PCSE Managing operations in a cloud solution environment Practice Test 6 — 15 Questions

Question 1

A Cloud Function that processes financial data is timing out after 60 seconds. The function performs complex calculations and cannot be decomposed further. What is the best solution?

Accepted Answer

Increase the Cloud Functions timeout to 120 seconds and optimize the code. Option D is correct because Cloud Functions has a maximum timeout of 60 minutes (540 seconds) for HTTP functions; increasing the timeout to 120 seconds and optimizing code can resolve the timeout. Option A is wrong because changing the runtime won't inherently reduce execution time. Option B is wrong because Cloud Run has a similar timeout but also requires code changes; it's more complex than adjusting the function. Option C is wrong because increasing memory alone may improve performance but does not extend timeout beyond 60 seconds.

Answer

Migrate the function to Cloud Run with a longer timeout

Answer

Change the Cloud Functions runtime from Node.js to Python

Answer

Increase the allocated memory for the function

Question 2

A company requires a secure, dedicated connection between their on-premises data center and Google Cloud with bandwidth of 10 Gbps and a 99.99% SLA. Which connectivity option should they use?

Accepted Answer

Use Dedicated Interconnect with two VLAN attachments. Option B is correct because Dedicated Interconnect offers 10 Gbps or 100 Gbps connections with a 99.99% SLA when configured with redundant connections. Option A is wrong because Cloud VPN supports lower bandwidth (up to 3 Gbps per tunnel) and does not offer a 99.99% SLA. Option C is wrong because Direct Peering uses public IPs and lacks SLA guarantees. Option D is wrong because Partner Interconnect typically offers lower bandwidth (up to 10 Gbps) but SLA varies by partner.

Answer

Use Direct Peering

Answer

Use Partner Interconnect with a 10 Gbps connection

Answer

Use Cloud VPN with two tunnels for redundancy

Question 3

A DevOps team wants to centralize logging and monitoring for a GKE cluster that runs hundreds of microservices. They need to view logs, metrics, and traces in a single dashboard. Which approach should they use?

Accepted Answer

Enable Cloud Logging and Cloud Monitoring for the GKE cluster. Option C is correct because Cloud Logging and Cloud Monitoring natively integrate with GKE and provide logs, metrics, and traces in a unified dashboard. Option A is wrong because Stackdriver Logging and Monitoring are the former names of Cloud Logging and Monitoring; they are the same service but the answer refers to outdated names. Option B is wrong because Prometheus requires manual setup and does not provide native GKE integration for all signals. Option D is wrong because third-party tools add complexity and may not integrate as seamlessly.

Answer

Use Stackdriver Logging and Stackdriver Monitoring

Answer

Use a third-party SIEM tool like Splunk or Elastic

Answer

Deploy Prometheus and Grafana on the cluster

Question 4

Which TWO Google Cloud services are serverless compute platforms that let you run code without managing servers?

Accepted Answer

Cloud Run. Options A and C are correct. Cloud Functions and Cloud Run are serverless compute services that abstract server management. Option B (Compute Engine) is IaaS. Option D (GKE) is container orchestration. Option E (App Engine) is also serverless but the correct two are Cloud Functions and Cloud Run. Note: App Engine is also serverless but the question asks for TWO; we selected Cloud Functions and Cloud Run as they are the most commonly cited serverless compute options.

Answer

Compute Engine

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine

Question 5

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

Accepted Answer

Check firewall rule logs in Cloud Logging. Options A, B, and D are correct. Checking firewall logs reveals denied traffic. Verifying network tags ensures instances match the target tags. Reviewing VPC flow logs shows actual traffic flows. Option C (check IAM permissions) is less relevant because firewall rules are network-level, not identity-based. Option E (inspect route tables) affects routing, not firewall blocking.

Answer

Check IAM permissions for the VM's service account

Answer

Inspect the route tables for the subnet

Question 6

Which TWO are benefits of using Cloud Armor with a global external HTTPS Load Balancer?

Accepted Answer

DDoS protection at the edge. Options A and B are correct. Cloud Armor provides DDoS protection and WAF capabilities. Option C (load balancing) is the load balancer's function, not Cloud Armor's. Option D (CDN) is provided by Cloud CDN. Option E (traffic management) is not a primary Cloud Armor feature.

Answer

Automatic content caching

Answer

Traffic management based on latency

Answer

Built-in load balancing

Question 7

Refer to the exhibit. A developer working from a workstation with IP 203.0.113.5 cannot SSH to a VM in the my-vpc network. Which firewall rule is most likely blocking the connection?

Accepted Answer

deny-ssh-all. Option C is correct because the deny-ssh-all rule has a priority of 200 (higher priority than the allow rules at 500 and 1000) and blocks SSH from all IPs. The order in GCP is based on priority (lower number = higher priority), so the deny overrides the allows. The allow-ssh-from-bastion only permits SSH from 10.0.1.2, not the developer's IP.

Answer

allow-ssh-from-bastion

Answer

default-allow-http

Answer

default-allow-ssh

Question 8

Refer to the exhibit. A user jane@example.com receives a 403 Access Denied error when trying to list objects in a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The IAM condition restricts access to requests originating from the 10.0.0.0/24 IP range. Option B is correct because the IAM policy includes a condition that requires the request to come from an IP starting with '10.0.0.' (private IP). If Jane is accessing from a different IP, the condition fails and access is denied. Option A is wrong; the role includes storage.objects.list. Option C is wrong; there is no indication of a different project. Option D is wrong; the policy is restrictive, not permissive.

Answer

Jane does not have the storage.objects.list permission

Answer

The bucket is in a different project

Answer

The IAM policy is too permissive and conflicts with other policies

Question 9

Refer to the exhibit. A Cloud Run service fails to start and shows the above error. What is the most likely cause?

Accepted Answer

The application is configured to listen on a different port than the one specified by PORT. Option B is correct because the error explicitly states the container is not listening on the port defined by PORT. Cloud Run expects the container to bind to the port specified in the PORT env var (default 8080). Option A is wrong; the error is about listening, not the variable missing. Option C is wrong; insufficient memory causes different errors. Option D is wrong; concurrent requests are runtime limits, not startup issues.

Answer

The container requires more memory than allocated

Answer

The PORT environment variable is not defined in the container

Answer

The number of concurrent requests exceeds the container's limit

Question 10

A company uses Cloud Monitoring to track latency on their Compute Engine instances. They notice a spike in latency every day at 2:00 PM. The operations team wants to automate the creation of a support ticket when this spike occurs. What should they do?

Accepted Answer

Create a Cloud Monitoring alert that sends a notification to a Pub/Sub topic, which triggers a Cloud Function that creates a ticket.. Option B is correct because Cloud Monitoring alerts can trigger a webhook or pub/sub to integrate with ticketing systems. Option A is incorrect because Cloud Functions require manual triggering or scheduling, not real-time alert. Option C is incorrect because Cloud Scheduler runs on a schedule, not based on metric thresholds. Option D is incorrect because Cloud Tasks is for asynchronous task execution, not directly for alerting.

Answer

Create a Cloud Function that runs every minute to check latency and create a ticket.

Answer

Configure Cloud Tasks to periodically query the latency metric and create a ticket.

Answer

Use Cloud Scheduler to run a job that checks latency every hour and creates a ticket if spike is detected.

Question 11

A security administrator needs to ensure that all service account keys older than 90 days are automatically disabled to reduce the risk of key compromise. Which Google Cloud service should be used to implement this policy?

Accepted Answer

Organization Policy Service. Option D is correct because Organization Policies can enforce constraints like disabling automatic key creation or setting key expiration. Option A is incorrect because IAM itself does not have lifecycle policies. Option B is incorrect because Secret Manager does not manage service account keys. Option C is incorrect because Cloud Key Management Service does not manage service account keys.

Answer

Cloud Secret Manager

Answer

Cloud IAM

Answer

Cloud Key Management Service

Question 12

A company wants to monitor for suspicious login attempts across all their Google Cloud projects. They want to send a real-time Slack notification when a login fails from an IP address outside their corporate CIDR range. What is the most efficient way to achieve this?

Accepted Answer

Export Admin Activity audit logs to a Pub/Sub topic via a sink, and use a Cloud Function that subscribes to the topic to filter and post to Slack.. Option A is correct because Admin Activity audit logs capture login events, and a Cloud Logging sink to Pub/Sub enables real-time streaming to a Cloud Function that posts to Slack. Option B is incorrect because Cloud Monitoring does not directly analyze audit logs. Option C is incorrect because Cloud Scheduler would not provide real-time response. Option D is incorrect because Cloud Audit Logs alone cannot send Slack notifications.

Answer

Create a Cloud Monitoring alert policy that checks for failed logins in logs and sends a notification to Slack via webhook.

Answer

Use Cloud Scheduler to run a batch job every hour that queries logs and sends a summary to Slack.

Answer

Enable Cloud Audit Logs and configure a log router to forward logs directly to Slack.

Question 13

An organization has hundreds of Google Cloud projects and wants to enforce a uniform firewall rule that blocks outbound traffic to known malicious IP addresses. They want to centrally manage this rule without manually applying it to each VPC. What should they do?

Accepted Answer

Create a hierarchical firewall rule at the organization or folder level.. Option C is correct because hierarchical firewall rules can be applied at the folder or organization level, allowing central management. Option A is incorrect because global VPC firewall rules still need to be applied per network or per project. Option B is incorrect because Organization Policies do not manage firewall rules. Option D is incorrect because Shared VPC does not enforce rules on all projects.

Answer

Use Organization Policies to block the IP addresses.

Answer

Create a global VPC firewall rule in each project using Deployment Manager.

Answer

Use Shared VPC and configure firewall rules in the host project.

Question 14

A security engineer receives an alert from Cloud Security Command Center (Cloud SCC) about a resource that is publicly accessible. The engineer identifies that the resource is a Cloud Storage bucket containing sensitive data. After making the bucket private, what is the next best step to prevent recurrence?

Accepted Answer

Create a Cloud Security Command Center notification for public bucket findings and use a Cloud Function to automatically disable public access.. Option B is correct because creating a security health analytics sink to Pub/Sub enables automated remediation. Option A is incorrect because deleting the bucket may lose data. Option C is incorrect because disabling public access at the organization level might be too broad and impact legitimate needs. Option D is incorrect because relying on documentation is not preventive.

Answer

Add a note in the operations runbook to check bucket permissions weekly.

Answer

Delete the bucket and all its contents to avoid future exposure.

Answer

Set an organization policy to disable public access to all Cloud Storage buckets.

Question 15

A company uses Cloud SQL for PostgreSQL and needs to ensure that database backups are retained for 30 days for compliance. They also want to be able to perform point-in-time recovery for the last 24 hours. What configuration should they use?

Accepted Answer

Enable automated backups with a retention of 30 days and enable binary logging (write-ahead logs) for point-in-time recovery.. Option A is correct because Cloud SQL automated backups and binary log (WAL) archiving enable point-in-time recovery. Option B is incorrect because export to Cloud Storage is a manual process. Option C is incorrect because snapshots are not supported for Cloud SQL. Option D is incorrect because manual backups do not provide point-in-time recovery.

Answer

Manually take a full backup every day and store it in Cloud Storage with object lifecycle management set to 30 days.

Answer

Take daily snapshots of the Compute Engine instance running Cloud SQL.

Answer

Use Cloud Scheduler to run a script that exports the database to Cloud Storage every hour, and keep the exports for 30 days.