions, allowing you to specify up to 3 automatic retries on failure. This is the appropriate choice for orchestrating a batch process that loads data into BigQuery, as Airflow provides robust retry logic, dependency management, and monitoring for complex workflows.

Answer

Cloud Run jobs with --max-retries=3.

Answer

Cloud Scheduler with retry policy.

Answer

BigQuery load job with maximum retries setting.

Answer

Cloud Functions with error handling.

Question 7

A company runs a critical application on a Compute Engine instance. They want to ensure that the application remains available even if the instance crashes. Which two GCP features should they use? (Choose two.)

Accepted Answer

Instance template with automatic restart.. An instance template with automatic restart enables Compute Engine to automatically restart a VM instance if it crashes or is terminated due to a non-user-initiated failure. This feature is configured at the instance level and ensures that the application recovers quickly without manual intervention, improving availability for a single-instance workload.

Answer

Regular snapshots of the persistent disk.

Answer

A load balancer distributing traffic to a single instance.

Answer

A Cloud CDN to cache static content.

Question 8

After deploying the above configuration, the application is not receiving traffic from the Kubernetes Service. The Service is correctly configured to target port 8080. What is the most likely issue?

Accepted Answer

The readiness probe is using HTTP but the container may not be ready on that path; change to TCP.. The readiness probe is configured as an HTTP GET request, but the application container may not be serving traffic on the specified HTTP path at startup. If the application listens on a TCP port but does not respond to HTTP GET on that path, the readiness probe will fail, causing the Service to not route traffic to the Pod. Changing the readiness probe to a TCP socket check ensures the probe only verifies that the port is open, which is more reliable when the application does not expose an HTTP endpoint for health checks.

Answer

The initialDelaySeconds for readiness probe is too short; increase it.

Answer

The port name is not defined; add a name to the container port.

Answer

The image pull policy is not set to Always; new pods may use stale image.

Answer

The liveness probe uses tcpSocket; it should be HTTPGet.

Question 9

A company uses the above IAM policy on a Cloud Storage bucket. They find that Bob can view objects in the bucket. Which statement explains this?

Accepted Answer

Bob is a member of the group viewers@example.com.. The IAM policy shown includes a binding that grants the `roles/storage.objectViewer` role to the group `viewers@example.com`. If Bob is a member of that group, he inherits the permissions to view objects in the bucket. The policy explicitly lists this group as a principal, so Bob's ability to view objects is directly explained by his group membership.

Answer

There is a higher-level policy that grants Bob viewer access.

Answer

The etag is mismatched causing policy override.

Answer

The bucket has uniform bucket-level access disabled.

Answer

The objectCreator role implicitly includes read access.

Question 10

Your company runs a stateless web application on Compute Engine. You want to ensure that if a zone fails, the application continues to serve traffic with minimal manual intervention. What should you do?

Accepted Answer

Create a regional managed instance group with an autoscaling policy and use a global Cloud Load Balancer.. A regional managed instance group (MIG) distributes instances across multiple zones within a region, ensuring that if one zone fails, the remaining zones continue serving traffic. Combined with a global Cloud Load Balancer, traffic is automatically routed to healthy instances in any zone, providing high availability with minimal manual intervention. Autoscaling further ensures that new instances are created to handle load, even if a zone becomes unavailable.

Answer

Schedule regular snapshots of each instance's persistent disk to a regional bucket.

Answer

Use a global Cloud Load Balancer and enable Cloud CDN.

Answer

Create an instance template and manually deploy instances in another zone.

Question 11

You are using Cloud SQL for PostgreSQL. You want to ensure that data can be recovered to any point within the last 7 days. What should you enable?

Accepted Answer

Enable automated backups and set the backup configuration to enable binary logging (point-in-time recovery).. Enabling automated backups with binary logging (also known as write-ahead logging or WAL archiving) in Cloud SQL for PostgreSQL allows point-in-time recovery (PITR). This lets you restore your database to any specific timestamp within the retention window, which you can set to 7 days. Automated backups alone only provide daily snapshot restores, not the granularity needed for recovery to any point in time.

Answer

Export the database daily to Cloud Storage.

Answer

Create a cross-region read replica.

Answer

Enable automated backups with a 7-day retention period.

Question 12

A developer wants to monitor the CPU usage of a single Compute Engine VM and receive alerts when it exceeds 80%. What is the simplest way to achieve this?

Accepted Answer

Install the Cloud Monitoring agent and create an alerting policy based on the metric 'cpu.utilization'.. The Cloud Monitoring agent (formerly Stackdriver agent) collects CPU utilization metrics from Compute Engine VMs and sends them to Cloud Monitoring. You can then create an alerting policy directly on the metric 'cpu.utilization' with a threshold of 80% without any custom scripting or additional infrastructure. This is the simplest and most native approach for a single VM.

Answer

Query the Compute Engine API periodically and check CPU usage.

Answer

Configure a Cloud Logging sink to BigQuery and set a scheduled query to detect high CPU.

Answer

Use the managed instance group's autoscaling metric to trigger a notification.

Question 13

Your company's global e-commerce platform uses a managed instance group (MIG) in us-central1 and a Cloud Load Balancer. Traffic has grown, and you want to improve availability by distributing load across multiple regions. What should you do?

Accepted Answer

Create MIGs in additional regions and add them as backends to the existing global load balancer.. A global external HTTP(S) load balancer can have backends in multiple regions. By creating managed instance groups (MIGs) in additional regions and adding them as backends to the existing global load balancer, you distribute traffic across regions, improving availability and reducing latency for users worldwide. This approach leverages the load balancer's anycast IP and cross-region load balancing capabilities.

Answer

Increase the machine type of the existing instances to handle more traffic.

Answer

Enable Cloud CDN to cache content closer to users.

Answer

Change the load balancer to global and configure a single backend.

Question 14

Your organization uses Cloud Spanner for a customer database with a 99.999% availability SLA. You need a Disaster Recovery plan that ensures data consistency with zero RPO in case of a region failure. What should you do?

Accepted Answer

Use a multi-region instance configuration (e.g., nam-eur-asia) for the Spanner instance.. Cloud Spanner multi-region instance configurations (e.g., nam-eur-asia) provide synchronous replication across multiple regions, ensuring strong global consistency and zero RPO. This architecture uses Paxos-based replication to commit writes only after they are durably stored in a majority of regions, so a region failure does not lose any committed data. The 99.999% availability SLA is met by automatic failover within the multi-region setup without manual intervention.

Answer

Use a single-region instance configuration and enable read replicas.

Answer

Export the database periodically to Cloud Storage and set up a cross-region load balancer.

Answer

Configure daily backups and store them in Cloud Storage in a different region.

Question 15

Your team manages a service with a 99.9% uptime SLO over a 30-day window. The error budget for this period is 43 minutes. In the first week, outages consumed 30 minutes of the budget. You are planning a new release. What should you do?

Accepted Answer

Delay the release and focus on improving reliability to rebuild the error budget.. With only 13 minutes of error budget remaining after the first week, proceeding with the release (Option B) risks exhausting the budget entirely from any unforeseen issues, violating the 99.9% SLO. Delaying the release (Option C) allows the team to focus on reliability improvements, such as implementing canary deployments, adding circuit breakers, or enhancing monitoring with tools like Prometheus and Grafana, to rebuild the error budget over the remaining 23 days. This aligns with the principle of using error budgets to balance innovation with reliability, as defined in Google's SRE practices.

Answer

Reduce the SLO to 99.8% to increase the error budget.

Answer

Proceed with the release because the remaining budget is sufficient.

Answer

Release the feature but only to a small percentage of users.