Courseiva

Google Professional Cloud Architect (PCA) — Questions 901–955

955 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 12

Page 13 of 13

901
MCQeasy

A team wants to allow a service account to be used only on specific Compute Engine VMs. Which IAM condition should be applied to the service account's roles?

A.resource.service
B.resource.owner
C.resource.name
D.resource.type
E.resource.labels
AnswerC

Correct. resource.name can be used to restrict to specific resources.

Why this answer

The `resource.name` IAM condition allows you to restrict a service account's roles to specific Compute Engine VM instances by matching the VM's resource name (e.g., `projects/project-id/zones/zone/instances/instance-name`). This ensures the service account can only be used on designated VMs, enforcing fine-grained access control.

Exam trap

Google Cloud often tests the misconception that `resource.type` or `resource.labels` can restrict access to a specific VM, but only `resource.name` provides a unique identifier for a single instance, while labels are for grouping and can change over time.

How to eliminate wrong answers

Option A is wrong because `resource.service` is not a valid IAM condition attribute for Compute Engine VMs; it is used in other services like Cloud Storage to match the service name. Option B is wrong because `resource.owner` is not a standard IAM condition attribute; IAM conditions use resource attributes like `resource.name`, not ownership metadata. Option D is wrong because `resource.type` refers to the resource type (e.g., `compute.googleapis.com/Instance`), which cannot narrow access to specific VMs—it applies to all VMs of that type.

Option E is wrong because `resource.labels` can filter VMs by label key-value pairs, but it does not uniquely identify a specific VM instance; labels are mutable and can be shared across multiple VMs, making them unsuitable for restricting to a single VM.

Full explanation →
902
Multi-Selectmedium

Your company uses Cloud Storage to store critical documents. You need to prevent accidental deletion or modification of objects for a retention period of 5 years. Which TWO features should you use?

Select 2 answers
A.Object versioning
B.Object hold
C.Requester pays
D.Lifecycle rule to delete objects older than 5 years
E.Retention policy with Bucket Lock
AnswersA, E

Versioning keeps old versions, enabling recovery from accidental changes.

Why this answer

Object versioning preserves previous versions of objects, allowing recovery from accidental deletion or overwrite. Retention policies (bucket-level) enforce a minimum retention period for all objects. Bucket Lock makes the retention policy immutable.

Object holds are per-object and can be removed. Lifecycle policies manage object transitions/deletion, not retention enforcement.

Full explanation →
903
MCQmedium

A company uses Cloud Logging to monitor their application logs. They notice that some logs from their Compute Engine instances are missing. The instances have the required logging permission. What is the most likely cause?

A.The log sink is not configured correctly.
B.The logging agent is not configured to send logs to Cloud Logging.
C.The instances are using a custom image without the logging agent.
D.The log bucket is in a different project.
E.The log entries are being filtered by the exclusion filter.
AnswerB

The logging agent must be installed and configured to forward logs.

Why this answer

Compute Engine instances do not automatically send logs to Cloud Logging. They require the Cloud Logging agent (based on fluentd) to be installed and configured to forward logs. Even with correct IAM permissions, without the agent, logs will not be collected.

Option B correctly identifies this missing agent as the most likely cause.

Exam trap

Google Cloud often tests the distinction between log collection (agent) and log routing (sinks) — the trap here is that candidates assume IAM permissions alone are sufficient, overlooking the mandatory agent installation and configuration step.

How to eliminate wrong answers

Option A is wrong because a log sink controls where logs are routed (e.g., to BigQuery or Pub/Sub), not whether logs are collected from instances; missing logs are a collection issue, not a routing issue. Option C is wrong because while a custom image might lack the agent, the question states the instances have the required logging permission, implying the agent could be installed separately; the most likely cause is the agent not being configured, not the image itself. Option D is wrong because log buckets in a different project would still receive logs if the sink is configured correctly; the issue is logs not appearing at all, not appearing in the wrong project.

Option E is wrong because exclusion filters remove logs after they are ingested; if logs are missing entirely, they were never ingested, so exclusion is not the cause.

Full explanation →
904
Multi-Selecteasy

A cloud architect needs to implement a CI/CD pipeline for a team developing a Python-based microservice. The team uses GitHub as their source repository. The pipeline should automatically run unit tests and deploy the service to Cloud Run when changes are pushed to the main branch. Which THREE Google Cloud services should they use?

Select 3 answers
A.Artifact Registry
B.Cloud Run
C.Cloud Deploy
D.Cloud Source Repositories
E.Cloud Build
AnswersA, B, E

Artifact Registry stores the container image built by Cloud Build.

Why this answer

Cloud Build can connect to GitHub via triggers to run tests and build a container image. Artifact Registry stores the image. Cloud Run deploys the container.

Cloud Deploy is for GKE and other platforms, not Cloud Run directly. Cloud Functions is serverless but not for containers. Cloud Source Repositories is Google's own git, not GitHub.

Full explanation →
905
MCQhard

An organization has a multi-regional deployment of a stateful application on GKE using regional persistent disks. They need to implement disaster recovery with an RPO of less than 1 hour and RTO of 30 minutes. What is the most cost-effective approach?

A.Use zonal persistent disks and take snapshots every 45 minutes, then restore in secondary region.
B.Use regional persistent disks with asynchronous replication to a secondary region and deploy GKE clusters in both regions with a load balancer directing traffic.
C.Use a third-party replication tool to asynchronously replicate data to the secondary region.
D.Use Cloud Storage FUSE to write state to a multi-regional bucket and read from secondary cluster.
AnswerB

Regional pd already replicates within zone; adding asynchronous cross-region replication meets RPO/RTO.

Why this answer

Regional persistent disks with asynchronous replication provide built-in, managed replication to a secondary region, meeting the RPO of less than 1 hour and RTO of 30 minutes without additional infrastructure costs. By deploying GKE clusters in both regions and using a load balancer, traffic can be redirected to the secondary cluster within the RTO, making this the most cost-effective approach as it avoids third-party tools or complex manual processes.

Exam trap

The trap here is that candidates often confuse the cost-effectiveness of snapshots (Option A) with the need for low RPO/RTO, overlooking that snapshot-based recovery cannot meet sub-hour RTOs due to restore times, while regional persistent disk replication provides near-continuous replication at a lower total cost than third-party tools.

How to eliminate wrong answers

Option A is wrong because zonal persistent disks with snapshots every 45 minutes cannot guarantee an RPO of less than 1 hour due to snapshot consistency delays and the time required to restore volumes in a secondary region, which would exceed the 30-minute RTO. Option C is wrong because using a third-party replication tool introduces additional licensing, operational overhead, and potential compatibility issues, making it less cost-effective than Google's native asynchronous replication. Option D is wrong because Cloud Storage FUSE introduces significant latency and consistency challenges for stateful applications, and multi-regional buckets do not provide the low-latency, consistent storage required for a stateful application's RPO and RTO targets.

Full explanation →
906
MCQmedium

A company uses Cloud Deployment Manager to manage infrastructure. They want to roll back to a previous deployment state after a failed update. What is the recommended approach?

A.Use gcloud deployment-manager deployments rollback --deployment <name>
B.Use the --update-policy=PARTIAL flag to selectively revert changes
C.Delete the deployment and recreate it from the previous template
D.Run gcloud deployment-manager deployments update --config <previous_manifest>
AnswerD

This updates the deployment to the configuration defined in the previous manifest, effectively rolling back.

Why this answer

Deployment Manager stores the deployment manifests. You can use an update with a previous manifest to revert to a known good state. Deleting and recreating is not a rollback.

Partial updates are not supported directly.

Full explanation →
907
MCQmedium

A company wants to migrate on-premises workloads to Google Cloud. They need to assess the existing infrastructure, plan the migration, and track progress. Which tool should they use?

A.Cloud Endpoints.
B.Cloud Deployment Manager.
C.Cloud Foundation Toolkit.
D.Migrate for Compute Engine.
AnswerD

Provides assessment and migration capabilities.

Why this answer

Migrate for Compute Engine (formerly Velostrata) is the correct tool because it is specifically designed to assess, plan, and migrate on-premises workloads to Google Cloud. It provides discovery of existing infrastructure, generates migration plans, and tracks progress through a dashboard, directly addressing the need for assessment, planning, and tracking.

Exam trap

The trap here is that candidates may confuse Cloud Foundation Toolkit (a foundation setup tool) with a migration tool, or assume Cloud Deployment Manager can handle migration planning, when in fact only Migrate for Compute Engine provides the full assessment-to-tracking workflow.

How to eliminate wrong answers

Option A is wrong because Cloud Endpoints is an API management service for securing and monitoring APIs, not a migration assessment or planning tool. Option B is wrong because Cloud Deployment Manager is an infrastructure-as-code tool for deploying Google Cloud resources using templates, not for assessing or migrating on-premises workloads. Option C is wrong because Cloud Foundation Toolkit provides Terraform templates and best practices for setting up a Google Cloud foundation (e.g., projects, networking), but it does not include discovery, assessment, or migration tracking for existing on-premises workloads.

Full explanation →
908
MCQmedium

An organization deploys a web application on Compute Engine behind a global HTTPS load balancer. They want to reduce latency for users worldwide and minimize load on backend instances. Which GCP service should they use?

A.Cloud Armor
B.Cloud NAT
C.Cloud CDN
D.VPC Network Peering
AnswerC

Cloud CDN caches content at Google's edge locations to reduce latency and backend load.

Why this answer

Cloud CDN uses Google's global edge caches to serve content closer to users, reducing latency and backend load. Cloud Armor provides security, Cloud NAT is for outbound connectivity, and VPC peering is for network connectivity, not caching.

Full explanation →
909
MCQmedium

An e-commerce company uses Cloud SQL for MySQL for its transactional database. They need to run complex analytical queries on the same data without impacting OLTP performance. The analytical queries should be run on a read replica with minimal lag. Which solution is BEST?

A.Use Data Studio directly on Cloud SQL primary instance
B.Migrate to Cloud Spanner to handle both workloads
C.Create a Cloud SQL read replica and run analytical queries on it
D.Export the database to BigQuery and run queries there
AnswerC

Read replicas handle read traffic, preventing impact on the primary instance for OLTP.

Why this answer

Creating a Cloud SQL read replica allows you to offload analytical queries to a separate instance that replicates from the primary using MySQL's native asynchronous replication. This isolates the OLTP workload from heavy analytical queries, and with proper configuration (e.g., using a higher machine type and enabling InnoDB buffer pool tuning on the replica), you can achieve minimal replication lag. The read replica supports the same MySQL engine, so complex analytical queries run without schema changes or data movement.

Exam trap

Candidates often mistakenly think exporting to BigQuery is the best solution for analytics on Cloud SQL data, but the trap is that the question explicitly requires 'minimal lag' and 'without impacting OLTP performance,' which a read replica achieves directly, whereas BigQuery introduces data movement delays and pipeline complexity.

How to eliminate wrong answers

Option A is wrong because Data Studio is a visualization tool, not a query engine; running analytical queries directly on the Cloud SQL primary instance would compete for CPU, memory, and I/O with OLTP transactions, causing performance degradation. Option B is wrong because Cloud Spanner is a globally distributed, strongly consistent relational database designed for horizontal scaling, not for running complex analytical queries on the same data without impacting OLTP; it also requires schema and application changes, and does not provide a read replica for analytics. Option D is wrong because exporting the database to BigQuery introduces significant latency (data must be exported, transformed, and loaded), and the export process itself can impact the primary instance's performance; it also requires managing a separate pipeline and does not provide near-real-time analytics with minimal lag.

Full explanation →
910
MCQmedium

A company wants to connect their on-premises network to Google Cloud with a dedicated, high-bandwidth, low-latency connection that has a Service Level Agreement (SLA) of 99.99% uptime. Which connectivity option should they choose?

A.High Availability VPN (HA VPN)
B.Partner Cloud Interconnect
C.Dedicated Cloud Interconnect
D.Classic VPN
AnswerC

Dedicated Interconnect provides direct physical connection, high bandwidth, low latency, and 99.99% SLA.

Why this answer

Dedicated Cloud Interconnect provides a direct physical connection with high bandwidth, low latency, and a 99.99% SLA. Partner Interconnect uses a third-party provider and has a lower SLA. HA VPN offers 99.99% SLA but lower bandwidth.

Classic VPN has no SLA.

Full explanation →
911
MCQhard

An organization is running a stateful workload on Compute Engine with a single persistent disk. They want to migrate to a regional persistent disk for higher availability. The disk is 500 GB and currently 80% full. They need zero downtime during the migration. What is the recommended approach?

A.Attach a new regional disk to the instance and use RAID 1 mirroring.
B.Create a snapshot of the disk, then create a new regional persistent disk from that snapshot, and attach it to the instance.
C.Use rsync to copy data to a new regional disk while the instance is running.
D.Use gcloud compute disks resize to change the disk type to regional.
AnswerB

This is the recommended migration path; snapshot creation is the only downtime window.

Why this answer

Creating a snapshot of the existing persistent disk and then creating a new regional persistent disk from that snapshot allows you to attach the new disk to the instance with zero downtime. The snapshot captures the disk state at a point in time, and the regional disk is created asynchronously; once available, you can detach the original disk and attach the regional disk without stopping the instance, as Compute Engine supports live disk attachment/detachment.

Exam trap

Google Cloud often tests the misconception that you can change a disk's type in-place using a resize or update command, but the only supported way to switch from zonal to regional is to create a new disk from a snapshot or image.

How to eliminate wrong answers

Option A is wrong because RAID 1 mirroring requires two disks of the same type and is not a supported feature for attaching a regional disk to a running instance; it would also require downtime to configure the RAID array. Option C is wrong because rsync does not provide a consistent point-in-time copy of a disk that is actively being written to, risking data inconsistency and requiring application-level quiescence to avoid corruption. Option D is wrong because gcloud compute disks resize does not support changing a disk's type from zonal to regional; you must create a new regional disk from a snapshot or image, not modify the existing disk.

Full explanation →
912
MCQmedium

A company is migrating a 200 TB on-premises file server to Cloud Storage. The network bandwidth is limited to 100 Mbps. The migration must complete within 30 days. Which approach should they use?

A.Use Storage Transfer Service from another cloud
B.Use gsutil rsync over the network
C.Use Cloud Data Fusion
D.Use Transfer Appliance
AnswerD

Transfer Appliance can physically ship 200 TB of data, which can be transferred within days. This meets the 30-day requirement.

Why this answer

Transfer Appliance is a physical device that can transfer up to 480 TB in a single shipment. At 100 Mbps, transferring 200 TB over the network would take approximately 200 TB * 1024 GB/TB * 8 bits/byte / (100 Mbps) = 1,638,400 Gb / 0.1 Gbps = 16,384,000 seconds ≈ 190 days, far exceeding 30 days. Therefore, using Transfer Appliance is the only feasible option.

Full explanation →
913
MCQmedium

A security engineer wants to ensure that all admin activity in their GCP organization is logged and retained for 3 years. They also need to be alerted if a new firewall rule is created. Which logs should they enable?

A.Data Access audit logs
B.Admin Activity audit logs
C.VPC flow logs
D.Cloud DNS logging
AnswerB

Admin Activity logs capture all create/modify/delete actions on resources like firewall rules.

Why this answer

Admin Activity audit logs record all API calls that modify configuration or metadata, such as creating firewall rules. Data Access audit logs record reads/writes to data, not admin actions. VPC flow logs record network traffic, not admin actions.

Cloud DNS logging records DNS queries.

Full explanation →
914
MCQmedium

A web application running on Compute Engine behind a global HTTP(S) load balancer experiences high latency during traffic spikes. Which quick fix would best address this issue without changing the architecture?

A.Configure managed instance group autoscaling to add more instances.
B.Enable Cloud CDN on the load balancer.
C.Switch to a regional load balancer to reduce latency.
D.Increase the machine type of the backend instances.
AnswerA

Horizontal scaling quickly increases capacity.

Why this answer

Managed instance group (MIG) autoscaling dynamically adds more instances when CPU utilization or other metrics exceed a threshold, directly absorbing the increased traffic during spikes. This is the quickest fix because it requires no architectural changes—just configuring autoscaling parameters on the existing MIG. By scaling out horizontally, the load balancer can distribute requests across more backends, reducing per-instance load and latency.

Exam trap

Google Cloud often tests the distinction between horizontal scaling (autoscaling) and vertical scaling (increasing machine type) or caching solutions, leading candidates to choose Cloud CDN or machine type changes as a 'quick fix' when the real issue is insufficient compute capacity to handle dynamic request spikes.

How to eliminate wrong answers

Option B is wrong because enabling Cloud CDN caches static content at edge locations, which does not help with high latency caused by dynamic request processing during traffic spikes—CDN only reduces latency for cacheable content, not for the dynamic workload that is overwhelming the backend. Option C is wrong because switching to a regional load balancer would actually increase latency for global users, as it lacks the anycast IP and global distribution of the global HTTP(S) load balancer, and it requires architectural changes (e.g., changing the load balancer type). Option D is wrong because increasing the machine type (vertical scaling) is not a quick fix—it requires instance recreation or rolling update, and it does not scale as elastically as horizontal autoscaling; it also may not handle sudden spikes as effectively as adding more instances.

Full explanation →
915
MCQeasy

A company is adopting Site Reliability Engineering (SRE) practices. After a major incident, they want to conduct a review to understand what went wrong and how to prevent recurrence, without blaming individuals. Which SRE practice should they follow?

A.Define SLOs and SLIs
B.Create an error budget policy
C.Perform capacity planning
D.Conduct a blameless postmortem
AnswerD

A blameless postmortem is an SRE practice to review incidents without blame, focusing on systemic improvements.

Why this answer

A blameless postmortem focuses on learning from incidents without assigning blame. Error budgets are for measuring reliability, SLOs/SLIs are for defining targets, and capacity planning is for scaling.

Full explanation →
916
Multi-Selecteasy

A company is using BigQuery for data analytics. They want to optimize costs while maintaining query performance. Which TWO actions should they take? (Choose 2.)

Select 2 answers
A.Use reserved slots with flat-rate pricing.
B.Always use SELECT *.
C.Partition tables by date.
D.Materialize frequently used queries as tables.
E.Use clustering on frequently filtered columns.
AnswersC, E

Partitioning reduces the amount of data scanned, lowering costs.

Why this answer

Partitioning tables by date (Option C) is correct because it allows BigQuery to prune partitions during query execution, scanning only the relevant date ranges instead of the entire table. This reduces the amount of data processed, directly lowering query costs under on-demand pricing while maintaining performance through reduced I/O.

Exam trap

Google Cloud often tests the distinction between cost optimization and performance optimization, and the trap here is that candidates might choose reserved slots (Option A) thinking it always reduces costs, when in fact it is a pricing model that only benefits sustained high usage, not a direct cost-reduction technique for typical query patterns.

Full explanation →
917
Multi-Selecteasy

A company deploys a critical application on Google Kubernetes Engine (GKE) and wants to ensure high availability during cluster upgrades. Which TWO practices should they follow?

Select 2 answers
A.Use a single-zone node pool with multiple replicas.
B.Use multiple node pools across different zones within the cluster.
C.Configure PodDisruptionBudgets to allow only a small number of pods to be unavailable during upgrades.
D.Enable cluster autoscaling to add nodes during upgrades.
E.Enable regional clusters for multi-zone control plane.
AnswersB, C

Multi-zone node pools allow pods to be rescheduled in other zones during upgrades.

Why this answer

Deploying multiple node pools across different zones ensures that if one zone fails or is taken down for maintenance, the application can continue serving from the other zones. This aligns with GKE's best practice for high availability by distributing workloads across failure domains. Option C is correct because PodDisruptionBudgets (PDBs) define the minimum number of pods that must remain available during voluntary disruptions like cluster upgrades, preventing the upgrade from taking down too many replicas at once.

Exam trap

The trap here is that candidates often confuse control plane high availability (regional clusters) with application-level high availability, or they assume autoscaling can compensate for disruption during upgrades, when in fact PDBs and multi-zone node pools are the correct mechanisms.

Full explanation →
918
MCQeasy

A startup runs a web application on App Engine standard environment. They want to ensure the application can handle sudden traffic spikes without manual intervention. Which App Engine feature should they configure?

A.Manual scaling with a fixed number of instances.
B.Basic scaling with automatic instance creation.
C.Resident instances with a minimum number of always-on instances.
D.Custom scaling based on CPU utilization.
E.Automatic scaling with a maximum number of idle instances.
AnswerE

Automatic scaling dynamically creates instances to handle traffic spikes.

Why this answer

App Engine's automatic scaling with a maximum number of idle instances is designed to handle sudden traffic spikes by dynamically creating and removing instances based on request load. This configuration allows the application to scale up quickly when traffic increases, ensuring responsiveness without manual intervention, while the maximum idle instances setting prevents over-provisioning and controls costs.

Exam trap

The trap here is that candidates often confuse 'basic scaling' with 'automatic scaling' because both involve dynamic instance creation, but basic scaling does not maintain idle instances and is unsuitable for handling sudden traffic spikes without latency.

How to eliminate wrong answers

Option A is wrong because manual scaling with a fixed number of instances requires manual intervention to adjust capacity, which does not handle sudden traffic spikes automatically. Option B is wrong because basic scaling creates instances only when a request is received and shuts them down after processing, leading to cold starts and latency under sudden spikes, and it does not maintain a pool of idle instances for immediate handling. Option C is wrong because resident instances with a minimum number of always-on instances are a feature of manual scaling, not automatic scaling, and they do not dynamically scale up or down in response to traffic spikes.

Option D is wrong because custom scaling based on CPU utilization is not a native App Engine scaling type; App Engine offers automatic, basic, and manual scaling, and custom scaling is not a supported configuration option.

Full explanation →
919
MCQmedium

A company needs to ensure that only approved container images can be deployed to a GKE cluster. They already use Binary Authorization. What additional step is required to enforce this policy?

A.Configure a VPC Service Perimeter
B.Enable Container Registry vulnerability scanning
C.Create an attestor and attach it to a Binary Authorization policy
D.Assign the container.deployer role to the GKE service account
AnswerC

An attestor validates image signatures; the policy enforces that only attested images can be deployed.

Why this answer

Binary Authorization requires an attestor that verifies image signatures. The attestor must be created and attached to a policy that requires at least one attestation.

Full explanation →
920
MCQeasy

A company wants to run a containerized web application that experiences unpredictable traffic spikes. They want to pay only for resources used during request processing, with no idle cost. Which compute service should they choose?

A.Google Kubernetes Engine (GKE) Autopilot
B.Cloud Run
C.App Engine Standard
D.Compute Engine with managed instance groups
AnswerB

Cloud Run scales to zero and charges per request, ideal for unpredictable traffic with no idle cost.

Why this answer

Cloud Run is a serverless container platform that scales to zero when not in use and charges per request. It eliminates idle costs. GKE Autopilot has a per-pod billing model but still incurs some cost for the cluster control plane.

App Engine Standard supports scaling to zero but is limited to specific runtimes. Compute Engine VMs incur cost for running instances even if idle.

Full explanation →
921
MCQhard

An organization needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which service should they use?

A.Cloud HSM
B.Cloud KMS
C.Cloud Asset Inventory
D.Secret Manager
AnswerD

Secret Manager is designed for storing secrets and supports rotation policies.

Why this answer

Secret Manager supports automatic rotation (via rotation period and next rotation time) and integrates with Cloud Functions via the API client libraries.

Full explanation →
922
Multi-Selecthard

A company runs a latency-sensitive web application on Compute Engine in us-east1. They want to improve response times for users in Europe and Asia without changing the application architecture. Which TWO actions should they take? (Choose 2.)

Select 2 answers
A.Use preemptible VMs to reduce cost
B.Enable Cloud CDN on the load balancer
C.Deploy additional instances in us-west1
D.Create a multi-region load balancer and deploy backends in europe-west1 and asia-east1
E.Use Cloud Armor to block high-latency requests
AnswersB, D

Cloud CDN caches static content at edge locations, improving latency for all users.

Why this answer

Cloud CDN caches static content at edge locations globally, reducing latency for users worldwide. Placing a load balancer in multiple regions (multi-region load balancing with proximity-based routing) directs users to the nearest backend region. Using only us-west1 would still leave European users far away.

Cloud Armor is for security, not performance. Spot VMs are for cost savings, not latency.

Full explanation →
923
MCQhard

A company is migrating a large Oracle database (5 TB) from on-premises to Cloud SQL for PostgreSQL. They require minimal downtime and automated schema conversion. Which Google Cloud service should they use?

A.Velostrata (Migrate for Compute Engine)
B.Transfer Appliance
C.Database Migration Service (DMS)
D.Storage Transfer Service
AnswerC

DMS supports Oracle to Cloud SQL for PostgreSQL migration with minimal downtime and automated schema conversion.

Why this answer

Database Migration Service (DMS) supports homogeneous and heterogeneous migrations with minimal downtime and includes schema conversion for Oracle to PostgreSQL via the Database Migration Service with converters. Velostrata is for VM migration, Transfer Appliance for bulk data, and Storage Transfer Service for cloud-to-cloud data.

Full explanation →
924
MCQeasy

A company runs a web application on Compute Engine instances behind a global HTTP(S) Load Balancer. The application uses Cloud SQL for MySQL for user data. Users report that during peak hours, the page load times increase significantly. The development team notices that the number of database connections exceeds the maximum allowed, causing some requests to fail. The application is designed to use connection pooling with a maximum pool size of 100 connections per instance. There are currently 10 instances. The Cloud SQL instance is configured with 4 vCPUs and 15 GB memory, and the maximum connections is set to 400. The application team wants to minimize cost while resolving the issue. What should the architect recommend?

A.Reduce the max pool size per instance to 40 connections.
B.Increase the Cloud SQL instance tier to have more vCPUs and memory.
C.Implement connection pooling at the global HTTP(S) Load Balancer level.
D.Use Cloud SQL Proxy with connection pooling.
AnswerA

This reduces total connections to 400, matching the Cloud SQL max and resolving the issue at no extra cost.

Why this answer

With 10 instances each configured for a max pool size of 100, the total potential connections is 1000, far exceeding the Cloud SQL limit of 400. Reducing the pool size to 40 per instance brings the total to exactly 400, fitting within the limit without any additional cost. Option B increases the instance tier, which adds cost unnecessarily when the current tier is sufficient with proper connection sizing.

Option C is not feasible because load balancers do not manage database connection pooling. Option D does not reduce the total number of connections and adds complexity without solving the core issue.

Full explanation →
925
MCQhard

An organization runs a Kubernetes cluster on GKE with cluster autoscaling enabled. They notice that pods are frequently in 'Pending' state due to insufficient CPU, but the cluster autoscaler does not add nodes quickly enough. What is the most likely cause?

A.The cluster autoscaler is using the 'least-waste' expander.
B.The horizontal pod autoscaler (HPA) is misconfigured.
C.The pod disruption budget (PDB) is too restrictive.
D.The node pool has reached the maximum node count limit.
AnswerD

Cluster autoscaler cannot exceed max node limit.

Why this answer

The cluster autoscaler cannot add new nodes if the node pool has already reached its maximum node count limit. This limit is configured at the node pool level in GKE, and once reached, the autoscaler will not scale up further, leaving pods in 'Pending' state due to insufficient CPU resources.

Exam trap

Google Cloud often tests the distinction between pod-level scaling (HPA) and node-level scaling (cluster autoscaler), and the trap here is that candidates confuse a restrictive PDB with a node pool limit, or assume the expander strategy directly causes scaling delays.

How to eliminate wrong answers

Option A is wrong because the 'least-waste' expander selects a node pool that minimizes resource waste after scaling, but it does not prevent the autoscaler from adding nodes; it only affects which node pool is chosen. Option B is wrong because the HPA scales pods based on CPU or memory utilization, not nodes; a misconfigured HPA would cause incorrect pod scaling, not a delay in node addition by the cluster autoscaler. Option C is wrong because a pod disruption budget (PDB) controls the number of pods that can be voluntarily disrupted during maintenance or upgrades, not the ability of the cluster autoscaler to add nodes.

Full explanation →
926
Multi-Selectmedium

A team is building a CI/CD pipeline for a Java application that will run on GKE. They want to automatically build the application, run unit tests, create a Docker image, push it to Artifact Registry, and deploy to GKE. Which two GCP services should be combined? (Choose two.)

Select 2 answers
A.Cloud Functions
B.Compute Engine
C.Cloud Run
D.Cloud Deploy
E.Cloud Build
AnswersD, E

Cloud Deploy can manage delivery pipelines to deploy to GKE.

Why this answer

Cloud Build handles the build and test steps, builds the Docker image, and pushes to Artifact Registry. Cloud Deploy manages the deployment to GKE. Cloud Run is serverless; Cloud Functions is event-driven; Compute Engine is VMs.

Full explanation →
927
Multi-Selecteasy

Which TWO methods can be used to encrypt data at rest in BigQuery?

Select 2 answers
A.Use a Cloud Storage bucket with bucket-level default encryption.
B.Use Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
C.Use Cloud SQL with encryption at rest.
D.Use Customer-Supplied Encryption Keys (CSEK).
E.Use Cloud Bigtable with encryption at rest.
AnswersB, D

BigQuery tables can use CMEK.

Why this answer

Customer-Managed Encryption Keys (CMEK) allow you to manage the encryption keys used to protect BigQuery data at rest via Cloud KMS. This gives you control over key rotation, access, and lifecycle, while BigQuery handles the encryption and decryption transparently. It is a supported method for encrypting data at rest in BigQuery.

Exam trap

A common trap on the Google PCA exam is that candidates confuse general encryption features (like Cloud Storage default encryption or Cloud SQL encryption) with BigQuery-specific encryption options, or they forget that CSEK is also a valid option for BigQuery.

Full explanation →
928
MCQhard

A company uses Cloud Key Management Service (Cloud KMS) with a customer-managed encryption key (CMEK) to encrypt data in BigQuery. They want to ensure the key can only be used by the BigQuery service account in the 'us-central1' region. Which IAM condition should be added to the key's IAM policy?

A.resource.name.startsWith('projects/_/locations/us-central1') && request.auth.principal == 'bigquery@system.gserviceaccount.com'
B.resource.name.startsWith('projects/_/locations/global') && request.auth.principal == 'bigquery@system.gserviceaccount.com'
C.resource.name.startsWith('projects/_/locations/us-central1') && request.auth.principalSet == 'serviceAccount:bq-<project-number>@bigquery-encryption.iam.gserviceaccount.com'
D.resource.service == 'bigquery.googleapis.com' && resource.location == 'us-central1'
AnswerC

This condition restricts the key to the us-central1 location and the BigQuery encryption service account.

Why this answer

IAM conditions allow restricting access based on attributes like region and service account. The condition must check the 'destination_service' for BigQuery and the 'region' for us-central1.

Full explanation →
929
MCQmedium

Refer to the exhibit. A user alice@example.com is unable to list objects in bucket 'bucket-b'. What is the most likely reason?

A.The condition restricts access only to bucket-a.
B.The IAM policy is missing the roles/storage.objectAdmin role.
C.The condition expression is invalid.
D.The user needs the roles/storage.legacyBucketReader role.
AnswerA

The condition expression limits the role to buckets with names starting with 'bucket-a'.

Why this answer

The IAM policy condition explicitly restricts access to resources with a name matching 'bucket-a'. Since the user is trying to list objects in 'bucket-b', the condition evaluates to false, and the IAM policy does not grant the required permissions. Without a matching condition, the effective permission set is empty, causing the list operation to fail.

Exam trap

Google Cloud often tests the nuance that IAM conditions can override role-based permissions, causing candidates to overlook the condition and focus only on the role assignment.

How to eliminate wrong answers

Option B is wrong because the IAM policy already includes the roles/storage.objectViewer role, which provides the storage.objects.list permission needed to list objects; adding roles/storage.objectAdmin would grant broader permissions but is not necessary for listing. Option C is wrong because the condition expression 'resource.name.startsWith("projects/_/buckets/bucket-a")' is syntactically valid and correctly uses the IAM condition syntax for resource name matching. Option D is wrong because roles/storage.legacyBucketReader is a legacy role that grants bucket-level read access, but the condition still restricts access to bucket-a only, so it would not help for bucket-b.

Full explanation →
930
MCQhard

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using the pod's own identity, without managing long-lived credentials. They have created a Google service account (GSA) and a Kubernetes service account (KSA). What should they do to bind the KSA to the GSA?

A.Create a service account key and mount it as a secret in the pod
B.Add an annotation to the KSA referencing the GSA, and grant the KSA the iam.workloadIdentityUser role on the GSA
C.Grant the GSA the roles/iam.serviceAccountUser role on the project
D.Add an annotation to the GSA referencing the KSA, and grant the KSA the iam.workloadIdentityUser role on the GSA
AnswerB

This is the correct configuration for Workload Identity: annotate the KSA with the GSA email, and grant the KSA the workload identity user role on the GSA.

Why this answer

Workload Identity allows you to configure a KSA to act as a GSA by adding an annotation to the KSA and granting the GSA the necessary IAM role. The GSA does not impersonate the KSA; the KSA impersonates the GSA. The annotation is set on the KSA, not the pod.

The GSA does not need to be bound to the KSA via an IAM role on the KSA.

Full explanation →
931
MCQhard

A financial services company uses Cloud Storage to store sensitive transaction records. They need to ensure that objects cannot be deleted or overwritten for a retention period of 7 years, even by the bucket owner. Which feature should they enable?

Answer options not yet available.

Why this answer

Bucket Lock with retention policy enforces a minimum retention period for objects. Once locked, the retention policy cannot be removed, preventing deletion or overwrite. Object versioning helps but can be overwritten.

Hold policies are temporary. IAM policies can be overridden by owner.

Full explanation →
932
MCQeasy

A development team uses Cloud Build for their CI/CD pipeline. They want to reduce build times. Which action is most effective?

A.Store build artifacts in a Cloud Storage bucket and reuse them
B.Enable parallel builds by separating build steps into multiple jobs
C.Use more powerful build machines by specifying larger machine types
D.Use a Cloud Run service to run builds asynchronously
AnswerB

Parallelizing independent steps reduces overall build duration.

Why this answer

Enabling parallel builds by separating build steps into multiple jobs reduces total build time by running independent steps concurrently. Other options are less effective or add complexity.

Full explanation →
933
Multi-Selecteasy

A company needs to store and serve large media files (each up to 5 GB) to users globally. The files are accessed infrequently (once a quarter) but must be available with low latency. Which THREE Cloud Storage classes and features should they consider? (Choose three.)

Select 3 answers
A.Coldline storage class
B.Standard storage class
C.Cloud CDN
D.Object lifecycle management
E.Nearline storage class
AnswersC, D, E

Cloud CDN caches large media files at Google’s globally distributed edge points of presence, which directly satisfies the low-latency requirement for users worldwide despite infrequent quarterly access. By serving cached content from the nearest edge location, it reduces origin server load and network round-trips, ensuring fast delivery of files up to 5 GB without requiring a higher-cost storage class for performance.

Why this answer

Nearline is suitable for data accessed less than once a month. Cloud CDN caches content at edge locations for low latency. Object lifecycle management can transition objects to colder storage automatically.

Standard is for frequently accessed data. Coldline is for data accessed less than once a quarter. Archive is for data accessed less than once a year.

Full explanation →
934
MCQmedium

Your organization stores critical financial data in Cloud Storage. You need to ensure that if an object is deleted or overwritten, you can recover it within 30 days. What feature should you enable?

A.Set a retention policy with a 30-day retention period
B.Configure lifecycle management to delete objects after 30 days
C.Enable object versioning on the bucket
D.Enable Bucket Lock with a retention policy
AnswerC

Versioning retains non-current versions, enabling recovery.

Why this answer

Cloud Storage offers object versioning and retention policies to protect data. Versioning keeps non-current versions of objects, allowing recovery from accidental deletion or overwrites. Object retention policies (e.g., retention policy or hold) prevent deletion or modification for a specified period, but versioning is the primary mechanism to recover from deletion.

Full explanation →
935
MCQhard

Refer to the exhibit. The SLO for the payments-api service is 99.9% availability over 30 days. The current compliance is 99.89% and the error budget is exhausted. Which action should the SRE team take FIRST?

A.Increase the SLO target to 99.99% to reduce future burn rate.
B.Pause all non-critical deployments and investigate the cause of the increased error rate.
C.Trigger a rollback of the latest deployment to stabilize the service.
D.Scale up the service to handle more traffic and reduce error rate.
AnswerB

This aligns with error budget policy: when budget is exhausted, slow down or stop deployments to prevent further errors.

Why this answer

The error budget is exhausted, meaning the service has already consumed its allowed downtime for the 30-day window. The immediate priority is to stop further budget erosion by pausing non-critical deployments and investigating the root cause of the increased error rate. This aligns with SRE best practices: when the error budget is depleted, the team should shift focus from feature velocity to reliability, halting all non-essential changes until the cause is understood and mitigated.

Exam trap

The exam often tests the misconception that you should immediately roll back or scale up when error budget is exhausted, but the correct first step is always to pause changes and investigate, because the root cause may not be the latest deployment and scaling may mask a deeper issue.

How to eliminate wrong answers

Option A is wrong because increasing the SLO target to 99.99% would actually tighten the error budget, making it even harder to comply and not addressing the current root cause of errors. Option C is wrong because triggering a rollback assumes the latest deployment is the cause, but the question does not provide evidence that a recent deployment introduced the errors; a rollback could be premature and destabilizing without investigation. Option D is wrong because scaling up the service may reduce errors caused by traffic spikes, but it does not address other potential causes like code bugs or configuration issues, and it consumes resources without fixing the underlying problem.

Full explanation →
936
MCQeasy

A company needs to store archival data that is accessed less than once a year and must be retained for 10 years for compliance. The data retrieval time is not critical. Which Cloud Storage class is MOST cost-effective?

A.Coldline storage class
B.Standard storage class
C.Nearline storage class
D.Archive storage class
AnswerD

Archive is the lowest-cost class for long-term retention with rare access.

Why this answer

Archive storage is the cheapest class for long-term archival data accessed less than once a year. Coldline is for 90-day access, Nearline for 30-day, and Standard for frequent access. Archive has the lowest storage cost but higher retrieval costs and minimum storage duration of 365 days.

Full explanation →
937
MCQhard

A company has a GKE cluster with Workload Identity enabled. A pod needs to access a BigQuery dataset in a different project. The team has created a service account in the pod's project and granted it BigQuery Data Viewer on the dataset. They also created an IAM policy binding between the Kubernetes service account and the Google service account. The pod still gets permission denied. What is missing?

A.The Google service account needs the iam.workloadIdentityUser role on itself
B.The Kubernetes service account needs the iam.workloadIdentityUser role
C.The pod needs a node pool with Workload Identity enabled
D.The BigQuery dataset must be in the same project as the cluster
AnswerA

This role allows the Kubernetes service account to impersonate the Google service account.

Why this answer

Workload Identity requires the Google service account to be granted the iam.workloadIdentityUser role on the Google service account itself, not just on the Kubernetes service account.

Full explanation →
938
MCQhard

An engineering team wants to perform load testing on their new microservices-based application deployed on GKE. They need a tool that can simulate thousands of concurrent users, generate detailed performance metrics, and integrate with Cloud Monitoring. Which tool should they use?

A.Locust
B.Cloud Load Testing
C.Apache JMeter
D.gcloud alpha loadtest
AnswerB

Cloud Load Testing is a managed service that generates load from multiple regions and provides metrics in Cloud Monitoring.

Why this answer

Cloud Load Testing (formerly known as Cloud Load Testing) is a Google Cloud service that allows you to create load tests with simulated users and integrates with Cloud Monitoring for detailed metrics. Locust is an open-source alternative but lacks native integration with Cloud Monitoring.

Full explanation →
939
MCQhard

A company runs an e-commerce platform on Google Cloud. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster (us-central1, three zones). The frontend service is exposed via an HTTP Load Balancer with Cloud CDN. Recently, during a flash sale, users experienced high latency and occasional 502 errors. The backend service is a Java application that reads from Cloud Spanner. The team has observed that Spanner CPU utilization averaged 65% during the sale, with a few spikes to 80%. The number of frontend pods was auto-scaled to 50, each running on n1-standard-2 nodes. The node pool is set to autoscale up to 100 nodes. The errors appear to correlate with periods of high CPU on the nodes, but not always. What is the most likely cause and recommended action?

A.Scale up the Cloud Spanner instance to handle higher peak CPU, as the 80% spikes indicate insufficient capacity.
B.Change the backend service to use a multi-zone NEG that includes endpoints from all three zones, and ensure the load balancer is configured for cross-zone load balancing.
C.Increase the CPU request for the frontend pods and set a higher target CPU utilization for the Horizontal Pod Autoscaler.
D.Increase the health check interval and timeout settings to give pods more time to respond before being marked unhealthy.
AnswerB

This ensures traffic is distributed evenly across zones, reducing cross-zone latency and preventing a single zone from being overloaded.

Why this answer

The high latency and 502 errors are likely caused by the HTTP Load Balancer sending requests to unhealthy backend pods due to zone-imbalanced traffic. A regional GKE cluster with a multi-zone NEG and cross-zone load balancing ensures that the load balancer distributes requests evenly across all pods in all three zones, preventing node CPU spikes in a single zone from causing errors. Option B directly addresses this by enabling proper traffic distribution, which is the most probable root cause given that node CPU spikes correlate with errors but not always.

Exam trap

The trap here is that candidates focus on scaling the database (Spanner) or adjusting pod-level configurations, when the real issue is zone-imbalanced traffic distribution from the HTTP Load Balancer, a common misdiagnosis in multi-zone GKE setups.

How to eliminate wrong answers

Option A is wrong because Spanner CPU at 65% average with spikes to 80% is well within acceptable limits (Spanner can handle up to 65-70% sustained CPU before needing scaling, and 80% spikes are transient); the errors correlate with node CPU, not Spanner CPU, so scaling Spanner would not resolve the issue. Option C is wrong because increasing CPU requests and HPA target utilization would reduce pod density per node, potentially worsening node CPU spikes and not addressing the load balancer's zone-imbalanced traffic distribution. Option D is wrong because increasing health check intervals and timeouts would make the load balancer slower to detect unhealthy pods, increasing the chance of routing traffic to failing pods and exacerbating 502 errors, not reducing them.

Full explanation →
940
Multi-Selecthard

A team is designing a disaster recovery (DR) plan for a critical application. Which THREE components are essential for a robust DR plan? (Choose 3)

Select 3 answers
A.Failover procedures and runbooks
B.Regular backups to a separate region
C.A single-region deployment for consistency
D.Monitoring and alerting for disaster events
E.Load testing to validate performance
AnswersA, B, D

Well-documented failover steps ensure quick recovery.

Why this answer

Failover procedures and runbooks (A) are essential because they provide step-by-step instructions for executing a controlled transition to the secondary site, ensuring minimal downtime and consistent recovery actions. Without documented runbooks, teams risk misconfigurations during a disaster, which can extend recovery time objectives (RTO) beyond acceptable limits.

Exam trap

Google Cloud often tests the misconception that a single-region deployment is acceptable for DR if it has high availability within that region, but the exam emphasizes that DR requires geographic separation to survive a full regional failure.

Full explanation →
941
MCQmedium

A financial services company requires a globally distributed relational database with strong consistency and horizontal scalability to serve a multi-region banking application. Write conflicts are rare. Which database should they choose?

A.Firestore in Native mode
B.Cloud SQL with cross-region replication
C.Cloud Bigtable
D.Cloud Spanner
AnswerD

Spanner is a globally distributed, strongly consistent relational database designed for multi-region deployments.

Why this answer

Cloud Spanner is the only Google Cloud database that provides global distribution, strong consistency, and horizontal scalability for relational workloads. It uses true-time technology for external consistency. Bigtable is NoSQL; Firestore is eventually consistent; Cloud SQL is regional.

Full explanation →
942
MCQhard

A startup is designing a real-time leaderboard for a multiplayer game. The leaderboard must update within seconds of a score change and handle millions of concurrent players. Strong consistency is not required, but availability is critical. Which database is most suitable?

A.Cloud Memorystore
B.Cloud Spanner
C.Cloud Firestore
D.Cloud Bigtable
AnswerD

Bigtable offers high throughput and low latency for simple key-value operations like leaderboards, and eventual consistency is acceptable.

Why this answer

Cloud Bigtable is optimized for high-throughput, low-latency reads and writes, and can serve as a leaderboard backend if row keys are designed properly. It offers eventual consistency, which is acceptable here. Cloud Spanner provides strong consistency but is more expensive and may have higher latency.

Firestore is good for real-time updates but may not handle millions of concurrent updates easily. Memorystore (Redis) can also do leaderboards but is not a database for persistent storage; it's a cache.

Full explanation →
943
MCQmedium

A company is using Cloud Functions (2nd gen) for event-driven processing of uploaded images in Cloud Storage. Each image is resized to multiple sizes and stored back in different buckets. Recently, the number of uploads has increased 10x, and the team notices that some images are not being processed, and logs show function execution timeouts after 60 seconds. The function's timeout is set to 60 seconds. The code processes images sequentially. The team needs to reliably process all images with minimal code changes. What should they do?

A.Increase the memory allocation for the function.
B.Use Cloud Tasks to queue the processing and run the function as a task handler.
C.Increase the Cloud Function timeout to 540 seconds.
D.Split the function into separate functions for each resize operation.
AnswerB

Cloud Tasks allows asynchronous processing with retries, reducing timeouts and enabling parallel execution.

Why this answer

Use Cloud Tasks to queue the processing and run the function as a task handler. This decouples the image processing from the upload event, allowing retries and better scalability. Cloud Tasks can handle the increased load and provide reliable execution with built-in retries.

Option A (increase memory) may improve performance but does not address the timeout issue when processing multiple images sequentially. Option C (increase timeout to 540 seconds) would merely extend the timeout window but still risks timeouts and does not scale. Option D (split into separate functions) increases complexity and requires significant code changes without addressing the fundamental sequential processing bottleneck.

Full explanation →
944
Multi-Selectmedium

A team needs to set up alerting for a production service. They want to receive notifications when the 99th percentile latency exceeds 500ms for 5 minutes. Which two Cloud Monitoring components are required? (Choose two.)

Answer options not yet available.

Why this answer

To alert on latency, you need a metric (e.g., from Cloud Monitoring) and an alerting policy that defines the condition and notification channel. A dashboard is not required. SLO is not required, but can be used.

Log-based metrics are for logs, not latency.

Full explanation →
945
MCQeasy

You are configuring a Cloud Monitoring alerting policy to notify your SRE team when the error rate of a service exceeds 5% over a 5-minute window. Which type of metric evaluation should you use?

A.Window-based
B.Log-based
C.Request-based
D.Health check-based
AnswerA

Window-based metrics evaluate conditions over a sliding time window.

Why this answer

A window-based metric evaluation (e.g., rate, ratio, or count over a sliding window) is appropriate for error rate over a 5-minute window. Request-based is for latency SLOs.

Full explanation →
946
MCQhard

Your company runs a critical application on Google Kubernetes Engine (GKE) in us-central1. The application consists of a frontend deployment with 3 replicas and a backend statefulset with 5 replicas using persistent volumes (SSD). Recently, the team noticed that during a regional outage in us-central1, the application became completely unavailable. They want to design a multi-region architecture that can survive a regional failure with RPO of 1 hour and RTO of 30 minutes. The application is stateless on the frontend but the backend stores critical data on persistent disks. The backend can operate in a read-only mode from a secondary region if needed. They have a limited budget and want to minimize ongoing costs. Which approach should they take?

A.Migrate the backend to Cloud SQL for MySQL with cross-region replication, and keep the frontend on GKE with multi-region ingress.
B.Deploy the frontend and backend in a regional GKE cluster and use regional persistent disks for the statefulset, replicating data synchronously across zones.
C.Deploy the frontend and backend in a single zonal cluster in us-central1-a, and use scheduled snapshots of persistent disks to a different region.
D.Deploy the frontend and backend in a regional GKE cluster across us-central1, and use a CronJob to take snapshots of persistent volumes every hour and copy them to a secondary region. In disaster, restore the snapshots to a new cluster in the secondary region.
AnswerD

Regional cluster survives zonal failure; snapshots provide cross-region backup with RPO 1 hour and RTO within 30 minutes if restore is automated.

Why this answer

Meets the RPO of 1 hour by using a CronJob to take hourly snapshots of PersistentVolume data and copy them to a secondary region. In a disaster, you restore those snapshots to a new GKE cluster in the secondary region, achieving an RTO of 30 minutes by automating the restore process. This approach minimizes ongoing costs because snapshots are incremental and you only pay for storage in the secondary region when needed, while the frontend remains stateless and can be redeployed quickly.

Exam trap

Google Cloud often tests the distinction between zonal, regional, and multi-region resilience; the trap here is that candidates may choose regional persistent disks (Option B) thinking they provide multi-region protection, when in fact they only replicate across zones within a single region.

How to eliminate wrong answers

Option A is wrong because migrating to Cloud SQL for MySQL with cross-region replication introduces significant ongoing costs for a managed database service and may not align with the existing statefulset architecture; it also requires application changes to use Cloud SQL instead of persistent disks. Option B is wrong because regional persistent disks replicate synchronously across zones within a single region, which does not protect against a full regional outage in us-central1. Option C is wrong because a single zonal cluster in us-central1-a cannot survive a regional failure, and scheduled snapshots to a different region without a restore plan in a secondary cluster do not meet the RTO of 30 minutes.

Full explanation →
947
MCQhard

A company is migrating a legacy monolithic application to a microservices architecture on GKE. They want to gradually shift traffic from the monolith to the new services. They also need to route requests based on headers (e.g., for A/B testing). Which GKE feature should they use?

A.Anthos Service Mesh
B.GKE Ingress with multiple backend services
C.Node pools with different machine types
D.GKE Autopilot
AnswerA

Anthos Service Mesh (based on Istio) provides advanced traffic management including header-based routing, canary deployments, and traffic splitting.

Why this answer

GKE provides traffic management through Kubernetes Ingress with custom resource definitions like the Multi-Cluster Ingress or using Service Mesh. However, for traffic splitting based on headers, the GKE Ingress alone doesn't support it. GKE supports Service Mesh (Anthos Service Mesh) which uses Istio to provide advanced traffic routing, including header-based routing and canary deployments.

GKE Autopilot is a mode, not a traffic management feature. Node pools are for compute resources.

Full explanation →
948
MCQeasy

A user wants to store a database password that will be used by a Compute Engine instance. What is the most secure and manageable approach?

A.Use Secret Manager and grant the instance's service account access to the secret
B.Set the password as an environment variable in instance metadata
C.Store the password in Cloud Storage bucket metadata
D.Store the password in a file on the instance's boot disk
AnswerA

Secret Manager is the recommended way to store secrets with fine-grained access control.

Why this answer

Secret Manager is the most secure and manageable approach because it provides encrypted storage, automatic rotation, and fine-grained access control via IAM. By granting the Compute Engine instance's service account access to the secret, the password is never exposed in plaintext metadata, logs, or disk files, and access can be audited and revoked independently of the instance lifecycle.

Exam trap

Google Cloud often tests the misconception that instance metadata is a secure place for secrets because it is 'internal' to the project, but in reality, metadata is accessible to any process on the instance and is logged, making it unsuitable for sensitive data.

How to eliminate wrong answers

Option B is wrong because setting the password as an environment variable in instance metadata exposes it in the metadata server, which can be accessed by any process on the instance or via the metadata API, and it is logged in Cloud Audit Logs. Option C is wrong because Cloud Storage bucket metadata is not designed for secrets; it is unencrypted at rest by default, accessible via the Storage API, and lacks IAM-level access control for individual metadata entries. Option D is wrong because storing the password in a file on the instance's boot disk persists the secret in the filesystem, making it vulnerable to snapshot exports, disk cloning, and unauthorized OS-level access, and it cannot be centrally managed or rotated.

Full explanation →
949
Multi-Selecthard

A company wants to implement a disaster recovery strategy for a critical application running on Compute Engine with state stored on persistent disks. They need an RTO of less than 15 minutes and an RPO of less than 1 hour. Which TWO steps should they take? (Choose two.)

Select 2 answers
A.Set up scheduled snapshots to a multi-regional Cloud Storage bucket
B.Use Cloud DNS with a failover policy
C.Use regional persistent disks for the application data
D.Create a managed instance group with health checks and auto-healing across multiple zones
E.Configure a global HTTP(S) load balancer in front of the application
AnswersC, D

Regional PDs synchronously replicate data across zones, enabling RPO under 1 hour.

Why this answer

Regional persistent disks replicate data synchronously across zones, providing low RPO. A managed instance group with a health check and auto-healing enables fast failover for low RTO. Snapshots have higher RPO.

Cloud DNS is for DNS failover, not for compute failover. Global load balancer is for traffic distribution, not stateful failover.

Full explanation →
950
MCQmedium

A company uses Google Cloud Armor to protect their HTTP load balancer from OWASP Top 10 attacks. After deploying a security policy with pre-configured WAF rules, they notice that some legitimate user requests are being blocked because they match a rule incorrectly. The security team wants to fine-tune the rules to reduce false positives while maintaining strong protection. They also want to evaluate the impact of changes before enforcing them. What should they do?

A.Disable the WAF rules entirely and implement IP-based allowlists.
B.Set the WAF rules to 'preview' mode to test their impact without blocking traffic, then adjust thresholds or exclusions based on logs.
C.Add a higher priority allow rule to permit the traffic that is being incorrectly blocked.
D.Remove the WAF rules and rely solely on rate limiting to protect the application.
AnswerB

Preview mode allows safe testing of rule modifications without disrupting legitimate traffic.

Why this answer

Google Cloud Armor's 'preview' mode allows you to apply a security policy to a backend service or load balancer without actually blocking traffic. Instead, all matched requests are logged, enabling you to analyze false positives in the logs before enforcing the rules. This approach lets you fine-tune thresholds, add exclusions, or adjust rule priorities based on real traffic patterns, reducing false positives while maintaining strong protection.

Exam trap

The trap here is that candidates may think adding a higher priority allow rule (Option C) is a valid fine-tuning approach, but it actually creates a security bypass rather than reducing false positives through proper rule adjustment.

How to eliminate wrong answers

Option A is wrong because disabling WAF rules entirely removes protection against OWASP Top 10 attacks, and IP-based allowlists only permit specific source IPs, which is not a scalable or effective defense against application-layer attacks. Option C is wrong because adding a higher priority allow rule would permit the traffic unconditionally, bypassing the WAF rules and potentially allowing malicious requests that match the same pattern, thus weakening security. Option D is wrong because removing WAF rules and relying solely on rate limiting does not protect against OWASP Top 10 attacks such as SQL injection or cross-site scripting, which require content inspection.

Full explanation →
951
MCQmedium

Your company uses HA VPN to connect on-premises to Google Cloud. You need to ensure the VPN connection meets a 99.99% SLA. Which configuration is required?

A.A single Cloud VPN gateway with two tunnels to the same on-premises peer gateway.
B.Two Cloud VPN gateways in the same region, each with one tunnel.
C.One Cloud VPN gateway with four tunnels to the same on-premises peer gateway.
D.Two Cloud VPN gateways in different regions, each with two tunnels to the same on-premises peer gateway.
AnswerD

This configuration provides redundancy and meets the 99.99% SLA.

Why this answer

HA VPN provides 99.99% SLA when configured with two Cloud VPN gateways (one per region) and two tunnels per gateway (four tunnels total) from each gateway to the on-premises peer gateway. Each gateway uses a different external IP. A single VPN gateway with two tunnels does not meet the SLA requirement because the gateway itself is a single point of failure.

Full explanation →
952
MCQeasy

A company wants to run a containerized application that scales down to zero when not in use and only incurs costs when requests are being processed. They do not want to manage infrastructure. Which compute service should they use?

A.Cloud Functions
B.Compute Engine
C.Cloud Run
D.Google Kubernetes Engine (GKE) Standard
AnswerC

Cloud Run is serverless, scales to zero, and charges only for request processing time.

Why this answer

Cloud Run is a fully managed serverless container platform that scales to zero and charges only for resources used during request processing. GKE Autopilot manages infrastructure but does not scale to zero (has a minimum node). Cloud Functions scales to zero but is for functions, not containers.

Compute Engine always has running VMs.

Full explanation →
953
MCQhard

Refer to the exhibit. An engineer created an instance with a startup script that references a Cloud Storage bucket. The instance boots but the startup script fails. What is the most likely cause?

A.The Cloud Storage bucket 'my-bucket' does not exist or the object 'startup.sh' is missing.
B.The startup script is not executable.
C.The instance does not have the appropriate IAM permissions to read from Cloud Storage.
D.The instance has no network connectivity to access Cloud Storage.
AnswerA

The error 'Could not find resource' indicates the bucket or object does not exist.

Why this answer

The error message indicates that the startup script cannot find the resource at gs://my-bucket/startup.sh. This could be because the bucket does not exist, the object does not exist, or the instance does not have permission to access the bucket. Given that the bucket is named 'my-bucket', it's likely that the bucket does not exist or the name is incorrect.

Full explanation →
954
MCQeasy

A startup uses Cloud Functions with a Pub/Sub trigger to process incoming orders. They notice that the function sometimes fails to process messages, and those messages are lost. What is the most likely cause?

A.The subscription has an ackDeadlineSeconds of 600.
B.The Cloud Function has a timeout of 540 seconds.
C.The Pub/Sub topic has a retention duration of 10 minutes.
D.The Cloud Function is configured with retry on failure set to false.
AnswerD

If retry is disabled, failed messages are dropped.

Why this answer

When a Cloud Function fails to process a Pub/Sub message and retry on failure is set to false, the message is not redelivered. Pub/Sub relies on the subscriber (the Cloud Function) to acknowledge messages; without retries, a failed execution causes the message to be dropped after the ack deadline expires, leading to message loss.

Exam trap

The trap here is that candidates often confuse the Cloud Function's timeout setting with message delivery guarantees, overlooking that the retry on failure flag is the critical control for preventing message loss in Pub/Sub-triggered functions.

How to eliminate wrong answers

Option A is wrong because a longer ackDeadlineSeconds (600 seconds) gives the function more time to process messages, reducing the chance of premature timeout and message loss, not causing it. Option B is wrong because a Cloud Function timeout of 540 seconds is generous and would not cause message loss unless the function consistently exceeds it; the default timeout is 60 seconds, so 540 seconds is actually a mitigation, not a cause. Option C is wrong because a topic retention duration of 10 minutes means messages that are not acknowledged are retained for 10 minutes before being discarded, which is a reasonable duration and does not cause immediate loss; the issue is about the function failing to process, not the topic discarding messages too quickly.

Full explanation →
955
MCQeasy

A developer wants to monitor the CPU usage of a single Compute Engine VM and receive alerts when it exceeds 80%. What is the simplest way to achieve this?

A.Query the Compute Engine API periodically and check CPU usage.
B.Configure a Cloud Logging sink to BigQuery and set a scheduled query to detect high CPU.
C.Install the Cloud Monitoring agent and create an alerting policy based on the metric 'cpu.utilization'.
D.Use the managed instance group's autoscaling metric to trigger a notification.
AnswerC

The Monitoring agent collects CPU utilization from the OS and sends it to Cloud Monitoring, where you can set alerts.

Why this answer

The Cloud Monitoring agent (formerly Stackdriver agent) collects CPU utilization metrics from Compute Engine VMs and sends them to Cloud Monitoring. You can then create an alerting policy directly on the metric 'cpu.utilization' with a threshold of 80% without any custom scripting or additional infrastructure. This is the simplest and most native approach for a single VM.

Exam trap

Google Cloud often tests the misconception that you need to export logs to BigQuery or query APIs manually, when in fact the Cloud Monitoring agent provides a built-in, agent-based metric that can be alerted on directly.

How to eliminate wrong answers

Option A is wrong because periodically querying the Compute Engine API for CPU usage is inefficient, requires custom code, and does not provide real-time alerting; the API does not expose high-frequency CPU metrics natively. Option B is wrong because exporting logs to BigQuery and running scheduled queries adds unnecessary complexity, latency, and cost; Cloud Logging sinks are for log data, not for real-time metric-based alerting. Option D is wrong because managed instance group autoscaling metrics are designed for scaling groups of VMs, not for alerting on a single VM's CPU usage; they do not trigger notifications directly.

Full explanation →
Page 12

Page 13 of 13

All pages

12345678910111213

Practice PCA by domain

Target a specific domain to shore up weak areas.

Managing Implementation and Ensuring Solution and Operations ReliabilityManaging and Provisioning a Solution InfrastructureDesigning for Security and ComplianceAnalysing and Optimising Technical and Business ProcessesDesign and plan a cloud solution architectureManage and provision cloud infrastructureDesign for security and complianceAnalyze and optimize technical and business processesManage implementation of cloud architectureEnsure solution and operations reliability
See all domains with question counts →