Google PCA Timed Practice Test 4 — 10 Questions

Question 1

An e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?

Accepted Answer

Use Cloud DLP with de-identification and re-identification transforms on the Cloud SQL database.. Cloud DLP can be used to de-identify sensitive data like credit card numbers at rest in Cloud SQL, using deterministic or reversible transformations (e.g., format-preserving encryption or tokenization) that allow re-identification only by authorized applications. This approach minimizes application changes because DLP can scan and transform the data directly in the database, and the application can use re-identification transforms via the DLP API when needed, without modifying existing queries or schema.

Answer

Implement column-level encryption using Cloud KMS in the application layer.

Answer

Grant DBAs the Cloud SQL Viewer role to restrict access to data.

Answer

Use Cloud SQL Proxy to encrypt connections and limit DBA access.

Question 2

A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?

Accepted Answer

Condition: 'iam.serviceAccount == "sa@project.iam.gserviceaccount.com"'. Option D is correct because the `iam.serviceAccount` condition attribute in IAM conditions allows you to restrict access based on the service account identity of the caller. When a Compute Engine instance uses a service account, the condition `iam.serviceAccount == "sa@project.iam.gserviceaccount.com"` ensures that only requests authenticated with that specific service account are allowed to access the Cloud Storage bucket. This is the standard IAM condition attribute for matching the service account of the requesting principal.

Answer

Condition: 'request.auth == "serviceAccount:sa@project.iam.gserviceaccount.com"'

Answer

Condition: 'origin.serviceAccount == "sa@project.iam.gserviceaccount.com"'

Answer

Condition: 'resource.serviceAccount == "sa@project.iam.gserviceaccount.com"'

Question 3

A developer ran the command `gcloud compute instances describe instance-1 --zone us-central1-a` and received the above output. They want to create another instance with the same configuration, except with a different external IP. Which action should they take?

Accepted Answer

Create a new instance without specifying a static IP, so it receives an ephemeral IP.. The `gcloud compute instances describe` output shows the instance has an external IP that is ephemeral (not reserved). To create a new instance with the same configuration but a different external IP, the simplest approach is to create a new instance without specifying a static IP, which will automatically assign a new ephemeral IP. This avoids the overhead of reserving and managing a static IP when only a temporary, different address is needed.

Answer

Reserve a new static external IP address and assign it to the new instance.

Answer

Use the same static IP address by releasing and reassigning it.

Answer

None of the above.

Question 4

A startup uses Cloud Functions with a Pub/Sub trigger to process incoming orders. They notice that the function sometimes fails to process messages, and those messages are lost. What is the most likely cause?

Accepted Answer

The Cloud Function is configured with retry on failure set to false.. Option D is correct because when a Cloud Function fails to process a Pub/Sub message and retry on failure is set to false, the message is not redelivered. Pub/Sub relies on the subscriber (the Cloud Function) to acknowledge messages; without retries, a failed execution causes the message to be dropped after the ack deadline expires, leading to message loss.

Answer

The subscription has an ackDeadlineSeconds of 600.

Answer

The Cloud Function has a timeout of 540 seconds.

Answer

The Pub/Sub topic has a retention duration of 10 minutes.

Question 5

Which TWO are best practices when designing a VPC network for a multi-tier application in Google Cloud?

Accepted Answer

Create separate subnets for each application tier.. Option B is correct because creating separate subnets for each application tier (e.g., web, application, database) allows you to apply granular firewall rules and routing policies per tier. This segmentation improves security by isolating traffic between tiers and aligns with Google Cloud's best practices for multi-tier architectures. It also simplifies network troubleshooting and scaling by keeping each tier's IP space distinct.

Answer

Disable VPC Flow Logs to reduce cost.

Answer

Use a single subnet for all tiers to simplify IP management.

Answer

Rely on the default priority of firewall rules to ensure proper ordering.

Question 6

A company uses a Shared VPC hosted in a common project (host project) to centralize network management. A service project team needs to create a Compute Engine instance with a specific static internal IP address from the Shared VPC subnet. What IAM permissions should be granted to the service project's Compute Engine default service account?

Accepted Answer

compute.subnetworks.use and compute.addresses.use on the subnet and static IP.. Option B is correct: To use a specific static internal IP from a Shared VPC, the service account needs compute.subnetworks.use and compute.addresses.use on the subnet or address resource. Option A is missing compute.addresses.use. Option C grants compute.instances.create but not the necessary subnet/address permissions. Option D is too broad and unnecessary.

Answer

compute.networkAdmin on the host project.

Answer

compute.subnetworks.use on the host project subnet.

Answer

compute.instances.create on the service project.

Question 7

A developer needs to grant public read access to all objects in a Cloud Storage bucket named 'my-public-assets'. What is the simplest way to achieve this?

Accepted Answer

Enable uniform bucket-level access and grant storage.objectViewer to AllUsers.. Option C is correct: AllUsers with storage.objectViewer on the bucket grants public read access to all objects. Option A requires setting ACLs per object. Option B is for uniform bucket-level access but that would require an additional step. Option D is wrong; bucket policy only is not sufficient without AllUsers.

Answer

Set a bucket policy that allows allUsers to read objects.

Answer

Grant storage.objectViewer to AllUsers on the bucket without enabling uniform bucket-level access.

Answer

Set an ACL on each object to allow public read.

Question 8

An organization wants to enforce a policy that prohibits the creation of Cloud Storage buckets with uniform bucket-level access disabled. What should they use?

Accepted Answer

Organization policy with a list constraint.. Option C is correct: Organization policies can enforce constraints like constraints/storage.uniformBucketLevelAccess. Option A (IAM) does not prevent bucket creation with specific settings. Option B (Cloud Audit Logs) is for logging. Option D (Cloud Armor) is for security policies at the edge.

Answer

IAM roles with custom permissions to deny bucket creation.

Answer

Cloud Audit Logs to monitor bucket creation.

Answer

Cloud Armor security policies.

Question 9

A company is migrating hundreds of on-premises VMs to Compute Engine. They want to minimize manual effort and downtime. Which service should they use?

Accepted Answer

Migrate for Compute Engine. Migrate for Compute Engine (formerly Velostrata) is the correct choice because it is a fully managed service specifically designed for migrating large-scale VM workloads to Compute Engine with minimal downtime. It uses a streaming migration approach that moves the OS and application data while the source VM continues running, then performs a cutover with near-zero downtime, making it ideal for hundreds of VMs without manual effort.

Answer

Cloud Build

Answer

gcloud compute instances import

Answer

Transfer Appliance

Answer

CloudEndure

Question 10

An administrator creates a GKE cluster with the command above. After deployment, the cluster has 3 nodes, but the node pool autoscaler never scales up even under load. What is the most likely reason?

Accepted Answer

The cluster is zonal, but node locations include multiple zones.. Option C is correct because the node pool autoscaler in GKE cannot scale up a cluster that uses multiple zones in a single zonal cluster. The autoscaler requires that all nodes in the pool be in the same zone to properly manage capacity; when node locations span multiple zones in a zonal cluster, the autoscaler is disabled and will not trigger scaling events, even under load.

Answer

The autoscaler minimum nodes is set to 1 and maximum to 5.

Answer

The disk size of 100 GB is insufficient.

Answer

The machine type e2-medium is too small for the workloads.