Google PCA Timed Practice Test 2 — 10 Questions

Question 1

A company wants to run a containerized web application that experiences unpredictable traffic spikes. They want to pay only for resources used during request processing, with no idle cost. Which compute service should they choose?

10 minute time limit — choose an answer to begin.

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero when not in use and charges per request. It eliminates idle costs. GKE Autopilot has a per-pod billing model but still incurs some cost for the cluster control plane. App Engine Standard supports scaling to zero but is limited to specific runtimes. Compute Engine VMs incur cost for running instances even if idle.

Answer

Google Kubernetes Engine (GKE) Autopilot

Answer

App Engine Standard

Answer

Compute Engine with managed instance groups

Question 2

A developer is using Cloud Build to automate deployments. The build fails with an error: 'Permission 'iam.serviceAccounts.actAs' denied.' What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have the Service Account User role on the service account used in the build steps. The error 'Permission iam.serviceAccounts.actAs denied' occurs when a Cloud Build build step tries to impersonate a service account (e.g., to deploy resources) but the Cloud Build service account lacks the Service Account User role on that target service account. Option D correctly identifies that the Cloud Build service account does not have the `roles/iam.serviceAccountUser` role on the service account used in the build steps, which is required to delegate access.

Answer

The developer does not have iam.serviceAccounts.actAs permission on the project

Answer

The build configuration is missing a required step

Answer

The Cloud Build service account is not enabled

Question 3

A global e-commerce platform uses Cloud Spanner for product inventory and wants to reduce costs. They notice that read replicas are underutilized and that most queries are single-key reads. Which configuration change will reduce costs while maintaining availability?

Accepted Answer

Downgrade the instance to a smaller regional configuration with fewer nodes. For Spanner, read replicas are used for read-only workloads; if underutilized, reducing the number of read replicas can lower costs without affecting write availability. However, fine-grained instance configuration changes are not straightforward; the best option is to adjust the number of nodes or use a smaller instance class. But among options, choosing a smaller regional configuration (fewer nodes) is practical.

Answer

Use Cloud SQL for reads and Spanner for writes only

Answer

Switch to a multi-region configuration with witness nodes

Answer

Reduce the number of read replicas in the instance configuration

Question 4

A company runs a latency-sensitive web application on Compute Engine in us-east1. They want to improve response times for users in Europe and Asia without changing the application architecture. Which TWO actions should they take? (Choose 2.)

Accepted Answer

Enable Cloud CDN on the load balancer. Cloud CDN caches static content at edge locations globally, reducing latency for users worldwide. Placing a load balancer in multiple regions (multi-region load balancing with proximity-based routing) directs users to the nearest backend region. Using only us-west1 would still leave European users far away. Cloud Armor is for security, not performance. Spot VMs are for cost savings, not latency.

Answer

Use preemptible VMs to reduce cost

Answer

Deploy additional instances in us-west1

Answer

Use Cloud Armor to block high-latency requests

Question 5

An organization runs a Kubernetes cluster on GKE with cluster autoscaling enabled. They notice that pods are frequently in 'Pending' state due to insufficient CPU, but the cluster autoscaler does not add nodes quickly enough. What is the most likely cause?

Accepted Answer

The node pool has reached the maximum node count limit.. The cluster autoscaler cannot add new nodes if the node pool has already reached its maximum node count limit. This limit is configured at the node pool level in GKE, and once reached, the autoscaler will not scale up further, leaving pods in 'Pending' state due to insufficient CPU resources.

Answer

The cluster autoscaler is using the 'least-waste' expander.

Answer

The horizontal pod autoscaler (HPA) is misconfigured.

Answer

The pod disruption budget (PDB) is too restrictive.

Question 6

A startup is building a serverless application that processes events from Cloud Storage buckets. Each event triggers a Python function that resizes images. Which GCP compute service is MOST suitable for this event-driven workload?

Accepted Answer

Cloud Functions. Cloud Functions is designed for event-driven, serverless compute. It can be triggered directly by Cloud Storage events (object finalize/create). Cloud Run requires HTTP invocation, App Engine is for web apps, and Compute Engine VMs require management.

Answer

Cloud Run

Answer

Compute Engine

Answer

App Engine

Question 7

An organization wants to protect an HTTPS load-balanced web application from common web attacks, such as SQL injection and cross-site scripting (XSS), as well as rate-limit traffic from specific IPs. Which three capabilities should they use together? (Choose three.)

Accepted Answer

Cloud Armor rate limiting. Cloud Armor provides WAF rules (preconfigured rules for SQLi, XSS, etc.), rate limiting, and IP blacklisting/whitelisting. All three are part of Cloud Armor security policies.

Answer

Cloud CDN

Answer

Cloud Load Balancing logging

Question 8

A company wants to use a multi-cloud strategy to avoid vendor lock-in and run workloads on both Google Cloud and AWS. They need to manage Kubernetes clusters across both environments consistently. Which TWO Google Cloud services can help achieve this?

Accepted Answer

Config Sync. Anthos (now GKE Enterprise) provides a consistent Kubernetes platform across on-premises and multiple clouds, including AWS. Config Sync is a component of Anthos that enables configuration management across clusters. BigQuery Omni allows querying data across clouds but is for analytics. Cloud Run is serverless and not for multi-cloud Kubernetes management. GKE on AWS is deprecated; Anthos is the recommended approach.

Answer

Cloud Run

Answer

BigQuery Omni

Answer

GKE on AWS

Question 9

A team is building a CI/CD pipeline for a Java application that will run on GKE. They want to automatically build the application, run unit tests, create a Docker image, push it to Artifact Registry, and deploy to GKE. Which two GCP services should be combined? (Choose two.)

Accepted Answer

Cloud Deploy. Cloud Build handles the build and test steps, builds the Docker image, and pushes to Artifact Registry. Cloud Deploy manages the deployment to GKE. Cloud Run is serverless; Cloud Functions is event-driven; Compute Engine is VMs.

Answer

Cloud Functions

Answer

Compute Engine

Answer

Cloud Run

Question 10

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using the pod's own identity, without managing long-lived credentials. They have created a Google service account (GSA) and a Kubernetes service account (KSA). What should they do to bind the KSA to the GSA?

Accepted Answer

Add an annotation to the KSA referencing the GSA, and grant the KSA the iam.workloadIdentityUser role on the GSA. Workload Identity allows you to configure a KSA to act as a GSA by adding an annotation to the KSA and granting the GSA the necessary IAM role. The GSA does not impersonate the KSA; the KSA impersonates the GSA. The annotation is set on the KSA, not the pod. The GSA does not need to be bound to the KSA via an IAM role on the KSA.

Answer

Create a service account key and mount it as a secret in the pod

Answer

Grant the GSA the roles/iam.serviceAccountUser role on the project

Answer

Add an annotation to the GSA referencing the KSA, and grant the KSA the iam.workloadIdentityUser role on the GSA