PCSE Managing operations in a cloud solution environment Practice Test 5 — 15 Questions

Question 1

Your Cloud SQL PostgreSQL instance is experiencing high replication lag between primary and read replica. You have verified the network and instance metrics. What is a likely cause?

Accepted Answer

Long-running queries on the replica. Long-running queries on the replica can block the apply process, increasing lag. Other options do not directly affect replication lag.

Answer

The replica is using a different machine type

Answer

The replica has point-in-time recovery enabled

Answer

The primary has automated backups enabled

Question 2

A DevOps team wants to automatically scale a managed instance group based on CPU utilization. Which metric should they use in the autoscaler?

Accepted Answer

'compute.googleapis.com/instance/cpu/utilization'. The compute.googleapis.com/instance/cpu/utilization metric measures actual CPU usage, suitable for autoscaling.

Answer

'compute.googleapis.com/instance/cpu/usage_time'

Answer

'compute.googleapis.com/instance/cpu/reserved_cores'

Answer

'agent.googleapis.com/cpu/utilization'

Question 3

A security operations team is using Cloud Audit Logs to investigate a suspicious data export from a Cloud Storage bucket. They need to see which user accessed a specific object and when. Which log type should they examine?

Accepted Answer

Admin Activity logs. Data Access logs record object-level operations on Cloud Storage. Admin Activity logs only cover configuration changes.

Answer

Data Access logs

Answer

Policy Denied logs

Answer

System Event logs

Question 4

Your organization uses Cloud CDN to distribute static content. Recently, users in a specific geographic region are experiencing high latency. What is the most likely cause?

Accepted Answer

There is no CDN edge node in that region. If there is no CDN edge node in that region, traffic must travel directly to the origin, increasing latency.

Answer

The CDN cache has been purged for that region

Answer

The origin server is unhealthy

Answer

The DNS resolution is failing for that region

Question 5

A Cloud Function is timing out. What is the maximum timeout for a Cloud Function (1st gen)?

Accepted Answer

540 seconds. Cloud Functions (1st gen) have a maximum timeout of 540 seconds.

Answer

60 seconds

Answer

900 seconds

Answer

3600 seconds

Question 6

A company is using Cloud Composer (Airflow) to orchestrate data pipelines. A DAG is failing with a 'Task received SIGTERM' error. What is the most likely cause?

Accepted Answer

The task exceeded its execution timeout. SIGTERM is sent when a task exceeds its execution timeout. Other causes produce different signals.

Answer

The worker node was preempted

Answer

The task ran out of memory

Answer

The Airflow scheduler crashed

Question 7

Which TWO actions should you take to reduce the attack surface of a Compute Engine VM? (Choose 2.)

Accepted Answer

Remove public IP addresses. Removing public IP and enabling Secure Boot reduce exposure. vTPM and other options do not directly reduce attack surface.

Answer

Enable Instance Termination Action

Answer

Use preemptible VMs

Answer

Enable Virtual Trusted Platform Module (vTPM)

Question 8

Which TWO techniques can be used to secure a Cloud Storage bucket containing sensitive data? (Choose 2.)

Accepted Answer

Enable uniform bucket-level access. Uniform bucket-level access simplifies permissions, and VPC Service Controls restrict access to the bucket from specific networks.

Answer

Set a retention policy

Answer

Use a Customer-managed encryption key (CMEK)

Answer

Enable object versioning

Question 9

Which THREE components are customer responsibilities under the Google Cloud Shared Responsibility Model for IaaS? (Choose 3.)

Accepted Answer

Security of virtual network controls. Option A is correct because under the IaaS shared responsibility model, the customer is responsible for configuring and managing virtual network controls such as firewalls, route tables, and network ACLs. Google Cloud provides the underlying network infrastructure, but the customer must secure traffic flows and access policies within their VPC.

Answer

Physical security of data centers

Answer

Security of the hypervisor

Question 10

A company is experiencing high latency on their HTTPS Load Balancer. Which action is most likely to resolve the issue?

Accepted Answer

Verify that the backend instances pass health checks. Option C is correct because health check failures can cause traffic to be routed to unhealthy backends, leading to latency. Option A is wrong because increasing instance size may help but is not the first step. Option B is wrong because adding more zones distributes load but doesn't address underlying health. Option D is wrong because changing SSL policy affects encryption, not latency.

Answer

Increase the machine type of the backend instances

Answer

Modify the SSL policy for the load balancer

Answer

Add more backend instances in additional zones

Question 11

A company needs to isolate development and production workloads within the same Google Cloud organization. Each environment must have its own VPC network, but they must share a common set of network security policies. Which design meets these requirements?

Accepted Answer

Use Shared VPC with separate service projects for dev and prod. Option A is correct because shared VPC allows separate projects (dev and prod) to use a common host VPC with consistent security policies. Option B is wrong because separate projects with VPC peering do not enforce shared security policies centrally. Option C is wrong because firewall rules alone cannot create separate networks. Option D is wrong because VPC peering does not provide centralized policy management.

Answer

Create separate projects and use VPC Network Peering between them

Answer

Create separate VPCs in the same project and use VPC peering

Answer

Use a single VPC with multiple subnets and strict firewall rules

Question 12

A security team needs to centrally manage secrets for multiple Google Cloud projects. Which solution should they use?

Accepted Answer

Use Secret Manager. Option D is correct because Secret Manager provides a centralized, durable, and scalable solution for storing and managing secrets across projects. Option A is wrong because storing secrets in Cloud Storage with encryption still requires managing access and does not offer built-in versioning or rotation. Option B is wrong because hardcoding secrets in code is insecure. Option C is wrong because Cloud KMS is for managing encryption keys, not secrets.

Answer

Hardcode secrets in application code and use IAM with access scopes

Answer

Use Cloud Key Management Service (Cloud KMS) to store and manage secrets

Answer

Store secrets in encrypted Cloud Storage buckets

Question 13

Users are reporting 502 Bad Gateway errors when accessing an application behind an external HTTPS Load Balancer. What is the most likely cause?

Accepted Answer

The backend instances are unhealthy or the SSL certificate is invalid. Option B is correct because 502 errors typically indicate that the load balancer cannot communicate with the backend, often due to unhealthy instances or SSL certificate issues. Option A is wrong because connection limits cause 503 or 429 errors, not 502. Option C is wrong because the load balancer type is correct for HTTPS. Option D is wrong because CDN affects content delivery, not backend connectivity.

Answer

Cloud CDN is not enabled for the load balancer

Answer

The backend instances have reached maximum concurrent connections

Answer

The load balancer is configured as an internal load balancer

Question 14

A global company must store customer data in a specific geographic region to comply with data residency regulations. The database needs strong transactional consistency and low-latency reads worldwide. Which database solution should they choose?

Accepted Answer

Use Cloud Spanner with a multi-region configuration that includes the required region. Option C is correct because Cloud Spanner offers global transactional consistency, horizontal scaling, and multi-region configurations for data residency. Option A is wrong because BigQuery is for analytics, not operational transactions. Option B is wrong because Cloud SQL in a single region cannot serve global reads with low latency. Option D is wrong because Firestore in multi-region does not guarantee strong consistency for all operations.

Answer

Use BigQuery with a multi-region dataset

Answer

Use Cloud SQL with cross-region replication

Answer

Use Firestore in multi-region mode

Question 15

A company runs a batch processing workload on Compute Engine VMs for 6 months. They want to reduce costs without sacrificing performance. Which option should they implement?

Accepted Answer

Purchase committed use discounts for the relevant machine types and regions. Option A is correct because committed use discounts (CUDs) provide significant discounts in exchange for a 1- or 3-year commitment, ideal for steady-state workloads. Option B is wrong because preemptible VMs are not suitable for long-running batch jobs due to termination risk. Option C is wrong because custom machine types may optimize resource use but do not offer discounts like CUDs. Option D is wrong because sole-tenant nodes isolate VMs but do not reduce costs.

Answer

Switch to preemptible VMs

Answer

Use sole-tenant nodes to share resources across projects

Answer

Migrate to custom machine types to eliminate wasted resources