Courseiva

Google Professional Cloud Architect (PCA) — Questions 676750

955 questions total · 13pages · All types, answers revealed

Page 9

Page 10 of 13

Page 11
676
MCQhard

A company runs a streaming data pipeline using Dataflow to process real-time data and insert into BigQuery. Recently, workers are frequently failing with out-of-memory errors and the pipeline latency is increasing. What should they do to resolve the issue?

A.Increase the worker machine type and memory
B.Use Cloud Pub/Sub for buffering and then load into BigQuery in batches
C.Enable autoscaling and increase the maximum number of workers
D.Enable Dataflow Streaming Engine
AnswerD

Streaming Engine moves state to a backend service, reducing memory usage per worker.

Why this answer

Dataflow Streaming Engine offloads the streaming data processing state and shuffle data from worker memory to a backend service, reducing memory pressure on workers. This directly addresses out-of-memory errors and latency increases without requiring manual scaling or machine type changes. It is the recommended solution for streaming pipelines experiencing memory bottlenecks.

Exam trap

Google Cloud often tests the misconception that scaling up resources (more memory or more workers) is the primary fix for streaming pipeline memory issues, when the real solution is to offload state management using Streaming Engine.

How to eliminate wrong answers

Option A is wrong because simply increasing worker machine type and memory does not resolve the root cause of state management overhead in streaming pipelines; it only delays the failure and increases cost without optimizing data flow. Option B is wrong because adding Pub/Sub buffering does not fix the memory issue within Dataflow workers; it shifts the problem to a different layer and may introduce additional latency and complexity. Option C is wrong because enabling autoscaling and increasing max workers can help with throughput but does not reduce per-worker memory consumption; workers may still fail with OOM errors if the pipeline's state or shuffle data exceeds available memory.

677
MCQeasy

A startup runs a web application on Google Kubernetes Engine (GKE) with 3 replicas serving user traffic. They use Cloud SQL for the database. Recently, the application experienced intermittent timeouts during peak hours. Monitoring shows high CPU usage on the GKE nodes and increased database connection pool exhaustion. The team is looking for a cost-effective solution that minimizes architectural changes. The application is stateless. What should they do?

A.Add more nodes to the GKE cluster and enable cluster autoscaling
B.Increase the number of pod replicas and configure a connection pooler like PgBouncer for Cloud SQL
C.Vertically scale the GKE node pool to larger machine types and increase Cloud SQL tier
D.Set up a Cloud SQL read replica and route read queries to it
AnswerB

More pods distribute CPU load, and a connection pooler reduces database connections, addressing both issues cost-effectively.

Why this answer

The application is stateless and experiencing database connection pool exhaustion alongside high CPU on GKE nodes. Increasing pod replicas distributes the CPU load across more pods, while adding a connection pooler like PgBouncer reduces the number of direct connections to Cloud SQL, preventing pool exhaustion without requiring database tier changes. This approach is cost-effective because it optimizes existing resources rather than scaling infrastructure.

Exam trap

Google Cloud often tests the misconception that scaling compute resources (nodes or pods) alone fixes database connection issues, but the trap here is that connection pool exhaustion is a database-layer problem requiring a connection pooler, not just more application instances.

How to eliminate wrong answers

Option A is wrong because adding more nodes and enabling cluster autoscaling addresses node CPU pressure but does not solve database connection pool exhaustion, which is a separate bottleneck at the database layer. Option C is wrong because vertically scaling both the GKE node pool and Cloud SQL tier is expensive and over-provisions resources, whereas the real issue is connection management, not raw compute or database capacity. Option D is wrong because setting up a Cloud SQL read replica only helps with read-heavy workloads, but the problem is connection pool exhaustion and high CPU on GKE nodes, not read scaling; the application is stateless and the bottleneck is at the database connection layer, not query distribution.

678
MCQmedium

Refer to the exhibit. A Cloud Run service is experiencing high latency and returns 502 errors when traffic spikes. What should the team adjust first?

A.Decrease containerConcurrency to 10
B.Increase the maximum number of instances
C.Increase the CPU limit to 2000m
D.Increase the memory limit to 512Mi
AnswerA

Lowering concurrency reduces the number of simultaneous requests per container, preventing overload and 502s.

Why this answer

The 502 errors and high latency during traffic spikes indicate that the Cloud Run service is overwhelmed by concurrent requests. Decreasing `containerConcurrency` to 10 limits the number of simultaneous requests each container instance can handle, which reduces the likelihood of request timeouts and 502 errors by forcing Cloud Run to scale out more instances sooner. This directly addresses the root cause—excessive concurrency per container—without incurring additional cost or requiring code changes.

Exam trap

Google Cloud often tests the misconception that scaling out (increasing max instances) or scaling up (increasing CPU/memory) is the immediate fix for latency and errors, when the real issue is often the concurrency limit per container.

How to eliminate wrong answers

Option B is wrong because increasing the maximum number of instances does not fix the per-container overload; it only allows more instances to be created, but if each instance still handles too many concurrent requests, they will still time out and return 502 errors. Option C is wrong because increasing the CPU limit to 2000m may improve processing speed but does not reduce the number of concurrent requests each container must handle; the bottleneck is concurrency, not raw CPU. Option D is wrong because increasing the memory limit to 512Mi addresses out-of-memory issues, not the high latency and 502 errors caused by excessive concurrent request handling.

679
Drag & Dropmedium

Drag and drop the steps to migrate a Compute Engine VM to a different region using a snapshot into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Snapshots are global resources, but disks are regional. Create the disk in the target region, then create the VM.

680
MCQhard

A company manages secrets for multiple microservices using Secret Manager. They need to ensure that each service can access only its own secrets, and that all access is logged. What is the best IAM architecture?

A.Create custom roles with secrets.get permission and bind to each service account at the individual secret resource.
B.Grant each service account the roles/secretmanager.secretAccessor role at the project level.
C.Use a single service account for all microservices with access to all secrets.
D.Grant each service account the roles/secretmanager.admin role at the secret level.
AnswerA

Custom roles allow fine-grained access; binding at secret level ensures least privilege.

Why this answer

It follows the principle of least privilege by binding custom roles with the `secrets.get` permission at the individual secret resource level, ensuring each microservice can only access its own secrets. This also enables fine-grained access control and logging, as Secret Manager audit logs capture each access attempt per secret and service account. By using a custom role, you avoid granting unnecessary permissions like `list` or `create`, which are included in predefined roles.

Exam trap

In Google PCA, candidates often mistakenly apply predefined roles at the project level, assuming it provides sufficient isolation. However, granting `roles/secretmanager.secretAccessor` at the project level allows each service account to access all secrets in the project, violating the requirement for per-service isolation. The correct approach is to bind a custom role with only the `secrets.get` permission at the individual secret resource level, enabling fine-grained access control and logging.

How to eliminate wrong answers

Option B is wrong because granting `roles/secretmanager.secretAccessor` at the project level gives each service account access to all secrets in the project, violating the requirement that each service can access only its own secrets. Option C is wrong because using a single service account for all microservices provides no isolation; any compromised service would gain access to all secrets, and audit logs would not distinguish which microservice accessed which secret. Option D is wrong because `roles/secretmanager.admin` includes administrative permissions (e.g., create, delete, update secrets) that are excessive for read-only access, and binding at the secret level still grants broader permissions than needed, increasing the attack surface.

681
Multi-Selecteasy

What are two best practices for designing a scalable Kubernetes architecture on GKE?

Select 2 answers
A.Use StatefulSets for stateless applications
B.Disable Cluster Autoscaler
C.Enable horizontal pod autoscaling
D.Use node pools with different machine types
E.Use a single zone cluster
AnswersC, D

Auto-scales pods based on metrics.

Why this answer

Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU/memory utilization or custom metrics, which is essential for handling variable workloads in a scalable Kubernetes architecture on GKE. HPA works by querying the Metrics Server and adjusting the `replicas` field in the Deployment or StatefulSet, ensuring efficient resource usage without manual intervention.

Exam trap

Google Cloud often tests the misconception that StatefulSets are interchangeable with Deployments for stateless apps, or that disabling Cluster Autoscaler simplifies management, but the trap here is that candidates may overlook the need for multi-zonal clusters and autoscaling mechanisms to achieve true scalability and resilience in GKE.

682
MCQmedium

After a data corruption incident, a company needs to restore their Cloud SQL for PostgreSQL instance from a backup. What is the correct procedure to minimize downtime?

A.Restore the backup directly to the existing Cloud SQL instance
B.Create a new instance from the backup, then rename and delete the old instance
C.Use point-in-time recovery to restore to a time before corruption
D.Export the backup to Cloud Storage and import into the existing instance
AnswerA

Cloud SQL supports restoring from backup to the same instance with minimal steps.

Why this answer

Restoring a backup directly to the existing Cloud SQL instance is the fastest method to minimize downtime because it overwrites the current data in-place without requiring DNS propagation, connection string changes, or reconfiguration of applications. Cloud SQL supports in-place restore from automated or on-demand backups, which typically completes within minutes for most instance sizes, as the operation leverages the underlying storage layer to apply the backup snapshot directly to the existing persistent disk.

Exam trap

Google Cloud often tests the misconception that creating a new instance and renaming it is the standard recovery procedure, but the trap here is that candidates overlook the additional downtime caused by DNS propagation and connection string updates, making the direct in-place restore the correct choice for minimizing downtime.

How to eliminate wrong answers

Option B is wrong because creating a new instance from the backup, then renaming and deleting the old instance introduces significant additional downtime due to the time required for provisioning a new instance, DNS propagation (which can take up to 5 minutes or more), and the need to update application connection strings or IP addresses. Option C is wrong because point-in-time recovery (PITR) is used for transactional log replay to restore to a specific timestamp, but it requires that write-ahead logs (WAL) are still available and is not the correct procedure for restoring from a backup after data corruption; PITR is typically slower and more complex than a direct backup restore. Option D is wrong because exporting a backup to Cloud Storage and then importing it into the existing instance is a multi-step, time-consuming process that involves exporting the database dump (e.g., using pg_dump), uploading to Cloud Storage, and then running an import operation (e.g., using psql or the Cloud SQL import feature), which can take hours for large databases and is not designed for minimizing downtime.

683
MCQeasy

A startup is building a mobile app backend that requires real-time data synchronization across multiple users. They need a fully managed, serverless NoSQL database that scales automatically and supports offline persistence. Which database should they choose?

A.Cloud Spanner
B.Cloud Bigtable
C.Cloud SQL
D.Cloud Firestore
AnswerD

Firestore provides real-time updates, offline persistence, and automatic scaling, making it ideal for mobile app backends.

Why this answer

Firestore is a serverless NoSQL document database designed for mobile apps with real-time sync, offline support, and automatic scaling. Cloud Bigtable is for high-throughput time-series data, not mobile. Cloud SQL is relational and not serverless.

Cloud Spanner is globally distributed relational, overkill for a mobile app backend.

684
MCQhard

A company is using BigQuery for analytics and wants to optimize query costs. They have many ad-hoc queries that scan large tables. What is the best practice?

A.Use clustering and partitioning on tables.
B.Use flat-rate pricing.
C.Use BI Engine.
D.Use materialized views.
AnswerA

Clustering and partitioning organize data to minimize scanned bytes, lowering per-query cost.

Why this answer

Clustering and partitioning reduce the amount of data scanned by BigQuery for each query, directly lowering query costs (which are based on bytes processed). Partitioning allows queries to skip entire partitions based on a date or timestamp column, while clustering sorts data within partitions, enabling block-level pruning for filter predicates. This is the most effective and scalable way to optimize ad-hoc queries on large tables without changing the query logic.

Exam trap

Google Cloud often tests the misconception that flat-rate pricing or BI Engine directly reduce per-query costs, when in fact they address capacity or latency, not the fundamental cost driver of bytes scanned.

How to eliminate wrong answers

Option B is wrong because flat-rate pricing (slot-based reservations) does not reduce the amount of data scanned; it only provides predictable costs for a fixed number of slots, and ad-hoc queries still incur slot usage but do not reduce per-query bytes processed. Option C is wrong because BI Engine is an in-memory acceleration service for interactive dashboards and repeated queries, not for optimizing ad-hoc analytical queries that scan large tables; it caches results but does not reduce scan bytes for new queries. Option D is wrong because materialized views precompute and store query results, which can speed up repeated queries but do not help with arbitrary ad-hoc queries that may not match the view definition; they also incur storage costs and require maintenance.

685
MCQmedium

A company wants to use their existing Active Directory for authentication to Google Cloud. They need to sync user and group identities to Cloud Identity and allow users to log in with their corporate credentials. Which two services should they use together?

A.Cloud Directory Sync and Workload Identity
B.Cloud Directory Sync and SAML SSO
C.SAML SSO and IAP
D.Cloud Identity and IAP
AnswerB

CDS syncs identities, and SAML SSO enables authentication with corporate credentials.

Why this answer

Cloud Directory Sync (CDS) syncs users and groups from LDAP/AD to Cloud Identity. SAML SSO allows users to authenticate using their corporate credentials. IAP is for application access, not directory sync.

Cloud Identity as a standalone does not sync automatically. Workload Identity is for Kubernetes.

686
MCQmedium

A data science team wants to run training jobs on a GKE cluster. The jobs are resource-intensive and can tolerate interruptions. To reduce costs, the team wants to use preemptible VMs for the node pool. Which additional step should they take to ensure training jobs are not lost when nodes are preempted?

A.Use a PodDisruptionBudget
B.Set up a Cloud Scheduler job to recreate nodes
C.Enable cluster autoscaler on the node pool
D.Configure a Vertical Pod Autoscaler
AnswerC

Cluster autoscaler will automatically add replacement nodes when preemptible VMs are terminated.

Why this answer

A cluster autoscaler with a node pool of preemptible VMs will replace preempted nodes. For job resilience, the application should be designed to handle interruptions, but at the infrastructure level, enabling cluster autoscaler ensures new nodes are added.

687
MCQmedium

An e-commerce platform uses Cloud SQL for PostgreSQL to serve product catalog data. As traffic grows, the database experiences high connection overhead and latency spikes. The team wants to reduce connection overhead and improve performance without changing application code. Which solution should they implement?

A.Use Memorystore (Redis) to cache database queries.
B.Migrate to Cloud Spanner for better scalability.
C.Use Cloud SQL Auth Proxy with connection pooling enabled.
D.Increase the maximum connections setting in Cloud SQL to handle more concurrent connections.
AnswerA

Memorystore (Redis) caches query results, reducing database load, but does not address connection overhead. Caching is not the solution to high connection overhead.

Why this answer

Memorystore (Redis) caches database query results, reducing the number of queries hitting Cloud SQL. This lowers connection overhead because fewer connections are opened, and improves latency by serving repeated queries from an in-memory cache. No application code changes are needed if the caching layer is deployed as an intermediary.

Option C is incorrect because Cloud SQL Auth Proxy only provides secure connectivity and does not perform connection pooling; a dedicated pooler like PgBouncer would be required.

Exam trap

Candidates may assume that increasing max connections solves connection overhead, but it actually increases contention. Connection pooling reuses connections, reducing overhead.

688
MCQhard

A company wants to enforce that only container images built and signed by their CI/CD pipeline can be deployed in their GKE cluster. Which Google Cloud service should they use?

A.Artifact Analysis
B.Binary Authorization
C.Cloud Audit Logs
D.Cloud Security Command Center
AnswerB

Binary Authorization enforces deployment policies based on image signatures.

Why this answer

Binary Authorization enforces that only trusted images (signed by authorities) are deployed. It integrates with GKE and Cloud Build to verify signatures.

689
MCQhard

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) across three zones in us-central1. The application uses a Cloud Spanner database. Recently, the application experienced increased latency and timeouts during peak hours. The operations team noticed that the MIG's CPU utilization is consistently above 80% during peak hours, and the autoscaler is configured to scale based on CPU utilization with a target of 60%. However, the autoscaler is not adding new instances quickly enough, causing performance degradation. The team also observed that new instances take over 5 minutes to become healthy and serve traffic. The health check is a simple TCP check on port 8080. The application startup script downloads large configuration files from Cloud Storage. What should the team do to improve the autoscaling response time and reduce latency?

A.Increase the minimum number of instances in the MIG to handle peak load.
B.Reduce the autoscaler target CPU utilization to 40% so it scales earlier.
C.Create a custom Compute Engine image that includes the application and configuration, and use it in the MIG.
D.Change the health check to HTTP and reduce the initial delay and check intervals.
AnswerC

Custom image reduces startup time, allowing faster scaling.

Why this answer

The primary bottleneck is the long instance startup time (over 5 minutes) caused by downloading large configuration files from Cloud Storage at boot. By creating a custom Compute Engine image that bakes the application and configuration into the image, new instances can start serving traffic almost immediately, drastically reducing the time before they become healthy and the autoscaler can consider them in scaling decisions. This directly addresses the root cause of slow autoscaling response, as the autoscaler cannot add instances faster than they become healthy.

Exam trap

The trap here is that candidates focus on tuning the autoscaler parameters (CPU target, health check intervals) rather than identifying the actual bottleneck—the instance startup time—which is a common misconception that autoscaling speed is purely a function of scaling policy settings.

How to eliminate wrong answers

Option A is wrong because increasing the minimum number of instances only handles baseline load, not the dynamic scaling speed during peak hours; it does not fix the slow instance startup time that delays autoscaler response. Option B is wrong because reducing the target CPU utilization to 40% would cause the autoscaler to trigger earlier, but it still cannot add instances faster than the 5-minute startup delay; it would only increase the number of pending instances without improving latency. Option D is wrong because changing the health check to HTTP and reducing intervals only affects how quickly the MIG detects an instance as healthy after it starts, but the fundamental problem is the 5-minute startup time itself—no health check tuning can make the instance boot faster.

690
MCQhard

An organization has a security policy that prohibits the use of external IP addresses on Compute Engine instances to reduce attack surface. They want to enforce this policy across all new and existing projects. Which approach should they use?

A.Use Organization Policy with constraint compute.vmExternalIpAccess
B.Use IAM conditions to prevent creation of instances with external IPs
C.Use Cloud Security Command Center to detect and alert on external IPs
D.Use VPC Firewall rules to block traffic to external IPs
AnswerA

This constraint explicitly prevents creation of VMs with external IPs and can be applied at org level.

Why this answer

The Organization Policy constraint `compute.vmExternalIpAccess` is the correct approach because it allows you to set a policy at the organization, folder, or project level that denies the assignment of external IP addresses to Compute Engine instances. This policy is enforced at resource creation time and applies to all new and existing VM instances, ensuring compliance with the security policy across the entire resource hierarchy. It directly prevents the use of external IPs, reducing the attack surface without requiring per-project or per-instance configuration.

Exam trap

The trap here is that candidates often confuse IAM conditions (which control who can perform an action) with Organization Policy constraints (which control what actions are allowed), leading them to choose IAM conditions as a preventive control when they only provide authorization-level restrictions, not resource-level enforcement.

How to eliminate wrong answers

Option B is wrong because IAM conditions can restrict who can create instances with external IPs, but they do not prevent the actual assignment of external IPs; a user with the compute.instances.create permission could still create an instance with an external IP if the condition is not properly scoped, and IAM conditions do not enforce the policy on existing instances. Option C is wrong because Cloud Security Command Center (SCC) is a detection and alerting tool that identifies misconfigurations after they occur, but it does not proactively enforce or prevent the use of external IPs; it only provides visibility and remediation recommendations. Option D is wrong because VPC Firewall rules control traffic to and from IP addresses, but they cannot prevent a VM from being assigned an external IP address; a VM with an external IP will still have that IP regardless of firewall rules, and firewall rules do not block the IP assignment itself.

691
MCQmedium

A company wants to use its existing Active Directory credentials to authenticate users to the GCP Console. Which service should they integrate with?

A.Identity-Aware Proxy
B.Cloud Identity with SAML SSO
C.Cloud KMS
D.Cloud Directory Sync
AnswerB

Cloud Identity supports SAML SSO with AD as an identity provider for GCP Console access.

Why this answer

Cloud Identity can federate with Active Directory via SAML or OIDC, allowing users to sign in with their AD credentials.

692
MCQmedium

A security engineer wants to configure Identity-Aware Proxy (IAP) for an HTTPS load-balanced application to enforce zero-trust access. Users will authenticate with their Google accounts. What is the minimum set of IAM roles needed for a user to access the application behind IAP?

A.roles/iam.serviceAccountUser
B.roles/iap.tunnelResourceAccessor
C.roles/iap.httpsResourceAccessor
D.roles/compute.viewer
AnswerC

roles/iap.httpsResourceAccessor (IAP-secured Web App User) is the correct role for accessing HTTPS applications behind IAP.

Why this answer

To access an application protected by IAP over HTTPS, a user must have the IAP-secured Web App User role (roles/iap.httpsResourceAccessor) on the resource. This role grants permission to access the resource through IAP. The other roles are not sufficient: roles/iam.serviceAccountUser is for managing service accounts, roles/iap.tunnelResourceAccessor is for TCP forwarding, and roles/compute.viewer only allows viewing Compute Engine resources, not accessing the application.

693
Multi-Selectmedium

An organization wants to ensure that all Compute Engine instances in a project are patched with the latest security updates. They also want to enforce a custom configuration (e.g., disable root SSH login) across all instances. Which TWO Google Cloud services should they use together?

Select 2 answers
A.Cloud Monitoring
B.OS Config patch management
C.Cloud Deployment Manager
D.OS Config OS policies
E.Cloud Asset Inventory
AnswersB, D

Patch management automates OS patching across instances.

Why this answer

OS Config's patch management handles patching, and OS policies enforce configurations like disabling root login. Cloud Monitoring monitors but does not patch; Cloud Asset Inventory discovers resources; Deployment Manager is for infrastructure-as-code, not ongoing configuration.

694
Multi-Selecthard

Which THREE actions can help reduce costs for a BigQuery workload that runs frequent, ad-hoc analytical queries on a large dataset?

Select 3 answers
A.Enable automatic schema detection to avoid manual schema definition.
B.Partition the table by a date or timestamp column.
C.Create materialized views for common aggregation queries.
D.Use clustering on columns frequently used in filter clauses.
E.Use flat-rate pricing with reserved slots.
AnswersB, C, D

Partitioning allows query pruning, scanning only relevant partitions.

Why this answer

Partitioning the table by a date or timestamp column (Option B) reduces the amount of data scanned by BigQuery for queries that filter on that column, directly lowering query costs (pay-per-byte model). It also improves performance by pruning irrelevant partitions, making it a core cost-saving technique for ad-hoc analytical workloads.

Exam trap

Google Cloud often tests the distinction between cost-reduction techniques that reduce bytes scanned (partitioning, clustering, materialized views) versus pricing model choices (flat-rate vs. on-demand), leading candidates to mistakenly select flat-rate pricing as a cost-saving action for ad-hoc queries.

695
MCQeasy

A startup is migrating its on-premises MySQL database (5 TB) to Cloud SQL. The database is mission-critical and downtime must be minimized. Which migration service should they use to reduce downtime?

A.Transfer Appliance
B.gcloud sql import command
C.Storage Transfer Service
D.Database Migration Service (DMS)
AnswerD

DMS supports continuous replication for minimal downtime migration.

Why this answer

Database Migration Service (DMS) supports continuous replication from on-premises MySQL to Cloud SQL, minimizing downtime. Other options like Transfer Appliance or Storage Transfer Service are for file transfers, not live databases.

696
Multi-Selecthard

A company uses Cloud CDN to accelerate content delivery. They notice that some users receive stale content even after purging the cache. Which THREE factors could cause this?

Select 3 answers
A.The content is compressed with gzip.
B.The purge request did not complete successfully.
C.The content was cached at multiple edge locations and not all were purged.
D.The CDN is configured with signed URLs.
E.The origin server returns a long Cache-Control: max-age header, causing the CDN to ignore the purge.
AnswersB, C, E

Failed purge operations leave stale cache intact.

Why this answer

A purge request that does not complete successfully will leave cached content intact, causing users to receive stale data. Cloud CDN processes purge requests asynchronously, and if the request fails (e.g., due to network issues or invalid paths), the cache is not invalidated. This directly explains why stale content persists despite an attempted purge.

Exam trap

Google Cloud often tests the misconception that a purge is instantaneous and global, leading candidates to overlook that incomplete or failed purge requests can leave stale content at some edge locations.

697
MCQmedium

A company is using Cloud CDN to accelerate content delivery. They notice increased costs from cache misses. What can they do?

A.Pre-cache popular content.
B.Use a larger cache size.
C.Increase cache TTL.
D.Use compression.
AnswerA

Pre-caching ensures popular content is always in the cache, reducing misses and cost.

Why this answer

Pre-caching popular content ensures that the most frequently requested objects are already stored in Cloud CDN edge caches before users request them. This directly reduces cache misses because the content is proactively loaded, eliminating the need for the first user to trigger a fetch from the origin. By targeting high-demand assets, you minimize origin requests and lower the cost associated with cache misses.

Exam trap

Google Cloud often tests the misconception that increasing cache TTL or cache size can fix cache misses, when in reality these settings only affect how long content stays fresh or how much can be stored, not whether the content is present in the first place.

How to eliminate wrong answers

Option B is wrong because cache size in Cloud CDN is not a configurable parameter; the service automatically manages cache storage based on usage and does not allow manual resizing, so increasing cache size is not a valid action. Option C is wrong because increasing cache TTL (Time-To-Live) only extends how long a cached object is considered fresh, but it does not address the root cause of cache misses—objects that are not in the cache at all will still miss regardless of TTL. Option D is wrong because compression reduces the size of objects transferred but does not affect cache hit ratio; it can even increase CPU load at the origin and edge without preventing cache misses.

698
MCQmedium

A company is using Cloud Load Balancing with backend services across multiple regions. They notice that traffic is not being evenly distributed and some backends are overloaded. Which configuration should they check?

A.Session affinity settings
B.Firewall rules
C.Cloud CDN caching
D.Health check frequency
AnswerA

Sticky sessions can lead to uneven load distribution.

Why this answer

Session affinity (sticky sessions) directs all requests from a single client to the same backend instance. If enabled, this can cause uneven load distribution because certain clients may generate disproportionately more traffic, overloading their pinned backends while others remain underutilized. Disabling or properly configuring session affinity allows the load balancer to distribute requests based on its default algorithm (e.g., round-robin or least-connections), improving balance across backends.

Exam trap

Google Cloud often tests the misconception that health checks or firewall rules are responsible for load distribution, when in fact session affinity is the primary configuration that can cause uneven traffic patterns by overriding the default balancing algorithm.

How to eliminate wrong answers

Option B is wrong because firewall rules control allowed traffic to/from backends but do not influence how the load balancer distributes incoming requests among healthy instances. Option C is wrong because Cloud CDN caching reduces load on backends by serving cached content at edge locations, but it does not affect the distribution of requests that reach the load balancer's backend pool. Option D is wrong because health check frequency determines how often the load balancer probes backend health, affecting failover speed but not the balancing algorithm or distribution of traffic among healthy backends.

699
MCQmedium

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

A.BigQuery
B.Firestore
C.Cloud Bigtable
D.Cloud Spanner
AnswerC

Bigtable is the correct choice: wide-column NoSQL, designed for time-series and IoT, single-digit ms latency, scales to millions of QPS.

Why this answer

Cloud Bigtable is designed for petabyte-scale, low-latency, high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is an analytics warehouse with seconds-to-minutes latency, Cloud SQL is for OLTP with limited QPS, and Firestore is for document data with hierarchical structure.

700
MCQmedium

A healthcare SaaS provider runs workloads in Google Cloud and needs to comply with HIPAA. They use Cloud SQL for PostgreSQL and want to encrypt data at rest with customer-managed encryption keys (CMEK). Which steps must they take?

A.Create a Cloud KMS key ring and key, then specify the key when creating the Cloud SQL instance
B.Use customer-supplied encryption keys (CSEK) by uploading your own key material
C.Enable CMEK in the Cloud SQL instance's settings after creation
D.Create a Cloud HSM key and grant the Cloud SQL service account access to it
AnswerA

This is the correct process for CMEK in Cloud SQL.

Why this answer

Cloud SQL for PostgreSQL supports CMEK only at instance creation time. You must first create a Cloud KMS key ring and key in the same region as the instance, then specify that key when creating the Cloud SQL instance. This ensures that the data at rest is encrypted with a customer-managed key, meeting HIPAA compliance requirements for control over encryption keys.

Exam trap

The trap here is that candidates often assume CMEK can be enabled after instance creation (like enabling encryption on a bucket) or confuse CMEK with CSEK, but Cloud SQL requires the key to be specified at creation time and does not support post-creation encryption changes.

How to eliminate wrong answers

Option B is wrong because CSEK (customer-supplied encryption keys) is not supported for Cloud SQL; it is used only with Compute Engine and Cloud Storage, and it requires you to manage key material outside of Google Cloud, which does not meet the CMEK requirement. Option C is wrong because CMEK cannot be enabled after creation; Cloud SQL requires the key to be specified at instance creation time, and you cannot change the encryption key later. Option D is wrong because while Cloud HSM can be used as a key source for CMEK, simply creating a Cloud HSM key and granting the Cloud SQL service account access is insufficient; you must also create a key ring and key in Cloud KMS (or HSM) and specify that key during instance creation, and the service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role, not just any access.

701
MCQeasy

A media company wants to serve publicly available images and videos to a global audience with low latency. Which Google Cloud service should they primarily use?

A.Cloud Storage with public bucket serving the files.
B.Cloud CDN with Cloud Storage as the origin.
C.Cloud Run with a container that serves the files.
D.Compute Engine with an HTTP server.
AnswerB

Cloud CDN caches content from Cloud Storage at edge locations, reducing latency for global users.

Why this answer

Cloud CDN with Cloud Storage as the origin is the correct choice because it uses Google's global edge cache to serve publicly available images and videos from Cloud Storage, minimizing latency for a global audience. Cloud CDN caches content at edge locations worldwide, reducing the round-trip time to the origin bucket, while Cloud Storage provides scalable, durable object storage. This combination is purpose-built for delivering static content with low latency and high throughput.

Exam trap

The trap here is that candidates often choose Cloud Storage with a public bucket (Option A) because it seems simplest, overlooking that Cloud CDN is required to achieve global low-latency delivery by caching content at edge locations.

How to eliminate wrong answers

Option A is wrong because a public Cloud Storage bucket serves files directly from the bucket's regional location, which does not provide global edge caching, resulting in higher latency for users far from the bucket's region. Option C is wrong because Cloud Run is a serverless compute platform designed for running containerized applications, not optimized for serving static files at scale; it lacks built-in edge caching and would incur unnecessary compute costs and cold-start latency. Option D is wrong because Compute Engine with an HTTP server requires manual scaling, maintenance, and lacks integrated global caching, making it inefficient and costly for serving static content to a global audience compared to a managed CDN solution.

702
MCQhard

A financial services company is migrating a monolithic Java application to Google Kubernetes Engine (GKE) for improved scalability and reliability. The application serves real-time trading data and has strict latency requirements. Post-migration, the team observes frequent pod restarts due to OutOfMemory (OOM) errors, increased latency during peak trading hours, and occasional database connection timeouts. The current setup uses a single GKE cluster with a node pool of n1-standard-4 machines, a stateless application deployed as a Deployment with resource requests and limits set to 512 Mi memory and 1 CPU. The database is a Cloud SQL PostgreSQL instance with 2 vCPUs and 7.5 GB memory, and applications connect using a hardcoded connection string. The team wants to ensure reliable operation under load and during node maintenance events. Which course of action best addresses the reliability issues?

A.Adjust resource requests to 1 Gi memory and 2 CPU, set limits to 2 Gi and 4 CPU, create an HPA based on a custom metric (e.g., requests per second), enable cluster autoscaler, implement Cloud SQL connection pooling via Cloud SQL Auth Proxy with a max connection pool size, and configure PDB with maxUnavailable 1.
B.Enable GKE node auto-upgrade, configure Pod Disruption Budgets (PDB) with minAvailable 1, and set readiness probes to check application health.
C.Migrate the database to a StatefulSet in GKE with persistent volumes, increase node count to 10, and enable cluster autoscaler.
D.Increase memory limits to 2 Gi and CPU to 2, add Horizontal Pod Autoscaler (HPA) based on CPU utilization, and implement connection pooling using Cloud SQL Auth Proxy.
AnswerA

Correctly addresses all issues: resource tuning for OOM, custom metric HPA for load, cluster autoscaler for capacity, connection pooling for timeouts, and PDB for maintenance.

Why this answer

Best addresses all reliability issues. Adjusting resource requests to 1 Gi memory and 2 CPU ensures proper scheduling, while limits of 2 Gi and 4 CPU prevent OOM errors. The HPA based on custom metrics (e.g., requests per second) scales pods proactively during peak trading hours.

Cluster autoscaler handles node capacity, and Cloud SQL connection pooling via Cloud SQL Auth Proxy with a max pool size prevents database connection timeouts. Finally, a PDB with maxUnavailable 1 ensures availability during node maintenance. Option B misses resource tuning, autoscaling, and connection pooling.

Option C unnecessarily moves the database to GKE, increasing complexity and losing managed DB benefits. Option D lacks custom metric HPA, cluster autoscaler, and PDB, leaving gaps in scalability and maintenance handling.

703
MCQmedium

Your team manages a service with a 99.9% uptime SLO over a 30-day window. The error budget for this period is 43 minutes. In the first week, outages consumed 30 minutes of the budget. You are planning a new release. What should you do?

A.Reduce the SLO to 99.8% to increase the error budget.
B.Proceed with the release because the remaining budget is sufficient.
C.Delay the release and focus on improving reliability to rebuild the error budget.
D.Release the feature but only to a small percentage of users.
AnswerC

Conservative approach: wait until more error budget is earned (e.g., through flawless operation) before releasing.

Why this answer

With only 13 minutes of error budget remaining after the first week, proceeding with the release (Option B) risks exhausting the budget entirely from any unforeseen issues, violating the 99.9% SLO. Delaying the release (Option C) allows the team to focus on reliability improvements, such as implementing canary deployments, adding circuit breakers, or enhancing monitoring with tools like Prometheus and Grafana, to rebuild the error budget over the remaining 23 days. This aligns with the principle of using error budgets to balance innovation with reliability, as defined in Google's SRE practices.

Exam trap

Google Cloud often tests the misconception that a canary release (Option D) is always safe, but the trap here is that it still consumes error budget and does not solve the underlying reliability deficit when the budget is already critically low.

How to eliminate wrong answers

Option A is wrong because reducing the SLO to 99.8% would increase the error budget to 86.4 minutes, but this is a reactive measure that lowers the reliability target rather than addressing the root cause of the outages; it also violates the principle of maintaining a consistent SLO commitment to customers. Option B is wrong because proceeding with the release with only 13 minutes of error budget left is reckless—any minor incident could exhaust the budget, leading to SLO violations and potential service credits or customer dissatisfaction, especially since the first week already consumed 70% of the budget. Option D is wrong because releasing to a small percentage of users (e.g., a canary deployment) is a valid risk mitigation strategy, but it does not address the fact that the error budget is nearly depleted; even a small-scale release could introduce bugs that consume the remaining budget, and the team should first stabilize the service before any new changes.

704
MCQmedium

A company is migrating a legacy monolithic application to Google Cloud. The application runs on a single VM and uses a local MySQL database. The goal is to minimize changes to the application code while improving availability. Which strategy should the company use?

A.Use a managed instance group for the application VM and store the database on a persistent disk attached to the primary instance.
B.Re-architect the application into microservices and use Cloud Run for stateless components.
C.Lift and shift the VM to Compute Engine, and migrate the database to Cloud SQL with a failover replica.
D.Containerize the application and deploy on Google Kubernetes Engine (GKE) with Cloud Spanner as the database.
AnswerC

Minimal code changes, uses managed database with high availability.

Why this answer

It minimizes code changes by lifting the application VM to Compute Engine as-is, while migrating the local MySQL database to Cloud SQL with a failover replica. This improves availability through Cloud SQL's managed automatic failover to a standby replica in a different zone, without requiring application code changes to the database connection logic (the application can continue using the same MySQL protocol).

Exam trap

The trap here is that candidates often choose Option A, mistakenly believing that a managed instance group with a persistent disk provides database high availability, but they overlook that the persistent disk cannot be shared across instances in a managed instance group without additional orchestration (e.g., regional persistent disks or a clustered filesystem), and the database process itself is not automatically failed over.

How to eliminate wrong answers

Option A is wrong because storing the database on a persistent disk attached to a single instance in a managed instance group does not provide high availability for the database; if the primary instance fails, the persistent disk cannot be attached to a new instance without manual intervention, and the database state is lost or requires complex recovery. Option B is wrong because re-architecting into microservices and using Cloud Run requires significant application code changes, contradicting the goal of minimizing changes to the application code. Option D is wrong because containerizing and deploying on GKE with Cloud Spanner requires substantial application code changes (Cloud Spanner uses a different SQL dialect and connection protocol than MySQL) and introduces unnecessary complexity, violating the requirement to minimize code changes.

705
MCQeasy

A startup deploys a web application on Compute Engine instances behind an HTTP load balancer. They need to handle unpredictable spikes in traffic with minimal operational overhead. What is the simplest scaling approach?

A.Set up a Kubernetes cluster with horizontal pod autoscaling
B.Use a managed instance group with autoscaling based on CPU utilization
C.Migrate the application to Cloud Run
D.Add more instances manually during peak hours
AnswerB

This is the simplest approach; it scales automatically with minimal configuration.

Why this answer

Using a managed instance group with autoscaling automatically adds/removes instances based on demand, requiring minimal manual intervention. Other options either require more complex setup or are not optimal.

706
MCQmedium

A company wants to implement a CI/CD pipeline for a microservices application on GKE. They require automated canary deployments with gradual traffic shifting and automatic rollback on metric failure. Which Google Cloud service is most suitable?

A.Cloud Deploy with Skaffold.
B.Cloud Build with Deployment Manager.
C.Spinnaker on GKE.
D.Istio with manual traffic management.
AnswerA

Cloud Deploy provides built-in canary strategies and automatic rollback when combined with Skaffold.

Why this answer

Cloud Deploy with Skaffold is the most suitable because it provides native support for progressive delivery on GKE, including automated canary deployments with gradual traffic shifting (using Service Mesh or Ingress) and automatic rollback based on Cloud Monitoring metrics. Skaffold handles the build and deploy configuration, while Cloud Deploy manages the rollout pipeline, approval gates, and metric-driven rollback logic without requiring manual intervention.

Exam trap

The trap here is that candidates often confuse a traffic management tool (like Istio) with a full CI/CD pipeline service, overlooking that Istio alone cannot automate rollback decisions based on metrics without extensive custom integration.

How to eliminate wrong answers

Option B is wrong because Cloud Build is a CI/CD orchestration service for building and testing, but it does not natively support canary deployments or automatic rollback based on metrics; Deployment Manager is an infrastructure-as-code tool, not a deployment pipeline manager. Option C is wrong because Spinnaker on GKE is a valid alternative but requires significant operational overhead to install, configure, and maintain, and it is not a fully managed Google Cloud service, making it less suitable for a company seeking a native, low-maintenance solution. Option D is wrong because Istio with manual traffic management provides the traffic shifting capability but lacks automated rollback on metric failure; it requires custom scripting and external monitoring integration to achieve the desired automation, which contradicts the requirement for an automated CI/CD pipeline.

707
MCQhard

A company wants to deploy a microservices architecture on Google Cloud. They need a service mesh to manage traffic, security, and observability across services. They also want to run workloads on both GKE and Compute Engine. Which solution should they use?

A.Cloud Service Mesh (Anthos Service Mesh)
B.Cloud Run for Anthos
C.Istio open-source installation on GKE
D.Traffic Director
AnswerA

It provides a fully managed service mesh across GKE and Compute Engine with Istio compatibility.

Why this answer

Anthos Service Mesh (based on Istio) provides traffic management, security, and observability for microservices across GKE, Compute Engine, and on-premises. Cloud Service Mesh is the same. Istio alone is open-source but not fully managed.

Cloud Run for Anthos is for serverless. Traffic Director is for VM-based load balancing but not a full service mesh.

708
MCQmedium

A company is migrating 500 TB of on-premises file server data to Cloud Storage. The on-premises network has a 1 Gbps link to Google Cloud, but the migration must complete within 30 days. What is the MOST cost-effective and reliable method?

A.Use Storage Transfer Service over a dedicated interconnect
B.Deploy a VPN and use gsutil rsync
C.Use Database Migration Service
D.Use Transfer Appliance
AnswerD

Transfer Appliance can physically ship 500 TB of data, bypassing network constraints. It is reliable and cost-effective for large data volumes.

Why this answer

Transfer Appliance is a physical device that Google ships to the customer; they load data onto it and return it for upload. For 500 TB over a 1 Gbps link, the theoretical transfer time is ~46 days (500 TB * 8 / 1 Gbps / 86400 sec/day), exceeding the 30-day window. Transfer Appliance avoids network transfer and meets the timeline.

Storage Transfer Service is for cloud-to-cloud or HTTP(S) sources, not on-prem. Migrate for Compute Engine is for VM migration.

709
Multi-Selecteasy

You are deploying a stateless web application on Compute Engine. Which TWO actions improve availability? (Choose 2)

Select 2 answers
A.Use a regional managed instance group.
B.Enable Cloud CDN for the static content.
C.Purchase 1-year committed use contracts for the instances.
D.Enable automatic restart on the instance template.
E.Use preemptible VMs to reduce cost.
AnswersA, D

Regional MIGs spread instances across zones; if one zone fails, other zones continue serving.

Why this answer

A regional managed instance group (MIG) distributes instances across multiple zones within a region, ensuring that if one zone fails, traffic is automatically routed to healthy instances in other zones. This provides high availability by eliminating a single zone of failure, which is critical for stateless web applications that can serve requests from any instance.

Exam trap

Google Cloud often tests the distinction between cost optimization (committed use contracts, preemptible VMs) and availability improvements, leading candidates to mistakenly choose financial commitments or caching services as availability solutions.

710
MCQmedium

A team uses Cloud Build to build container images and deploy to Cloud Run. They want to automate deployments whenever a new image is pushed to Container Registry. What is the best approach?

A.Use Cloud Deploy with a delivery pipeline that polls for new images
B.Configure a Cloud Build trigger that runs on a push to the container image in Container Registry
C.Create a Cloud Function that subscribes to Pub/Sub and calls Cloud Run deploy
D.Set up a Cloud Scheduler job to run a script that deploys the latest image
AnswerB

Cloud Build triggers can respond to image push events directly.

Why this answer

Cloud Build triggers can be configured to fire on a push to a container image in Container Registry, using the 'cloud-builds' Pub/Sub topic that Container Registry publishes to when an image is pushed. This allows Cloud Build to automatically run a build step (e.g., gcloud run deploy) to deploy the new image to Cloud Run without any polling or external infrastructure.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing Cloud Functions or Cloud Scheduler, missing the fact that Cloud Build triggers natively integrate with Container Registry's Pub/Sub events for automated, event-driven deployments.

How to eliminate wrong answers

Option A is wrong because Cloud Deploy delivery pipelines do not poll for new images; they are designed for continuous delivery with Skaffold-based configurations and require explicit triggers or manual releases, not automatic detection of image pushes. Option C is wrong because while a Cloud Function subscribing to Pub/Sub could work, it introduces unnecessary complexity and latency compared to the native Cloud Build trigger, which is the recommended and simpler approach for this exact use case. Option D is wrong because Cloud Scheduler jobs run on a fixed schedule and cannot detect new image pushes in real time, leading to either missed deployments or unnecessary redeployments of the same image.

711
MCQmedium

An organization is implementing a Hub-and-Spoke network topology with multiple VPCs. Which Google Cloud product is designed for centralized connectivity and policy enforcement?

A.Cloud VPN
B.Cloud NAT
C.Network Connectivity Center
D.Shared VPC
AnswerD

Centralized VPC management with policy enforcement.

Why this answer

Shared VPC (D) is the correct answer because it allows an organization to centrally manage connectivity and enforce network policies across multiple VPCs from a single host project. By designating a host project and attaching service projects, Shared VPC enables centralized control over firewall rules, routes, and IAM policies, which is essential for a hub-and-spoke topology where the host VPC acts as the hub and service VPCs as spokes.

Exam trap

The trap here is that candidates often confuse Network Connectivity Center (NCC) as a centralized hub for VPCs, but NCC is designed for hybrid connectivity (on-prem to cloud) and multi-cloud, not for managing multiple VPCs within a single Google Cloud organization with centralized policy enforcement, which is the domain of Shared VPC.

How to eliminate wrong answers

Option A (Cloud VPN) is wrong because it is a site-to-site VPN service that connects on-premises networks to Google Cloud, not a solution for centralized connectivity and policy enforcement between multiple VPCs. Option B (Cloud NAT) is wrong because it provides outbound internet access for private instances via network address translation, not inter-VPC connectivity or policy enforcement. Option C (Network Connectivity Center) is wrong because, while it can connect on-premises and cloud networks, it is primarily a hub for hybrid connectivity using VPN or Interconnect, not for managing multiple VPCs within a single organization with centralized policy enforcement; Shared VPC is the native solution for that purpose.

712
MCQeasy

A company uses Cloud Identity to manage users and wants to allow employees to authenticate to Google Cloud using their existing corporate Active Directory credentials. Which solution should they implement?

A.Cloud Directory Sync
B.Workload Identity Federation
C.IAM policies
D.Identity-Aware Proxy
AnswerA

Why this answer

Cloud Directory Sync synchronizes users and groups from on-premises AD to Cloud Identity, enabling SSO with existing credentials.

713
MCQeasy

You are reviewing an IAM policy for a Cloud Storage bucket. Alice is a member of the data-team group. What level of access does Alice have to objects in this bucket?

A.Read-only access.
B.No access, because the group policy overrides the individual policy.
C.Read and write access (admin).
D.Write-only access.
AnswerC

Her effective permissions are the union of both roles.

Why this answer

The IAM policy grants the data-team group the roles/storage.objectAdmin role, which provides full read, write, and delete access to objects in the bucket. Alice, as a member of the data-team group, inherits this role and therefore has read and write (admin) access to the objects.

Exam trap

Google Cloud often tests the misconception that group policies override individual policies (a common RBAC misunderstanding), but in Google Cloud IAM, all applicable policies are additive unless a deny rule is explicitly applied.

How to eliminate wrong answers

Option A is wrong because the group policy grants the storage.objectAdmin role, not a read-only role like roles/storage.objectViewer. Option B is wrong because IAM policies are additive; group policies do not override individual policies—instead, the effective permissions are the union of all applicable policies. Option D is wrong because the storage.objectAdmin role includes both read and write permissions, not write-only access.

714
MCQhard

A large e-commerce company runs its production workloads on Google Cloud. The security team has implemented a VPC Service Controls perimeter around the production project to prevent data exfiltration. The perimeter includes the project, and access is allowed only from an access level that requires the user to be on the corporate network (192.0.2.0/24). Recently, the DevOps team reported that their CI/CD pipeline, which runs on Cloud Build with a VPC connector attached to a shared VPC in a different project, is failing to deploy to Cloud Run. The pipeline uses a service account with roles/run.admin on the production project. The Cloud Build worker IPs are ephemeral and not in the corporate IP range. The pipeline's deployment step times out with permission errors. Which action will resolve the issue while maintaining security compliance?

A.Add the Cloud Build service account as a member of the access level used in the perimeter, so that it is not restricted by IP.
B.Remove the VPC Service Controls perimeter from the production project and rely solely on IAM permissions.
C.Add the Cloud Build worker IP range (0.0.0.0/0) to the access level's IP condition to allow all IPs.
D.Create a new service account for Cloud Build with roles/iam.serviceAccountUser and roles/run.admin, and assign it to the Cloud Run service.
AnswerA

Access levels can include service accounts as members, allowing them to bypass IP restrictions.

Why this answer

Adding the Cloud Build service account as a member of the access level allows it to bypass the IP restriction. In VPC Service Controls, access levels can include both IP conditions and members. By adding the service account as a member, the perimeter still enforces IP restrictions for other users, but the service account is allowed through based on its identity, not its IP.

This resolves the deployment failure while maintaining the security perimeter. Option B is wrong because removing the perimeter defeats the security requirement. Option C is wrong because adding 0.0.0.0/0 would allow all IPs, weakening security.

Option D is wrong because changing the service account does not change the ephemeral nature of the Cloud Build worker IPs; the permission error is due to IP restriction, not IAM roles.

715
MCQeasy

An engineer wants to store a database password securely and allow a Cloud Run service to access it. Which GCP service should they use?

A.Secret Manager
B.Cloud Storage
C.Cloud Key Management Service (KMS)
D.Firestore
AnswerA

Secret Manager securely stores secrets and provides fine-grained access control.

Why this answer

Secret Manager is designed for storing secrets like passwords, API keys, and certificates. It integrates with Cloud Run via volume mounts or environment variables. Cloud KMS is for encryption keys.

Cloud Storage is for objects. Firestore is a database.

716
MCQmedium

A company runs a critical application on Compute Engine and wants to automate recovery in case of a zone failure by redeploying instances in another zone. They have a startup script that configures the application. What is the simplest way to achieve zone failover?

A.Use a global load balancer with a backend service pointing to multiple zonal instance groups
B.Set up a Cloud Scheduler to check instance health and create new instances via Cloud Functions
C.Create a regional managed instance group (MIG) with autohealing
D.Create a snapshot schedule and use Cloud Deployment Manager to recreate instances
AnswerC

Regional MIG distributes instances across multiple zones and automatically creates instances in healthy zones if a zone fails.

Why this answer

An instance group with autohealing and a health check can automatically recreate instances in another zone if the instance becomes unhealthy. However, for zone-level failure, a regional managed instance group (MIG) distributes instances across multiple zones and automatically rebalances if one zone fails.

717
MCQhard

Your team is following an incident management process. After resolving a major incident, you are tasked with conducting a postmortem. What is the PRIMARY goal of the postmortem process in Google Cloud's recommended approach?

A.Understand the root cause and implement changes to prevent recurrence
B.Document the incident timeline and communicate it to stakeholders
C.Calculate the financial impact and bill the responsible team
D.Identify the individual responsible for the incident and take corrective action
AnswerA

The primary goal is to learn and improve.

Why this answer

Google's Site Reliability Engineering (SRE) approach emphasizes blameless postmortems. The primary goal is to learn from the incident and improve the system to prevent recurrence, not to assign blame or track individual performance.

718
MCQeasy

A company deploys a web application on Compute Engine behind an HTTP Load Balancer. They want to ensure only healthy instances receive traffic. What should they configure?

A.Configure the instance group autoscaling based on CPU utilization
B.Configure an HTTP health check with a custom request path that returns a 200 status
C.Configure a TCP health check on port 80
D.Configure an SSL health check to verify TLS handshake
AnswerB

HTTP health check validates the application layer by checking a specific endpoint.

Why this answer

An HTTP health check with a custom request path that returns a 200 status allows the HTTP Load Balancer to verify that the web application is actually serving requests correctly. This ensures that only instances passing the application-level health check are considered healthy and receive traffic, preventing requests from being routed to instances that may be running but not serving the expected content.

Exam trap

The trap here is that candidates often confuse health checks with autoscaling metrics, assuming that CPU-based autoscaling alone ensures traffic is only sent to healthy instances, when in fact health checks are a separate mechanism required for load balancer traffic routing.

How to eliminate wrong answers

Option A is wrong because autoscaling based on CPU utilization manages the number of instances but does not determine which instances are healthy for traffic routing; the load balancer still needs health checks to decide which instances to send traffic to. Option C is wrong because a TCP health check on port 80 only verifies that the TCP port is open, not that the web application is responding correctly; an instance could have a listening port but return errors or be unresponsive at the application layer. Option D is wrong because an SSL health check verifies the TLS handshake, which is unnecessary for HTTP traffic and does not validate the application's response; it is designed for HTTPS backends, not plain HTTP.

719
MCQhard

Refer to the exhibit. The log entry is from Cloud Logging for a VPC subnetwork. What is the most likely cause of this error?

A.A firewall rule blocking ingress on port 80.
B.The subnetwork default has no internet gateway.
C.The VM at 10.0.0.2 is not running.
D.The packet is malformed.
AnswerA

The error message attributes the drop to firewall policy 'default-deny-ingress'.

Why this answer

The log entry indicates a packet was dropped by a firewall rule. Since the destination is 10.0.0.2 on port 80 (HTTP), the most likely cause is a firewall rule blocking ingress traffic on port 80. In Google Cloud VPC, firewall rules are stateful and evaluated before any routing decisions, so a missing or misconfigured ingress rule for TCP port 80 would cause this drop.

Exam trap

Google Cloud often tests the distinction between firewall drops and routing failures; the trap here is that candidates may confuse a firewall rule drop with a missing internet gateway or an unreachable VM, but the log entry's 'firewall' field explicitly indicates a firewall decision, not a routing or connectivity issue.

How to eliminate wrong answers

Option B is wrong because the absence of an internet gateway would not cause a packet drop logged by a firewall rule; it would result in a routing failure (e.g., no route to internet), which is logged differently. Option C is wrong because if the VM at 10.0.0.2 were not running, the packet would be dropped at the hypervisor level (e.g., ICMP unreachable or no ARP response), not by a firewall rule. Option D is wrong because a malformed packet would typically be dropped at a lower network layer (e.g., by the NIC or kernel) and would not generate a firewall rule log entry; firewall rules inspect valid packets against policy.

720
MCQhard

A company runs a data analytics platform on Google Cloud using BigQuery, Dataflow, and Cloud Storage. They notice that Dataflow jobs are failing with 'out of memory' errors for certain large pipelines. The pipelines process variable amounts of data, sometimes spiking 10x normal. Which strategy should they use to handle these spikes cost-effectively?

A.Manually monitor the job and increase the number of workers when a spike is detected.
B.Increase the machine type of the workers to a high-memory type and disable autoscaling.
C.Configure the Dataflow pipeline to use autoscaling with a higher maximum number of workers and use preemptible VMs for cost savings.
D.Use Dataflow Streaming Engine to offload state to persistent storage and reduce memory usage.
AnswerC

Autoscaling adjusts workers dynamically; preemptible VMs reduce cost for fault-tolerant work.

Why this answer

Dataflow's autoscaling can dynamically add workers to handle sudden data spikes, and using preemptible VMs significantly reduces cost for batch pipelines that can tolerate interruptions. This approach avoids manual intervention and over-provisioning, making it cost-effective for variable workloads.

Exam trap

Google Cloud often tests the distinction between batch and streaming optimizations, and candidates mistakenly apply Streaming Engine (designed for stateful streaming) to batch pipelines suffering from memory spikes, missing the cost-effective autoscaling with preemptible VMs strategy.

How to eliminate wrong answers

Option A is wrong because manual monitoring and scaling is not cost-effective or reliable for unpredictable spikes; it introduces latency and operational overhead. Option B is wrong because disabling autoscaling and using a fixed high-memory machine type leads to over-provisioning during normal loads and cannot handle spikes beyond the fixed capacity, wasting resources. Option D is wrong because Dataflow Streaming Engine is designed for streaming pipelines to reduce memory usage by offloading state, but the question describes batch pipelines (Dataflow jobs processing variable data amounts), and it does not address the root cause of memory exhaustion during large batch spikes.

721
MCQmedium

A developer needs to build a serverless event-driven application that responds to Cloud Storage object uploads by processing the file and storing results in Firestore. Which compute service is the best fit?

A.Cloud Functions
B.App Engine Flexible Environment
C.Cloud Run for Anthos
D.Compute Engine with startup scripts
AnswerA

Cloud Functions can be triggered by Cloud Storage events, scales automatically, and charges only for execution time.

Why this answer

Cloud Functions is a serverless event-driven compute service that can be triggered directly by Cloud Storage events, ideal for simple processing tasks.

722
MCQmedium

A company needs to connect their on-premises data center to Google Cloud with a dedicated, low-latency connection that provides a Service Level Agreement (SLA) of 99.99% uptime. They anticipate high bandwidth usage (10 Gbps). Which connectivity option should they choose?

A.Cloud VPN with static routing
B.Cloud CDN
C.Partner Interconnect
D.Dedicated Interconnect
AnswerD

Direct private connection, up to 10 Gbps, 99.99% SLA with redundancy.

Why this answer

Dedicated Interconnect provides a direct physical connection between on-premises and GCP, offers up to 10 Gbps per circuit, and comes with a 99.99% SLA when configured with redundant connections.

723
MCQmedium

A company uses Cloud Build to deploy a Java application to Artifact Registry. They want to automatically trigger a build only when changes are pushed to the 'main' branch in their Cloud Source Repository. Which configuration should they use?

A.Configure a Cloud Function that listens for Pub/Sub messages from Cloud Source Repo and calls Cloud Build API
B.Create a Cloud Build trigger with an included branch filter set to '^main$'
C.Create a Cloud Scheduler job that runs a Pub/Sub push to Cloud Build every hour
D.Use a Cloud Build build step that checks the branch name and aborts if not main
AnswerB

The branch filter '^main$' ensures only pushes to the main branch trigger a build.

Why this answer

Cloud Build triggers can be configured with a branch filter (regex) to trigger builds only on specific branches. The trigger is set to watch the repository and fire on push events matching the branch pattern. Using a Cloud Scheduler with Pub/Sub is an alternative for scheduled builds, but not for push-based triggers.

724
MCQeasy

A team wants to define an SLO for a service that requires 99.9% availability over a 30-day window. They need to measure the ratio of successful requests to total requests. Which SLI should they use?

A.Request success rate
B.SRE
C.Request latency
D.Error budget
AnswerA

The proportion of successful requests is the standard SLI for availability.

Why this answer

An SLI is a measure of service performance. For availability, the standard SLI is the proportion of successful requests (e.g., HTTP 2xx) to total requests. Latency SLI measures response times.

Error budget is derived from SLO. SRE is the practice.

725
Multi-Selecteasy

Which THREE practices are recommended for organizing projects in a Google Cloud organization?

Select 3 answers
A.Create a separate project to hold organization policies.
B.Use a separate project for each environment (e.g., development, staging, production).
C.Apply IAM policies at the folder level instead of the organization level when possible.
D.Use a shared VPC host project for multiple service projects to centralize network management.
E.Consolidate all production resources into a single project for simplicity.
AnswersB, C, D

Separate projects isolate environments and allow independent management and billing.

Why this answer

Using separate projects for each environment (development, staging, production) enforces resource isolation, prevents accidental cross-environment changes, and allows independent IAM policies, billing, and quotas. This aligns with Google Cloud's recommended resource hierarchy best practices for managing lifecycle and security boundaries.

Exam trap

The trap here is that candidates often confuse the purpose of organization policies with project-level resources, mistakenly thinking a separate project is needed to hold policies, when in fact policies are inherited through the resource hierarchy (organization → folder → project).

726
Multi-Selectmedium

A company wants to improve the reliability of their microservices architecture on Google Cloud. Which TWO practices should they implement? (Choose 2)

Select 2 answers
A.Design with a single point of failure for simplicity
B.Implement retry with exponential backoff
C.Use synchronous communication between all services
D.Implement circuit breaker pattern
E.Disable health checks to reduce latency
AnswersB, D

Retry with backoff handles transient failures without overwhelming the system.

Why this answer

B is correct because implementing retry with exponential backoff allows transient failures (e.g., network timeouts, temporary service unavailability) to be handled gracefully by automatically retrying the request after increasing delays, reducing load on the recovering service. This pattern is essential in microservices on Google Cloud to improve reliability without overwhelming downstream dependencies.

Exam trap

Google Cloud often tests the misconception that synchronous communication is more reliable because it provides immediate feedback, but in distributed systems, asynchronous patterns and resilience mechanisms like retries and circuit breakers are actually critical for reliability.

727
MCQeasy

A company wants to ensure that all access to their Cloud Storage bucket is logged for compliance purposes. Which type of audit log should they enable?

A.Admin Activity audit logs
B.Data Access audit logs
C.System Event audit logs
D.Access Transparency logs
AnswerB

Data Access logs capture read and write operations on data.

Why this answer

Data Access audit logs (Option B) are required to log every API call that reads, writes, or deletes data in a Cloud Storage bucket, such as object GETs and PUTs. Admin Activity logs only record configuration changes, not data access, so they would not capture the read/write operations needed for compliance logging.

Exam trap

Candidates often confuse Admin Activity logs with Data Access logs, thinking that Admin Activity logs cover data access operations, but they only record configuration changes; Data Access logs are needed for actual data access auditing.

How to eliminate wrong answers

Option A is wrong because Admin Activity audit logs record only metadata or configuration changes (e.g., creating or deleting a bucket), not the actual data access events like reading or writing objects. Option C is wrong because System Event audit logs capture Google Cloud system actions (e.g., automatic maintenance or VM live migration), not user-driven data access to Cloud Storage. Option D is wrong because Access Transparency logs provide logs of Google personnel accessing your data, not your own users' access to Cloud Storage objects.

728
Multi-Selecthard

A data analytics team wants to build a pipeline that processes files from a Cloud Storage bucket, transforms the data, and loads it into BigQuery. They want to trigger the pipeline only when new files arrive. Which THREE services can be used together to achieve this? (Choose 3.)

Select 3 answers
A.Cloud Scheduler
B.Cloud Storage triggers for Cloud Functions
C.Cloud Build triggers
D.Cloud Workflows
E.BigQuery Data Transfer Service
AnswersB, D, E

Cloud Functions can be triggered on object creation in Cloud Storage.

Why this answer

Cloud Functions can be triggered by Cloud Storage events (e.g., object finalize). Cloud Workflows can orchestrate multiple steps. Cloud Build is for CI/CD, not event-driven data processing.

Cloud Scheduler is for scheduled jobs, not event triggers. Cloud Run can be invoked by Cloud Functions or eventarc, but the direct trigger from storage is via Cloud Functions or Eventarc.

729
MCQmedium

Refer to the exhibit. A user creates a Cloud SQL for PostgreSQL instance and a Compute Engine VM. The VM cannot connect to the database. What is the most likely cause?

A.The Cloud SQL instance requires SSL connections, and the client is not using SSL.
B.The Cloud SQL instance does not have a private IP assigned, but the VM is attempting to connect using the private IP.
C.The VM's firewall is blocking egress to port 5432 on the Cloud SQL public IP.
D.The authorized networks setting is too permissive; it should be restricted to the VM's public IP.
AnswerB

Correct: The '--assign-ip' flag only assigns a public IP. To use private IP, the instance needs to be configured with a private network. The VM likely uses the private IP because it is in the same region, but the instance doesn't have one.

Why this answer

The Cloud SQL instance has authorized networks set to 0.0.0.0/0, which allows all IPs. However, the instance has a public IP, and the VM has an external IP. The connection fails with timeout, suggesting that the traffic is not reaching the database.

This could be due to the database not having SSL enforced, but that would cause a different error. The most likely cause is that the Cloud SQL instance is not configured to allow connections from the VM's public IP, because authorized networks only apply to connections using the public IP. But the exhibit shows it's set to 0.0.0.0/0, so that should work.

Another possibility: the VM is trying to connect to the private IP of the Cloud SQL instance, but the instance does not have a private IP. The exhibit shows '--assign-ip' which assigns a public IP, but does not assign a private IP. The VM might be trying to connect to the private IP, which doesn't exist.

However, the error is 'connection timed out', which suggests the client cannot reach the IP. If the client is using the public IP, the firewall on the VM allows egress. The issue could be that the Cloud SQL instance's public IP is not reachable from the VM's network due to VPC firewall rules? But the VM's firewall allows egress to 0.0.0.0/0.

The most likely cause is that the Cloud SQL instance does not have a private IP, and the VM is trying to connect via private IP. But the user might be using the correct public IP. Another common issue: the Cloud SQL instance requires SSL, but the client is not using SSL.

However, that would give a different error like 'SSL required'. The timeout suggests network connectivity. Given the exhibit, the Cloud SQL instance has only a public IP and authorized networks allow all IPs, so the issue is likely that the VM is trying to connect using the instance's private IP, which doesn't exist.

Alternatively, the VM might be in a different VPC and peering is not set up. But the question says 'different VPC'. Since the instance has a public IP, the VM can connect via public IP regardless of VPC.

The most plausible answer is that the Cloud SQL instance does not have a private IP, and the user is trying to connect to the private IP. However, the exhibit doesn't show the connection string. Another possibility: the user has not enabled public IP access from the VM's network? No, authorized networks allow all.

I think the intended answer is that the Cloud SQL instance does not have a private IP, so the VM, if using private IP, cannot connect. But the question says 'connection fails', so we need to infer. Let me craft options.

730
Multi-Selectmedium

A company needs to allow a third-party auditor to view all Compute Engine resources in a project but not allow any modifications. The auditor must not have access to any other services. Which THREE steps should be taken?

Select 3 answers
A.Grant the 'Viewer' primitive role (roles/viewer)
B.Grant the 'Compute Viewer' role (roles/compute.viewer)
C.Ensure no other IAM roles are granted to the auditor
D.Assign the role at the project level
E.Assign the role at the resource (VM) level
AnswersB, C, D

Compute Viewer provides read-only access to Compute Engine resources.

Why this answer

The correct IAM role is Compute Viewer. To restrict access to only Compute Engine, do not grant other roles. The viewer role should be assigned at the project level to cover all Compute resources.

731
MCQhard

A company is deploying a multi-tenant SaaS application on GKE. Each tenant's data must be isolated at the network level. They want to use a single GKE cluster but ensure that pods from different tenants cannot communicate with each other. Which GCP feature should they use?

A.Istio service mesh
B.VPC Service Controls
C.Kubernetes Network Policies
D.GKE Sandbox
AnswerC

Network Policies can restrict pod-to-pod traffic based on labels and namespaces, providing tenant isolation.

Why this answer

Kubernetes Network Policies allow you to define rules for pod-to-pod communication within a cluster, enabling tenant isolation. GKE Sandbox provides stronger isolation at the kernel level but is not specifically for network isolation. VPC Service Controls are for Google Cloud services, not pod-level.

Istio can also provide network control but is a more complex mesh.

732
Multi-Selecthard

A company runs a microservices-based application on Google Kubernetes Engine (GKE) with a Regional cluster. They want to improve reliability by implementing best practices for pod scheduling and resilience. Which TWO actions should they take? (Choose two.)

Select 2 answers
A.Set terminationGracePeriodSeconds to 0 for faster pod termination during scale-down
B.Enable cluster autoscaler to automatically add nodes when pods are pending
C.Define a PodDisruptionBudget for each deployment to limit the number of concurrent disruptions
D.Set resource requests equal to limits to ensure guaranteed QoS class
E.Configure pod anti-affinity to spread replicas across different zones
AnswersC, E

Correct: PDB ensures minimum availability during voluntary disruptions.

Why this answer

A PodDisruptionBudget (PDB) limits the number of Pods of a replicated application that can be down simultaneously from voluntary disruptions, such as node maintenance or cluster upgrades. This ensures that a minimum number of replicas remain available, improving application reliability during planned events.

Exam trap

Google Cloud often tests the distinction between voluntary disruptions (handled by PDB) and involuntary disruptions (e.g., node failure), and the trap here is that candidates confuse resource optimization (requests/limits) or scaling (cluster autoscaler) with resilience mechanisms like PDB and anti-affinity.

733
MCQhard

Refer to the exhibit. The HPA is configured to scale based on CPU, but it has not scaled up despite the CPU usage being above the target. Which is the most likely cause?

A.The cluster has autoscaling enabled, which may conflict with HPA.
B.The node pool oauthScopes lack the monitoring scope required for HPA to read metrics.
C.The HPA target is 80%, but the current CPU is 90% which should trigger scaling; the HPA may be broken.
D.The HPA min replicas is 3, so it cannot scale down, but it should scale up.
AnswerB

Without the monitoring scope, the HPA cannot retrieve CPU metrics from the nodes.

Why this answer

The node pool uses a service account with devstorage.read_only scope, which does not include the required permissions for the HPA to read metrics. The HPA needs the monitoring scope or a service account with monitoring roles to access CPU metrics.

734
MCQhard

A company needs to store archival data that is accessed less than once a year, with retrieval times of up to 12 hours acceptable. The data must be kept for 10 years for compliance. What is the most cost-effective Cloud Storage solution?

A.Cloud Storage Coldline class with a retention policy
B.Cloud Storage Nearline class
C.Cloud Storage Archive class with a lifecycle policy that deletes objects after 10 years
D.Cloud Storage Standard class with object versioning
AnswerC

Archive class is cheapest for infrequently accessed data; lifecycle deletion meets compliance requirements.

Why this answer

Cloud Storage Archive class is the most cost-effective option for data accessed less than once a year with retrieval times up to 12 hours, as it offers the lowest storage cost among Google Cloud Storage classes. A lifecycle policy that deletes objects after 10 years ensures compliance with the retention requirement without incurring ongoing storage costs beyond the mandated period.

Exam trap

The trap here is that candidates often confuse 'retention policy' (which prevents deletion) with 'lifecycle policy' (which automates deletion), leading them to choose Coldline or Nearline with a retention policy, missing that Archive class with a lifecycle delete rule is the most cost-effective and compliant solution.

How to eliminate wrong answers

Option A is wrong because Coldline class is designed for data accessed at most once every 90 days, not less than once a year, and its storage cost is higher than Archive class; a retention policy prevents deletion but does not automatically delete data after 10 years, leading to unnecessary costs. Option B is wrong because Nearline class is intended for data accessed less than once a month, with higher storage cost than Archive, and it lacks a built-in mechanism to enforce a 10-year deletion. Option D is wrong because Standard class is for frequently accessed data, has the highest storage cost, and object versioning increases storage costs by retaining multiple versions, making it unsuitable for long-term archival with minimal access.

735
MCQeasy

A company is deploying a web application on Google Kubernetes Engine (GKE) and needs to ensure that the application's service account can only pull images from a specific Container Registry repository. What is the best practice to enforce this?

A.Use Workload Identity and grant the Kubernetes service account's associated Google service account the roles/storage.objectViewer role on the registry bucket.
B.Grant the Compute Engine default service account the roles/storage.objectViewer role on the registry bucket.
C.Set an IAM policy on the pod directly using the 'gke-default' service account.
D.Create an IAM condition on the node pool's service account that limits access to the registry bucket.
AnswerA

Workload Identity binds pod identity to a GSA, and bucket-level IAM restricts access.

Why this answer

Workload Identity allows you to map a Kubernetes service account to a Google service account and grant that Google service account the roles/storage.objectViewer role on the specific Container Registry bucket. This ensures that only pods using that Kubernetes service account can pull images from the designated repository, following the principle of least privilege.

Exam trap

The trap here is that candidates often confuse node-level service accounts (like the Compute Engine default service account) with application-level service accounts, assuming that granting permissions to the node's service account is sufficient, when in fact it grants overly broad access to all pods on the node.

How to eliminate wrong answers

Option B is wrong because granting the Compute Engine default service account the roles/storage.objectViewer role on the registry bucket would allow all pods on any node in the cluster to pull images from that repository, violating the requirement to restrict access to a specific application's service account. Option C is wrong because IAM policies cannot be set directly on pods; IAM policies are applied to Google Cloud resources (like service accounts or buckets), not to Kubernetes pods. Option D is wrong because IAM conditions on the node pool's service account would apply to all pods running on that node pool, not just the specific application's service account, and node pool service accounts are typically used for node-level operations, not for application-level image pull authorization.

736
MCQeasy

A startup wants to encrypt data at rest in Cloud Storage using Customer-Managed Encryption Keys (CMEK). They have already created a Cloud KMS key ring and key. What additional step is required to enable CMEK for a new Cloud Storage bucket?

A.Enable the Cloud KMS API in the project where the bucket will reside.
B.Create a Cloud HSM key instead, as CMEK requires HSM.
C.Add a label to the key ring to associate it with the bucket.
D.Grant the Cloud Storage service account the Cloud KMS CryptoKey Encrypter/Decrypter role on the key.
AnswerD

The service account that Cloud Storage uses must be authorized to use the key.

Why this answer

To use CMEK with Cloud Storage, the Cloud Storage service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key. This permission allows the bucket's underlying storage system to encrypt and decrypt objects using the customer-managed key. Without this IAM binding, the bucket cannot access the key, and CMEK operations will fail.

Exam trap

A common misconception is that enabling the Cloud KMS API or using Cloud HSM is required for CMEK, when the actual critical step is granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account on the key.

How to eliminate wrong answers

Option A is wrong because the Cloud KMS API is automatically enabled when you create a key ring or key via the console or gcloud, and it is not a prerequisite for CMEK on a bucket; the bucket itself does not need the KMS API enabled separately. Option B is wrong because CMEK supports both Cloud KMS software keys and Cloud HSM keys; HSM is not required, and the question explicitly states a Cloud KMS key has already been created. Option C is wrong because labels on a key ring are metadata tags and have no role in associating a key with a bucket; the association is done via IAM permissions on the key, not labels.

737
Multi-Selectmedium

A company is migrating a large on-premises data warehouse to BigQuery. The data includes sensitive customer information that must be encrypted at rest and in transit. They also need to mask credit card numbers for analysts who do not have a need to see the full number. Which TWO Google Cloud services should they use? (Choose 2.)

Select 2 answers
A.Cloud Identity-Aware Proxy (IAP)
B.Cloud Data Loss Prevention (DLP)
C.Cloud Data Catalog and policy tags
D.Cloud Audit Logs
E.Cloud Key Management Service (KMS)
AnswersB, C

DLP can inspect and de-identify sensitive data, such as masking credit card numbers, before storing in BigQuery.

Why this answer

BigQuery supports column-level security via policy tags using Data Catalog. Data Loss Prevention (DLP) can automatically classify and mask sensitive data such as credit card numbers. Cloud Key Management Service (KMS) is for managing encryption keys but not for masking.

Cloud Audit Logs are for auditing, not masking. Cloud Identity-Aware Proxy (IAP) controls access at the application level, not for data masking.

738
Multi-Selecthard

A company is running a multi-region application on Google Kubernetes Engine with workloads in us-central1 and europe-west1. They want to route traffic to the closest region based on user location. Which three components should they configure? (Choose three.)

Select 3 answers
A.Cloud Armor security policy
B.Cloud DNS with geo-routing policy
C.Network endpoint groups (NEGs) pointing to GKE pods
D.Regional internal load balancer
E.Global external HTTP(S) load balancer
AnswersB, C, E

Routes DNS queries to the closest region's load balancer IP.

Why this answer

Cloud DNS geo-routing policy directs DNS queries to the closest healthy backend based on the user's geographic location, enabling traffic to be routed to the nearest GKE region (us-central1 or europe-west1). This is essential for minimizing latency and optimizing user experience in a multi-region setup.

Exam trap

The trap here is that candidates often confuse Cloud Armor's security filtering capabilities with traffic routing, or mistakenly think a regional internal load balancer can handle multi-region traffic, when in fact only a global external HTTP(S) load balancer combined with geo-routing DNS and NEGs can achieve proximity-based routing across regions.

739
MCQhard

A company uses Cloud KMS with CMEK to encrypt data stored in BigQuery. They need to audit who has used the encryption key and when. Which type of audit log should they enable?

A.Network Security audit logs
B.Admin Activity audit logs
C.System Event audit logs
D.Data Access audit logs
AnswerD

Data Access logs capture who accessed data or performed cryptographic operations using Cloud KMS keys.

Why this answer

Cloud KMS operations (e.g., encrypt, decrypt) are recorded in Data Access audit logs. Admin Activity logs record configuration changes, not data access.

740
MCQeasy

Which GCP service should be used to automatically scale a GKE cluster's number of nodes based on pending pods?

A.Vertical Pod Autoscaler (VPA)
B.Cluster Autoscaler
C.Node Auto-Provisioning
D.Horizontal Pod Autoscaler (HPA)
AnswerB

Cluster Autoscaler automatically adds or removes nodes in a node pool based on pod scheduling needs.

Why this answer

The cluster autoscaler adjusts the number of nodes in node pools based on pod resource requests. HPA scales pods, not nodes. VPA adjusts pod resource requests.

Node auto-provisioning is part of cluster autoscaler but the described functionality is cluster autoscaler.

741
Multi-Selectmedium

Which TWO statements are true regarding the benefits of using VPC Network Peering over Cloud VPN for connecting two VPC networks?

Select 2 answers
A.VPC Network Peering provides lower latency because traffic stays within Google's network.
B.VPC Network Peering requires a separate VPN gateway appliance.
C.Cloud VPN incurs egress costs for data transfer, while VPC Network Peering typically does not.
D.VPC Network Peering can only be established within the same organization.
E.Cloud VPN encrypts traffic, which VPC Network Peering does not.
AnswersA, C

Peering uses Google's internal network, avoiding internet hops, thus lower latency.

Why this answer

VPC Network Peering uses Google's internal infrastructure to route traffic directly between VPC networks, avoiding the public internet and reducing the number of network hops. This results in lower latency compared to Cloud VPN, which typically encrypts and tunnels traffic over the public internet, introducing additional overhead and potential variability in latency.

Exam trap

The trap here is that candidates may confuse the lack of encryption in VPC Network Peering as a disadvantage, but the question asks for benefits, so encryption (Option E) is not a benefit of peering; instead, the lower latency and reduced egress costs are the key advantages.

742
Multi-Selectmedium

Which THREE are valid methods to connect an on-premises network to a Google Cloud VPC?

Select 3 answers
A.Dedicated Interconnect
B.Cloud VPN
C.Cloud Router
D.VPC peering
E.Partner Interconnect
AnswersA, B, E

Dedicated Interconnect provides direct physical connection.

Why this answer

Dedicated Interconnect (A) provides a direct physical connection between your on-premises network and Google Cloud, offering high bandwidth and a Service Level Agreement (SLA) of up to 99.99% availability. It uses a cross-connect in a colocation facility to attach your on-premises router to a Google Cloud router, enabling private, low-latency connectivity to your VPC without traversing the public internet.

Exam trap

The trap here is that candidates confuse Cloud Router as a standalone connectivity method, when it is actually a routing component that must be paired with a VPN tunnel or Interconnect to function.

743
MCQhard

A multinational corporation operates in multiple regions and must comply with GDPR. They use Cloud Load Balancing to distribute traffic across regional backends. Their security team wants to block traffic from specific countries (e.g., non-EU countries) at the edge. What should they use?

A.Configure Cloud CDN to serve content only to EU-based users.
B.Use Cloud Armor security policies with geographic-based denylist rules.
C.Set VPC firewall rules to allow traffic only from EU IP ranges.
D.Configure Identity-Aware Proxy (IAP) to require user authentication from allowed countries.
AnswerB

Cloud Armor can block traffic from specific countries at the Google Cloud edge.

Why this answer

Cloud Armor security policies support geographic-based access control using denylist or allowlist rules that match client IP addresses against country-level geolocation data. This allows the security team to block traffic from specific countries at the edge, before it reaches the backend, which is the most efficient and compliant approach for GDPR enforcement.

Exam trap

The trap here is that candidates often confuse VPC firewall rules (which filter by IP ranges) with Cloud Armor's geolocation-based policies, or they assume Cloud CDN or IAP can enforce geographic access control, when in fact only Cloud Armor provides native country-level blocking at the edge.

How to eliminate wrong answers

Option A is wrong because Cloud CDN caches content but does not enforce geographic access control; it can serve cached content to any user regardless of location, and its 'geo restrictions' are only for signed URLs, not for blocking traffic at the edge. Option C is wrong because VPC firewall rules operate at the network layer and cannot reliably block traffic based on country-level geolocation; they only filter by IP ranges, which are not accurate for country-level blocking due to IP reassignment and lack of granularity. Option D is wrong because Identity-Aware Proxy (IAP) controls access based on user identity and context, not on the geographic origin of the IP address; it cannot block traffic at the edge based solely on country.

744
MCQmedium

A company runs a web application on Compute Engine with an HTTP Load Balancer. Users report intermittent 502 Bad Gateway errors. What is the most likely cause?

A.Load balancer quota exceeded.
B.Firewall rules block health checks.
C.SSL certificate expired.
D.Backend instances are unhealthy or overloaded.
AnswerD

502 Bad Gateway typically means the backend is not responding properly.

Why this answer

The 502 Bad Gateway error from an HTTP Load Balancer typically indicates that the backend instances are failing to respond to the load balancer's health checks or are overwhelmed, causing the load balancer to consider them unhealthy and return a 502 error. This is the most common cause because the load balancer relies on healthy backends to forward traffic, and overloaded or failing instances cannot handle requests.

Exam trap

The trap here is that candidates often confuse 502 errors with SSL or quota issues, but the PCA exam specifically tests that 502 errors from an HTTP Load Balancer are almost always due to backend unavailability or overload, not frontend configuration problems.

How to eliminate wrong answers

Option A is wrong because exceeding a load balancer quota would result in a 429 Too Many Requests or a 503 Service Unavailable error, not a 502 Bad Gateway. Option B is wrong because firewall rules blocking health checks would cause the load balancer to mark backends as unhealthy, but the error would typically be a 502 only if the health check fails and no healthy backends remain; however, the question asks for the most likely cause, and overloaded backends are more common than misconfigured firewalls in intermittent 502 scenarios. Option C is wrong because an expired SSL certificate on the load balancer would cause SSL handshake failures and a 502 error only if the certificate is used for backend-to-load-balancer communication, but the load balancer terminates SSL and uses its own certificate; an expired certificate on the backend would not cause a 502 from the load balancer's perspective.

745
Multi-Selectmedium

A company wants to implement a zero-trust access model for internal web applications running on Compute Engine. They need to authenticate users using corporate credentials and enforce context-aware access based on device posture and IP address. Which TWO services should they use?

Select 2 answers
A.VPC Service Controls
B.Cloud VPN
C.Cloud Identity
D.Cloud Armor
E.Identity-Aware Proxy (IAP)
AnswersC, E

Cloud Identity provides corporate identity management and SSO.

Why this answer

Identity-Aware Proxy (IAP) provides context-aware access control and integrates with Cloud Identity for authentication. Device posture and IP can be assessed via Access Context Manager (part of VPC Service Controls) or IAP's own context conditions.

746
MCQeasy

Your company runs a global e-commerce platform on Google Cloud. The application is deployed across multiple regions for low latency. You use Cloud SQL for transactional data and Cloud Spanner for global consistency of inventory. Recently, the operations team reported that the application is experiencing increased latency during peak hours, and the monthly cloud bill has risen significantly. Upon investigation, you find that the Cloud SQL instance is underutilized (CPU < 20%) while Cloud Spanner split utilization is over 80%. The application instances are fronted by a global external HTTPS load balancer. Network egress costs are high. Which course of action would best address both the latency and cost issues?

A.Reduce the Cloud SQL instance tier to a lower machine type to save costs, and add read replicas in other regions for failover.
B.Add more nodes to the Cloud SQL instance and enable automatic storage increase to handle peak loads.
C.Increase the number of splits in Cloud Spanner to reduce hot spots, and configure Cloud CDN in front of the load balancer to cache static content.
D.Move the transactional database to Cloud Spanner and decommission Cloud SQL to reduce complexity.
AnswerC

Increasing splits improves Spanner performance; Cloud CDN reduces egress costs and latency for static content.

Why this answer

The primary performance issue is Cloud Spanner split utilization over 80%, indicating hot spots that cause increased latency. Increasing the number of splits redistributes load across more nodes, reducing contention. Additionally, configuring Cloud CDN caches static content at edge locations, reducing network egress costs and latency by serving content closer to users.

Exam trap

The trap here is that candidates focus on the underutilized Cloud SQL instance and assume it is the problem, ignoring that the real bottleneck is Cloud Spanner split utilization and network egress costs, which require a different solution (split management and CDN caching).

How to eliminate wrong answers

Option A is wrong because reducing the Cloud SQL instance tier would not address the high Cloud Spanner split utilization or network egress costs; Cloud SQL is underutilized, so downsizing it does not solve the root cause. Option B is wrong because adding nodes to Cloud SQL does not fix Cloud Spanner hot spots or high egress costs; Cloud SQL is not the bottleneck. Option D is wrong because moving transactional data to Cloud Spanner would increase complexity and cost without addressing the specific split utilization and egress issues; Cloud SQL is underutilized, so decommissioning it is unnecessary and could introduce migration risks.

747
MCQeasy

You need to create a Cloud Logging sink that exports logs to a BigQuery dataset for long-term analysis. Which destination type should you specify?

A.Cloud Storage
B.BigQuery
C.Pub/Sub
D.Custom HTTP endpoint
AnswerB

BigQuery is a sink destination for logs.

Why this answer

BigQuery is a supported sink destination. Cloud Storage, Pub/Sub, and custom HTTP endpoints are also supported, but for analysis in BigQuery, you specify BigQuery as the destination.

748
MCQhard

You have a Cloud Deploy delivery pipeline with an approval gate. You want to automatically roll back a release if the rollout fails during the deploy step. How should you configure the pipeline?

A.Set an automatic rollback policy in the delivery pipeline definition
B.Use a Cloud Build post-deploy hook to check the rollout status and roll back if needed
C.Configure the approval gate to reject the deployment if it fails
D.Enable the 'rollback on failure' flag in the pipeline
AnswerA

Correct. The delivery pipeline definition supports a `rollback_policy` that automatically rolls back on deploy failure.

Why this answer

Cloud Deploy does have a built-in automatic rollback feature via the `rollback_policy` in the delivery pipeline definition. Setting this policy automatically rolls back a release if the rollout fails during the deploy step. Option B describes a custom solution that is unnecessary because the native policy exists.

Option C is incorrect because approval gates are for manual approval and cannot automatically trigger a rollback. Option D is incorrect because no such global flag exists. Therefore, option A is correct.

Exam trap

Candidates may assume Cloud Deploy lacks automated rollback, but it actually supports it via a pipeline-level rollback policy.

749
MCQeasy

Your organization wants to use Cloud SQL for a MySQL database with automatic failover in the event of a zone outage. Which configuration should you choose?

A.Set up Cloud SQL with external replication to a VM in another zone
B.Create a Cloud SQL instance with a cross-region read replica
C.Create a single-zone Cloud SQL instance with automatic backups enabled
D.Create a regional Cloud SQL instance (high availability) with a primary and standby zone
AnswerD

Regional instances provide automatic failover.

Why this answer

Cloud SQL provides high availability by creating a primary instance in one zone and a standby instance (failover replica) in another zone within the same region. Automatic failover is enabled when you create a regional Cloud SQL instance. A read replica does not provide automatic failover.

750
Multi-Selecthard

A company is designing a disaster recovery plan for a critical application running on Compute Engine with data in Cloud SQL. They require a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 5 minutes. Which THREE actions should they take? (Choose THREE.)

Select 3 answers
A.Configure a Cloud SQL cross-region replica in the DR region
B.Enable Cloud SQL automatic storage increase
C.Set up Cloud DNS failover with weighted routing
D.Create a managed instance group in the DR region
E.Use Cloud CDN to cache static content globally
AnswersA, C, D

Provides near real-time replication meeting RPO of 5 minutes.

Why this answer

Cloud SQL replica in another region provides cross-region replication with RPO of seconds to minutes. Managed instance group in the DR region allows quick failover of compute. Cloud DNS with weighted routing can direct traffic to the DR region upon failover, meeting RTO within 1 hour.

Page 9

Page 10 of 13

Page 11