Courseiva

Google Professional Cloud Architect (PCA) — Questions 1–75

955 questions total · 13pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 13

Page 2
1
MCQhard

A company uses BigQuery for large-scale analytics. They have a fixed monthly budget and want to ensure predictable costs for query processing, even when many users run concurrent queries. Which BigQuery pricing model should they use?

A.On-demand pricing with flat-rate discounts
B.Autoscaling slot reservations
C.Flat-rate pricing with slot reservations
D.On-demand pricing with committed use discounts
AnswerC

Slot reservations provide a fixed cost for a certain number of slots, making expenses predictable. Queries run within the reserved slots.

Why this answer

BigQuery slot reservations (fixed capacity) provide predictable pricing by purchasing a set number of slots. On-demand pricing charges per byte scanned, which can vary with usage. Flat-rate pricing via reservations is best for predictable costs.

Committed use discounts apply to slot reservations, but the core model is reservations.

Full explanation →
2
MCQmedium

Refer to the exhibit. A cloud administrator is attempting to grant the BigQuery Data Viewer role to an external user (user@example.com) but receives the error shown. What is the most likely cause?

A.The organization policy constraints/iam.allowedPolicyMemberDomains blocks external domains.
B.The BigQuery dataset requires domain-wide delegation.
C.The user does not have the resourcemanager.projects.setIamPolicy permission.
D.The external user must first be added to a Google Group.
AnswerA

The error includes '[ORGANIZATION_POLICY: constraints/iam.allowedPolicyMemberDomains]', indicating this policy is blocking the external user.

Why this answer

The error indicates that the organization's policy constraints/iam.allowedPolicyMemberDomains is blocking the addition of an external user. This constraint restricts IAM policy bindings to only allow members from specified domains, and since user@example.com is from an external domain, the binding is denied. The error message directly references this constraint, making it the most likely cause.

Exam trap

Google often tests the distinction between IAM permission errors and organization policy constraints, where candidates mistakenly focus on the administrator's permissions (Option C) rather than the broader policy that blocks external members.

How to eliminate wrong answers

Option B is wrong because domain-wide delegation is a Google Workspace feature for service accounts to access user data, not related to granting IAM roles to external users. Option C is wrong because the error message does not indicate a permissions issue for the administrator; the error is about policy constraints, not missing IAM permissions. Option D is wrong because Google Groups are not required for granting IAM roles to external users; the constraint blocks any external member regardless of group membership.

Full explanation →
3
MCQhard

A company is running a critical application on Compute Engine. The application writes logs to a local persistent disk. The operations team wants to ensure logs are not lost if the VM fails. What should they do?

A.Use a regional persistent disk to replicate data across zones.
B.Schedule persistent disk snapshots every 5 minutes.
C.Create a script to copy logs to a Cloud Storage bucket every minute.
D.Configure the application to write logs to Cloud Logging using the Logging agent.
AnswerD

Logs are streamed to a durable, centralized service, ensuring no loss on VM failure.

Why this answer

Cloud Logging with the Logging agent provides a centralized, durable, and managed log storage solution. The agent streams logs from the VM to Cloud Logging in near real-time, ensuring logs are preserved even if the VM or its local persistent disk fails. This decouples log storage from the VM's lifecycle, meeting the operations team's requirement for log durability.

Exam trap

The trap here is that candidates often overestimate the reliability of local persistent disks or periodic backups (snapshots/scripts) for log durability, failing to recognize that only a real-time, off-instance streaming solution like Cloud Logging eliminates the risk of log loss during VM failure.

How to eliminate wrong answers

Option A is wrong because regional persistent disks replicate data synchronously across zones within a region, but they still depend on the VM being operational; if the VM fails, the disk is inaccessible until the VM is recovered, and logs on the disk are not automatically exported. Option B is wrong because scheduling snapshots every 5 minutes introduces a recovery point objective (RPO) of up to 5 minutes, meaning logs written between snapshots are lost if the VM fails; snapshots are also not a real-time streaming solution. Option C is wrong because a script copying logs to Cloud Storage every minute creates an RPO of up to 1 minute, still risking log loss, and adds complexity and potential failure points (e.g., script crashes, permissions issues) without guaranteeing delivery.

Full explanation →
4
MCQeasy

A company needs to store archival data that is accessed less than once a year. They want the lowest storage cost possible, but they can accept a retrieval time of up to 24 hours. Which Cloud Storage class should they use?

A.Nearline
B.Archive
C.Standard
D.Coldline
AnswerB

Archive is the cheapest storage class, designed for long-term retention with retrieval times of up to 24 hours.

Why this answer

Archive storage is the lowest-cost storage class for long-term archival with retrieval times in hours (typically 24 hours). Coldline is for data accessed less than once a quarter. Nearline is for monthly access.

Standard is for frequently accessed data.

Full explanation →
5
MCQhard

A company runs a critical application on Compute Engine that must remain available even if an entire zone fails. They have configured a managed instance group across three zones with autoscaling based on CPU utilization. The application state is stored in a Cloud SQL instance. Which additional step should they take to ensure high availability?

A.Use a Cloud Load Balancer in front of the managed instance group.
B.Configure a regional Cloud SQL instance with primary and standby in different zones.
C.Deploy a read replica of the Cloud SQL instance in another region.
D.Take frequent snapshots of the boot disk and store them in a multi-regional bucket.
AnswerB

Regional Cloud SQL provides automatic failover across zones, matching the compute layer's zone redundancy.

Why this answer

Cloud SQL provides high availability with a standby instance in a different zone using regional persistent disk. This ensures failover if the primary zone fails.

Full explanation →
6
Multi-Selectmedium

A security team needs to detect and redact personally identifiable information (PII) in documents stored in Cloud Storage before sharing them with external partners. Which two Google Cloud services should they use together? (Choose two.)

Select 2 answers
A.Cloud Data Loss Prevention (DLP) API
B.Cloud Storage
C.Cloud KMS
D.Cloud Dataflow
E.Cloud NAT
AnswersA, B

DLP can inspect and de-identify PII in Cloud Storage.

Why this answer

Cloud DLP can scan Cloud Storage for PII and de-identify the data. The scanned and de-identified results can be written back to Cloud Storage. Cloud Dataflow is not needed for this simple use case; Cloud Function can trigger DLP jobs.

Full explanation →
7
MCQeasy

An engineer needs to view the logs of a specific Compute Engine instance in near real-time from the command line. Which gcloud command should they use?

Answer options not yet available.

Why this answer

gcloud logging tail streams logs in near real-time. gcloud compute ssh gives shell access, not logs. gcloud logging read queries past logs. gcloud app logs tail is for App Engine.

Full explanation →
8
MCQhard

A healthcare organization stores Protected Health Information (PHI) in Cloud SQL. They have implemented encryption at rest using CMEK and enforce TLS for all connections. To meet HIPAA compliance, they need to ensure that PHI cannot be exfiltrated from the Cloud SQL instance even if an application is compromised. The Cloud SQL instance is accessed by Compute Engine instances in the same VPC using private IPs. The security team wants to add an additional layer of defense against data exfiltration. What should they do?

A.Deploy Cloud Armor and apply a WAF rule to block suspicious traffic to the Cloud SQL instance.
B.Use the Cloud SQL Auth proxy from all applications to enforce IAM-based authentication.
C.Configure VPC Service Controls with a service perimeter that includes the Cloud SQL instance and uses Private Service Connect.
D.Enable customer-managed encryption keys (CMEK) on the Cloud SQL instance.
AnswerC

VPC SC restricts data access to authorized networks and prevents exfiltration via internet.

Why this answer

VPC Service Controls with a service perimeter that includes the Cloud SQL instance and uses Private Service Connect prevents data exfiltration by creating a security boundary around the Cloud SQL instance. Even if an application is compromised, the service perimeter blocks unauthorized copying or movement of PHI outside the perimeter, and Private Service Connect ensures traffic stays within Google's network without traversing the public internet. This directly addresses the requirement for an additional layer of defense against exfiltration beyond encryption and TLS.

Exam trap

In Google PCA exams, the trap is that candidates confuse encryption (CMEK) or secure connectivity (Auth proxy) with exfiltration prevention, not realizing that VPC Service Controls is the only option that creates a data boundary to block unauthorized data movement even from compromised applications.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) that protects HTTP(S) load-balanced traffic, but Cloud SQL uses private IPs within a VPC and does not have a public HTTP endpoint, so Cloud Armor cannot inspect or block traffic to the Cloud SQL instance directly. Option B is wrong because the Cloud SQL Auth proxy enforces IAM-based authentication and encrypts connections, but it does not prevent data exfiltration; if an application is compromised, the proxy still allows the attacker to query and extract PHI using valid credentials. Option D is wrong because CMEK is already implemented for encryption at rest, and encryption alone does not prevent data exfiltration—it only protects data if the storage media is stolen, not if an application is compromised and actively queries the database.

Full explanation →
9
MCQmedium

A company has a legacy monolithic application running on-premises that must be migrated to Google Cloud with minimal changes. The application uses a SQL Server database and has strict licensing constraints. Which migration approach and storage service is most appropriate?

A.Re-architect to microservices on GKE with AlloyDB
B.Lift-and-shift onto Compute Engine with SQL Server on the same VM
C.Re-platform to Cloud Spanner
D.Lift-and-shift onto Compute Engine with Cloud SQL for SQL Server
AnswerD

Lift-and-shift moves the app as-is; Cloud SQL for SQL Server provides a fully managed, compatible database, meeting licensing constraints.

Why this answer

The requirement specifies minimal changes and strict licensing constraints. Lift-and-shift onto Compute Engine with Cloud SQL for SQL Server allows you to migrate the monolithic application with minimal modifications while leveraging a managed SQL Server service that respects existing licensing (including bring-your-own-license). This avoids the cost and complexity of re-architecting or re-platforming.

Exam trap

The trap here is that candidates often assume 'minimal changes' means they must keep the database on the same VM (Option B), but they overlook that SQL Server licensing requires dedicated resources and that Cloud SQL for SQL Server is a managed service that still supports lift-and-shift with proper licensing compliance.

How to eliminate wrong answers

Option A is wrong because re-architecting to microservices on GKE with AlloyDB violates the 'minimal changes' requirement and AlloyDB is PostgreSQL-compatible, not SQL Server, so it would require significant application code changes. Option B is wrong because running SQL Server on the same VM as the application violates the 'strict licensing constraints' — SQL Server licensing typically requires dedicated cores/VMs, and co-locating on a single VM can lead to licensing non-compliance and performance contention. Option C is wrong because re-platforming to Cloud Spanner would require rewriting the application to use Spanner's distributed SQL dialect and schema, which is a major change and does not support SQL Server licensing.

Full explanation →
10
MCQmedium

Your company's global e-commerce platform uses a managed instance group (MIG) in us-central1 and a Cloud Load Balancer. Traffic has grown, and you want to improve availability by distributing load across multiple regions. What should you do?

A.Increase the machine type of the existing instances to handle more traffic.
B.Enable Cloud CDN to cache content closer to users.
C.Create MIGs in additional regions and add them as backends to the existing global load balancer.
D.Change the load balancer to global and configure a single backend.
AnswerC

Multiple backends across regions with health checks enable the load balancer to route traffic only to healthy backends, improving availability.

Why this answer

A global external HTTP(S) load balancer can have backends in multiple regions. By creating managed instance groups (MIGs) in additional regions and adding them as backends to the existing global load balancer, you distribute traffic across regions, improving availability and reducing latency for users worldwide. This approach leverages the load balancer's anycast IP and cross-region load balancing capabilities.

Exam trap

The trap here is that candidates confuse Cloud CDN (which caches content) with multi-region backend distribution, or think that simply making the load balancer 'global' with a single backend achieves regional redundancy, when in fact you must add backends in multiple regions to distribute load and improve availability.

How to eliminate wrong answers

Option A is wrong because increasing the machine type of existing instances only scales vertically within a single region, which does not address multi-region availability or distribute load geographically. Option B is wrong because Cloud CDN caches static content at edge locations but does not distribute compute load across regions; it reduces latency for cached content but does not improve availability for dynamic requests or handle regional failures. Option D is wrong because changing the load balancer to global and configuring a single backend (a single MIG) still limits compute resources to one region, failing to provide multi-region distribution or fault isolation.

Full explanation →
11
MCQeasy

Refer to the exhibit. A user (ops@example.com) is unable to create a new VPC network in the project. What should the administrator verify first?

A.The user has been granted roles/compute.admin.
B.The user has the project owner role.
C.The user has the roles/storage.admin role.
D.The user has appropriate IAM roles such as roles/compute.networkAdmin.
AnswerD

The current role is read-only; a more permissive role is needed.

Why this answer

To create a VPC network in Google Cloud, the user needs the compute.networks.create permission. The roles/compute.networkAdmin IAM role includes this permission, along with others needed to manage VPC networks. Option D correctly identifies that the user must have appropriate IAM roles, specifically roles/compute.networkAdmin or a custom role with the necessary compute.networks.create permission.

Exam trap

Google Cloud often tests the principle of least privilege and the specific IAM roles required for VPC operations, trapping candidates who assume that a broad role like compute.admin or owner is the first thing to verify, rather than the more specific networkAdmin role.

How to eliminate wrong answers

Option A is wrong because roles/compute.admin is a highly privileged role that includes all compute permissions, but it is not the minimum required role; the question asks what the administrator should verify first, and checking for a more specific role like roles/compute.networkAdmin is more appropriate. Option B is wrong because the project owner role (roles/owner) includes all permissions, but it is overly broad and not the first thing to verify; the administrator should check for the specific network admin role first. Option C is wrong because roles/storage.admin grants permissions for Cloud Storage, not for VPC network creation, which requires compute.networks.* permissions.

Full explanation →
12
MCQhard

Refer to the exhibit. All five nginx pods are scheduled on the same node (default-pool-1). What is the most likely reason?

A.The node auto-scaler has not created additional nodes yet, but the other nodes are present.
B.The pods have a nodeSelector that matches only default-pool-1.
C.The other nodes have taints that the pods do not tolerate.
D.The resource requests are too high, so the scheduler packed pods onto one node due to resource constraints on the others.
AnswerC

Correct: If nodes have taints, pods without matching tolerations will not be scheduled on them, causing all pods to land on the node without taints.

Why this answer

Taints on nodes prevent pods from being scheduled unless the pods have corresponding tolerations. If the other nodes have taints that the nginx pods do not tolerate, the scheduler will only place them on nodes without those taints, which in this case is default-pool-1. This is a common scenario when nodes are dedicated to specific workloads or have special hardware.

Exam trap

This question tests the distinction between taints/tolerations and nodeSelector/affinity in Kubernetes on Google Cloud. Candidates often overlook that taints can silently exclude pods from all but one node, and assume only nodeSelector restricts pod placement.

How to eliminate wrong answers

Option A is wrong because the node auto-scaler adds nodes when pods are unschedulable due to resource constraints, but here all pods are scheduled on one node, indicating the scheduler deliberately chose that node, not that other nodes are missing. Option B is wrong because if a nodeSelector matched only default-pool-1, the pods would be scheduled exclusively there, but the question asks for the 'most likely reason' and taints are a more common cause for pods being forced onto a single node when other nodes exist. Option D is wrong because if resource requests were too high, the scheduler would leave pods pending or spread them across nodes that can fit them, not pack them all onto one node; packing suggests the other nodes are intentionally excluded.

Full explanation →
13
MCQhard

Your organization uses a Shared VPC to centrally manage network resources. A project that is not the host project needs to create a Cloud SQL instance using a private IP in the Shared VPC. What must be configured?

A.Create a VPC peering between the service project and the host project
B.Grant the service project the 'compute.networkUser' role on the VPC network
C.Use Cloud NAT to allow the Cloud SQL instance to communicate
D.Enable the Service Networking API and allocate an IP range for the Cloud SQL instance
AnswerD

Correct. Private services access requires allocating an IP range and establishing a connection.

Why this answer

For a service project to allocate private IP in a Shared VPC, the Shared VPC host project must grant the service project the 'compute.networkUser' role on the subnetwork. Additionally, the service project needs the Service Networking API enabled and a private service access connection.

Full explanation →
14
MCQmedium

You are a cloud architect for an e-commerce company. Their application runs on Google Kubernetes Engine (GKE) with a Regional cluster. The application consists of a frontend service, a backend service, and a Redis cache. Traffic is routed via an external HTTP(S) Load Balancer to the frontend. Recently, customers have reported intermittent 502 Bad Gateway errors during peak hours. The frontend logs show 'upstream connect error or disconnect/reset before headers. retried and limit reset' errors. The backend service is deployed with 3 replicas, each with resource requests of 1 CPU and 2 GB memory. The cluster autoscaler is enabled with a minimum of 3 nodes and a maximum of 10 nodes, using e2-standard-4 instances. The backend service's HPA is configured with CPU utilization target of 80%. During peak hours, CPU utilization on the backend pods reaches 90%, but the HPA does not scale up. The cluster has sufficient node capacity. What should you do to resolve the issue?

A.Change the HPA to use memory utilization instead of CPU.
B.Lower the HPA CPU target to 60% and increase the number of replicas min to 5.
C.Increase the backend service's max connections per pod in the backendConfig.
D.Increase the maximum number of nodes in the cluster autoscaler to 20.
AnswerB

Lowering the target triggers scaling earlier, and more min replicas provide baseline capacity.

Why this answer

The HPA is configured with a CPU utilization target of 80%, but during peak hours, CPU utilization reaches 90% without triggering scale-up. This indicates that the HPA's target utilization is too high relative to the actual load, causing the HPA to not scale because the average CPU utilization across pods may still be below the target when considering the metric calculation. Lowering the HPA CPU target to 60% ensures that the HPA triggers scaling earlier, and increasing the minimum replicas to 5 provides a baseline capacity to absorb traffic spikes, preventing the upstream connect errors from the backend being overwhelmed.

Exam trap

Google Cloud often tests the misconception that increasing cluster node count or changing autoscaler settings resolves pod-level scaling issues, when the real problem is the HPA configuration not triggering due to a high target utilization or insufficient minimum replicas.

How to eliminate wrong answers

Option A is wrong because switching to memory utilization does not address the root cause—CPU is the bottleneck (90% utilization) and memory may not be the limiting factor; the HPA would still fail to scale if memory is not the constrained resource. Option C is wrong because the error 'upstream connect error or disconnect/reset before headers' indicates connection timeouts or resource exhaustion at the pod level, not a connection limit per pod; increasing max connections in backendConfig would not resolve the underlying CPU starvation. Option D is wrong because the cluster already has sufficient node capacity (the autoscaler can add nodes up to 10, and the issue is that the HPA is not scaling pods, not that nodes are unavailable; adding more nodes does not force the HPA to scale pods.

Full explanation →
15
MCQeasy

A team uses Cloud Build for CI/CD. The builds are taking longer than expected due to dependency downloads. What is the best practice to speed up builds?

A.Increase the machine type to e2-highcpu-32 to speed up compilation.
B.Use Docker layer caching with Cloud Build by specifying a cache image or using Kaniko cache.
C.Use Artifact Registry to store built packages and pull them during build.
D.Store dependencies in Cloud Source Repositories and fetch them during build.
AnswerB

Caching dependencies reduces build time significantly.

Why this answer

Docker layer caching allows Cloud Build to reuse previously built layers, significantly reducing the time spent re-downloading and re-installing dependencies. By specifying a cache image or using Kaniko's built-in cache, only changed layers are rebuilt, while unchanged dependency layers are pulled from the cache instead of being fetched from the internet each time.

Exam trap

The trap here is that candidates confuse increasing compute resources (Option A) with solving a network-bound problem, or they mistakenly think storing dependencies in a repository (Options C and D) eliminates the need to download them, when in fact only layer caching avoids re-downloading by reusing previously built layers.

How to eliminate wrong answers

Option A is wrong because increasing the machine type to e2-highcpu-32 primarily speeds up CPU-bound compilation tasks, not network-bound dependency downloads; the bottleneck here is network latency and download throughput, not CPU cores. Option C is wrong because Artifact Registry stores built packages (e.g., container images, Maven artifacts), not raw dependency files; pulling pre-built packages from Artifact Registry does not address the initial download of dependencies during the build process. Option D is wrong because Cloud Source Repositories is a Git repository hosting service, not a dependency cache; storing dependencies there would require manual management and does not integrate with standard package managers (e.g., pip, npm, Maven) to avoid re-downloading.

Full explanation →
16
MCQhard

A financial services firm runs batch risk calculations nightly using a large Compute Engine VM with a GPU. Jobs complete in 4 hours but are not time-sensitive. To reduce costs without sacrificing reliability, the firm enables preemptible VMs but finds that jobs are interrupted and restarting from scratch causes delays. What is the best approach to improve reliability while maintaining cost savings?

A.Request a committed use discount for the GPU and use a standard VM without preemptible.
B.Use a non-preemptible VM but downgrade the GPU type to reduce cost.
C.Use a spot VM with a high availability SLA, relying on low preemption rates.
D.Use a managed instance group with preemptible VMs and implement checkpointing to save progress periodically.
AnswerD

Checkpointing allows the job to resume after preemption, and preemptible VMs reduce cost.

Why this answer

Using managed instance groups with preemptible VMs and checkpointing allows the job to resume from the last checkpoint after preemption, maintaining reliability. Simply accepting preemptions or using non-preemptible VMs would not balance cost and reliability.

Full explanation →
17
MCQhard

A user reports that an application running on instance-1 is unreliable and often restarts. What is the most likely cause?

A.The instance is in a single zone without redundancy.
B.The machine type is too small.
C.The instance is using an outdated image.
D.The instance is preemptible and can be terminated at any time.
AnswerD

Preemptible VMs are subject to termination within 24 hours.

Why this answer

Preemptible instances (now called 'spot instances' in Google Cloud) can be terminated by Google Compute Engine at any time due to resource demands, with only 30 seconds of warning. This makes them unsuitable for applications that require reliability and continuous uptime, as the instance can be stopped abruptly, causing the application to restart or become unavailable.

Exam trap

Google Cloud often tests the distinction between preemptible instances and other common causes of instability, such as resource exhaustion or zone failures, to see if candidates understand that preemptible instances are explicitly designed to be terminated at any time.

How to eliminate wrong answers

Option A is wrong because a single-zone deployment without redundancy can cause downtime if the zone fails, but it does not cause frequent, unpredictable restarts of the instance itself. Option B is wrong because a machine type that is too small would typically cause performance degradation or out-of-memory errors, not frequent restarts of the instance. Option C is wrong because an outdated image may have security vulnerabilities or missing patches, but it does not directly cause the instance to restart repeatedly.

Full explanation →
18
MCQhard

The firewall rule 'allow-ssh' was not created. According to the audit log, what is the most likely reason?

A.The user is not authenticated.
B.The user has the compute.securityAdmin role but not compute.firewalls.create.
C.The user does not have the compute.firewalls.create permission.
D.The firewall rule already exists and cannot be duplicated.
AnswerC

AuthorizationInfo shows granted: false for that permission.

Why this answer

The audit log indicates the firewall rule 'allow-ssh' was not created because the user lacks the specific permission required to create firewall rules in Google Cloud. The correct permission is `compute.firewalls.create`, which is part of the `compute.securityAdmin` role but not automatically granted with it; the `compute.securityAdmin` role includes `compute.firewalls.create`, so Option B is factually incorrect. The most likely reason is that the user does not have the `compute.firewalls.create` permission, which is a prerequisite for creating firewall rules.

Exam trap

The trap here is that candidates assume the `compute.securityAdmin` role does not include `compute.firewalls.create`, when in fact it does, leading them to incorrectly select Option B.

How to eliminate wrong answers

Option A is wrong because the audit log would show an authentication failure (e.g., 'unauthenticated' or 'login failed') if the user were not authenticated, but the scenario states the rule was not created, implying the user was authenticated but lacked authorization. Option B is wrong because the `compute.securityAdmin` role actually includes the `compute.firewalls.create` permission; if the user had that role, they would have the necessary permission, so this option presents a false contradiction. Option D is wrong because the audit log would show a 'resource already exists' error (HTTP 409 Conflict) if the rule already existed, but the question states the rule was not created, not that creation was attempted and failed due to duplication.

Full explanation →
19
MCQeasy

A company wants to deploy a containerized application on Google Cloud and needs persistent storage that can be accessed by multiple pods in a GKE cluster concurrently. Which storage solution should they use?

A.Persistent Disk with ReadWriteMany access mode
B.Cloud Storage via Storage FUSE
C.Compute Engine persistent disk attached to each node
D.Filestore
AnswerD

Filestore provides a managed NFS server that supports concurrent read/write from multiple pods.

Why this answer

Filestore is the correct choice because it provides a managed NFS file server that supports the ReadWriteMany (RWX) access mode, allowing multiple pods in a GKE cluster to concurrently read from and write to the same persistent storage volume. This is essential for workloads like content management systems or shared data processing that require simultaneous access from multiple pods.

Exam trap

The trap here is that candidates often confuse Persistent Disk's ReadWriteOnce capability with ReadWriteMany, or incorrectly assume that Cloud Storage FUSE provides the same concurrent POSIX access as a true shared filesystem like NFS.

How to eliminate wrong answers

Option A is wrong because Persistent Disk volumes in GKE support only ReadWriteOnce (RWO) access mode, meaning they can be mounted by only a single pod at a time, not multiple pods concurrently. Option B is wrong because Cloud Storage via Storage FUSE provides a file-system interface to object storage, but it does not offer true POSIX-compliant concurrent read-write access from multiple pods and introduces latency and consistency limitations. Option C is wrong because Compute Engine persistent disks attached to each node are local to that node and cannot be shared across multiple nodes or pods; they also default to ReadWriteOnce mode.

Full explanation →
20
MCQmedium

A financial services company runs a multi-tier application on Compute Engine. They need to restrict network access so that only the web tier can communicate with the application tier, and only the application tier can access the database tier. All VMs are in the same VPC network. What is the most secure way to implement this?

A.Use Identity-Aware Proxy (IAP) to manage network access between tiers.
B.Use VPC firewall rules with target tags to allow traffic between specific tiers.
C.Create separate VPC networks for each tier and use VPC peering.
D.Assign a unique service account to each tier and use IAM conditions to restrict traffic.
AnswerB

VPC firewall rules with tags are the simplest and most secure way to enforce network segmentation within a VPC.

Why this answer

VPC firewall rules with target tags allow you to precisely control ingress and egress traffic between VM instances based on their assigned tags. By tagging web tier VMs with a tag like 'web-tier' and application tier VMs with 'app-tier', you can create a firewall rule that allows traffic from 'web-tier' to 'app-tier' on the required port (e.g., TCP 8080) and another rule allowing traffic from 'app-tier' to 'db-tier' on the database port (e.g., TCP 3306). This approach enforces the principle of least privilege within a single VPC network without introducing unnecessary complexity or breaking network isolation.

Exam trap

The trap here is that candidates often confuse IAM conditions or service accounts with network-layer access control, or they overcomplicate the solution by suggesting separate VPC networks when the simplest and most secure method within a single VPC is using firewall rules with target tags.

How to eliminate wrong answers

Option A is wrong because Identity-Aware Proxy (IAP) is designed for user-level authentication and authorization to access applications and VMs via HTTPS or SSH/RDP tunnels, not for controlling network traffic between VM tiers within a VPC. Option C is wrong because creating separate VPC networks for each tier and using VPC peering would allow all traffic between the peered networks unless additional firewall rules are applied, and it adds unnecessary complexity; the question explicitly states all VMs are in the same VPC network, making this approach less secure and more complex than using tags. Option D is wrong because service accounts and IAM conditions control API-level permissions (e.g., who can create or delete resources), not network-layer traffic between VM instances; they cannot restrict which VMs can communicate with each other over the network.

Full explanation →
21
Multi-Selecthard

A company has set up an external HTTP(S) load balancer with a backend service pointing to a managed instance group. Some instances are failing health checks. Which TWO actions should the company take to troubleshoot the issue?

Select 2 answers
A.Ensure the health check path specified in the backend service returns a 200 OK status.
B.Verify that the firewall rules allow traffic from the load balancer health check IP ranges.
C.Disable session affinity to allow better distribution of traffic.
D.Change the health check interval from 5 seconds to 30 seconds.
E.Increase the number of instances in the instance group to distribute the load.
AnswersA, B

If the health check path does not respond correctly, the instance will be considered unhealthy.

Why this answer

The HTTP(S) load balancer's health check probes the specified path on each backend instance. If the path does not return a 200 OK status, the load balancer marks the instance as unhealthy and stops sending traffic to it. Ensuring the health check path returns a 200 OK is the first step in verifying that the health check is configured correctly.

Exam trap

The trap here is that candidates often focus on load distribution or scaling solutions (options C and E) rather than the fundamental connectivity and application-level checks (options A and B) that directly determine health check success.

Full explanation →
22
MCQmedium

Refer to the exhibit. The exhibit shows logs and a metric from a GCE instance that was terminated. The instance was part of a managed instance group. Which diagnostic step should be taken FIRST to prevent recurrence?

A.Review the memory usage metric for the instance prior to termination.
B.Set a disk usage alert to be notified when disk exceeds 90%.
C.Increase the disk size of the instance template and redeploy.
D.Add a startup script to clear temporary files on boot.
AnswerA

Memory usage history will reveal if the instance was memory-constrained, guiding whether to increase memory.

Why this answer

The logs indicate OOM kills, and the disk is nearly full. The most likely cause is a combination of high memory usage and disk filling up (possibly swap or logs). First, check memory usage history to confirm if the instance was under-provisioned.

Full explanation →
23
MCQmedium

A company wants to grant a service account in Project A the ability to push containers to Artifact Registry in Project B. They want to follow the principle of least privilege. Which IAM roles should they assign?

A.Grant the service account the Storage Object Admin role (roles/storage.objectAdmin) on Project B
B.Grant the service account the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B
C.Grant the service account the Artifact Registry Admin role (roles/artifactregistry.admin) on the repository in Project B
D.Grant the service account the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository in Project B
AnswerB

Writer role allows pushing images and is the correct least-privilege role for this task.

Why this answer

To push containers, the service account needs the Artifact Registry Writer role (roles/artifactregistry.writer) on the repository in Project B. The Storage Object Admin role is too broad. The Artifact Registry Admin role is overly permissive.

The Viewer role only allows reading.

Full explanation →
24
MCQhard

A company uses Cloud NAT to allow private instances to access the internet. They notice intermittent connectivity issues. What should they check first?

A.Cloud NAT gateway has at least one NAT IP address configured.
B.Cloud NAT router has a configured IP address range.
C.Cloud NAT gateway is in the same region as the instances.
D.The VPC subnet has private Google access enabled.
E.The instances have external IP addresses assigned.
AnswerA

Without NAT IPs, traffic cannot be translated, causing intermittent failures.

Why this answer

Intermittent connectivity issues when using Cloud NAT are most commonly caused by a lack of NAT IP addresses. Cloud NAT uses source network address translation (SNAT) to map private instance traffic to a public IP address; if the gateway has no NAT IP addresses configured, or if the number of concurrent connections exceeds the available port capacity of the assigned NAT IPs, packets are dropped, leading to intermittent failures. Checking that at least one NAT IP address is assigned is the first and most critical troubleshooting step.

Exam trap

Google Cloud often tests the misconception that Cloud NAT requires a router with a configured IP range or that Private Google Access is needed for internet access, but the real first check is ensuring NAT IP addresses are assigned to the gateway.

How to eliminate wrong answers

Option B is wrong because Cloud NAT does not require a configured IP address range on the router; the router handles dynamic routing, but NAT IPs are assigned directly to the Cloud NAT gateway, not as a range on the router. Option C is wrong because Cloud NAT is a regional resource and must be in the same region as the instances by design; if it were in a different region, connectivity would fail entirely, not intermittently. Option D is wrong because Private Google Access enables instances to reach Google APIs and services without public IPs, but it does not affect general internet connectivity through Cloud NAT.

Option E is wrong because instances behind Cloud NAT should not have external IP addresses; assigning external IPs bypasses Cloud NAT entirely and would cause direct internet access, not intermittent NAT issues.

Full explanation →
25
MCQmedium

An e-commerce company is experiencing traffic spikes during flash sales. Their application runs on Compute Engine instances behind a TCP load balancer. They want to automatically scale the number of instances based on CPU utilization. Which configuration is required?

A.Configure Cloud Run for autoscaling and rewrite the application to run in containers.
B.Create an unmanaged instance group with a static number of instances and configure Cloud CDN.
C.Use Cloud Functions to handle traffic spikes and redirect traffic from the load balancer.
D.Create a managed instance group (MIG) with an autoscaling policy based on CPU utilization.
AnswerD

MIGs support autoscaling based on metrics like CPU utilization, adjusting instance count automatically.

Why this answer

Managed Instance Groups (MIGs) with autoscaling based on CPU utilization is the correct approach. Cloud Functions and Cloud Run are not Compute Engine instance scaling. A global HTTP(S) Load Balancer is not required for TCP traffic.

Full explanation →
26
MCQhard

A company is using Cloud Armor to protect their external HTTPS load balancer. They want to block traffic from a specific list of IP ranges. They create a security policy with a deny rule. However, the denials seem not to be applied to all backend services. What is the most likely cause?

A.The security policy is not attached to the backend service
B.The security policy is attached to the load balancer's target proxy, but the deny rule priority is lower than an allow rule
C.Cloud Armor policies only apply to global load balancers, not regional
D.The security policy has an allow rule that overrides the deny rule
AnswerB

Rules evaluated by priority; higher priority allow rule can override lower priority deny rule.

Why this answer

Cloud Armor security policies are evaluated against the rules in priority order, with lower numbers having higher priority. If a deny rule has a higher priority number (lower priority) than an allow rule, the allow rule will be evaluated first and permit the traffic, effectively overriding the deny. The most likely cause is that the deny rule's priority is not set lower than any conflicting allow rules, so the allow rule matches first.

Exam trap

Google Cloud often tests the misconception that simply having a deny rule in a security policy is sufficient, without understanding that rule priority determines which rule is evaluated first, and an allow rule with lower priority number can override a deny rule.

How to eliminate wrong answers

Option A is wrong because the security policy is attached to the target proxy (not the backend service), and the question states the policy is created and denials are not applied, implying attachment exists but rules are not effective. Option C is wrong because Cloud Armor policies apply to both global and regional external HTTPS load balancers; the question does not specify regional, and this is not a common cause for rules not being applied. Option D is wrong because while an allow rule can override a deny rule, the specific mechanism is priority-based evaluation; the statement 'overrides' is too vague and does not capture the priority ordering that is the core issue.

Full explanation →
27
Multi-Selecthard

A company runs a batch processing workload on Compute Engine. They need to minimize cost and ensure jobs complete within a 24-hour window. Which THREE strategies should they implement? (Choose 3.)

Select 3 answers
A.Use sole-tenant nodes for resource isolation.
B.Use preemptible VMs for fault-tolerant jobs.
C.Configure instance reservations for guaranteed capacity.
D.Use committed use discounts for one-year term.
E.Set up a managed instance group with autoscaling based on job queue depth.
AnswersB, D, E

Preemptible VMs are low-cost and suitable for batch jobs that can handle interruptions.

Why this answer

Preemptible VMs are significantly cheaper than standard VMs and are ideal for batch processing workloads that are fault-tolerant. Since the job can handle interruptions and be restarted, using preemptible VMs directly reduces cost while still completing within the 24-hour window if the job is designed to checkpoint progress.

Exam trap

Google Cloud often tests the misconception that sole-tenant nodes or instance reservations are cost-saving strategies, when in fact they are designed for isolation or capacity assurance and typically increase costs.

Full explanation →
28
MCQmedium

An organization runs a stateful application on GKE that must not lose data during cluster upgrades or node repairs. The application uses persistent volumes with ReadWriteOnce access mode. The team wants to ensure pods are not evicted simultaneously. Which Kubernetes resource should they configure?

A.PodDisruptionBudget
B.ClusterAutoscaler
C.HorizontalPodAutoscaler
D.VerticalPodAutoscaler
AnswerA

A PodDisruptionBudget (PDB) specifies the minimum number or percentage of replicas that must remain available during voluntary disruptions, such as cluster upgrades or node repairs. By setting `maxUnavailable: 0` or `minAvailable: 1`, the PDB prevents the simultaneous eviction of pods using ReadWriteOnce persistent volumes, thereby satisfying the requirement that no data be lost and pods are not evicted concurrently.

Why this answer

PodDisruptionBudget (PDB) specifies the minimum number of available pods that must remain up during voluntary disruptions, such as node upgrades.

Full explanation →
29
MCQeasy

A company needs to grant a data scientist read-only access to BigQuery datasets in the project 'analytics-prod' without granting permissions to any other resources. Which IAM role should be assigned at the project level?

A.roles/viewer
B.roles/bigquery.user
C.roles/bigquery.dataViewer
D.roles/bigquery.jobUser
AnswerC

BigQuery Data Viewer grants read-only access to datasets and tables.

Why this answer

The BigQuery Data Viewer role (roles/bigquery.dataViewer) grants read access to BigQuery datasets and tables. Assigning at the project level applies to all datasets in that project.

Full explanation →
30
MCQmedium

You need to create a private GKE cluster with Workload Identity enabled to allow pods to access Google Cloud APIs without static service account keys. What must you configure for the cluster?

A.Enable Binary Authorization on the cluster
B.Enable Workload Identity on the cluster and set the --workload-pool flag at cluster creation
C.Create a node pool with a service account that has the necessary IAM roles and assign that SA to pods
D.Use Cloud NAT to allow pods to communicate with Google APIs
AnswerB

Correct. Workload Identity is enabled via the --workload-pool flag on the cluster.

Why this answer

Workload Identity requires a GKE cluster with Workload Identity enabled and a Google-managed service account for the node pool or individual pods.

Full explanation →
31
Multi-Selecthard

Which THREE services can be used to audit changes to resources in a Google Cloud project?

Select 3 answers
A.Security Command Center
B.Cloud Monitoring
C.Cloud Asset Inventory
D.Cloud Endpoints
E.Cloud Audit Logs
AnswersA, C, E

SCC provides event findings and anomaly detection for changes.

Why this answer

Security Command Center (A) is correct because it provides a centralized view of security risks, including audit capabilities for resource changes via its 'Event Threat Detection' and 'Asset Inventory' features, which log and alert on modifications to Google Cloud resources. It integrates with Cloud Audit Logs to surface security-relevant changes, making it a valid service for auditing changes.

Exam trap

The trap here is that candidates often confuse Cloud Monitoring (which can alert on changes via custom metrics) with a dedicated auditing service, but Cloud Monitoring does not natively log or track resource changes—it only reacts to metrics, not audit trails.

Full explanation →
32
Multi-Selecteasy

A company is deploying a web application on Compute Engine. They want to automatically scale the number of instances based on CPU utilization. Which two components are required to set up autoscaling? (Choose two.)

Select 2 answers
A.Cloud Functions
B.Cloud Load Balancing
C.Instance template
D.Managed instance group
E.Cloud Monitoring
AnswersC, D

Defines the instance configuration for the MIG.

Why this answer

An instance template is required because it defines the machine configuration (machine type, boot disk image, network tags, etc.) for all VMs created by the autoscaler. Without a template, the managed instance group would have no blueprint to provision new instances when scaling out.

Exam trap

The trap here is that candidates often think Cloud Monitoring is required because autoscaling uses CPU metrics, but the autoscaler automatically accesses those metrics without requiring Cloud Monitoring to be separately configured.

Full explanation →
33
Multi-Selecteasy

A company wants to monitor the health of their Cloud Run services. Which THREE metrics should they use to define a comprehensive health SLI? (Choose 3)

Select 3 answers
A.Latency (e.g., p99 response time)
B.CPU utilization
C.Request count
D.Instance count
E.Error rate (percentage of 5xx responses)
AnswersA, C, E

Latency is a key performance SLI for user experience.

Why this answer

Latency (p99 response time) is a critical metric for Cloud Run because it measures the end-to-end request processing time, directly reflecting user experience. In a serverless environment, high latency can indicate cold starts, insufficient concurrency, or downstream service bottlenecks, making it essential for a comprehensive health SLI.

Exam trap

Google Cloud often tests the misconception that infrastructure-level metrics like CPU or instance count are valid health SLIs for serverless services, when in fact user-facing metrics (latency, errors, request count) are the correct choices for a comprehensive health SLI.

Full explanation →
34
MCQeasy

An organization wants to connect their on-premises data center to Google Cloud with a dedicated 10 Gbps link. They require high availability and have budget for two physically diverse connections. Which solution should they choose?

A.Use Partner Interconnect with a single 10 Gbps connection.
B.Configure a single Dedicated Interconnect connection and use Cloud VPN as backup.
C.Provision two Cloud Dedicated Interconnect connections from diverse peering points.
D.Deploy a single HA VPN tunnel.
AnswerC

Two Dedicated Interconnect connections from diverse locations provide high availability and dedicated bandwidth.

Why this answer

Cloud Dedicated Interconnect provides direct physical connections between on-premises and Google Cloud. For high availability, two separate circuits (each 10 Gbps or 100 Gbps) from diverse peering points are recommended. HA VPN is software-defined and lower bandwidth.

Partner Interconnect uses a service provider but Dedicated Interconnect is preferred for dedicated bandwidth.

Full explanation →
35
MCQeasy

Your company runs a critical application on Compute Engine instances in us-central1. The application requires low latency between instances that are all in the same region. You notice that network latency between instances varies and sometimes spikes. You want to ensure consistent low-latency communication. You currently use external IP addresses for communication between instances. What should you do?

A.Move instances to the same zone to reduce network hops.
B.Upgrade to larger machine types to improve network bandwidth.
C.Use internal IP addresses instead of external IPs for inter-instance communication.
D.Set up a Cloud VPN connection between instances.
AnswerC

Internal IPs use Google's internal network, which is optimized for low latency and higher throughput within the same region, avoiding the variability of external IP routing.

Why this answer

Using internal IP addresses (RFC 1918) for inter-instance communication avoids the overhead of NAT, external routing, and potential egress bottlenecks. Traffic stays within Google's internal network fabric, reducing latency variability and eliminating spikes caused by external internet path fluctuations.

Exam trap

The trap here is that candidates assume moving to the same zone or upgrading machine types will fix latency, but the root cause is the external IP routing path, not proximity or bandwidth.

How to eliminate wrong answers

Option A is wrong because moving instances to the same zone reduces physical distance but does not address the fundamental issue of using external IPs, which still forces traffic through external gateways and can introduce latency spikes. Option B is wrong because larger machine types increase network bandwidth (throughput) but do not reduce latency or eliminate the variability caused by external IP routing. Option D is wrong because Cloud VPN is designed for secure connectivity between on-premises and VPC, not for inter-instance communication within the same region; it adds encryption overhead and does not solve the external IP latency problem.

Full explanation →
36
MCQeasy

Which Google Cloud service provides a fully managed, serverless data warehouse for petabyte-scale analytics using SQL?

A.Firestore
B.Cloud Spanner
C.Cloud SQL
D.BigQuery
AnswerD

BigQuery is a serverless data warehouse that scales to petabytes and supports standard SQL.

Why this answer

BigQuery is Google Cloud's fully managed, serverless data warehouse designed for petabyte-scale analytics using standard SQL. It automatically handles infrastructure scaling, partitioning, and query optimization, allowing users to run fast SQL queries on massive datasets without managing servers or clusters.

Exam trap

Google often tests the distinction between transactional databases (like Cloud SQL, Spanner) and analytical data warehouses (like BigQuery), where candidates mistakenly choose a familiar SQL database service for analytics without recognizing the petabyte-scale, serverless requirement.

How to eliminate wrong answers

Option A is wrong because Firestore is a NoSQL document database for mobile and web app development, not a data warehouse for analytics. Option B is wrong because Cloud Spanner is a globally distributed, strongly consistent relational database service for transactional workloads, not for petabyte-scale analytics. Option C is wrong because Cloud SQL is a managed relational database service for MySQL, PostgreSQL, and SQL Server, designed for OLTP workloads and limited in scale compared to BigQuery's petabyte analytics.

Full explanation →
37
MCQhard

An engineer runs the command above. A few days later, the instance becomes unresponsive. Upon investigation, you find that the boot disk is 100 GB and 95% full. The data disk is 500 GB and only 20% full. What is the most likely cause of the unresponsiveness?

A.The boot disk is too small and has run out of space.
B.The data disk is pd-standard, which is causing I/O bottlenecks for the OS.
C.The boot disk is pd-ssd, which is too slow for the workload.
D.The instance has run out of IOPS on the boot disk.
AnswerA

95% full boot disk can cause system instability and unresponsiveness.

Why this answer

The boot disk is 95% full, which leaves insufficient free space for the operating system to write temporary files, logs, or perform essential system operations. When a Linux or Windows boot disk runs out of space, the OS can become unresponsive because critical processes (e.g., systemd, journald, or the Windows Registry) cannot write to disk. In Google Cloud, the boot disk is the root device (typically /dev/sda1), and filling it to 95% on a 100 GB disk means only 5 GB remains, which is easily exhausted by normal system activity.

Exam trap

Google Cloud often tests the distinction between disk space exhaustion and performance bottlenecks; the trap here is that candidates may focus on disk type (pd-standard vs pd-ssd) or IOPS limits instead of recognizing that a nearly full boot disk directly causes OS unresponsiveness.

How to eliminate wrong answers

Option B is wrong because pd-standard disks are HDD-based and can cause I/O bottlenecks, but the data disk is only 20% full and the question states the instance became unresponsive due to disk space, not I/O performance. Option C is wrong because pd-ssd is a high-performance SSD type, not too slow for typical workloads; the issue is space exhaustion, not speed. Option D is wrong because running out of IOPS would cause performance degradation or throttling, not unresponsiveness due to disk space; the boot disk is nearly full, which is a capacity problem, not an IOPS limit.

Full explanation →
38
MCQmedium

A company runs a multi-tier web application on Google Kubernetes Engine (GKE) with a frontend service, a backend service, and a Cloud SQL for PostgreSQL database. During peak hours, the frontend pod CPU usage is high (consistently above 80%), while the backend service shows moderate CPU usage (around 50%). Response times for user requests increase significantly, often exceeding the 200ms p99 latency target. Cloud SQL metrics show low query latency and no contention. The team wants to improve performance in a cost-effective manner. Which initial step should they take?

A.Add a read replica for Cloud SQL to offload read queries.
B.Migrate the backend service to a custom machine type with more vCPUs.
C.Enable vertical pod autoscaling for the backend service.
D.Increase the number of frontend pods by adjusting the horizontal pod autoscaler's target CPU utilization.
AnswerD

Frontend CPU is high, so scaling out frontend pods will help handle the load and reduce latency. This is cost-effective as it adds only needed capacity.

Why this answer

The frontend pods are CPU-bound during peak hours, causing increased response times. Increasing the number of frontend pods via the Horizontal Pod Autoscaler (HPA) by lowering the target CPU utilization threshold distributes the load across more replicas, directly addressing the bottleneck without additional infrastructure cost. This is the most cost-effective initial step because it leverages existing resources and autoscaling capabilities.

Exam trap

Google Cloud often tests the misconception that backend or database changes are needed when the bottleneck is clearly at the frontend tier, leading candidates to choose expensive or irrelevant scaling options like read replicas or vertical scaling.

How to eliminate wrong answers

Option A is wrong because Cloud SQL metrics show low query latency and no contention, so a read replica would not resolve the frontend CPU bottleneck and would add unnecessary cost. Option B is wrong because the backend service shows only moderate CPU usage (50%), so migrating to a custom machine type with more vCPUs would be over-provisioning and not cost-effective; the bottleneck is the frontend, not the backend. Option C is wrong because vertical pod autoscaling (VPA) adjusts CPU/memory requests for existing pods, but the frontend pods are already CPU-saturated; scaling up vertically would require pod restarts and may hit node limits, whereas horizontal scaling is more appropriate for stateless web tiers.

Full explanation →
39
MCQmedium

A security team wants to prevent data exfiltration from a GKE cluster to external storage. They need to restrict access to Cloud Storage buckets from the cluster without using private IPs. Which solution should they implement?

A.Configure firewall rules to block outbound traffic to Cloud Storage
B.Enable Cloud Armor on the GKE cluster
C.Use Private Google Access for on-premises access
D.Implement VPC Service Controls with a service perimeter
AnswerD

VPC Service Controls create perimeters around GCP resources (e.g., Cloud Storage) to block data exfiltration to unauthorized networks.

Why this answer

VPC Service Controls use service perimeters to protect resources and prevent data exfiltration from authorized networks, including GKE clusters, to external resources.

Full explanation →
40
Multi-Selecthard

A company uses GKE with Istio for service mesh. They want to implement a canary deployment for a critical service with fine-grained traffic splitting. Which THREE components should they configure? (Choose three.)

Select 3 answers
A.Kubernetes Service
B.DestinationRule
C.Ingress Gateway
D.HorizontalPodAutoscaler
E.VirtualService
AnswersA, B, E

The Service is the target for the VirtualService, providing a stable DNS name.

Why this answer

Istio uses VirtualService, DestinationRule, and Kubernetes Service to achieve canary deployments. VirtualService defines traffic routing rules, DestinationRule defines subsets (versions), and Kubernetes Service serves as a stable endpoint. Ingress Gateway is for external traffic, not internal.

HorizontalPodAutoscaler is for scaling, not routing.

Full explanation →
41
MCQmedium

A company has a production GKE cluster with a node pool using n1-standard-4 machine types. They need to change to e2-standard-4 without downtime. Which approach should be taken?

A.Enable GKE Node Auto-Repair to automatically fix the issue.
B.Delete the existing node pool and create a new one with the new machine type.
C.Update the existing node pool's machine type via gcloud container node-pools update.
D.Create a new node pool with the new machine type, cordon and drain old nodes, then delete the old pool.
E.Use gcloud compute machine-types change on the nodes.
AnswerD

Correct. This approach migrates workloads gracefully.

Why this answer

It ensures zero downtime by first creating a new node pool with the desired e2-standard-4 machine type, then cordoning and draining the old nodes to gracefully migrate workloads, and finally deleting the old pool. This approach leverages Kubernetes' native pod eviction and rescheduling mechanisms to maintain application availability throughout the migration.

Exam trap

Google Cloud often tests the misconception that you can update an existing node pool's machine type via a simple command, but in GKE, machine type is immutable after creation, requiring a new pool and graceful migration.

How to eliminate wrong answers

Option A is wrong because Node Auto-Repair only fixes unhealthy nodes (e.g., those with kernel issues) and cannot change machine types. Option B is wrong because deleting the existing node pool before creating a new one would cause downtime, as workloads have no target nodes to migrate to. Option C is wrong because the gcloud container node-pools update command does not support changing the machine type of an existing node pool; machine type is an immutable property set at creation.

Option E is wrong because gcloud compute machine-types change is a Compute Engine command for standalone VMs, not applicable to GKE node pools managed by the cluster.

Full explanation →
42
Multi-Selecthard

A company uses Cloud Armor to protect their HTTP load balancer. They need to block traffic from a specific set of IP addresses and also prevent SQL injection attacks. Which two configurations should they use? (Choose TWO.)

Select 2 answers
A.IAM roles to restrict access
B.Firewall rules on the VM instances
C.Ingress rules on the VPC network
D.Security policies with IP deny rules
E.Web Application Firewall (WAF) rules with SQL injection preconfigured rules
AnswersD, E

Cloud Armor security policies can include IP-based deny rules.

Why this answer

Cloud Armor security policies allow you to create IP deny rules to block traffic from specific IP addresses or ranges at the edge of Google's network, before it reaches your load balancer. Option E is correct because Cloud Armor also provides preconfigured WAF rules, including SQL injection detection, which can be added to the same security policy to inspect HTTP/HTTPS requests and block malicious payloads.

Exam trap

The trap here is that candidates confuse network-layer controls (firewall rules, VPC ingress) with application-layer protection (WAF), or think IAM roles can filter traffic, when in fact Cloud Armor is the only service that combines IP-based deny rules with WAF capabilities for HTTP load balancers.

Full explanation →
43
MCQmedium

A company wants to optimise costs for their BigQuery workloads. They have a predictable set of queries that run every hour, with occasional ad-hoc queries from analysts. They want to reduce the cost of the scheduled queries while keeping the ad-hoc queries cost-effective. Which pricing model should they choose?

A.Use Editions with a baseline of reserved slots for scheduled queries and allow autoscaling for ad-hoc
B.On-demand pricing
C.Use committed use discounts on slots
D.Flat-rate pricing (slot reservations) for all queries
AnswerA

Editions allow reserving slots for predictable workloads and autoscaling for spikes, optimising cost and performance.

Why this answer

BigQuery slot reservations (editions) allow allocating dedicated slots for predictable workloads, with separate pricing for ad-hoc queries (on-demand). Flat-rate pricing is cheaper for large steady-state usage but may waste slots during idle time. On-demand is pay-per-query; for predictable queries, it may be expensive.

The best approach is to use a hybrid: reserved slots for scheduled queries and on-demand for ad-hoc.

Full explanation →
44
MCQeasy

A developer wants to store a database password that is used by a Cloud Function. The password must be automatically rotated every 30 days and accessed securely without storing it in the source code. Which GCP service should they use?

A.Cloud KMS
B.Cloud Runtime Configuration
C.Secret Manager
D.Firestore
AnswerC

Secret Manager is designed for storing and managing secrets with rotation capabilities.

Why this answer

Secret Manager stores secrets like API keys and passwords. It supports automatic rotation via Cloud Scheduler and Cloud Functions, and provides fine-grained access control.

Full explanation →
45
MCQeasy

An engineer needs to grant a user the ability to create and manage service accounts in a project. Which predefined IAM role provides these permissions?

A.roles/owner
B.roles/iam.serviceAccountAdmin
C.roles/editor
D.roles/iam.workloadIdentityUser
AnswerB

This role grants full control over service accounts.

Why this answer

The roles/iam.serviceAccountAdmin role includes permissions to create, delete, and manage service accounts.

Full explanation →
46
MCQmedium

An organization uses Active Directory (AD) on-premises and wants to synchronize user identities to Google Cloud Identity so that users can access G Suite and GCP resources with their existing credentials. Which service should they use?

A.Cloud Identity-Aware Proxy (IAP)
B.Federation with Google Identity Platform
C.Cloud Directory Sync
D.SAML SSO
AnswerC

Cloud Directory Sync synchronizes identities from on-premises LDAP/AD to Cloud Identity.

Why this answer

Cloud Directory Sync (formerly Google Cloud Directory Sync) synchronizes users and groups from LDAP-compliant directories like Active Directory to Cloud Identity. It allows single sign-on and identity management.

Full explanation →
47
MCQhard

A company's BigQuery costs are higher than expected. They run many ad-hoc queries with filters on the 'transaction_date' column and 'customer_id' column. They also have a materialized view that is rarely used. Which combination of actions will MOST effectively reduce query costs?

A.Convert to a clustered table on transaction_date and disable caching
B.Use flat-rate pricing for all queries and cluster on transaction_date
C.Partition on customer_id and use materialized views for all queries
D.Partition on transaction_date, cluster on customer_id, and drop the unused materialized view
AnswerD

Partitioning and clustering reduce bytes scanned; dropping unused views cuts storage costs.

Why this answer

Partitioning by transaction_date reduces scanned data for date filters. Clustering by customer_id further reduces bytes billed for queries filtering on that column. Dropping unused materialized views avoids storage costs.

Full explanation →
48
MCQmedium

An organization uses Cloud Deployment Manager to manage infrastructure as code. They need to ensure that changes to production resources are reviewed and approved before deployment. What should they do?

A.Use Cloud Scheduler to run deployment configs and review logs after deployment
B.Integrate Cloud Deployment Manager with Cloud Build and add a manual approval step in the Cloud Build pipeline
C.Create a Cloud Deployment Manager preview deployment and manually approve it
D.Use Cloud Build with a trigger on a branch that requires pull request approval before merging
AnswerB

Cloud Build can have approval gates, requiring manual sign-off before proceeding with deployment.

Why this answer

Integrating Cloud Deployment Manager with Cloud Build allows you to create a CI/CD pipeline that includes a manual approval step. This ensures that changes to production resources are reviewed and approved before the deployment config is applied, meeting the requirement for change control.

Exam trap

The trap here is that candidates often confuse code review (pull request approval) with deployment approval, thinking that merging code with approval automatically ensures deployment approval, but Cloud Deployment Manager requires a separate approval step in the deployment pipeline to control when infrastructure changes are actually applied.

How to eliminate wrong answers

Option A is wrong because Cloud Scheduler is a cron job service for triggering actions on a schedule; it does not provide any review or approval mechanism, and reviewing logs after deployment does not prevent unapproved changes. Option C is wrong because a Cloud Deployment Manager preview deployment only shows what changes would be made without actually applying them, but it does not enforce a formal review and approval workflow; manual approval of a preview is not a built-in feature of Deployment Manager. Option D is wrong because while using Cloud Build with a trigger on a branch that requires pull request approval before merging enforces code review, it does not directly integrate with Cloud Deployment Manager to control the deployment of infrastructure; it only controls the merge of code, not the deployment of resources.

Full explanation →
49
Multi-Selectmedium

Which THREE are best practices for designing a highly available Cloud SQL for MySQL instance? (Choose 3)

Select 3 answers
A.Configure cross-region replication
B.Enable automatic backups
C.Use a regional persistent disk
D.Enable high availability with a standby in a different zone
E.Set a maintenance window in off-peak hours
AnswersB, C, D

Backups are essential for data restoration.

Why this answer

Automatic backups in Cloud SQL for MySQL provide point-in-time recovery (PITR) capabilities, which are essential for data durability and disaster recovery. Enabling automatic backups ensures that transaction logs are retained, allowing you to restore your database to any point within the backup retention period, typically up to 7 days.

Exam trap

The trap here is that candidates often confuse cross-region replication with high availability, but Cloud SQL's HA is zone-based within a single region, not cross-region, and maintenance windows are operational best practices, not HA design features.

Full explanation →
50
MCQmedium

You need to monitor the performance of a production Cloud Run service and set an alert when the p99 latency exceeds 500 ms over a 5-minute window. Which combination of Cloud Monitoring resources should you use?

A.Define an alerting policy using the metric 'run.googleapis.com/request_latencies' with a percentile aggregator and threshold condition
B.Create a log-based metric for latency and an alerting policy with a condition on the count of logs
C.Use Cloud Logging to export logs to BigQuery and run a scheduled query to check latency
D.Create an uptime check and set an alert on the check response time
AnswerA

This is the correct approach using Cloud Monitoring's alerting policy with appropriate metric.

Why this answer

To alert on latency, you create a custom metric or use an existing metric (e.g., request latencies), then define a threshold condition using an alerting policy. The alerting policy specifies the metric (request latency), aggregator (p99), condition (threshold >500ms for 5 minutes), and notification channel.

Full explanation →
51
MCQeasy

A company wants to reduce Google Cloud costs for a batch processing workload. They currently use n1-standard-4 VMs running 24/7. The workload runs for 2 hours each night. What is the most cost-effective recommendation?

A.Use on-demand VMs and rely on sustained use discounts.
B.Use a custom machine type with fewer vCPUs.
C.Use committed use discounts for 1 year.
D.Use preemptible VMs with a startup script and persistent disk.
AnswerD

Preemptible VMs cost about 60% less than standard, ideal for short, fault-tolerant batch jobs.

Why this answer

D is correct because the workload runs for only 2 hours per night, making preemptible VMs ideal — they cost up to 80% less than on-demand VMs and can be terminated at any time. A startup script ensures the job resumes if the VM is preempted, and using a persistent disk preserves data across interruptions. This combination provides the lowest cost for a short, fault-tolerant batch job.

Exam trap

The trap here is that candidates see 'cost-effective' and immediately think of committed use discounts (C) or sustained use discounts (A), failing to recognize that for short, intermittent workloads, preemptible VMs offer the deepest savings despite their preemption risk.

How to eliminate wrong answers

Option A is wrong because sustained use discounts apply automatically to on-demand VMs running for a significant portion of a month, but a 2-hour nightly workload (about 60 hours/month) does not trigger meaningful discounts — the discount only kicks in after 25% of a month (roughly 180 hours). Option B is wrong because custom machine types with fewer vCPUs reduce cost only if the workload is over-provisioned; the question does not indicate that n1-standard-4 is oversized, and the core issue is idle time, not resource sizing. Option C is wrong because committed use discounts (1-year) require a 24/7 commitment, which is wasteful for a 2-hour nightly job — you pay for unused resources the other 22 hours each day, negating any discount benefit.

Full explanation →
52
MCQhard

A company uses Cloud Armor to protect an HTTP(S) Load Balancer. They want to block traffic from a specific IP address range during off-peak hours but allow it during peak hours. How can they achieve this?

A.Implement a Cloud Function that updates the security policy on a schedule
B.Use a Cloud Armor security policy rule with a condition on the IP address and a time condition
C.Create two separate security policies and switch between them using Cloud Load Balancer URL maps
D.Use VPC firewall rules to block the IP range during off-peak hours
AnswerB

Cloud Armor supports rule conditions that can check the request time, allowing time-based blocking.

Why this answer

Cloud Armor security policies can use rules with conditions based on IP addresses and can also have time-based conditions (e.g., via headers or custom conditions). However, natively, Cloud Armor does not support scheduled rules. An alternative is to use a Cloud Function to modify the security policy based on time.

But the simplest approach is to configure a rule with a condition that evaluates the request time using the `request.time` attribute if supported; else, use a Cloud Function to update rules. Given the options, the closest is using a rule that includes a time condition via `request.time` but that is not a standard feature. Actually, Cloud Armor rules can use expressions including `request.time` to match time windows.

So the correct answer is a rule with a time condition.

Full explanation →
53
MCQmedium

A company has an on-premises data center connected to GCP via Dedicated Interconnect. They run latency-sensitive applications on GCE and use Cloud Storage for backups. The backup traffic is causing congestion on the Interconnect link. How should they optimize costs and performance?

A.Increase the Dedicated Interconnect bandwidth to accommodate both traffic types.
B.Move backup storage to a different region to reduce data transfer costs.
C.Use Cloud Interconnect to connect directly to Cloud Storage for backup traffic.
D.Route backup traffic through a separate VPN tunnel over the internet to reduce congestion on the Interconnect.
AnswerD

This offloads non-critical traffic, preserving Interconnect performance for latency-sensitive apps.

Why this answer

Routing backup traffic over a separate VPN tunnel using the internet offloads non-latency-sensitive backup data from the Dedicated Interconnect link, reducing congestion without incurring additional costs for increased bandwidth. This approach preserves the low-latency path for critical application traffic while using a cost-effective, encrypted internet-based connection for backups, optimizing both performance and cost.

Exam trap

The trap here is that candidates often assume all traffic must use the most reliable connection (Dedicated Interconnect) for everything, overlooking that non-critical traffic can be cost-effectively offloaded to a VPN over the internet without violating security or performance requirements.

How to eliminate wrong answers

Option A is wrong because simply increasing Dedicated Interconnect bandwidth would raise costs without addressing the root cause—it would still mix latency-sensitive and backup traffic, potentially degrading performance for critical apps. Option B is wrong because moving backup storage to a different region does not reduce congestion on the Interconnect link; it may even increase latency and costs due to cross-region data transfer fees. Option C is wrong because Cloud Interconnect is a general term for dedicated connections (including Dedicated Interconnect and Partner Interconnect) and does not provide a separate path to Cloud Storage; using it would still route backup traffic over the same congested link, failing to alleviate the issue.

Full explanation →
54
MCQmedium

A company wants to use their own HSM to hold encryption keys for Google Cloud services, but they want Google Cloud to perform cryptographic operations without exposing the keys. Which service should they use?

A.Cloud KMS (software)
B.CSEK
C.Cloud HSM
D.Secret Manager
AnswerC

Why this answer

Cloud HSM is a cloud-hosted HSM that allows customers to manage keys in FIPS 140-2 Level 3 HSMs, with Google performing operations without exposing key material.

Full explanation →
55
Multi-Selecteasy

A company wants to provide a private, low-latency connection between their on-premises data center and Google Cloud, with bandwidth up to 10 Gbps and a service level agreement (SLA) of 99.99% availability. Which TWO connectivity options should they consider?

Select 2 answers
A.Partner Interconnect
B.Dedicated Interconnect
C.Direct Peering
D.Cloud VPN
E.Carrier Peering
AnswersA, B

Partner Interconnect provides up to 10 Gbps through a supported provider with 99.99% SLA.

Why this answer

Dedicated Interconnect offers up to 100 Gbps per circuit and a 99.99% SLA. Partner Interconnect also offers 10 Gbps and 99.99% SLA through supported partners. VPN is over the internet, lower bandwidth and no 99.99% SLA.

Direct Peering is for Google services, no SLA. Carrier Peering is not a Google Cloud service.

Full explanation →
56
Multi-Selectmedium

A company wants to use Cloud Key Management Service (Cloud KMS) to manage encryption keys for multiple applications. They have the following requirements: 1) Keys must be automatically rotated every 90 days. 2) Different applications should have access only to their own keys. 3) All key operations must be logged for audit purposes. Which THREE steps should they take? (Choose three.)

Select 3 answers
A.Grant the roles/cloudkms.admin role to each application's service account
B.Enable Cloud Audit Logs for the Cloud KMS API
C.Store the keys in Cloud HSM
D.Create a key ring for each application
E.Set a rotation period of 90 days on each key
AnswersB, D, E

Audit logs capture all key operations for compliance.

Why this answer

Cloud KMS supports key rotation schedules, IAM for access control, and Cloud Audit Logs for logging.

Full explanation →
57
Multi-Selecteasy

Which two GCP audit log types are available by default? (Choose TWO).

Select 2 answers
A.Admin Activity audit logs
B.System Event audit logs
C.Cloud Audit Logs
D.Policy Denied audit logs
E.Data Access audit logs
AnswersA, B

Enabled by default, record administrative actions.

Why this answer

Admin Activity and System Event audit logs are enabled by default. Data Access logs must be explicitly enabled.

Full explanation →
58
Multi-Selecteasy

Which TWO statements are true about Cloud Load Balancing?

Select 2 answers
A.All load balancers require a regional forwarding rule.
B.Regional load balancing supports TCP/UDP traffic.
C.Global load balancing supports only HTTP/S traffic.
D.Internal load balancing is only for traffic within the same VPC.
E.Load balancers can be associated with instance groups in multiple regions.
AnswersB, E

Regional external load balancers (e.g., Network Load Balancer) support TCP and UDP.

Why this answer

Regional load balancing (such as the external regional TCP/UDP Network Load Balancer) operates at Layer 4 and supports TCP and UDP traffic, making option B correct. Additionally, global load balancers like the external HTTP(S), SSL Proxy, and TCP Proxy load balancers can be associated with instance groups in multiple regions, allowing traffic distribution across regions for high availability and low latency. This makes option E correct.

Options A, C, and D are incorrect because: A – not all load balancers require a regional forwarding rule (e.g., global load balancers use a global forwarding rule); C – global load balancers support not only HTTP/S but also TCP and UDP via the SSL Proxy and TCP Proxy load balancers; D – internal load balancing can also span across peered VPCs, not just the same VPC.

Exam trap

Google Cloud often tests the misconception that global load balancers only handle HTTP/S traffic, but in Google Cloud, global load balancers also support TCP and UDP via the global external proxy network load balancer, making option C a common trap.

Full explanation →
59
MCQeasy

A startup wants to deploy a containerised web application that auto-scales based on HTTP request traffic, with no infrastructure management. They expect unpredictable traffic spikes. Which compute service is most suitable?

A.Cloud Run
B.Compute Engine with managed instance groups
C.Cloud Functions
D.Google Kubernetes Engine (GKE) Autopilot
AnswerA

Cloud Run is ideal: serverless, auto-scaling based on HTTP traffic, pay-per-use, no infrastructure management.

Why this answer

Cloud Run is a fully managed serverless container platform that automatically scales to zero and can handle traffic spikes. It abstracts away infrastructure management. GKE requires cluster management even in Autopilot (though reduced).

Compute Engine requires manual scaling. Cloud Functions is for event-driven functions, not containerised web apps.

Full explanation →
60
Drag & Dropmedium

Drag and drop the steps to implement a disaster recovery plan using Cloud Storage and Cloud Functions in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Versioning protects against accidental deletion. The Cloud Function copies objects to the DR bucket.

Full explanation →
61
MCQeasy

A security team wants to ensure that all Compute Engine instances in a project are launched with a specific custom encryption key (CMEK) stored in Cloud KMS. What is the correct way to enforce this policy?

A.Set a service account with permissions to use the CMEK.
B.Use the organization policy constraint constraints/compute.requireCmek.
C.Create a firewall rule to block unencrypted traffic.
D.Configure the VPC Service Perimeter to block non-CMEK instances.
AnswerB

This constraint requires all persistent disks to be encrypted with a CMEK.

Why this answer

Using organization policy constraints, specifically constraints/compute.requireCmek, enforces that all new disks are encrypted with a CMEK from Cloud KMS. Other options do not enforce encryption at a project level.

Full explanation →
62
MCQeasy

A company uses Cloud SQL for MySQL to host its production database. The database experiences high read traffic. The team wants to improve read performance without modifying the application. What should they do?

A.Increase the number of CPUs on the primary Cloud SQL instance.
B.Use Cloud SQL Proxy with connection pooling.
C.Add read replicas and configure the application to use them for read queries.
D.Enable automatic storage increase to allow more data.
AnswerC

Read replicas distribute read load, improving performance without app changes.

Why this answer

Adding read replicas offloads read queries from the primary Cloud SQL instance, distributing the read load across multiple replicas. This improves read performance without any application code changes, as the application can be configured to direct read queries to the replica endpoints. Cloud SQL for MySQL replicas use asynchronous replication, ensuring near-real-time data consistency for read-heavy workloads.

Exam trap

The trap here is that candidates confuse scaling the primary instance (vertical scaling) with offloading reads via replicas (horizontal scaling), or they mistakenly believe Cloud SQL Proxy provides performance benefits when it is only a connectivity and security layer.

How to eliminate wrong answers

Option A is wrong because increasing CPUs on the primary instance only scales vertical capacity, which does not address high read traffic without modifying the application; it also increases cost and may hit instance limits. Option B is wrong because Cloud SQL Proxy is a secure connectivity tool that provides IAM-based authentication and encryption, not a connection pooler; it does not improve read performance or offload read traffic. Option D is wrong because enabling automatic storage increase only prevents out-of-disk errors by expanding storage capacity, which has no impact on read performance or query throughput.

Full explanation →
63
Multi-Selecthard

Which THREE are best practices for managing secrets (e.g., API keys, passwords) in Google Cloud? (Select exactly 3.)

Select 3 answers
A.Rotate secrets regularly and automatically where possible.
B.Encrypt secrets and store them in source code repositories.
C.Use Secret Manager to store and version secrets.
D.Grant access to secrets using IAM roles at the project or secret level.
E.Pass secrets as environment variables to Compute Engine instances.
AnswersA, C, D

Regular rotation reduces the risk of compromised secrets.

Why this answer

Regular, automated rotation of secrets limits the window of exposure if a secret is compromised. Secret Manager supports automatic rotation policies with a rotation period and next rotation time, and can trigger a Cloud Function or Cloud Run service to generate a new secret version, ensuring secrets are rotated without manual intervention.

Exam trap

Google Cloud often tests the misconception that encrypting secrets before storing them in code repositories is acceptable, when in fact any storage in source control violates the principle of separation of secrets from code, and that environment variables are a secure method for passing secrets to Compute Engine instances, whereas they are easily exposed through metadata endpoints or process inspection.

Full explanation →
64
MCQeasy

Your organization uses Cloud SQL for MySQL to host a production database. The database size is 500 GB. You need to create a read replica for reporting purposes. The read replica should be in a different region for disaster recovery. You have created the read replica in the us-west1 region. However, the replication lag is higher than expected, sometimes exceeding 5 minutes. What should you do to reduce replication lag?

A.Configure an external read replica using MySQL binary log replication.
B.Increase the disk size of the read replica.
C.Upgrade the primary instance to a higher machine type with more CPU and memory.
D.Decrease the backup window on the primary instance.
AnswerC

A higher machine type on the primary increases its ability to commit transactions and write to the binary log, which reduces replication lag. Also consider placing the replica in the same region if possible.

Why this answer

Replication lag in Cloud SQL for MySQL is often caused by the primary instance being unable to keep up with the write workload, especially when the replica is in a different region. Upgrading the primary to a higher machine type with more CPU and memory increases its capacity to process transactions and generate binary logs, reducing the backlog that causes lag. This directly addresses the root cause of high replication lag, unlike other options that target unrelated aspects.

Exam trap

Google Cloud often tests the misconception that replication lag is always a replica-side issue, leading candidates to focus on replica resources (disk size) or external configurations, when the real bottleneck is the primary's capacity to generate and send binary logs under heavy write load.

How to eliminate wrong answers

Option A is wrong because configuring an external read replica using MySQL binary log replication does not reduce lag; it introduces additional network latency and management overhead, and the lag issue is already present with a Cloud SQL replica. Option B is wrong because increasing the disk size of the read replica only provides more storage space, which does not affect replication lag; lag is caused by the primary's write throughput or network latency, not the replica's disk capacity. Option D is wrong because decreasing the backup window on the primary instance does not impact replication lag; backups are independent of the replication stream and do not affect binary log generation or transmission.

Full explanation →
65
MCQeasy

A company wants to analyze their Google Cloud spending and receive recommendations for rightsizing resources. Which tool provides this functionality?

A.BigQuery Reservations
B.Active Assist
C.Google Cloud Pricing Calculator
D.Cloud Billing reports
AnswerB

Active Assist provides cost optimization recommendations, including rightsizing.

Why this answer

Active Assist includes recommendations for rightsizing Compute Engine VMs, Cloud SQL instances, and more. BigQuery Reservations is for slot management. Cloud Billing reports show costs but not recommendations.

Pricing Calculator estimates costs.

Full explanation →
66
MCQhard

A company uses Cloud CDN to accelerate content delivery for their global user base. They notice a low cache hit ratio, and they also need to deliver personalized content based on user geolocation. What should they do?

A.Set appropriate Cache-Control headers and use cache keys including the 'User-Geo' header
B.Configure cache keys based on URL and query parameters
C.Use signed URLs for personalized content
D.Serve personalized content from the origin and use Cloud CDN only for static content
AnswerA

This enables caching per geography while personalizing.

Why this answer

Setting appropriate Cache-Control headers (e.g., s-maxage, private vs. public) allows Cloud CDN to cache content effectively, while including the 'User-Geo' header in cache keys enables the CDN to serve different cached responses based on the user's geolocation. This approach balances caching efficiency with personalized content delivery, as the CDN can cache a separate copy for each geographic region without requiring a cache miss for every request.

Exam trap

Google Cloud often tests the misconception that personalized content cannot be cached at all, leading candidates to choose Option D, but in reality, Cloud CDN can cache personalized content by using geolocation-based cache keys, which improves performance while still delivering region-specific responses.

How to eliminate wrong answers

Option B is wrong because configuring cache keys based solely on URL and query parameters does not account for geolocation-based personalization; it would serve the same cached content to all users regardless of location, failing to deliver personalized content. Option C is wrong because signed URLs are used for access control and authorization (e.g., restricting content to specific users or time windows), not for personalizing content based on geolocation; they do not improve cache hit ratio or handle geolocation-based differentiation. Option D is wrong because serving personalized content exclusively from the origin and using Cloud CDN only for static content defeats the purpose of using a CDN for dynamic personalization; it would increase latency and origin load, and does not leverage Cloud CDN's ability to cache region-specific responses.

Full explanation →
67
MCQhard

A team deployed the Terraform configuration shown in the exhibit. They observe that Cloud NAT is not translating traffic from the private subnet as expected. What is the most likely cause?

A.The Cloud Router is not in the same VPC network as the private subnet
B.The log filter is set to ERRORS_ONLY, which suppresses all logs
C.The NAT IP allocation is manual and no IPs were specified
D.The subnet is not included in the source_subnetwork_ip_ranges_to_nat list
AnswerA

Cloud NAT requires the router to be in the same VPC network as the subnet. If the router is in a different VPC, NAT will not work.

Why this answer

Cloud NAT requires a Cloud Router to be in the same VPC network as the subnet whose traffic needs translation. If the Cloud Router is in a different VPC network, the NAT gateway cannot establish the necessary BGP sessions or route traffic from the private subnet, causing NAT to fail silently.

Exam trap

Google Cloud often tests the requirement that Cloud Router must be in the same VPC as the NAT gateway and the private subnet, tempting candidates to focus on subnet inclusion or log settings instead of the cross-VPC routing dependency.

How to eliminate wrong answers

Option B is wrong because the log filter setting (ERRORS_ONLY) only affects which logs are sent to Cloud Logging; it does not prevent NAT from translating traffic. Option C is wrong because manual NAT IP allocation without specifying IPs would cause NAT to fail with a clear error, not silently fail to translate traffic. Option D is wrong because the source_subnetwork_ip_ranges_to_nat list controls which subnets are eligible for NAT, but the exhibit shows the subnet is included; the issue is the Cloud Router's VPC mismatch.

Full explanation →
68
MCQhard

A company deploys a Kubernetes workload in GKE that needs to access Cloud Storage. They want to avoid managing service account keys. What is the recommended approach?

A.Use the default Compute Engine service account on the node.
B.Store a service account key in a Kubernetes secret and mount it.
C.Use Workload Identity to map the Kubernetes service account to a GCP service account.
D.Use Cloud Key Management Service to encrypt the service account key.
AnswerC

Why this answer

Workload Identity allows you to bind a Kubernetes service account to a GCP service account, so pods can authenticate using the GCP service account without managing keys.

Full explanation →
69
MCQeasy

A developer is migrating a stateful application to GKE. The application requires persistent storage with high IOPS for a database. Which storage option is most suitable?

A.Local SSD
B.Persistent Disk SSD
C.Cloud Storage Fuse
D.Persistent Disk Standard
AnswerB

PD SSD offers high IOPS and persists data independently of node lifecycle.

Why this answer

Persistent Disk SSD (pd-ssd) is the most suitable option for a stateful database on GKE requiring high IOPS because it provides block storage with consistent, high-performance IOPS and can be dynamically provisioned via PersistentVolumeClaims. Unlike Local SSD, pd-ssd persists data independently of the node lifecycle, ensuring data durability during pod rescheduling or node failures.

Exam trap

Google Cloud often tests the misconception that Local SSD is suitable for stateful workloads because of its high IOPS, but the trap is that candidates forget Local SSD is ephemeral and does not survive pod rescheduling or node failures.

How to eliminate wrong answers

Option A is wrong because Local SSD provides high IOPS but is ephemeral—data is lost if the pod is rescheduled or the node is deleted, making it unsuitable for stateful databases that require persistent storage. Option C is wrong because Cloud Storage Fuse is a file-system interface for Cloud Storage objects, not a block device; it introduces latency and lacks the low-level IOPS consistency needed for database workloads. Option D is wrong because Persistent Disk Standard (pd-standard) uses HDD-based storage with significantly lower IOPS and higher latency, which cannot meet the high IOPS requirements of a database.

Full explanation →
70
MCQhard

A company has two on-premises data centers connected to Google Cloud via two Dedicated Interconnect connections (each 10 Gbps) from different providers. They want to achieve the highest availability for connectivity. Which configuration should they use?

A.Configure two VLAN attachments on each Interconnect with separate BGP sessions
B.Configure one VLAN attachment per Interconnect and use BGP with active/passive
C.Use a single VLAN attachment and rely on the second Interconnect as a backup
D.Configure each Interconnect with a single VLAN attachment and use Cloud Router with active/active BGP
AnswerA

This provides redundancy at both the connection and VLAN level, maximizing availability.

Why this answer

For highest availability, use two separate VLAN attachments on each Interconnect connection, with BGP sessions on each. This provides redundancy at multiple levels. Using a single VLAN attachment or single Interconnect reduces availability.

Cloud Router with active/passive is less optimal than active/active.

Full explanation →
71
MCQmedium

Your organization requires all container images deployed to GKE to be signed by an approved authority. Which service enforces that only signed images are allowed to run?

A.Binary Authorization
B.Cloud Asset Inventory
C.Artifact Registry
D.Container Analysis
AnswerA

Correct. Binary Authorization enforces image signing and attestation.

Why this answer

Binary Authorization enforces policies that require images to be signed by trusted authorities before they can be deployed on GKE.

Full explanation →
72
MCQmedium

A company is experiencing high latency in their VPC. They enabled VPC Flow Logs to capture metadata but need to analyze the logs for traffic patterns. Which Google Cloud service should they use to query and analyze VPC Flow Logs?

A.BigQuery
B.Cloud Storage
C.Cloud Logging
D.Cloud Monitoring
AnswerA

Exporting VPC Flow Logs to BigQuery allows powerful SQL analysis.

Why this answer

BigQuery is the correct service because VPC Flow Logs can be exported directly to BigQuery for querying and analyzing traffic patterns using SQL. BigQuery provides a serverless, highly scalable data warehouse that can handle large volumes of flow log metadata, enabling complex queries on source/destination IPs, ports, protocols, and packet counts. This allows the company to identify latency sources by analyzing traffic patterns over time.

Exam trap

The trap here is that candidates often confuse Cloud Logging (which can store and filter logs) with BigQuery (which is needed for complex SQL-based analysis), assuming that log storage alone is sufficient for deep traffic pattern queries.

How to eliminate wrong answers

Option B (Cloud Storage) is wrong because Cloud Storage is an object storage service for storing unstructured data, not a query engine; you would need additional tools like BigQuery or Dataproc to analyze the logs. Option C (Cloud Logging) is wrong because Cloud Logging is designed for real-time log ingestion, monitoring, and basic filtering, but it lacks the advanced SQL querying capabilities and scalability needed for deep traffic pattern analysis across large datasets. Option D (Cloud Monitoring) is wrong because Cloud Monitoring focuses on metrics, uptime checks, and alerting, not on querying raw log data like VPC Flow Logs.

Full explanation →
73
Drag & Dropmedium

Drag and drop the steps to configure IAM roles for a service account to access Cloud Storage from a Compute Engine instance into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The service account must be attached to the instance before it can be used. Granting roles is done on the service account.

Full explanation →
74
MCQeasy

A company uses Cloud SQL for PostgreSQL. They want to minimize downtime during maintenance. Which feature should they enable?

A.Read replicas.
B.High availability with a standby in another zone.
C.Point-in-time recovery.
D.Automated backups.
AnswerB

Provides automatic failover.

Why this answer

High availability (HA) with a standby in another zone ensures that Cloud SQL for PostgreSQL automatically fails over to a standby instance in a different zone if the primary zone experiences an outage. This minimizes downtime during maintenance because Cloud SQL performs a controlled failover to the standby, typically completing within a few seconds, rather than requiring a full instance restart or rebuild.

Exam trap

The trap here is that candidates often confuse read replicas with high availability, assuming read replicas can automatically take over for the primary, but read replicas require manual promotion and do not provide automatic failover, making HA with a standby the correct choice for minimizing downtime during maintenance.

How to eliminate wrong answers

Option A is wrong because read replicas are designed for offloading read traffic and do not provide automatic failover for the primary instance; they require manual promotion, which introduces downtime. Option C is wrong because point-in-time recovery (PITR) is used for restoring data to a specific timestamp after data corruption or accidental deletion, not for reducing downtime during planned maintenance. Option D is wrong because automated backups protect against data loss by creating periodic backups, but they do not provide a standby instance for failover, so maintenance still requires downtime to restart the primary instance.

Full explanation →
75
MCQmedium

An e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?

A.Implement column-level encryption using Cloud KMS in the application layer.
B.Grant DBAs the Cloud SQL Viewer role to restrict access to data.
C.Use Cloud SQL Proxy to encrypt connections and limit DBA access.
D.Use Cloud DLP with de-identification and re-identification transforms on the Cloud SQL database.
AnswerD

Cloud DLP can automatically detect and tokenize sensitive data, with re-identification for authorized apps.

Why this answer

Cloud DLP can be used to de-identify sensitive data like credit card numbers at rest in Cloud SQL, using deterministic or reversible transformations (e.g., format-preserving encryption or tokenization) that allow re-identification only by authorized applications. This approach minimizes application changes because DLP can scan and transform the data directly in the database, and the application can use re-identification transforms via the DLP API when needed, without modifying existing queries or schema.

Exam trap

The trap here is that candidates often confuse Cloud DLP's de-identification capabilities with simple encryption or access control, assuming that encrypting connections (Cloud SQL Proxy) or restricting IAM roles (Cloud SQL Viewer) protects data at rest from privileged users.

How to eliminate wrong answers

Option A is wrong because implementing column-level encryption in the application layer would require significant application code changes to encrypt and decrypt data, contradicting the requirement to minimize application changes. Option B is wrong because the Cloud SQL Viewer role only grants read-only access to instance metadata and logs, not to the actual data in the database; it does not prevent DBAs from querying tables directly if they have database-level access. Option C is wrong because Cloud SQL Proxy only encrypts connections in transit and does not restrict DBA access to the data at rest; DBAs can still connect and view plaintext credit card numbers.

Full explanation →

Page 1 of 13

Page 2

All pages

12345678910111213

Practice PCA by domain

Target a specific domain to shore up weak areas.

Managing Implementation and Ensuring Solution and Operations ReliabilityManaging and Provisioning a Solution InfrastructureDesigning for Security and ComplianceAnalysing and Optimising Technical and Business ProcessesDesign and plan a cloud solution architectureManage and provision cloud infrastructureDesign for security and complianceAnalyze and optimize technical and business processesManage implementation of cloud architectureEnsure solution and operations reliability
See all domains with question counts →