Courseiva

Google Professional Cloud Architect (PCA) — Questions 751–825

955 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 10

Page 11 of 13

Page 12
751
Multi-Selecthard

An organization needs to comply with FedRAMP requirements and restrict data storage to specific regions. They also need to audit all admin activities and data access. Which three components should they implement? (Choose three.)

Select 3 answers
A.VPC Service Controls
B.Data Access audit logs
C.Cloud Armor
D.Admin Activity audit logs
E.Assured Workloads
AnswersB, D, E

Why this answer

Assured Workloads enforces compliance controls (e.g., region restrictions). Admin Activity audit logs capture administrative actions, and Data Access audit logs capture data reads/writes for compliance.

Full explanation →
752
MCQhard

Your company runs a multi-region web application on Google Kubernetes Engine (GKE) with pods that process sensitive user data. The application uses Cloud SQL for PostgreSQL as the backend database. Your security team has implemented the following controls: 1) All traffic to the database is encrypted using SSL/TLS. 2) The GKE cluster uses Workload Identity to bind Kubernetes service accounts to IAM service accounts. 3) The Cloud SQL instance is configured with a public IP address and authorized networks to allow only the GKE cluster's node IP ranges. 4) The database credentials are stored in Secret Manager and mounted as volumes in the pods. Recently, a security audit revealed that a pod was compromised due to a container vulnerability. The attacker was able to exfiltrate sensitive data directly from the Cloud SQL database using the credentials from Secret Manager. The security team wants to prevent such exfiltration in the future while minimizing changes to the application code. Which course of action should you recommend?

A.Deploy Cloud SQL Auth Proxy as a sidecar container in each pod, and configure IAM database authentication to replace static credentials.
B.Migrate the database to Cloud Spanner, which has built-in IAM integration and automatic encryption.
C.Rotate the database password and store the new password in Secret Manager, then update the application to fetch the password from Secret Manager at startup.
D.Change the Cloud SQL instance to use a private IP address and disable public access, ensuring only the GKE cluster can reach it via VPC peering.
AnswerA

Cloud SQL Auth Proxy with IAM authentication removes static credentials and uses IAM roles to control access, preventing credential exfiltration.

Why this answer

Deploying Cloud SQL Auth Proxy as a sidecar container enforces IAM-based authentication, eliminating static credentials that can be exfiltrated. The proxy also handles SSL/TLS encryption automatically and allows fine-grained access control via IAM permissions, so even if a pod is compromised, the attacker cannot reuse stolen credentials because they are tied to the pod's identity via Workload Identity. This approach requires minimal code changes since the application connects to localhost instead of the Cloud SQL public IP.

Exam trap

Google Cloud often tests the misconception that network-level controls (like private IPs) are sufficient to prevent data exfiltration from a compromised pod, but the real vulnerability is the use of static credentials that can be stolen and reused regardless of network isolation.

How to eliminate wrong answers

Option B is wrong because migrating to Cloud Spanner is a significant architectural change that requires rewriting application code and data modeling, which violates the requirement to minimize changes to the application code. Option C is wrong because rotating the password and storing it in Secret Manager does not prevent exfiltration; if a pod is compromised, the attacker can still read the new password from the mounted volume and reuse it to access the database directly. Option D is wrong because using a private IP and disabling public access only restricts network-level access; it does not prevent an attacker who has compromised a pod within the cluster from using the stored credentials to connect to the database over the private network.

Full explanation →
753
Matchingmedium

Match each GCP security service to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Manage encryption keys

Hardware security module for key protection

Store API keys, passwords, certificates

Manage access control

Centralized security and risk management

Why these pairings

Cloud Armor protects against DDoS and web attacks; IAP controls access based on identity; KMS handles encryption keys; DLP protects sensitive data. Distractors swap these functions.

Full explanation →
754
MCQhard

A company has a global web application deployed across multiple regions. They use an external HTTPS Load Balancer with backend services in us-central1 and europe-west1. They want users to be routed to the closest healthy backend. Which load balancing configuration is required?

A.Internal HTTP(S) Load Balancer
B.External HTTPS Load Balancer with global backend
C.External TCP/UDP Network Load Balancer
D.Classic Application Load Balancer
E.Regional external HTTPS Load Balancer
AnswerB

Correct. Global external HTTPS Load Balancer supports proximity-based routing.

Why this answer

An External HTTPS Load Balancer with a global backend configuration uses Google Cloud's global anycast IP and the Premium Tier network to route users to the closest healthy backend based on latency and proximity. This setup ensures that traffic from users worldwide is directed to the nearest region (us-central1 or europe-west1) with a healthy instance group, providing optimal performance and failover.

Exam trap

The trap here is that candidates often confuse 'global' with 'regional' load balancers, mistakenly thinking a regional external HTTPS load balancer can serve multiple regions, but only the global external HTTPS load balancer supports cross-region backend services with anycast routing.

How to eliminate wrong answers

Option A is wrong because an Internal HTTP(S) Load Balancer is used for traffic within a VPC network, not for external user traffic from the internet. Option C is wrong because an External TCP/UDP Network Load Balancer operates at Layer 4 and does not support HTTPS termination, content-based routing, or global backend selection across regions. Option D is wrong because Classic Application Load Balancer is a legacy GCP resource that does not support global backends or cross-region routing; it is regionally scoped.

Option E is wrong because a Regional external HTTPS Load Balancer is confined to a single region and cannot route traffic to backends in multiple regions like us-central1 and europe-west1.

Full explanation →
755
MCQmedium

An organization needs to run a stateful application on Google Kubernetes Engine (GKE) where the nodes are fully managed by Google and the application workload SLAs are guaranteed. They want to minimize operational overhead. Which GKE mode should they use?

A.GKE Standard with Cluster Autoscaler
B.GKE Standard with node auto-provisioning
C.GKE Standard with sole-tenant nodes
D.GKE Autopilot
AnswerD

Autopilot provides a fully managed cluster with workload SLAs and no node management overhead.

Why this answer

GKE Autopilot manages the entire node infrastructure including node provisioning, scaling, and maintenance. It provides workload-level SLAs (e.g., 99.95% for pods). Standard mode requires the user to manage node pools.

Full explanation →
756
MCQmedium

You want to monitor the latency of an application running on Compute Engine and create an alert if the 99th percentile latency exceeds 500ms for more than 5 minutes. Which approach should you use?

A.Use Cloud Trace to analyze latency and set a trace-based alert
B.Use Error Reporting to capture latency errors
C.Create a Metric Threshold alert using the 'Latency' metric with a percentile alignment
D.Create a log-based metric from application logs and set an alert on that metric
AnswerC

Correct. Cloud Monitoring supports distribution metrics with percentile alignments.

Why this answer

Cloud Monitoring can create alerting policies based on distribution metrics (like latency) using percentile aggregations. You can define a metric threshold with a rolling window.

Full explanation →
757
MCQmedium

A company is migrating hundreds of on-premises VMs to Compute Engine. They want to minimize manual effort and downtime. Which service should they use?

A.Cloud Build
B.gcloud compute instances import
C.Transfer Appliance
D.Migrate for Compute Engine
E.CloudEndure
AnswerD

Correct. It supports bulk migration with minimal downtime.

Why this answer

Migrate for Compute Engine (formerly Velostrata) is the correct choice because it is a fully managed service specifically designed for migrating large-scale VM workloads to Compute Engine with minimal downtime. It uses a streaming migration approach that moves the OS and application data while the source VM continues running, then performs a cutover with near-zero downtime, making it ideal for hundreds of VMs without manual effort.

Exam trap

The trap here is that candidates may confuse CloudEndure (a popular third-party migration tool) with a native Google Cloud service, or assume gcloud compute instances import is sufficient for large-scale live migrations, but the exam emphasizes using the dedicated, fully managed migration service for minimal downtime and automation.

How to eliminate wrong answers

Option A (Cloud Build) is wrong because it is a CI/CD service for building, testing, and deploying software artifacts, not for migrating on-premises VMs to Compute Engine. Option B (gcloud compute instances import) is wrong because it is a command-line tool for importing single VM images or disks, not designed for orchestrating hundreds of live VM migrations with minimal downtime. Option C (Transfer Appliance) is wrong because it is a physical hardware device for offline bulk data transfer to Google Cloud, not suitable for live VM migration with minimal downtime.

Option E (CloudEndure) is wrong because it is an AWS service (now part of AWS Application Migration Service), not a Google Cloud service; while it can migrate to GCP, it is not a native Google Cloud offering and the question asks for a service they should use, implying a Google-managed solution.

Full explanation →
758
MCQmedium

A company wants to enforce that all secrets used by applications running on Compute Engine are rotated automatically every 30 days. Which GCP service should they use to store and manage these secrets?

A.Cloud Key Management Service with CMEK
B.Secret Manager
C.Environment variables
D.Cloud KMS
AnswerB

Why this answer

Secret Manager supports automatic rotation of secrets based on a specified schedule, and applications can access the latest version without redeployment.

Full explanation →
759
MCQeasy

A company needs to deploy a stateless web application that can handle variable traffic. Which compute option is the most cost-effective and scales automatically?

A.App Engine standard environment with automatic scaling.
B.Google Kubernetes Engine (GKE) with cluster autoscaling.
C.Compute Engine with managed instance groups and autoscaling.
D.Compute Engine with preemptible VMs.
E.Cloud Run with CPU always allocated.
AnswerA

App Engine standard is serverless, cost-effective, and auto-scales.

Why this answer

App Engine standard environment with automatic scaling is the most cost-effective and automatically scales to zero when there is no traffic, making it ideal for variable traffic stateless web applications. It abstracts infrastructure management, charges only for resources used, and handles scaling instantly without provisioning overhead.

Exam trap

Google Cloud often tests the misconception that managed instance groups or GKE are always the best for autoscaling, but the trap here is that for a stateless web app with variable traffic, serverless options like App Engine standard are more cost-effective because they scale to zero and require no infrastructure management.

How to eliminate wrong answers

Option B is wrong because GKE with cluster autoscaling requires managing a Kubernetes cluster, which adds operational overhead and cost for a simple stateless web app, and it does not scale to zero. Option C is wrong because Compute Engine with managed instance groups and autoscaling still requires managing VMs and has a minimum instance count, leading to higher costs and slower scaling compared to serverless options. Option D is wrong because preemptible VMs can be terminated at any time, making them unsuitable for a production web application that needs reliability and consistent availability.

Option E is wrong because Cloud Run with CPU always allocated incurs costs even when the application is idle, whereas the default CPU-throttled mode is more cost-effective for variable traffic.

Full explanation →
760
MCQmedium

A team manages a GKE cluster with node pools using different machine types. They plan to upgrade the cluster to a new Kubernetes version. What is the safest upgrade strategy to minimize application downtime?

A.Perform a rolling upgrade by draining all nodes simultaneously.
B.Create a new cluster with the desired version and migrate workloads.
C.Use a surge upgrade to add new nodes before removing old ones.
D.Upgrade the node pool configuration one by one.
AnswerC

Surge upgrade maintains capacity during the upgrade, minimizing disruption.

Why this answer

A surge upgrade in GKE adds new nodes with the desired Kubernetes version before removing old nodes, ensuring capacity is maintained throughout the process. This minimizes application downtime by allowing pods to be rescheduled onto new nodes before old nodes are drained, following a controlled rolling update pattern that respects PodDisruptionBudgets.

Exam trap

Google Cloud often tests the misconception that draining all nodes simultaneously is a valid rolling upgrade strategy, when in fact it causes complete downtime and violates Kubernetes best practices for workload availability.

How to eliminate wrong answers

Option A is wrong because draining all nodes simultaneously would remove all running pods at once, causing complete application downtime and violating PodDisruptionBudgets if configured. Option B is wrong because creating a new cluster and migrating workloads requires manual or tool-based migration, which introduces significant operational overhead and potential downtime during the cutover, and is not the safest or most efficient strategy for an existing cluster. Option D is wrong because upgrading node pool configuration one by one does not specify a surge or rolling mechanism; without surge, it would drain nodes in the pool sequentially, potentially causing capacity shortages and downtime if the pool is under-provisioned.

Full explanation →
761
MCQhard

A company has a multi-region deployment of App Engine and wants to optimize request routing for latency and cost. Which GCP service should they use?

A.Cloud Endpoints.
B.Cloud Load Balancing with global anycast.
C.Cloud DNS with latency-based routing.
D.Cloud Traffic Director.
AnswerB

Global load balancing directs users to the closest healthy backend, minimizing latency and balancing cost.

Why this answer

Cloud Load Balancing with global anycast uses Google's global network and anycast IP addresses to route user traffic to the nearest healthy backend, minimizing latency. It also supports premium tier routing for lower latency and standard tier for lower cost, directly addressing the optimization goals for a multi-region App Engine deployment.

Exam trap

The trap here is that candidates often confuse Cloud DNS latency-based routing (a DNS-level, cache-prone approach) with true anycast-based global load balancing, which provides immediate, health-aware routing without DNS caching delays.

How to eliminate wrong answers

Option A is wrong because Cloud Endpoints is an API management service for securing, monitoring, and managing APIs, not a global load balancer for routing traffic across regions based on latency and cost. Option C is wrong because Cloud DNS with latency-based routing is a DNS-level feature that can direct traffic based on latency, but it lacks the fine-grained health checking, anycast IP, and traffic splitting capabilities of a global load balancer, and DNS caching can cause routing delays. Option D is wrong because Cloud Traffic Director is a traffic management service for service mesh (e.g., with Istio on GKE), not designed for global HTTP(S) load balancing to App Engine; it operates at the service mesh layer, not the edge.

Full explanation →
762
MCQmedium

Refer to the exhibit. A user reports that the instance 'batch-vm' is unavailable. Based on the output, what is the most likely cause of the unavailability?

A.The VM was stopped manually by a user.
B.The preemptible VM was terminated by Google due to its preemptible nature.
C.The VM lost its external IP address.
D.The VM crashed due to an out-of-memory error.
AnswerB

Preemptible instances can be terminated at any time, and the status is TERMINATED.

Why this answer

The exhibit shows the instance 'batch-vm' with a status of 'TERMINATED' and the 'preemptible' flag set to 'true'. Preemptible VMs in Google Cloud have a maximum runtime of 24 hours and can be terminated at any time by Google Compute Engine due to resource constraints. The termination reason is typically 'preemption', which matches the scenario of a user reporting unavailability without manual intervention.

Exam trap

Google Cloud often tests the distinction between 'STOPPED' (user-initiated, billable for attached resources) and 'TERMINATED' (preempted or deleted, no longer billable), and candidates confuse preemption with a manual stop or a crash.

How to eliminate wrong answers

Option A is wrong because a manual stop would show the VM status as 'STOPPED' (not 'TERMINATED') and would not be caused by Google's infrastructure; the exhibit does not indicate any user-initiated stop action. Option C is wrong because losing an external IP address does not terminate a VM; the VM would still be running (status 'RUNNING') but inaccessible via that IP, and the exhibit shows the VM as 'TERMINATED'. Option D is wrong because an out-of-memory error would cause the VM to become unresponsive or crash, but the VM would remain in a 'RUNNING' or 'STOPPING' state, not transition to 'TERMINATED'; termination is a distinct lifecycle state typically triggered by preemption, deletion, or explicit stop.

Full explanation →
763
MCQhard

A company is running a stateful application on Compute Engine with local SSDs for low-latency writes. They want to perform a rolling update without losing data stored on the local SSDs. Which strategy is MOST appropriate?

A.Perform a rolling update using a managed instance group with a canary target; data on local SSDs will be preserved because the instance is only updated.
B.Use a stateful managed instance group with preserved local SSDs.
C.Snapshot the local SSDs before the update and restore after each instance update.
D.Migrate the application to use persistent disks for data storage, then perform rolling updates.
AnswerD

Persistent disks survive instance termination, enabling rolling updates without data loss.

Why this answer

Local SSDs are ephemeral; data is lost when the instance stops. To persist data, use persistent disks or migrate data to a persistent disk first. Rolling updates with local SSDs will lose data on terminated instances.

The best approach is to change the application to use persistent disks, which survive instance termination.

Full explanation →
764
MCQmedium

A company wants to analyze the total cost of ownership (TCO) for migrating their on-premises data center to Google Cloud. They need to compare compute, storage, and network costs, including operational expenses like maintenance and power. Which tool should they use?

A.Google Cloud Pricing Calculator
B.Cloud Billing reports
C.Active Assist cost optimization recommendations
D.Google Cloud TCO Calculator
AnswerD

The TCO Calculator is specifically designed to compare on-prem costs (including operational) with Google Cloud costs.

Why this answer

Google Cloud's TCO calculator allows you to input on-premises infrastructure details and estimate cloud costs, including compute, storage, network, and operational savings. The Pricing Calculator is for estimating cloud costs but does not compare on-prem vs cloud. Active Assist is for optimization recommendations, not TCO analysis.

Full explanation →
765
MCQmedium

A company runs a stateful application on GKE that requires persistent storage. They want to ensure that during cluster upgrades, pods are not disrupted and storage is preserved. Which configuration should they use?

A.Enable Cluster Autoscaler on the node pool
B.Use a Deployment with a HorizontalPodAutoscaler
C.Use a StatefulSet with a PodDisruptionBudget
D.Use PersistentVolumeClaims with ReadWriteMany access mode
AnswerC

StatefulSets provide stable persistent storage for each pod, and PodDisruptionBudgets prevent voluntary disruptions during cluster upgrades.

Why this answer

PodDisruptionBudgets (PDBs) ensure that a minimum number of pods remain available during voluntary disruptions like cluster upgrades. PersistentVolumeClaims with ReadWriteOnce access mode allow pods to persist data. Combining PDBs with StatefulSets provides ordered, graceful deployment and scaling while preserving storage.

The cluster autoscaler only adjusts node count, not pod disruptions. HorizontalPodAutoscaler scales pods based on metrics but does not protect against disruptions.

Full explanation →
766
MCQhard

A company runs a Bigtable instance for real-time analytics. They notice increasing latency for point reads. The row key pattern is 'YYYYMMDD_userID_productID'. The team suspects read hotspots. Which row key design change would BEST distribute the load across tablets?

A.Prepend a random number field: 'random_YYYYMMDD_userID_productID'
B.Reorder to 'userID_productID_YYYYMMDD'
C.Keep the same order but use a shorter timestamp: 'YYMMDD_userID_productID'
D.Reverse the timestamp: 'DDMMYYYY_userID_productID'
AnswerB

By moving user ID first, reads for a specific user are spread across many tablets. If different users are read concurrently, load is distributed.

Why this answer

Using a field prefix (like user ID) before the timestamp distributes reads across tablets because Bigtable orders rows lexicographically. If the timestamp is first, recent data falls into a single tablet, causing hotspots. Reversing the timestamp or hashing the row key are also common strategies.

Salting with a random prefix is another approach.

Full explanation →
767
MCQmedium

A team wants to provide a consistent, low-latency experience for global users accessing static content (images, CSS, JS) hosted on Cloud Storage. They also need to be able to invalidate cached content quickly when updates occur. Which service should they use?

A.Cloud NAT
B.Cloud Load Balancing with backend bucket
C.Cloud Storage transfer service
D.Cloud CDN
AnswerD

Cloud CDN caches static content globally and supports cache invalidation via the console or CLI.

Why this answer

Cloud CDN caches content at edge locations for low latency. Cache invalidation allows purging updated content, which is essential for static assets.

Full explanation →
768
MCQmedium

A company is designing a VPC Service Controls perimeter to protect data stored in Google Cloud. They need to allow access from their on-premises network via a Cloud VPN tunnel while blocking all internet-based access. What is the most secure and manageable approach?

A.Configure firewall rules to only allow traffic from the on-premises CIDR to the VPC.
B.Use Cloud VPN and Private Google Access to allow on-premises access without public IPs.
C.Configure a VPC Service Controls perimeter and create an access level that includes the on-premises CIDR range.
D.Use Cloud IAP (Identity-Aware Proxy) to restrict access based on identity and context.
AnswerC

VPC Service Controls with an access level effectively restricts API access to the allowed CIDR, preventing data exfiltration via the internet.

Why this answer

VPC Service Controls (VPC SC) is the only Google Cloud-native mechanism that can create a security perimeter around managed services (like Cloud Storage, BigQuery) and restrict access based on an access level that includes the on-premises CIDR range. This ensures that only traffic originating from the on-premises network (via the Cloud VPN tunnel) is allowed, while all internet-based access is blocked, even if the request uses valid credentials. Firewall rules alone cannot restrict access to Google-managed APIs, and Private Google Access does not enforce a perimeter around services.

Exam trap

The trap here is that candidates often confuse network-level controls (firewall rules, Private Google Access) with service-level perimeter controls, mistakenly believing that blocking traffic at the VPC level is sufficient to protect Google-managed APIs that are accessed via external endpoints.

How to eliminate wrong answers

Option A is wrong because firewall rules only control traffic at the VPC network level and cannot block access to Google-managed APIs (e.g., Cloud Storage, BigQuery) that are accessed via external IPs; they do not create a service perimeter. Option B is wrong because Private Google Access allows on-premises traffic to reach Google APIs via private IPs but does not block internet-based access to those same APIs; it lacks the ability to define a perimeter that denies all external traffic. Option D is wrong because Cloud IAP controls access based on identity and context at the application layer, but it does not enforce network-level perimeter controls and cannot block access from the internet to the underlying Google Cloud services (e.g., Cloud Storage buckets) that are not fronted by IAP.

Full explanation →
769
Multi-Selecteasy

A company runs a batch processing job that uses preemptible VMs. The job occasionally fails due to VM preemption. They want to improve reliability without significantly increasing cost. Which TWO actions should they take? (Choose TWO.)

Select 2 answers
A.Use a managed instance group with autoscaling and preemptible VMs
B.Use sole-tenant nodes to reduce risk of preemption
C.Switch to regular (non-preemptible) VMs
D.Implement a retry mechanism in the job to re-run failed tasks
E.Increase the number of preemptible VMs
AnswersA, D

MIGs can automatically replace preempted VMs, and autoscaling adds resilience. Preemptible VMs keep costs low.

Why this answer

Using a managed instance group (MIG) with autoscaling and preemptible VMs can automatically recreate instances if preempted. Implementing a retry logic in the application to re-run failed tasks also improves reliability. Using sole-tenant nodes or adding more nodes increases cost or complexity.

Switching to regular VMs increases cost.

Full explanation →
770
Multi-Selecthard

A company is moving a legacy application to Compute Engine. The application has inconsistent resource usage and the team wants to optimise costs without performance degradation. They are evaluating committed use discounts (CUDs) and other discount types. Which THREE statements are correct about CUDs? (Choose 3)

Select 3 answers
A.CUDs require a minimum of 10 instances to qualify
B.Spend-based CUDs are applied automatically to all eligible projects in the billing account
C.CUDs cannot be combined with sustained use discounts
D.CUDs provide a discount in exchange for committing to a minimum spend or resource usage for 1 or 3 years
E.Resource-based CUDs apply to a specific machine series and region
AnswersB, D, E

Spend-based CUDs apply at the billing account level.

Why this answer

CUDs offer discounts for 1-year or 3-year commitments. Resource-based CUDs apply to specific machine types in a region. Spend-based CUDs apply to total compute spend.

CUDs can be combined with sustained use discounts, but sustained use discounts are automatic and not required to be purchased.

Full explanation →
771
MCQmedium

Refer to the exhibit. A load balancer forwards HTTPS traffic to a target pool with two instances. The health check is configured on port 80 with path /health. Some users report intermittent connection errors. What is the most likely cause?

A.The health check path /health does not exist on the backend instances.
B.The health check is using HTTP but the backend instances only serve HTTPS, causing them to be marked unhealthy.
C.The load balancer's IP address is not reachable from the internet.
D.The instances are in different zones, causing latency.
AnswerB

The health check is configured on port 80 with HTTP, but the load balancer forwards HTTPS (port 443). If the instances only listen on HTTPS (port 443), the health check on port 80 will fail, marking instances unhealthy and causing connection errors.

Why this answer

The health check is configured to use HTTP on port 80, but the backend instances only serve HTTPS. When the load balancer sends an HTTP GET request to /health on port 80, the instances either reject the connection or fail to respond correctly, causing the health check to fail. This marks the instances as unhealthy, leading to intermittent connection errors as traffic is not forwarded to them.

Exam trap

Google PCA often tests the subtle distinction between the health check protocol and the backend serving protocol, where candidates assume that a health check on port 80 with HTTP will work regardless of whether the backend expects HTTPS, leading them to overlook the protocol mismatch.

How to eliminate wrong answers

Option A is wrong because even if the /health path does not exist, the health check would still receive an HTTP response (e.g., 404), which could still be considered healthy depending on the health check configuration; the core issue is the protocol mismatch, not the path. Option C is wrong because the load balancer's IP address is reachable from the internet (users are reporting intermittent errors, not total failure), and the problem lies in the health check configuration, not external reachability. Option D is wrong because instances in different zones do not inherently cause latency that would result in health check failures or intermittent connection errors; Google Cloud load balancers handle cross-zone traffic efficiently.

Full explanation →
772
MCQmedium

A team is migrating a monolithic application to microservices on GKE. They want to gradually shift users to the new microservices version while keeping the old monolithic version running. They need to route a small percentage of users based on a cookie. Which traffic management approach should they use?

A.Use Istio VirtualService with match rules based on cookie and weighted destinations
B.Use Kubernetes Services with multiple Deployments and manual scaling
C.Configure an HTTP(S) load balancer with URL maps and backend services
D.Deploy two separate GKE clusters and use DNS-based traffic splitting
AnswerA

Istio supports cookie-based matching and weighted routing, enabling canary deployments.

Why this answer

Istio traffic management allows fine-grained routing based on HTTP headers, cookies, or other attributes. It supports traffic splitting and canary deployments with precise percentage control.

Full explanation →
773
MCQhard

A company runs a stateful application on Compute Engine with persistent disks. They want to ensure data durability across a zone failure. What is the best approach?

A.Replicate data at application level to another instance in a different zone
B.Use Google Cloud NetApp Volumes with replication
C.Use regional persistent disks
D.Take regular snapshots of the persistent disks and store them in a multiregional bucket
AnswerC

Regional PDs replicate data across zones with synchronous writes, ensuring durability.

Why this answer

Regional persistent disks (RPDs) synchronously replicate data between two zones in the same region, providing an RPO of zero and automatic failover without application-level changes. This ensures data durability across a zone failure while maintaining consistent performance and low latency.

Exam trap

Google Cloud often tests the distinction between synchronous replication (regional persistent disks) and asynchronous backup (snapshots), leading candidates to choose snapshots for durability when they actually need zero RPO across a zone failure.

How to eliminate wrong answers

Option A is wrong because replicating data at the application level adds complexity, latency, and requires custom code, whereas Compute Engine offers a managed, synchronous replication solution. Option B is wrong because Google Cloud NetApp Volumes is a third-party service that is not natively integrated with Compute Engine for this use case and introduces additional cost and management overhead. Option D is wrong because regular snapshots stored in a multiregional bucket provide point-in-time recovery but have an RPO of minutes to hours and do not offer synchronous replication, so data written between snapshots is lost during a zone failure.

Full explanation →
774
MCQhard

A company uses Cloud Bigtable for time-series data. They experience high latency and uneven load distribution across nodes. What is the most likely cause?

A.The data is stored in a single column family
B.The app is using strong reads instead of eventual consistency
C.The table has a single row key pattern that causes hot spotting
D.The cluster has too many nodes
AnswerC

Sequential row keys lead to hot spots.

Why this answer

Cloud Bigtable partitions data by row key range and distributes tablets across nodes. A single row key pattern (e.g., monotonically increasing timestamps) causes all writes to target the same tablet, creating a hot spot. This leads to uneven load distribution and high latency because one node is overwhelmed while others remain idle.

Exam trap

Google Cloud often tests the misconception that column families or read consistency levels are the root cause of performance issues, when in fact row key design is the primary driver of load distribution in Bigtable.

How to eliminate wrong answers

Option A is wrong because storing data in a single column family does not cause uneven load distribution; column families affect storage and read performance but not row key distribution. Option B is wrong because strong reads (read-after-write consistency) add latency but do not cause uneven load distribution across nodes; the issue is about write hot spotting, not read consistency. Option D is wrong because having too many nodes would reduce load per node, not increase latency or cause uneven distribution; the cluster would be over-provisioned, not hot-spotted.

Full explanation →
775
MCQhard

A company runs multiple microservices on Cloud Run. Each service uses a Serverless VPC Access connector to connect to a shared Cloud Memorystore for Redis instance (standard tier) in a VPC network. The Redis instance is configured with a firewall rule that allows TCP connections on port 6379 from the VPC connector's subnet (10.8.0.0/28). After a recent code update, the order-service fails to connect to Redis, while the user-service continues to work. The error logs in order-service show 'connection refused'. The engineer verifies that both services use the same VPC connector, the same Redis instance IP, and the same service account. The VPC connector's metrics show no errors. What is the most likely cause?

A.The order-service is deployed in a different region than the Redis instance.
B.The order-service code now attempts to connect to Redis on port 6380.
C.The VPC connector is out of memory.
D.The Redis instance has reached its maximum number of connections.
AnswerB

A port mismatch would cause connection refused only for the affected service, while the firewall rule only permits port 6379.

Why this answer

The order-service successfully connects to the same Redis instance before the code update. After the update, it fails with 'connection refused', while the user-service still works. Since both services share the same networking configuration and the firewall only allows port 6379, the most likely cause is that the order-service code now attempts to connect on a different port (e.g., 6380) that is not allowed by the firewall.

Other options would affect both services or are inconsistent with the symptoms.

Full explanation →
776
MCQmedium

A company needs to run a batch job that processes data stored in Cloud Storage. The job runs once per day and takes about 2 hours on 8 vCPUs. Cost is the primary concern, and the job can be interrupted. Which compute option is MOST cost-effective?

A.Standard VM (on-demand)
B.Spot VM
C.Preemptible VM
D.Sole-tenant node
AnswerC

Preemptible VMs offer the lowest cost for fault-tolerant batch jobs.

Why this answer

Preemptible VMs (the predecessor to Spot VMs in GCP) are the most cost-effective option for batch workloads that can tolerate interruptions because they offer up to 80% discount compared to standard on-demand VMs. Since the job runs once per day for only 2 hours and can be interrupted, Preemptible VMs are ideal—they can be terminated at any time by GCP, but the job can be retried or resumed. Spot VMs are the modern equivalent, but Preemptible VMs are still available and are explicitly designed for fault-tolerant, short-lived batch processing.

Exam trap

Candidates often confuse Preemptible VMs and Spot VMs in Google Cloud. Spot VMs are the newer offering, but Preemptible VMs are still available and are explicitly designed for fault-tolerant, short-lived batch processing. Since the question explicitly lists Preemptible VMs as an option, it is the correct answer for cost-sensitive, interruptible batch jobs.

How to eliminate wrong answers

Option A is wrong because Standard on-demand VMs are the most expensive compute option and are not cost-optimized for interruptible batch jobs. Option B is wrong because Spot VMs are the current GCP offering that replaced Preemptible VMs; while they are also cost-effective, the question specifically lists Preemptible VM as a distinct option, and Preemptible VMs are the original, slightly cheaper (no dynamic pricing) alternative for short-lived batch jobs. Option D is wrong because Sole-tenant nodes are dedicated physical servers used for licensing or compliance requirements, and they are significantly more expensive than shared VMs, making them unsuitable for cost-sensitive, interruptible workloads.

Full explanation →
777
MCQmedium

A data engineer needs to analyze data in BigQuery but must mask personally identifiable information (PII) based on user roles. Which service should they use?

A.BigQuery column-level security
B.Cloud Key Management Service
C.Cloud Data Catalog
D.Cloud Data Loss Prevention (DLP)
AnswerA

BigQuery column-level security with data masking can restrict PII based on roles.

Why this answer

BigQuery column-level security allows you to apply fine-grained access controls to specific columns containing PII, such as by using policy tags to restrict access based on user roles. This directly meets the requirement to mask sensitive data in BigQuery without moving or duplicating data, as it integrates with Cloud IAM to enforce role-based access at query time.

Exam trap

A common trap in Google PCA exams is confusing Cloud DLP (which is for classification and de-identification before data storage) with BigQuery column-level security (which provides runtime access control based on roles). DLP does not enforce role-based masking at query time; column-level security with policy tags does.

How to eliminate wrong answers

Option B (Cloud Key Management Service) is wrong because it manages encryption keys for data at rest or in transit, not role-based masking or access control at the column level in BigQuery. Option C (Cloud Data Catalog) is wrong because it is a metadata management and discovery service for tagging and searching assets, not a tool for enforcing data masking or access policies. Option D (Cloud Data Loss Prevention) is wrong because while it can inspect and classify PII, it is not a runtime access control service; it is typically used for scanning and de-identification before ingestion, not for dynamic role-based masking within BigQuery queries.

Full explanation →
778
Multi-Selectmedium

A company runs a web application on Compute Engine behind an HTTP load balancer. They want to improve reliability by implementing failover across two regions. Which TWO actions should they take?

Select 2 answers
A.Deploy a global external HTTP load balancer with backends in both regions.
B.Configure a backend service with a failover policy pointing to primary and secondary backends.
C.Configure DNS-based failover using Cloud DNS with health checks.
D.Use an internal load balancer to route traffic between regions.
E.Use a regional external HTTP load balancer with a multi-region backend.
AnswersA, B

Global load balancer automatically routes to healthy backends, providing cross-region failover.

Why this answer

A global external HTTP load balancer is required for cross-region failover because it uses a single anycast IP address and routes traffic to the closest healthy backend. By deploying backends in both regions, the load balancer automatically fails over to the secondary region if the primary region's backends become unhealthy, improving reliability without DNS propagation delays.

Exam trap

The trap here is that candidates confuse DNS-based failover (which is slow and not recommended for HTTP load balancing) with the instant, anycast-based failover of a global load balancer, or mistakenly think a regional load balancer can span multiple regions.

Full explanation →
779
MCQeasy

A developer is writing a Cloud Function that processes files uploaded to a Cloud Storage bucket. Which trigger should they use?

A.HTTP trigger
B.Firestore trigger
C.Cloud Storage trigger
D.Pub/Sub trigger
AnswerC

A Cloud Storage trigger fires on object changes.

Why this answer

Cloud Functions can be triggered by Cloud Storage events such as object finalize, delete, etc.

Full explanation →
780
Multi-Selectmedium

Your organization is implementing a Disaster Recovery plan for a critical database. Which THREE components are essential for a robust DR strategy? (Choose 3)

Select 3 answers
A.A single global load balancer for both regions.
B.Automated failover process to switch traffic to the DR region.
C.Data replication strategy (synchronous or asynchronous) to a secondary region.
D.Regular DR drills (testing failover at least once per quarter).
E.Using a single zone for the primary region.
AnswersB, C, D

Automation minimizes manual errors and reduces RTO.

Why this answer

An automated failover process is essential for minimizing Recovery Time Objective (RTO) in a Disaster Recovery strategy. Without automation, manual intervention introduces delays and risks of human error, which can extend downtime significantly. In cloud or on-premises environments, automated failover typically relies on health checks, DNS updates, or traffic manager rules to seamlessly redirect traffic to the DR region when the primary fails.

Exam trap

Google Cloud often tests the misconception that a single global load balancer provides high availability, when in fact it becomes a single point of failure unless it is itself deployed in a redundant, multi-region architecture.

Full explanation →
781
MCQeasy

Which Google Cloud service allows organizations to define perimeters that protect resources and data from exfiltration to other VPCs or networks?

A.Private Service Connect
B.Identity-Aware Proxy (IAP)
C.Cloud Armor
D.VPC Service Controls
AnswerD

VPC Service Controls create service perimeters to protect data from exfiltration.

Why this answer

VPC Service Controls allow you to define service perimeters that restrict access to managed services from outside the perimeter, preventing data exfiltration.

Full explanation →
782
Multi-Selecthard

A company uses Terraform to manage infrastructure. They want to store the Terraform state file remotely and enable state locking to prevent concurrent modifications. Which three Google Cloud services or features should they use? (Choose three.)

Select 3 answers
A.Object versioning on the state bucket
B.Cloud Storage
C.Cloud NAT
D.Cloud Shell
E.Cloud KMS
AnswersA, B, E

Versioning enables state history and helps prevent conflicts through generation locking.

Why this answer

Cloud Storage is used as a backend for Terraform state. Object versioning provides history and locking via the storage object's generation number. Cloud KMS can encrypt the state file.

Cloud NAT is for outbound connectivity. Cloud Shell is not required for state management. Secret Manager is for secrets, not state.

Full explanation →
783
MCQhard

An organization is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single server with an on-premises database. The application is stateful and requires low-latency access to the database. The migration must minimize downtime and ensure high availability. Which architecture should the company adopt?

A.Deploy on GKE with StatefulSets and use Cloud Spanner for global consistency.
B.Deploy on Compute Engine with a regional persistent disk and use Cloud SQL for PostgreSQL with regional high availability.
C.Deploy on App Engine Standard Environment and use Cloud Firestore in Datastore mode.
D.Deploy on Cloud Run and use Cloud SQL with read replicas.
AnswerB

This provides HA and low-latency access needed for the stateful monolithic app.

Why this answer

It combines Compute Engine with a regional persistent disk for synchronous replication across zones, ensuring high availability with minimal downtime during a zonal failure. Cloud SQL for PostgreSQL with regional high availability provides a managed, low-latency database with automatic failover, meeting the stateful application's need for low-latency access and high availability without the complexity of container orchestration.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing containerized or serverless options (GKE, Cloud Run, App Engine) without recognizing that a legacy monolithic stateful application with low-latency requirements is best served by a simple, proven VM-based architecture with regional persistent disks and a managed relational database with synchronous replication.

How to eliminate wrong answers

Option A is wrong because GKE with StatefulSets introduces orchestration overhead and potential downtime during cluster upgrades or node failures, and Cloud Spanner, while globally consistent, adds latency and cost overkill for a single-region low-latency requirement. Option C is wrong because App Engine Standard Environment is stateless by design and does not support stateful applications with persistent local storage, and Cloud Firestore in Datastore mode is a NoSQL database that does not provide the relational consistency and low-latency access expected from a legacy monolithic database. Option D is wrong because Cloud Run is stateless and ephemeral, requiring external storage for state, and Cloud SQL with read replicas does not provide synchronous replication for high availability; read replicas are asynchronous and cannot guarantee zero data loss during a failover.

Full explanation →
784
MCQmedium

A company uses Cloud Storage to store backup files. They need to retain backups for 7 years and must be able to recover deleted or overwritten files within that period. Which Cloud Storage feature should they enable?

A.Object retention policy
B.Lifecycle management
C.Object versioning
D.Uniform bucket-level access
AnswerC

Versioning keeps all versions, allowing recovery of deleted or overwritten objects.

Why this answer

Object versioning keeps multiple versions of an object, allowing recovery from deletion or overwrite. Object retention policies prevent deletion but do not allow recovery of overwritten versions. Lifecycle management is for automation.

Uniform bucket-level access is for permissions.

Full explanation →
785
Multi-Selectmedium

A company is deploying a critical application on GKE and wants to ensure high availability during node upgrades and failures. Which TWO configurations should they implement? (Choose 2.)

Select 2 answers
A.Enable Workload Identity for the service account
B.Configure a PodDisruptionBudget for the deployment
C.Create a multi-zonal node pool to spread nodes across multiple zones
D.Use a HorizontalPodAutoscaler with high target utilization
E.Enable Cluster Autoscaler on the node pool
AnswersB, C

PDB ensures that voluntary disruptions (e.g., upgrades) do not bring all pods down.

Why this answer

PodDisruptionBudgets (PDBs) ensure that a minimum number of pods remain available during voluntary disruptions like node upgrades. Multi-zonal node pools distribute pods across zones, protecting against zone failures. Cluster Autoscaler adds nodes when needed but does not directly ensure availability.

HPA scales pods but does not handle disruptions. Workload Identity is for authentication, not availability.

Full explanation →
786
MCQmedium

A company wants to deploy a containerized microservices application on GCP with minimal operational overhead. They need automatic scaling, no node management, and pay only for requested resources. Which compute option is most appropriate?

A.GKE Standard with node auto-provisioning
B.Cloud Run
C.GKE Autopilot
D.App Engine Flexible Environment
AnswerB

Cloud Run is fully managed, no nodes to manage, scales to zero, and billing per request.

Why this answer

Cloud Run is a fully managed serverless container platform that scales automatically, requires no node management, and charges per request.

Full explanation →
787
MCQmedium

A company is using Cloud Spanner to serve a global gaming application. They have a single instance in us-central1. Players in Asia experience high latency. The application reads and writes player profiles. The team wants to reduce latency for Asian players while keeping write latency low for global consistency. They need a solution that minimizes operational overhead and uses native Spanner capabilities. What should they do?

A.Configure a multi-region instance configuration that includes us-central1 and an Asian region.
B.Add read replicas in Asia using Spanner's read-only replicas.
C.Use Cloud CDN to cache player profiles at the edge.
D.Create a new instance in asia-east1 and use Directed Read options to route reads from Asia.
AnswerA

Multi-region configuration provides read-write replicas in Asia, reducing both read and write latency.

Why this answer

A multi-region instance configuration in Cloud Spanner is the correct solution because it provides a single writable instance that spans multiple geographic regions, allowing reads and writes to be served locally in each region while maintaining strong global consistency. This minimizes latency for Asian players by enabling local reads and writes, and it uses native Spanner capabilities without additional operational overhead. Option A directly addresses the requirement for low write latency and global consistency by leveraging Spanner's built-in multi-region replication.

Exam trap

The trap here is that candidates may confuse Spanner's multi-region configuration with read replicas or separate instances, not realizing that Spanner's native multi-region setup provides both local reads and writes with strong consistency, unlike other databases that require separate read replicas or caching layers.

How to eliminate wrong answers

Option B is wrong because Spanner does not support read-only replicas; it uses a single writable instance with synchronous replication across regions, and adding read-only replicas is not a native Spanner capability. Option C is wrong because Cloud CDN caches static content at the edge, but player profiles are dynamic, frequently updated data that requires strong consistency, which CDN cannot provide. Option D is wrong because creating a separate instance in Asia would require cross-instance replication and would not maintain global consistency; Directed Read options are for read-only replicas in Bigtable, not Spanner.

Full explanation →
788
MCQmedium

A company has Compute Engine instances in us-east1-a and us-east1-b zones. They want to allow communication between these instances with minimal latency and no additional cost. What is the best networking approach?

A.Configure VPC Network Peering between two separate VPC networks.
B.Use a single VPC network that includes both zones.
C.Create a new subnet in each zone and use Cloud NAT.
D.Set up a Cloud VPN between the zones.
AnswerB

Instances in the same VPC network can communicate using internal IPs with low latency.

Why this answer

A single VPC network spans all regions and zones, allowing instances in different zones (us-east1-a and us-east1-b) to communicate using internal IP addresses with low latency and no additional cost. This is because VPC networks provide flat, global networking by default, and traffic between zones within the same VPC uses Google's internal backbone without incurring egress charges.

Exam trap

The trap here is that candidates may overcomplicate the solution by thinking they need separate networks or VPNs for zone-to-zone communication, when in fact a single VPC inherently supports flat, cost-free internal connectivity across zones.

How to eliminate wrong answers

Option A is wrong because VPC Network Peering is used to connect separate VPC networks, which adds complexity and is unnecessary when instances are in the same VPC; it also does not reduce latency or cost compared to a single VPC. Option C is wrong because Cloud NAT is designed for outbound internet access from private instances, not for inter-zone communication, and it would introduce additional latency and cost. Option D is wrong because Cloud VPN is a site-to-site VPN solution for connecting on-premises networks or different VPCs across regions, not for intra-VPC zone-to-zone communication, and it adds latency and cost.

Full explanation →
789
MCQmedium

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) with autoscaling. During a traffic spike, some instances become unhealthy but are not automatically replaced. What is the most likely cause?

A.The MIG is regional and one zone failed.
B.The autohealing health check is misconfigured.
C.The instance template has a startup script error.
D.The HTTP load balancer's health check is failing.
AnswerB

MIG autohealing relies on a health check to detect unhealthy instances and replace them; a misconfiguration prevents detection.

Why this answer

The most likely cause is that the autohealing health check is misconfigured. In a managed instance group, autohealing relies on a health check to detect unhealthy instances and trigger replacement. If the health check is misconfigured (e.g., wrong port, path, or protocol), the MIG will not recognize instances as unhealthy and will not automatically replace them, even during a traffic spike.

Exam trap

Google Cloud often tests the distinction between the MIG's autohealing health check and the load balancer's health check, leading candidates to incorrectly attribute instance replacement failures to load balancer issues rather than the MIG's own health check configuration.

How to eliminate wrong answers

Option A is wrong because a regional MIG with a single zone failure would still trigger autohealing in the remaining healthy zones, and the MIG would replace instances in the failed zone if the health check is correctly configured. Option C is wrong because a startup script error would cause instances to fail at boot, but the MIG would still attempt to replace them based on the health check; the issue is not about the template but the detection mechanism. Option D is wrong because the HTTP load balancer's health check is separate from the MIG's autohealing health check; a failing load balancer health check does not prevent the MIG from replacing unhealthy instances if its own health check is properly configured.

Full explanation →
790
Multi-Selecteasy

A startup deploys a microservices application on GKE. They need to ensure high availability of the services. Which two strategies should they implement? (Choose TWO.)

Select 2 answers
A.Use horizontal pod autoscaling
B.Use regional persistent disks for stateful components
C.Use node auto-repair
D.Deploy the application across multiple zones in a region
E.Use cluster autoscaler
AnswersB, D

Regional PDs replicate data synchronously across zones.

Why this answer

Regional persistent disks provide synchronous replication across two zones within a region, ensuring that stateful workloads (e.g., databases) remain available even if an entire zone fails. This is critical for high availability of stateful components in a GKE cluster, as it prevents data loss and allows pods to be rescheduled in another zone with the same persistent volume.

Exam trap

The trap here is that candidates often confuse auto-scaling mechanisms (HPA, cluster autoscaler) with high availability, failing to recognize that true HA requires redundancy across failure domains (zones) and persistent storage that survives zone outages.

Full explanation →
791
Multi-Selecteasy

A company uses Cloud Build to automate their CI/CD pipeline. They want to optimize the build process for a Java application. Which three practices should they adopt? (Choose three.)

Select 3 answers
A.Parallelize independent build steps by using Cloud Build's step parallelism or by splitting into multiple builds.
B.Store Maven dependencies in a private repository in Artifact Registry for faster access.
C.Use Docker layer caching with Cloud Build by specifying a cached image.
D.Use a custom build step that downloads all tools from the internet each time.
E.Use a high-CPU machine type (e.g., n1-highcpu-64) for faster compilation.
AnswersA, B, C

Reduces overall build time.

Why this answer

Cloud Build allows you to define build steps that run sequentially by default, but you can parallelize independent steps by using the `waitFor` field to specify dependencies. This reduces total build time by running non-dependent steps concurrently, which is a key optimization for CI/CD pipelines. Splitting into multiple builds is also a valid approach for parallel execution.

Exam trap

Google Cloud often tests the misconception that you can arbitrarily choose high-CPU machine types in Cloud Build, but Cloud Build does not support custom machine types in its standard configuration—this is a trap where candidates confuse Cloud Build with Compute Engine or other GCP services.

Full explanation →
792
Multi-Selectmedium

A company is moving a legacy monolithic application to a microservices architecture on Google Cloud. They want to minimize operational overhead and automatically scale each service independently. Which TWO compute services should they consider? (Choose two.)

Select 2 answers
A.Cloud Run
B.Compute Engine with managed instance groups
C.Google Kubernetes Engine (GKE) Standard
D.Cloud Functions
E.Google Kubernetes Engine (GKE) Autopilot
AnswersA, E

Cloud Run automatically scales each container service independently with zero overhead.

Why this answer

Cloud Run and GKE Autopilot both offer automatic scaling and reduced operational overhead. Cloud Run is serverless for containers; GKE Autopilot manages the cluster infrastructure. Compute Engine requires manual scaling.

Cloud Functions is for functions, not full services. GKE Standard requires node management.

Full explanation →
793
Multi-Selectmedium

A company wants to improve the performance of their Cloud SQL for PostgreSQL instance. They notice many idle connections and slow queries. Which THREE actions could help? (Choose 3)

Select 3 answers
A.Add appropriate indexes
B.Add read replicas
C.Use PgBouncer for connection pooling
D.Enable private IP
E.Increase disk size
AnswersA, B, C

Speeds up slow queries.

Why this answer

PgBouncer reduces connection overhead. Read replicas offload read queries. Adding indexes speeds up queries.

Private IP improves security and latency but not performance. Increasing disk size helps if I/O bottleneck, but not connection or query performance.

Full explanation →
794
MCQmedium

An application uses Cloud Pub/Sub for asynchronous processing. Subscribers occasionally fail to acknowledge messages within the ack deadline, causing redelivery. How to improve reliability and prevent message buildup?

A.Increase the ack deadline to the maximum value
B.Set max delivery attempts to 1 to avoid redelivery
C.Implement exponential backoff in the subscriber retry logic
D.Use a dead-letter topic to capture failed messages
AnswerC

Exponential backoff allows the subscriber to retry after increasing delays, handling transient failures effectively.

Why this answer

Implementing exponential backoff in the subscriber retry logic allows the subscriber to gradually increase the delay between retries when messages are not acknowledged, reducing the likelihood of overwhelming the system and preventing message buildup. This approach aligns with Cloud Pub/Sub's recommended practices for handling transient failures, as it gives the subscriber time to recover without exhausting the ack deadline or causing excessive redelivery.

Exam trap

Google Cloud often tests the misconception that increasing the ack deadline or using a dead-letter topic alone solves reliability issues, but the key is implementing retry logic with backoff to handle transient failures without losing messages or causing buildup.

How to eliminate wrong answers

Option A is wrong because increasing the ack deadline to the maximum value (e.g., 600 seconds) does not address the root cause of subscriber failures; it only delays redelivery, potentially leading to message buildup if the subscriber never recovers. Option B is wrong because setting max delivery attempts to 1 prevents redelivery entirely, which means any message that fails to be acknowledged will be permanently lost, undermining the reliability of asynchronous processing. Option D is wrong because using a dead-letter topic captures failed messages after all delivery attempts are exhausted, but it does not prevent message buildup during the retry process; it is a last-resort mechanism, not a proactive reliability improvement.

Full explanation →
795
Matchingmedium

Match each Google Cloud service to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Distribute traffic across instances

Cache content at edge locations

Protect against DDoS and web attacks

Enable outbound internet for private instances

Dedicated connection between on-prem and GCP

Why these pairings

These are core networking services in GCP. Cloud VPC provides isolated virtual networks, Cloud Load Balancing distributes traffic, Cloud CDN caches content at the edge, and Cloud NAT enables outbound internet for private instances. Common confusion: mixing up VPC and Load Balancing definitions, or CDN and NAT.

Full explanation →
796
Multi-Selectmedium

A data analytics team uses BigQuery to run large queries. They want to reduce query costs. Which three practices should they adopt? (Choose THREE.)

Select 3 answers
A.Use query caching
B.Use clustered tables on commonly filtered columns
C.Partition tables by date
D.Create materialized views for frequent aggregations
E.Always use SELECT * to ensure all columns are available
AnswersB, C, D

Clustering improves query performance and reduces cost by limiting scans.

Why this answer

Clustering tables on commonly filtered columns in BigQuery allows the query engine to prune blocks of data that don't match the filter, reducing the amount of data scanned and thus lowering query costs. This is especially effective when combined with partitioning, as it further narrows the scan to relevant clusters within a partition.

Exam trap

Google Cloud often tests the misconception that query caching is a cost-reduction technique, but candidates must remember that caching only avoids reprocessing identical queries and does not reduce the cost of the initial query or queries with different filters.

Full explanation →
797
MCQhard

Your organization uses Cloud Logging to collect logs from all GCP projects. The security team wants to be alerted when a specific IAM policy change (e.g., granting roles/compute.admin to a user) occurs in any project. They need near real-time notification via email and a ticketing system. What should you do?

A.Create a log-based alert in Cloud Logging with a filter for SetIamPolicy and configure a Pub/Sub notification channel. Use a Cloud Function subscribed to that topic to create a ticket in the ticketing system.
B.Use Cloud Asset Inventory to monitor IAM policy changes and set up a notification to Pub/Sub.
C.Export all logs to BigQuery and run a scheduled query every hour to detect changes. If found, send an email using Cloud Scheduler.
D.Create a Cloud Monitoring alert policy based on a metric from the Cloud Audit Logs, with email and SMS notifications.
AnswerA

Log-based alerts can directly send to Pub/Sub; the Cloud Function can create a ticket. Email can also be added as another channel.

Why this answer

Log-based alerts in Cloud Logging can monitor logs for a specific filter (e.g., protoPayload.methodName=SetIamPolicy) and send notifications to multiple channels (email, Pub/Sub). Pub/Sub can then trigger a Cloud Function to create a ticket. Alerting policies can also use log-based metrics.

Cloud Audit Logs logs IAM changes. The correct approach is to create a log-based alert with a Pub/Sub notification channel.

Full explanation →
798
Multi-Selecthard

Which THREE options are valid strategies for disaster recovery (DR) in Google Cloud?

Select 3 answers
A.Store hourly snapshots of Compute Engine disks in the same region.
B.Deploy a mirrored environment in another region and use Traffic Director to fail over.
C.Enable Cloud CDN to cache static content from multiple origins.
D.Use a Cloud Storage bucket in a different region with Object Versioning enabled.
E.Configure a cross-region replica for Cloud SQL and promote it during failover.
AnswersB, D, E

Traffic Director can route traffic to the DR environment.

Why this answer

Traffic Director, based on the xDS API (Envoy), can manage traffic routing across regions. By deploying a mirrored environment in another region and configuring Traffic Director with failover policies, you can redirect traffic to the secondary region if the primary fails, enabling a robust active-passive or active-active DR strategy.

Exam trap

The trap here is confusing high-availability features (like snapshots or CDN) with true disaster recovery, which requires geographic separation and automated failover mechanisms.

Full explanation →
799
MCQeasy

A security team wants to receive alerts when a user attempts to grant the 'roles/owner' role to a member outside of the organization's domain. Which log filter should they use to create a log-based metric?

A.Filter on Admin Activity log type with 'protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND NOT protoPayload.request.policy.bindings: member: "example.com"'.
B.Filter on Data Access log type with 'protoPayload.methodName="google.iam.v1.IAMPolicy.SetIamPolicy"'.
C.Filter on Admin Activity logs for 'resource.type="gce_instance" AND protoPayload.methodName="compute.instances.setServiceAccount"'.
D.Filter on System Event logs with a query for 'resource.type="project" AND protoPayload.response.status.code=7'.
AnswerA

This filter catches IAM policy changes where members are not from the allowed domain.

Why this answer

It uses the Admin Activity audit log type, which captures IAM policy changes, and filters for the SetIamPolicy method on the cloudresourcemanager service. The condition NOT protoPayload.request.policy.bindings: member: "example.com" ensures alerts are triggered only when the owner role is granted to a member outside the organization's domain, matching the security requirement exactly.

Exam trap

In the Google PCA exam, the distinction between Admin Activity logs (for configuration changes like IAM) and Data Access logs (for data reads) is often tested. Candidates mistakenly choose Data Access logs because they associate IAM with 'access control' rather than administrative operations.

How to eliminate wrong answers

Option B is wrong because Data Access logs record read operations on resource data, not IAM policy modifications; SetIamPolicy is an administrative write operation and appears only in Admin Activity logs. Option C is wrong because it filters on compute.instances.setServiceAccount, which changes the service account attached to a VM instance, not the IAM policy granting the owner role to a user. Option D is wrong because System Event logs track Google Cloud system actions (e.g., maintenance events), not user-driven IAM policy changes, and the filter for response.status.code=7 (PERMISSION_DENIED) would only catch failed attempts, not successful grants.

Full explanation →
800
MCQhard

A company is designing a disaster recovery strategy for a critical application running on Compute Engine with a regional managed instance group (MIG) and an HTTP load balancer. They require an RTO of 10 minutes and RPO of 1 hour. The application state is stored in Cloud SQL for PostgreSQL. What is the most cost-effective approach?

A.Deploy an active-active configuration across two regions using Cloud Spanner
B.Configure a cold standby with a Cloud SQL backup and MIG template in another region
C.Take daily exports of Cloud SQL to Cloud Storage and restore in another region
D.Use Cloud SQL cross-region replica with a warm standby MIG in the secondary region
AnswerD

Cross-region replica keeps data within RPO; warm standby MIG can be promoted within RTO.

Why this answer

Cloud SQL for PostgreSQL supports cross-region replication with a default replication lag typically under 1 hour. For RPO of 1 hour, cross-region replica is sufficient. For RTO of 10 minutes, having a warm standby in another region with a MIG and load balancer configuration that can be promoted quickly meets the requirement.

Full active-active is more expensive; restoring from backups is slower; a cold standby may not meet RTO.

Full explanation →
801
MCQhard

A company runs a batch processing workload on Compute Engine that executes nightly. The job is fault-tolerant and can withstand interruptions. The job uses 500 vCPUs and runs for 4 hours each night. Which compute option is MOST cost-effective?

A.On-demand Compute Engine VMs
B.Preemptible VMs
C.Spot VMs
D.Committed use discounts (1-year)
AnswerB

Preemptible VMs are 80% cheaper and ideal for fault-tolerant batch jobs that can be interrupted.

Why this answer

Preemptible VMs are up to 80% cheaper than regular VMs and are ideal for fault-tolerant, interruptible workloads. Committed use discounts require a 1- or 3-year commitment and are not cost-effective if the job runs only a few hours nightly. On-demand instances are the most expensive.

Spot VMs are similar to preemptible but with dynamic pricing; preemptible is simpler and offers fixed discount.

Full explanation →
802
MCQeasy

What is the purpose of a Pod Disruption Budget (PDB) in GKE?

A.To automatically scale pods based on CPU usage
B.To distribute pods across different zones
C.To ensure a minimum number of pods are always available during voluntary disruptions
D.To prevent any pod from being terminated
AnswerC

PDBs define the minimum available pods, ensuring high availability.

Why this answer

A PDB limits the number of pods of a replicated application that can be down simultaneously from voluntary disruptions (e.g., node upgrades, cluster autoscaler evictions).

Full explanation →
803
MCQhard

A global e-commerce platform uses Spanner for its transactional database. They observe that some transactions are aborted with 'ABORTED' status due to contention. The application retries immediately, but throughput degrades. What design change should they implement to reduce contention?

A.Redesign the schema to use a separate table for frequently updated rows and batch updates using a single transaction
B.Increase the number of nodes in the Spanner instance
C.Use client-side retry with exponential backoff and jitter
D.Change the transaction isolation level to READ UNCOMMITTED
AnswerA

Isolating hot rows reduces lock conflicts; batching updates into a single transaction reduces lock hold time.

Why this answer

Spanner contention arises when multiple transactions try to update the same row concurrently, causing aborts. By redesigning the schema to use a separate table for frequently updated rows and batching updates into a single transaction, you reduce the number of overlapping locks on hot rows. This minimizes lock conflicts and aborts, improving throughput without changing Spanner's underlying TrueTime-based concurrency control.

Exam trap

The trap here is that candidates confuse horizontal scaling (adding nodes) with solving lock contention, but Spanner's contention is a concurrency control issue, not a capacity issue, so scaling out does not reduce row-level lock conflicts.

How to eliminate wrong answers

Option B is wrong because increasing the number of nodes in Spanner improves storage and throughput capacity but does not reduce lock contention on specific hot rows; contention is a locking issue, not a capacity issue. Option C is wrong because client-side retry with exponential backoff and jitter is a best practice for handling transient failures, but it does not address the root cause of contention—it only makes retries more polite, not less frequent. Option D is wrong because Spanner does not support READ UNCOMMITTED isolation; it uses Serializable isolation (and Stale Reads for read-only queries), and lowering isolation is not possible and would violate consistency guarantees.

Full explanation →
804
MCQhard

A multinational corporation must comply with GDPR and requires that all customer data stored in BigQuery be encrypted using customer-managed encryption keys (CMEK) and that the keys are stored in a specific region. Which combination of steps should they take?

A.Enable default encryption at rest in BigQuery and use Organization Policies to restrict key location
B.Create a Cloud KMS key ring and crypto key in the desired region, then associate the BigQuery dataset with the CMEK key using DDL
C.Create a Cloud HSM key, then use Cloud DLP to automatically encrypt the data before loading into BigQuery
D.Use Cloud External Key Manager (EKM) to integrate with an on-premises key management system
AnswerB

This is the standard procedure for CMEK in BigQuery.

Why this answer

It directly fulfills the requirement: creating a Cloud KMS key ring and crypto key in the desired region, then associating the BigQuery dataset with that CMEK key using DDL (e.g., `ALTER SCHEMA mydataset SET OPTIONS(kms_key_name='...')`). This ensures that all data at rest in BigQuery is encrypted with a customer-managed key stored in a specific regional location, as mandated by GDPR for data residency and control.

Exam trap

A common pitfall is that candidates may confuse Cloud DLP or EKM as valid methods for BigQuery encryption at rest, when only CMEK via Cloud KMS with DDL association meets the specific requirement of regional key storage and customer control.

How to eliminate wrong answers

Option A is wrong because enabling default encryption at rest in BigQuery uses Google-managed keys, not customer-managed encryption keys (CMEK), and Organization Policies can restrict key location but do not enforce CMEK usage or provide customer-managed key control. Option C is wrong because Cloud HSM keys are a type of CMEK, but using Cloud DLP to encrypt data before loading into BigQuery is not the correct method; DLP is for data classification and de-identification, not for native BigQuery encryption at rest with CMEK, and it does not associate the key with the dataset. Option D is wrong because Cloud External Key Manager (EKM) integrates with an external key management system, but it does not store the keys in a specific Google Cloud region; the keys remain external, and BigQuery CMEK requires keys to be in Cloud KMS (including HSM) to enforce regional key location.

Full explanation →
805
MCQmedium

An organization is migrating a MySQL database to Cloud SQL. They require automatic failover with zero data loss in the event of a zone outage. Which configuration should they use?

A.Cloud SQL with a cross-region replica.
B.Cloud SQL with automated backups and binary logging.
C.Cloud SQL with a read replica in a different zone.
D.Cloud SQL with high availability (HA) configuration.
AnswerD

HA uses synchronous replication in two zones, providing automatic failover with no data loss.

Why this answer

Cloud SQL's high availability (HA) configuration uses a synchronous write to a standby instance in a different zone within the same region. This ensures that every transaction committed on the primary is also committed on the standby before acknowledging the client, guaranteeing zero data loss during a zone outage. Automatic failover to the standby occurs with no manual intervention, meeting both the automatic failover and zero data loss requirements.

Exam trap

The trap here is that candidates often confuse a read replica (which uses asynchronous replication and requires manual promotion) with an HA standby (which uses synchronous replication and automatic failover), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because a cross-region replica uses asynchronous replication, which can result in data loss of up to several seconds of transactions during a failover, failing the zero data loss requirement. Option B is wrong because automated backups and binary logging provide point-in-time recovery from a backup, but they do not provide automatic failover; recovery requires manual intervention and can lose transactions committed after the last backup. Option C is wrong because a read replica in a different zone is designed for read scaling, not for automatic failover; promoting a read replica to primary is a manual process and the replica uses asynchronous replication, risking data loss.

Full explanation →
806
MCQhard

A company deploys a global application on Cloud Run and uses Cloud SQL for user data. They need sub-10ms read latency for frequently accessed user profiles across regions. Traffic is unpredictable but consistently high. The database must support strong consistency. Which approach meets these requirements?

A.Use Cloud Bigtable with replication across regions
B.Use Cloud Spanner with multi-region configuration
C.Use Cloud SQL with read replicas in each region and enable synchronous replication
D.Use Cloud SQL with cross-region replication and Memorystore cache in each region
AnswerB

Cloud Spanner offers global, strongly consistent reads and writes with low latency, suitable for unpredictable high traffic.

Why this answer

Cloud Spanner with a multi-region configuration is the only option that provides strong consistency, sub-10ms read latency, and automatic scaling for unpredictable, high traffic across regions. It uses synchronous replication with Paxos-based consensus to ensure globally consistent reads without sacrificing performance.

Exam trap

The trap here is that candidates often assume Cloud SQL with read replicas or caching can achieve strong consistency across regions, but they overlook that Cloud SQL replication is asynchronous and Memorystore introduces eventual consistency, making Cloud Spanner the only viable choice for global strong consistency with sub-10ms reads.

How to eliminate wrong answers

Option A is wrong because Cloud Bigtable does not support strong consistency across regions; it offers eventual consistency for multi-region replication. Option C is wrong because Cloud SQL read replicas are asynchronous and do not provide strong consistency; synchronous replication is not supported across regions. Option D is wrong because Cloud SQL with cross-region replication is asynchronous, and adding Memorystore cache introduces eventual consistency, failing the strong consistency requirement.

Full explanation →
807
MCQeasy

A company wants to define an SLO for their application's availability. They measure that the application was down for 30 minutes in a 30-day period. What is the availability SLO that they can achieve?

A.99.5%
B.99.9%
C.99.99%
D.99.95%
AnswerB

99.9% allows 43.2 minutes downtime per month; 30 minutes is within that.

Why this answer

Availability = (total time - downtime) / total time. 30 days = 43200 minutes. (43200 - 30) / 43200 = 99.93%. The closest higher but achievable SLO would be 99.9%, because 99.95% would allow only 21.6 minutes downtime. Typically SLOs are stated as 99.9%, 99.95%, etc.

Full explanation →
808
MCQeasy

A company runs a critical application on Compute Engine instances in a managed instance group (MIG) with autoscaling. Users report intermittent 503 errors during traffic spikes. Which action should the company take to improve reliability?

A.Change the load balancer from regional to global
B.Configure a health check with a sufficient initial delay (grace period) in the MIG
C.Increase the autoscaling cool-down period from 60s to 120s
D.Increase the maximum number of instances in the MIG
AnswerB

Correct: ensures instances are healthy before traffic is sent.

Why this answer

Intermittent 503 errors during traffic spikes often indicate that new VM instances are being started but are not yet ready to serve traffic, causing the load balancer to forward requests to them prematurely. Configuring a health check with a sufficient initial delay (grace period) in the MIG ensures that newly created instances are given time to fully initialize and pass health checks before they receive traffic, preventing 503 errors. This directly addresses the root cause by allowing the application to become healthy before being added to the load balancer's backend.

Exam trap

Google Cloud often tests the misconception that scaling-related errors are always solved by increasing capacity or adjusting scaling parameters, when in fact the root cause is often a misconfigured health check or insufficient initialization time for new instances.

How to eliminate wrong answers

Option A is wrong because changing the load balancer from regional to global does not address the timing issue of new instances being marked healthy before they are ready; global load balancers improve cross-region routing but do not affect instance readiness. Option C is wrong because increasing the autoscaling cool-down period from 60s to 120s only delays the scaling decision after a scale-out event, but does not prevent the load balancer from sending traffic to instances that are still initializing; the cool-down period controls how often autoscaler evaluates metrics, not instance readiness. Option D is wrong because increasing the maximum number of instances in the MIG allows more capacity but does not fix the problem of instances being added to the backend pool before they are ready; it may even exacerbate the issue by creating more unhealthy instances.

Full explanation →
809
Multi-Selecteasy

A company is building a web application on GKE. They want to automatically scale the number of pods based on HTTP request rate. Which TWO resources should they configure?

Select 2 answers
A.Cluster Autoscaler (Node Auto-scaling)
B.Custom Metrics API (e.g., Stackdriver Adapter)
C.GKE Ingress
D.Horizontal Pod Autoscaler (HPA)
E.Vertical Pod Autoscaler (VPA)
AnswersB, D

To scale on HTTP request rate, you need to expose that metric via the Custom Metrics API so HPA can use it.

Why this answer

Horizontal Pod Autoscaler (HPA) scales pods based on CPU/memory or custom metrics. To scale based on HTTP request rate, they need to expose custom metrics (e.g., from Stackdriver/Cloud Monitoring) via the Custom Metrics API. The Vertical Pod Autoscaler (VPA) adjusts resource requests, not pod count.

Node autoscaler scales nodes, not pods. Ingress is for traffic routing.

Full explanation →
810
MCQeasy

A company is using Cloud Storage for backups and wants to minimize costs. The backups are accessed infrequently and can tolerate retrieval delays. Which storage class is most appropriate?

A.Standard
B.Archive
C.Coldline
D.Nearline
AnswerB

Archive is the cheapest option for long-term backups with rare access and retrieval delays acceptable.

Why this answer

Archive storage class is the most cost-effective option for backups that are accessed infrequently and can tolerate retrieval delays. It offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of minutes to hours, making it ideal for long-term backup data that does not require immediate access.

Exam trap

Google Cloud often tests the misconception that 'Coldline' is the cheapest storage class, but Archive is actually the lowest-cost option for data that can tolerate retrieval delays of minutes to hours, not just for data that is rarely accessed.

How to eliminate wrong answers

Option A is wrong because Standard storage class is designed for frequently accessed data with no retrieval delay, and its higher cost makes it unsuitable for infrequently accessed backups. Option C is wrong because Coldline storage, while cheaper than Standard, is still more expensive than Archive and has a 90-day minimum storage duration, which may not be optimal for long-term backups with very low access frequency. Option D is wrong because Nearline storage is intended for data accessed less than once a month, but it has a 30-day minimum storage duration and higher cost compared to Archive, making it less cost-efficient for backups that can tolerate retrieval delays.

Full explanation →
811
MCQeasy

A company is migrating sensitive customer data to Google Cloud. They need to ensure data is encrypted at rest and in transit. Which Google Cloud service provides a centralized way to manage encryption keys used by Google Cloud services?

A.Cloud HSM
B.Cloud External Key Manager (Cloud EKM)
C.Cloud Key Management Service (Cloud KMS)
D.Secret Manager
AnswerC

Cloud KMS provides centralized management of encryption keys used by Google Cloud services.

Why this answer

Cloud KMS is the correct choice because it provides a centralized, managed service for creating, rotating, and destroying encryption keys used by Google Cloud services. It integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest, and it supports customer-managed encryption keys (CMEK) for granular control. For data in transit, Cloud KMS can be used to manage keys for TLS or application-level encryption, though Google Cloud automatically encrypts all network traffic by default.

Exam trap

Google Cloud often tests the distinction between Cloud KMS as the centralized key management service and Cloud HSM as a hardware-backed option within Cloud KMS, leading candidates to choose Cloud HSM when the question asks for the centralized service.

How to eliminate wrong answers

Option A is wrong because Cloud HSM is a hardware security module service that provides dedicated, FIPS 140-2 Level 3 validated hardware for key operations, but it is not the centralized key management service; it is an option within Cloud KMS for higher security requirements. Option B is wrong because Cloud External Key Manager (Cloud EKM) allows you to manage keys outside of Google Cloud using an external key management partner, but it is not a centralized Google Cloud service for managing encryption keys used by Google Cloud services; it is for keys stored externally. Option D is wrong because Secret Manager is designed to store and manage secrets such as API keys, passwords, and certificates, not encryption keys for encrypting data at rest or in transit across Google Cloud services.

Full explanation →
812
Multi-Selectmedium

Which TWO are required to allow on-premises hosts to access Google APIs using internal IP addresses (Private Google Access)? (Choose 2)

Select 2 answers
A.A Cloud Interconnect or Cloud VPN connection between on-premises and VPC
B.A Cloud Router instance configured in the on-premises network
C.VPC Service Controls enabled
D.Private Google Access enabled on the subnet that the on-premises traffic will use
E.A private DNS zone for googleapis.com
AnswersA, D

Provides network connectivity between on-premises and GCP.

Why this answer

A Cloud Interconnect or Cloud VPN connection is required to establish private, encrypted connectivity between on-premises hosts and a VPC network. This provides the network path for on-premises traffic to reach Google APIs using internal IP addresses, bypassing the public internet. Without this direct connection, on-premises hosts cannot leverage Private Google Access, which only applies to traffic originating within Google Cloud subnets.

Exam trap

Google Cloud often tests the misconception that a Cloud Router or DNS zone is required for Private Google Access, but the core requirement is simply the private network connectivity (Cloud Interconnect or Cloud VPN) and the subnet-level feature enablement.

Full explanation →
813
MCQmedium

A team uses Cloud Functions triggered by Cloud Storage events to process uploaded images. They want to ensure that only HTTP-triggered functions can be invoked from outside the project. Which configuration should they apply?

A.Add a VPC firewall rule to allow only internal traffic
B.Set --ingress-settings=internal-only on the HTTP function
C.Remove the Cloud Storage trigger function's trigger
D.Set --ingress-settings=all on the HTTP function
AnswerB

This restricts invocation to within the project.

Why this answer

For Cloud Functions (1st gen), setting --ingress-settings=internal-only restricts invocation to within the project. For Cloud Functions (2nd gen), using an ingress setting of 'all' allows external invocation; using 'internal-only' blocks external calls.

Full explanation →
814
MCQhard

When will the key be automatically rotated?

A.Every 180 days
B.Only when manually triggered
C.Every 30 days
D.Every 90 days
AnswerD

7776000s = 90 days.

Why this answer

In Google Cloud, customer-managed encryption keys (CMEK) can be configured for automatic rotation with a default period of 90 days. This is enforced by Cloud Key Management Service (Cloud KMS) to limit the exposure window if a key is compromised.

Exam trap

Google Cloud Professional Cloud Architect exams often test the default rotation period (90 days) versus other common values (30, 180 days) to catch candidates who confuse it with password expiration policies or other security controls.

How to eliminate wrong answers

Option A is wrong because 180 days is not the default automatic rotation period; it is longer than the standard 90-day rotation interval and would increase security risk. Option B is wrong because automatic rotation is enabled by default, not only when manually triggered; manual rotation is an alternative but not the default behavior. Option C is wrong because 30 days is too short for the default rotation period; while some organizations may choose a shorter interval, the default is 90 days.

Full explanation →
815
MCQeasy

A company wants to store backup data that is accessed rarely but must be available for retrieval within minutes. Which Cloud Storage class is appropriate?

A.Standard
B.Nearline
C.Coldline
D.Archive
AnswerB

Low-cost storage for data accessed less than once a month with fast retrieval.

Why this answer

Nearline storage is designed for data accessed less than once a month but requires retrieval within minutes, making it ideal for backup data that needs quick availability. It offers lower cost than Standard storage while still supporting sub-minute retrieval times, aligning with the scenario's access and latency requirements.

Exam trap

Google Cloud often tests the distinction between 'retrieval within minutes' and 'retrieval within hours' to confuse candidates into selecting Coldline or Archive, assuming 'rarely accessed' automatically means the cheapest option, but the key is the specific retrieval time requirement.

How to eliminate wrong answers

Option A is wrong because Standard storage is for frequently accessed data (e.g., multiple times per month) and costs more, making it unsuitable for rarely accessed backups. Option C is wrong because Coldline storage is for data accessed less than once a quarter, with retrieval times that can be minutes to hours, but it is optimized for even colder data than Nearline, and its cost structure (including retrieval fees) is less appropriate for backups needing consistent minute-level access. Option D is wrong because Archive storage is for long-term retention with retrieval times typically in hours (e.g., 1-12 hours), not minutes, and is intended for data that is accessed extremely rarely, such as regulatory archives.

Full explanation →
816
MCQeasy

A company wants to run a legacy application on Google Cloud that requires a specific operating system version and kernel tuning. The application is not containerised and cannot be easily modified. Which compute service should they use?

A.Cloud Run
B.App Engine Flexible Environment
C.Google Kubernetes Engine (GKE)
D.Compute Engine
AnswerD

Full VM control, custom OS and kernel settings.

Why this answer

Compute Engine provides full control over the virtual machine, including the OS and kernel parameters, making it ideal for legacy applications that require custom configurations.

Full explanation →
817
MCQmedium

Refer to the exhibit. An engineer deploys this Terraform configuration. After deployment, they can SSH into the VM using its public IP. However, they want to restrict SSH access to only a specific IP range (203.0.113.0/24). What change is required?

A.Change the 'source_ranges' in the firewall rule to ['203.0.113.0/24']. The instance already has the required tag.
B.Modify the instance to use a network tag 'restricted-ssh' and update the firewall rule target_tags accordingly.
C.Add a new firewall rule with higher priority allowing SSH from 203.0.113.0/24, and keep the existing rule but change its priority to 100.
D.Update the 'source_ranges' in the firewall rule to ['203.0.113.0/24'] and remove the 'ssh-allowed' tag from the instance.
AnswerA

Correct: Updating the source ranges restricts incoming SSH to the specified IP range.

Why this answer

The firewall rule 'allow-ssh' currently allows SSH from all IPs (0.0.0.0/0) to instances with tag 'ssh-allowed'. To restrict to a specific IP range, the source_ranges must be updated to ['203.0.113.0/24']. The instance already has the tag 'ssh-allowed', so no change to tags is needed.

Full explanation →
818
MCQmedium

An e-commerce company uses Cloud SQL for MySQL for their transactional database. During a recent load test, the database experienced high latency under write-heavy workloads. The team needs to improve write performance without changing the application. Which action is most effective?

A.Enable binary logging to improve write performance
B.Increase the machine type of the primary instance
C.Migrate to Cloud Spanner
D.Add multiple read replicas
AnswerB

Scaling up the primary instance provides more CPU and memory for write operations, directly improving write throughput.

Why this answer

Cloud SQL for MySQL supports read replicas for read scalability, but for write-heavy workloads you need a larger machine type (scale up) or use memory optimized. Adding read replicas does not help writes. Enabling binary logging adds overhead.

Vertically scaling (increasing vCPUs and RAM) directly improves write throughput. Using Cloud Spanner would require application changes.

Full explanation →
819
Multi-Selecteasy

A DevOps team is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the pods can securely access Google Cloud APIs (e.g., Cloud Storage) without managing service account keys. Which TWO steps should they take? (Choose two.)

Select 2 answers
A.Create a dedicated GCP service account with necessary roles and bind it to Kubernetes service accounts via Workload Identity.
B.Use the Compute Engine default service account on each node.
C.Use a secrets management solution like HashiCorp Vault to store service account keys and retrieve them at runtime.
D.Enable Workload Identity on the GKE cluster.
E.Store service account keys in a Kubernetes Secret and mount them into pods.
AnswersA, D

This grants minimal required permissions to the workload, following the principle of least privilege, and leverages Workload Identity for secure access.

Why this answer

Workload Identity allows you to bind a Kubernetes service account to a GCP service account, enabling pods to authenticate to Google Cloud APIs (e.g., Cloud Storage) without managing or storing service account keys. This eliminates the security risk of key leakage and simplifies credential rotation. Option D is correct because Workload Identity must be explicitly enabled on the GKE cluster (using the `--workload-pool` flag or via the console) before the binding can be established.

Exam trap

Google Cloud often tests the misconception that storing keys in Kubernetes Secrets or using node-level default service accounts is acceptable for secure API access, when in fact Workload Identity is the recommended, keyless approach for GKE.

Full explanation →
820
MCQmedium

A security admin wants to audit all 'create' and 'delete' operations on Compute Engine instances in a project for the last 90 days. Which type of audit log should they query?

A.Data Access audit logs
B.Admin Activity audit logs
C.System Event audit logs
D.Policy Denied audit logs
AnswerB

Admin Activity logs capture administrative actions like create and delete.

Why this answer

Admin Activity audit logs record all API calls that modify configuration or metadata of resources. They are retained for 400 days by default.

Full explanation →
821
MCQmedium

Refer to the exhibit. An engineer deployed this Terraform configuration and can SSH to the instance using the external IP. However, they notice that the instance has a public IP address even though they intended to have no public IP. What change should be made to the configuration to ensure the instance does not get a public IP?

A.Change the metadata key enable-oslogin to FALSE.
B.Remove the entire access_config block from the network_interface configuration.
C.Set access_config = [] instead of leaving it empty.
D.Set the network to a custom VPC that does not have external internet access.
AnswerB

Removing the access_config block prevents Terraform from assigning a public IP.

Why this answer

The `access_config` block in a Terraform `google_compute_instance` resource is what assigns a public (external) IP address to the instance's network interface. By removing the entire `access_config` block, the instance will only receive a private IP address, fulfilling the requirement of no public IP. Leaving the block empty (as in option C) still creates an ephemeral external IP by default, so it does not solve the problem.

Exam trap

A common trap in Google PCA is that an empty `access_config` block in Terraform for GCP still provisions a public IP, tricking candidates into thinking it means 'no public IP' when the correct fix is to remove the block entirely.

How to eliminate wrong answers

Option A is wrong because `enable-oslogin` controls OS Login authentication, not public IP assignment; disabling it has no effect on whether an external IP is provisioned. Option C is wrong because setting `access_config = []` is syntactically equivalent to an empty block and still triggers the creation of an ephemeral external IP; the block must be entirely absent to avoid a public IP. Option D is wrong because using a custom VPC without external internet access does not prevent the instance from being assigned a public IP; the `access_config` block directly controls that assignment, regardless of the VPC's routing or internet access capabilities.

Full explanation →
822
MCQhard

A company runs a large-scale data processing pipeline using Dataflow with streaming data from Pub/Sub. They notice increasing costs due to high data shuffle operations. They want to optimize the pipeline performance and cost. Which approach should they take?

A.Use a larger machine type for workers.
B.Increase the number of workers to reduce shuffle.
C.Optimize the pipeline by partitioning data and using Combine transforms.
D.Switch to batch mode overnight.
AnswerC

Partitioning and Combine reduce the amount of data shuffled, lowering cost and improving performance.

Why this answer

Optimizing pipeline logic to minimize shuffle reduces resource usage and cost. Increasing workers or using larger machine types may improve performance but increase cost. Switching to batch mode would lose real-time processing capability.

Full explanation →
823
MCQhard

A security team wants to enforce that only container images signed by their internal CI/CD pipeline can run on GKE clusters. They also need to ensure that unsigned images are rejected at admission time. Which combination of services and configurations should they use?

A.GKE PodSecurityPolicy with allowed registries
B.Binary Authorization with Cloud KMS for signing
C.Cloud Build with Container Analysis
D.Artifact Registry vulnerability scanning and IAM roles
AnswerB

Binary Authorization enforces policy that only signed images can run. Cloud KMS provides the cryptographic keys for signing.

Why this answer

Binary Authorization enforces policy by requiring images to be signed by trusted signers (e.g., using Cloud KMS). It integrates with GKE admission control to block unsigned images. Cloud KMS creates and manages signing keys.

Artifact Registry stores signed images but does not enforce policy. Cloud Build can be used to sign images during build, but the enforcement mechanism is Binary Authorization.

Full explanation →
824
MCQhard

A company is using Cloud Storage to store sensitive data. They need to enforce that objects are deleted exactly 30 days after creation. Which object lifecycle rule should they configure?

A.AbortIncompleteMultipartUpload after 30 days.
B.Delete action with condition daysFromNonCurrentTime: 30.
C.Delete action with condition age: 30.
D.SetStorageClass to Nearline after 30 days.
AnswerC

Deletes objects 30 days after creation.

Why this answer

The 'Delete action with condition age: 30' directly instructs Cloud Storage to remove objects 30 days after their creation time. The 'age' condition is measured from the object's creation timestamp, which aligns perfectly with the requirement to delete objects exactly 30 days after creation.

Exam trap

Google Cloud often tests the distinction between 'age' (based on creation time) and 'daysFromNonCurrentTime' (based on versioning status), leading candidates to confuse deletion of current objects with cleanup of older versions.

How to eliminate wrong answers

Option A is wrong because AbortIncompleteMultipartUpload is used to cancel incomplete multipart uploads after a specified number of days, not to delete completed objects. Option B is wrong because 'daysFromNonCurrentTime' applies to non-current object versions in a versioned bucket, not to the creation time of the current object. Option D is wrong because SetStorageClass to Nearline changes the storage class to a colder tier but does not delete the object; it only modifies the cost and retrieval latency.

Full explanation →
825
Multi-Selectmedium

An organization wants to monitor network traffic between VMs in a VPC for troubleshooting. Which TWO services can provide this?

Select 2 answers
A.Cloud Audit Logs
B.Packet Mirroring (Network Intelligence Center)
C.VPC Flow Logs
D.Cloud Monitoring
E.Cloud Logging
AnswersB, C

Provides deep packet inspection.

Why this answer

Packet Mirroring (Network Intelligence Center) clones actual packet contents (headers and payload) from VM instances for deep packet inspection, enabling detailed troubleshooting. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, packet count) flowing to and from VMs, providing visibility into network traffic patterns and bottlenecks. Both services are useful for monitoring network traffic between VMs in a VPC, with Packet Mirroring offering full packet capture and VPC Flow Logs providing metadata-level logging.

Exam trap

Google Cloud often tests the distinction between services that capture raw packet data (Packet Mirroring) versus those that log only metadata or metrics (VPC Flow Logs). Candidates may incorrectly think only one is correct, but both can be used for troubleshooting network traffic between VMs, depending on the depth of information needed.

Full explanation →
Page 10

Page 11 of 13

Page 12

All pages

12345678910111213

Practice PCA by domain

Target a specific domain to shore up weak areas.

Managing Implementation and Ensuring Solution and Operations ReliabilityManaging and Provisioning a Solution InfrastructureDesigning for Security and ComplianceAnalysing and Optimising Technical and Business ProcessesDesign and plan a cloud solution architectureManage and provision cloud infrastructureDesign for security and complianceAnalyze and optimize technical and business processesManage implementation of cloud architectureEnsure solution and operations reliability
See all domains with question counts →