Google PCA Ensure solution and operations reliability — Timed 15 Questions

Question 1

Match each GCP networking concept to its definition.

Accepted Answer

VPC: A global, isolated virtual network that spans all regions.. The correct matches are A, B, C, and F. Option A correctly defines VPC as a global isolated virtual network. Option B correctly defines Subnet as a regional subnet within a VPC. Option C correctly defines Firewall Rules as traffic control rules. Option F correctly defines VPC Peering as a direct private connection. Options D and E are incorrect because their definitions are swapped: Cloud Router uses BGP for dynamic routing (not NAT), and Cloud NAT provides outbound internet access via NAT (not BGP). Therefore, D and E are wrong.

Answer

Cloud Router: A managed service that provides outbound internet access for private instances via NAT.

Answer

Cloud NAT: A managed service that dynamically exchanges routes between VPC and on-premises networks using BGP.

Question 2

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. During a traffic spike from a legitimate source, legitimate requests are being blocked. How should they tune the security policy to minimize false positives?

Accepted Answer

Enable adaptive protection with machine learning. Enabling adaptive protection with machine learning allows Cloud Armor to analyze traffic patterns and distinguish between legitimate and malicious requests, dynamically adjusting the security policy to reduce false positives during legitimate traffic spikes. Option B (increasing rate limiting threshold) is a static measure that may not adapt to changing traffic patterns. Option C (disabling WAF rules) removes protection entirely and is not a targeted solution. Option D (JWT authentication) is for validating token-based authentication, not for tuning DDoS protection to avoid false positives.

Answer

Increase the rate limiting threshold

Answer

Disable the Web Application Firewall (WAF) rules

Answer

Use the JSON Web Token (JWT) authentication to filter requests

Question 3

An organization deploys a microservices application on Google Kubernetes Engine (GKE) with multiple Deployments. They want to ensure that the application remains available during a cluster-wide upgrade. Which three best practices should they follow? (Choose three.)

Accepted Answer

Use multiple node pools across different zones.. To maintain availability during a GKE cluster upgrade, three best practices are: (1) Configure PodDisruptionBudgets (PDBs) for each deployment to limit the number of pods that can be disrupted simultaneously during voluntary disruptions like node upgrades. (2) Use multiple node pools across different zones to allow GKE to upgrade nodes one zone at a time, ensuring that replicas in other zones remain available. (3) Set up a load balancer with health checks so that traffic is only directed to healthy pods, automatically routing away from pods being terminated during the upgrade.

Answer

Enable cluster autoscaling.

Answer

Use StatefulSets instead of Deployments for all services.

Answer

Use node pools with multiple node types.

Question 4

A company uses Cloud Storage to store user-uploaded content. They want to ensure that the data is highly durable and protected against accidental deletion. Which two features should they enable? (Choose two.)

Accepted Answer

Object versioning.. Object versioning (C) preserves multiple versions of objects, allowing recovery if an object is accidentally deleted or overwritten. Bucket retention policy (D) enforces a minimum retention period, preventing deletion or modification of objects until the period ends. Lifecycle management (B) automates deletion or transition, which could cause accidental data loss rather than prevent it. Requester pays (A) is a billing feature, and uniform bucket-level access (E) controls access permissions—none of these protect against accidental deletion.

Answer

Requester pays.

Answer

Lifecycle management.

Answer

Uniform bucket-level access.

Question 5

A developer ran the above command to create a health check for a backend service. Which of the following should they do to resolve the error?

Accepted Answer

Use a different name for the health check.. The error indicates that a health check with the same name already exists. In Google Cloud, health check names must be unique within a project (or within a region for regional health checks). By using a different name, the developer can create a new health check without conflicting with the existing one.

Answer

Change the request-path to a different value.

Answer

Delete the existing health check and recreate it.

Answer

Add the --global flag to the command.

Answer

Use --load-balancer-type internal to create a new health check with the same name.

Question 6

A company has a Spanner instance for global transactions. They need to ensure reliability during a regional outage. What is the best approach?

Accepted Answer

Enable multi-region configuration with read-only replicas.. Spanner multi-region configurations with read-only replicas provide automatic failover. In the event of a regional outage, Spanner can promote a read-only replica to read-write to maintain availability, ensuring strong consistency and global transaction support. This is the best approach for reliability during a regional outage.

Answer

Spanner is already resilient across zones; use backup/restore for regions.

Answer

Use multiple instances in different regions.

Answer

Enable leader placement option.

Question 7

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) with autoscaling. During a traffic spike, some instances become unhealthy but are not automatically replaced. What is the most likely cause?

Accepted Answer

The autohealing health check is misconfigured.. The most likely cause is that the autohealing health check is misconfigured. In a managed instance group, autohealing relies on a health check to detect unhealthy instances and trigger replacement. If the health check is misconfigured (e.g., wrong port, path, or protocol), the MIG will not recognize instances as unhealthy and will not automatically replace them, even during a traffic spike.

Answer

The MIG is regional and one zone failed.

Answer

The instance template has a startup script error.

Answer

The HTTP load balancer's health check is failing.

Question 8

A company is designing a disaster recovery plan for a Cloud SQL for PostgreSQL instance. They want to failover to a different region with minimal data loss and recovery time under 10 minutes. The database is 500 GB and experiences 2,000 write transactions per second. Which solution should they use?

Accepted Answer

Create a cross-region read replica and promote it to primary during failover.. Both options B and C are valid solutions. Cloud SQL for PostgreSQL supports cross-region read replicas (also referred to as cross-region replicas) that are continuously updated via asynchronous replication. Promoting such a replica to a primary instance typically takes minutes, meeting the RTO under 10 minutes, while replication lag is usually a few seconds, meeting the requirement for minimal data loss. Option B explicitly describes creating a cross-region read replica and promoting it, which is a standard DR practice. Option C describes the same feature using the managed cross-region replication feature. Therefore, both are correct.

Answer

Export the database daily using gsutil and import in the other region using pg_restore.

Answer

Automated backups with point-in-time recovery to a new instance in the other region.

Question 9

A company uses Cloud Spanner for a global financial application. They experience increased latency and transaction aborts during peak hours. Which measure should they take first to improve reliability?

Accepted Answer

Optimize transactions to reduce lock contention.. Transaction aborts and latency in Cloud Spanner are most commonly caused by lock contention during peak hours. By optimizing transactions—such as reducing their scope, using read-only transactions where possible, and avoiding hot-spot writes—you directly address the root cause of contention without incurring additional cost or schema changes. This aligns with Google's best practices for Spanner reliability.

Answer

Increase the number of nodes in the Spanner instance.

Answer

Reduce the number of indexes on frequently updated columns.

Answer

Use interleaved tables to co-locate related data.

Question 10

A company deploys a microservices application on Google Kubernetes Engine (GKE). Pods in one deployment are frequently OOMKilled. The team sets memory requests and limits, but pods still crash. What is the most likely remaining cause?

Accepted Answer

The application has a memory leak that eventually exceeds the limit.. OOMKilled errors occur when a container exceeds its memory limit. Setting memory requests and limits prevents unbounded usage, but if the application has a memory leak, it will continue to consume memory until it hits the configured limit, causing the kernel's Out-Of-Memory (OOM) killer to terminate the pod. The fact that pods still crash after setting limits indicates the application itself is the root cause, not resource configuration.

Answer

CPU requests are too low, causing throttling and eventual crash.

Answer

The node pool is too small, causing memory pressure on the node.

Answer

Memory limits are set higher than the node's allocatable memory.

Question 11

An organization uses Cloud Functions (2nd gen) for event-driven processing. They notice that some functions fail with 'memory limit exceeded' errors during peak load. The function processes messages from Pub/Sub and writes to Firestore. What should they do to improve reliability without sacrificing throughput?

Accepted Answer

Increase the memory allocated to the Cloud Function.. The 'memory limit exceeded' error indicates that the function's allocated memory is insufficient for the workload during peak load. Increasing the memory allocation (Option B) directly resolves this by providing more RAM for processing larger messages or concurrent operations, without altering the invocation pattern or throughput. Cloud Functions (2nd gen) allow memory to be set up to 32 GiB, and this change does not reduce the number of events processed per second.

Answer

Increase the maximum number of concurrent function instances.

Answer

Enable Pub/Sub batching to reduce the number of function invocations.

Answer

Split the function into multiple smaller functions, each handling a subset of the data.

Question 12

A company deploys a stateful workload using StatefulSets on GKE. They want to ensure that if a pod is evicted, its persistent volume claim (PVC) is reattached to the replacement pod in the same zone. Which configuration achieves this?

Accepted Answer

Use a StatefulSet with a volumeClaimTemplate referencing a persistent disk in the same zone.. StatefulSets are designed for stateful workloads and guarantee stable network identities and persistent storage. When a pod is evicted, the StatefulSet controller ensures the replacement pod uses the same PVC, which is bound to a GCE Persistent Disk in the same zone as the original pod, provided the volumeClaimTemplate specifies a disk in that zone. This maintains data locality and avoids cross-zone reattachment.

Answer

Use a Deployment with a PVC that has allowedTopologies restricting to the desired zone.

Answer

Use a Deployment with a persistent volume that is manually attached after pod creation.

Answer

Use a StatefulSet with a persistent disk that has access mode ReadOnlyMany.

Question 13

A company monitors their application with Cloud Monitoring. They set up an alerting policy to notify the on-call team when the 99th percentile latency exceeds 500 ms for 5 minutes. However, they receive false positive alerts due to short bursts. How should they refine the policy?

Accepted Answer

Increase the evaluation window to 10 minutes.. Increasing the evaluation window to 10 minutes smooths out short bursts of high latency, ensuring the alert triggers only when the 99th percentile latency exceeds 500 ms for a sustained period. Cloud Monitoring evaluates metrics over the specified window, so a longer window reduces false positives from transient spikes while still detecting genuine degradation.

Answer

Set up alerting on each data point individually.

Answer

Decrease the threshold to 400 ms.

Answer

Change the metric to average latency instead of 99th percentile.

Question 14

A company runs a web application on Compute Engine behind an HTTP load balancer. They want to improve reliability by implementing failover across two regions. Which TWO actions should they take?

Accepted Answer

Deploy a global external HTTP load balancer with backends in both regions.. A global external HTTP load balancer is required for cross-region failover because it uses a single anycast IP address and routes traffic to the closest healthy backend. By deploying backends in both regions, the load balancer automatically fails over to the secondary region if the primary region's backends become unhealthy, improving reliability without DNS propagation delays.

Answer

Configure DNS-based failover using Cloud DNS with health checks.

Answer

Use an internal load balancer to route traffic between regions.

Answer

Use a regional external HTTP load balancer with a multi-region backend.

Question 15

A company uses Cloud CDN to accelerate content delivery. They notice that some users receive stale content even after purging the cache. Which THREE factors could cause this?

Accepted Answer

The purge request did not complete successfully.. A purge request that does not complete successfully will leave cached content intact, causing users to receive stale data. Cloud CDN processes purge requests asynchronously, and if the request fails (e.g., due to network issues or invalid paths), the cache is not invalidated. This directly explains why stale content persists despite an attempted purge.

Answer

The content is compressed with gzip.

Answer

The CDN is configured with signed URLs.