Courseiva

Google Professional Cloud Architect (PCA) — Questions 226–300

955 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 3

Page 4 of 13

Page 5
226
MCQhard

An organization needs to run workloads that are subject to ITAR (International Traffic in Arms Regulations) in Google Cloud. Which region should they use to ensure compliance with ITAR requirements?

A.europe-west1
B.us-central1
C.us-military-east4
D.us-east1
AnswerC

us-military-east4 is part of Assured Workloads for Government and supports ITAR.

Why this answer

Assured Workloads for Government provides controlled regions that are compliant with ITAR. The us-central1 region is not ITAR-compliant. The us-military regions (e.g., us-military-east4) are part of Assured Workloads for Government and support ITAR.

Full explanation →
227
MCQmedium

A company is migrating an on-premises monolithic Java application to Google Cloud. They want to minimize changes to the code while gaining some cloud benefits like autoscaling and managed infrastructure. They plan to eventually refactor to microservices. Which compute option BEST fits their current needs?

A.Migrate the application to Cloud Run.
B.Deploy the application in a container on GKE Standard.
C.Deploy the application on App Engine Flexible Environment.
D.Migrate the application to Compute Engine VMs.
AnswerC

App Engine Flexible supports Java with minimal changes, provides autoscaling, and allows gradual refactoring.

Why this answer

App Engine Flexible Environment supports Java with minimal code changes, provides autoscaling and managed infrastructure, and is suitable for monolithic apps. It allows gradual refactoring to microservices. GKE and Cloud Run require containerization, and Compute Engine needs manual scaling.

Full explanation →
228
Multi-Selecthard

A company runs a stateful application on GKE using StatefulSets. Which THREE practices improve reliability?

Select 3 answers
A.Use headless services.
B.Use horizontal autoscaling based on disk usage.
C.Use volume snapshots for backup.
D.Use pod disruption budgets.
E.Use persistent volumes with reclaim policy Delete.
AnswersA, C, D

Provides stable network identities for stateful workloads.

Why this answer

A headless service (clusterIP: None) allows direct pod-to-pod communication without load balancing, which is essential for stateful applications like databases that require stable network identities. Each pod in a StatefulSet gets a unique DNS name (e.g., pod-0.service.namespace.svc.cluster.local), enabling reliable discovery and ordering for replication, leader election, and failover. This ensures that clients always reach the correct pod instance, improving overall reliability.

Exam trap

Google Cloud often tests the misconception that horizontal autoscaling can be based on any arbitrary metric like disk usage, but the HPA only supports CPU, memory, and custom/external metrics that must be exposed through the Metrics Server or a custom metrics adapter.

Full explanation →
229
MCQhard

Your company runs a stateful web application on Compute Engine instances in a managed instance group (MIG) with autoscaling based on CPU utilization. The application maintains session state in memory on each instance. Recently, users have been experiencing session timeouts and data loss during scaling events. Additionally, the application's performance degrades under load due to frequent database queries for session data. You need to design a solution that ensures session persistence, improves performance, and minimizes application changes. The application is written in Java and uses Tomcat. Which of the following should you do?

A.Rewrite the application to be stateless by moving all state to the frontend using JWT tokens, eliminating the need for server-side sessions.
B.Deploy Cloud Memorystore for Redis as a session store, and configure Tomcat to use Redis-backed session persistence using the Redisson or Spring Session framework.
C.Configure the load balancer to use session affinity (sticky sessions) and increase the instance size to handle more sessions per instance.
D.Store session data in Cloud SQL using Spring Session JDBC, and configure the application to retrieve sessions from the database.
AnswerB

Redis provides fast, in-memory session storage accessible by all instances, ensuring persistence and performance with minimal code changes.

Why this answer

It introduces an external, highly available, in-memory session store (Cloud Memorystore for Redis) that decouples session state from individual Compute Engine instances. This eliminates session loss during autoscaling events and reduces database load by serving session data from fast Redis memory, all while requiring minimal application changes via Tomcat's built-in session persistence or Spring Session integration.

Exam trap

The trap here is that candidates often choose session affinity (sticky sessions) thinking it solves session persistence, but it only routes traffic to the same instance and does not protect against session loss when that instance is terminated during autoscaling or maintenance.

How to eliminate wrong answers

Option A is wrong because rewriting the application to be stateless with JWT tokens moves session state to the frontend, which requires significant application changes and does not address the existing Tomcat session management; it also shifts security and token management complexity without solving the immediate session persistence issue. Option C is wrong because session affinity (sticky sessions) ties a user to a specific instance, which does not prevent session loss when that instance is terminated during autoscaling; increasing instance size only delays the problem and does not provide a shared, durable session store. Option D is wrong because storing session data in Cloud SQL (a relational database) introduces latency and contention for frequent session reads/writes, degrading performance under load, and it does not leverage the in-memory speed needed for session persistence; it also requires more application changes than using Redis with Tomcat.

Full explanation →
230
MCQeasy

A startup is setting up a CI/CD pipeline for their web application using Cloud Build and Cloud Deploy. They have configured a Cloud Build trigger that executes on pushes to the main branch of a Cloud Source Repositories repository. The trigger runs a build step that builds a Docker image and pushes it to Artifact Registry, then creates a release using Cloud Deploy. The pipeline fails with an error message indicating that the Cloud Build service account does not have permission to create releases. What should the architect do to resolve the issue?

A.Add the Cloud Deploy Developer IAM role to the Cloud Build service account.
B.Verify that the cloudbuild.yaml file contains the correct steps.
C.Enable the Cloud Deploy API for the project.
D.Grant the Cloud Build service account the Cloud Run Admin role.
AnswerA

Correct: The Cloud Build service account needs roles/clouddeploy.developer to create releases.

Why this answer

The Cloud Build service account (typically the Compute Engine default service account or a custom service account) needs the Cloud Deploy Developer IAM role (roles/clouddeploy.developer) to create releases in Cloud Deploy. This role grants the necessary permissions, such as clouddeploy.releases.create, which are required for the Cloud Build trigger to successfully create a release after building and pushing the Docker image. Without this role, the pipeline fails with a permission error, making option A the correct resolution.

Exam trap

The trap here is that candidates might assume the Cloud Build service account has sufficient permissions by default (e.g., via the Editor role) or confuse Cloud Deploy permissions with Cloud Run permissions, leading them to select the Cloud Run Admin role instead of the specific Cloud Deploy Developer role.

How to eliminate wrong answers

Option B is wrong because the cloudbuild.yaml file's correctness is irrelevant to the permission error; the error explicitly states the Cloud Build service account lacks permissions, not that the build steps are misconfigured. Option C is wrong because if the Cloud Deploy API were not enabled, the error would typically indicate that the API is not available or that the resource is not found, not a specific permission denied error for creating releases. Option D is wrong because the Cloud Run Admin role (roles/run.admin) grants permissions for Cloud Run services, not for Cloud Deploy release creation; Cloud Deploy uses its own IAM roles (e.g., Cloud Deploy Developer) to manage releases and delivery pipelines.

Full explanation →
231
MCQmedium

A company runs a Kubernetes cluster on GKE. They need to ensure that pods cannot access Google Cloud APIs unless explicitly allowed through a service account. Which GKE feature should they use?

A.Network Policies
B.Pod Security Policies
C.Cloud Audit Logs
D.Workload Identity
AnswerD

Maps Kubernetes SA to Google SA for fine-grained IAM.

Why this answer

Workload Identity is the correct choice because it allows pods in GKE to authenticate to Google Cloud APIs using a specific Google service account, rather than the default Compute Engine service account. This ensures that pods cannot access any Google Cloud APIs unless explicitly granted permission via IAM roles bound to that service account, meeting the requirement for least-privilege access.

Exam trap

The trap here is that candidates often confuse network-level controls (Network Policies) with identity-based access controls, or they assume that Pod Security Policies can restrict API access, when in fact only Workload Identity provides the mechanism to explicitly bind pod identity to a specific Google service account for API authorization.

How to eliminate wrong answers

Option A is wrong because Network Policies control traffic flow between pods and external endpoints at the network layer (e.g., using IP addresses and ports), but they do not manage authentication or authorization to Google Cloud APIs. Option B is wrong because Pod Security Policies (now replaced by Pod Security Admission in GKE) enforce security constraints on pod specifications (e.g., privileged containers, host namespaces), but they do not control which Google Cloud APIs a pod can call. Option C is wrong because Cloud Audit Logs record API calls and activities for auditing purposes, but they do not restrict or prevent pods from accessing Google Cloud APIs.

Full explanation →
232
MCQhard

Refer to the exhibit. A Cloud Deployment Manager deployment fails with the error 'Resource 'my-firewall' already exists'. What is the most likely cause?

A.The user lacks IAM permissions to create firewall rules.
B.The network reference in the firewall rule is incorrect.
C.A firewall rule with the name 'my-firewall' already exists in the project.
D.The deployment does not include a 'delete' policy for existing resources.
AnswerC

The error clearly indicates the resource already exists.

Why this answer

The error message 'Resource 'my-firewall' already exists' directly indicates that a firewall rule with the exact name 'my-firewall' is already present in the project. Cloud Deployment Manager creates resources by name, and if a resource with the same name exists (even if it was created outside the deployment), the deployment will fail unless the deployment is configured to adopt or manage that existing resource. The error is not about permissions, network references, or missing delete policies—it is a name collision.

Exam trap

Google Cloud often tests the distinction between resource name conflicts and other common errors (permissions, invalid references) to see if candidates can interpret the exact error message rather than guessing based on general troubleshooting.

How to eliminate wrong answers

Option A is wrong because an IAM permission issue would produce an error like 'Permission denied' or 'Required permission compute.firewalls.create', not a 'Resource already exists' error. Option B is wrong because an incorrect network reference would cause a validation error such as 'Invalid value for field 'network'' or a 400 Bad Request, not a resource name conflict. Option D is wrong because Deployment Manager does not require a 'delete' policy for existing resources; the 'delete' policy controls what happens to resources when the deployment is deleted, not whether a deployment can create a resource with a duplicate name.

Full explanation →
233
Multi-Selecteasy

A company wants to enable a new DevOps team to have read-only access to logs in the default Cloud Logging bucket for their project, but prevent them from modifying log views or creating linked datasets in BigQuery. Which two IAM roles should be granted to the team?

Select 2 answers
A.roles/logging.viewAccessor
B.roles/logging.configWriter
C.roles/logging.admin
D.roles/logging.viewer
E.roles/bigquery.dataViewer
AnswersA, D

Allows viewing of log views without modifying them.

Why this answer

The roles/logging.viewAccessor role grants read-only access to log entries in Cloud Logging buckets, including the default bucket, without allowing modifications to log views or linked datasets. The roles/logging.viewer role provides broader read-only access to all Logging resources, including logs, but still prevents modifying log views or creating linked datasets in BigQuery. Together, these two roles satisfy the requirement of read-only log access while explicitly excluding permissions to alter log views or manage BigQuery linked datasets.

Exam trap

The trap here is that candidates often confuse roles/logging.viewer with roles/logging.viewAccessor, thinking they are interchangeable, but the exam tests the distinction that viewAccessor is bucket-scoped and viewer is project-scoped, and both are needed to cover the default bucket access without granting modification permissions.

Full explanation →
234
MCQhard

An e-commerce company uses Cloud SQL for MySQL to handle user sessions. During Black Friday sales, the database experiences high read latency and connection timeouts. The traffic pattern shows 95% read operations and 5% write operations. They need to improve read performance without significant architectural changes. Which action should they take?

A.Enable Cloud SQL Proxy to reduce connection overhead.
B.Migrate from Cloud SQL to Cloud Spanner for better scalability.
C.Add Cloud SQL read replicas and configure the application to use them for read operations.
D.Enable automatic storage increases and increase the machine type of the primary instance.
AnswerC

Read replicas distribute read queries, reducing load on the primary and improving latency.

Why this answer

Adding read replicas offloads read traffic from the primary instance, improving read latency and reducing connection timeouts. Read replicas are easy to configure and cost-effective.

Full explanation →
235
MCQhard

An e-commerce platform uses Cloud Spanner for order processing. The operations team notices that a recent schema change caused a spike in latency. They need to quickly revert to the previous schema without losing any data. What is the fastest way to achieve this?

A.Manually write DDL statements to revert the schema, and use a script to fix any data inconsistencies.
B.Export the database, drop and recreate the database with the old schema, and import the data.
C.Use Cloud Spanner's built-in DDL rollback feature to revert the schema change.
D.Restore the database from a backup taken before the schema change, using point-in-time recovery.
AnswerD

Restoring from a backup before the change is the fastest way to revert schema and data.

Why this answer

Cloud Spanner does not support automatic schema rollback. The best approach is to use database migration tools like Skipper or use versioned migrations. However, Spanner supports creating a new table with the old schema and copying data.

The fastest way to revert a schema change is to restore from a backup that was taken before the change. Cloud Spanner supports point-in-time recovery (PITR) within the retention period (7 days). If a backup exists, restore it to a new database and redirect traffic.

Rolling back via DDL statements is possible but may be complex if data has been added or altered.

Full explanation →
236
MCQhard

A company has a Bigtable instance handling time-series data. Write throughput is below expectations and latency is high. The row key format is `userid_timestamp`. Which row key design change would MOST improve performance?

A.Use `timestamp_userid` without reversal
B.Add more column families to store different metrics
C.Use a hash of the userid as the row key prefix
D.Reverse the timestamp and use `timestamp_userid`
AnswerC

Hashing distributes writes evenly across tablets.

Why this answer

Bigtable performance relies on distributing writes across tablets. A row key with a high-cardinality prefix (e.g., hashed userid) avoids hotspots. A timestamp prefix causes all writes to go to the last tablet (hotspot).

Reversing timestamp helps but still not as good as hashing. Adding column families does not affect row key distribution.

Full explanation →
237
MCQmedium

Your company runs a multi-region Cloud Spanner instance for a global financial application. The SLA requirement is 99.999% availability. You need to ensure that the database remains available during a regional outage. What configuration should you use?

A.Use a dual-region configuration with two regions but only one for writes.
B.Use a single-region configuration with a read replica in another region.
C.Use a multi-region configuration (e.g., nam3) with automatic replication across multiple regions.
D.Configure a single-region instance and create periodic backups to restore in another region.
AnswerC

Multi-region configurations provide synchronous replication across regions and 99.999% SLA.

Why this answer

Cloud Spanner multi-region configurations (e.g., nam3, eur3) automatically replicate data across regions within a continent. They provide 99.999% availability SLA. A single-region configuration offers 99.99% SLA.

Read replicas (as in Cloud SQL) are not a concept in Spanner. Multi-region configs use multiple read-write regions.

Full explanation →
238
Multi-Selectmedium

Which TWO options are best practices for ensuring high availability of an application running on Google Kubernetes Engine (GKE)?

Select 2 answers
A.Use pod anti-affinity to spread pods across multiple zones.
B.Deploy all nodes in the same zone to simplify networking.
C.Configure managed instance groups with autohealing.
D.Prefer using preemptible VMs for cost savings.
E.Use a single zonal cluster to avoid cross-zone latency.
AnswersA, C

Spreading pods across zones improves resilience to zonal failures.

Why this answer

Pod anti-affinity ensures that pods from the same application are scheduled on different nodes across multiple zones, reducing the blast radius of a zonal failure. This is a key pattern for achieving high availability in GKE, as it prevents a single zone outage from taking down all replicas of your application.

Exam trap

The trap here is that candidates often confuse cost-optimization strategies (like preemptible VMs) with high-availability strategies, or they mistakenly believe that a single-zone cluster with autohealing is sufficient for zonal fault tolerance, when in fact you need multi-zone distribution and a regional cluster.

Full explanation →
239
MCQmedium

After a production incident, a team wants to conduct a postmortem to identify root causes and document actions to prevent recurrence. Which steps are part of Google's recommended postmortem process?

Answer options not yet available.

Why this answer

Google's postmortem process includes gathering data, analyzing the timeline, identifying root causes, assigning action items, and sharing the report. The focus is on blameless culture, not punishment.

Full explanation →
240
MCQhard

You are running a Kubernetes cluster in GKE with the default node pool configuration shown in the exhibit. Your application requires high disk I/O performance. You notice that the application is experiencing high latency for disk operations. What is the most likely cause?

A.Node auto-repair is causing disk contention.
B.The default node pool uses pd-standard disks, which have low IOPS.
C.The OAuth scopes restrict disk access, causing high latency.
D.The machine type n1-standard-2 does not have enough CPU.
AnswerB

pd-standard is HDD with lower IOPS; pd-ssd provides higher performance for high I/O workloads.

Why this answer

The default node pool in GKE uses pd-standard (standard persistent disk) which provides lower IOPS compared to pd-ssd. For applications requiring high disk I/O performance, pd-standard disks become a bottleneck, causing high latency. Upgrading to pd-ssd or using local SSDs would resolve this issue.

Exam trap

Google Cloud often tests the distinction between storage performance (disk type) and other operational features (auto-repair, scopes, machine type), leading candidates to confuse node health mechanisms or permission settings with actual I/O performance bottlenecks.

How to eliminate wrong answers

Option A is wrong because node auto-repair is a GKE feature that automatically repairs unhealthy nodes (e.g., if the node fails health checks), but it does not cause disk contention; it operates at the node level, not by interfering with disk I/O. Option C is wrong because OAuth scopes control API access permissions (e.g., read/write to Cloud Storage), not the performance characteristics of persistent disk operations; disk I/O latency is a storage performance issue, not an authorization issue. Option D is wrong because n1-standard-2 (2 vCPUs, 7.5 GB memory) is a general-purpose machine type that can handle moderate workloads; insufficient CPU would manifest as high CPU utilization or scheduling delays, not specifically high disk I/O latency.

Full explanation →
241
MCQmedium

You are responsible for post-incident reviews. After a major outage, your team identifies that the root cause was a misconfiguration in a deployment pipeline that caused an incorrect rollout. Which step should be included in the postmortem process?

A.Ignore the incident and move on
B.Document the timeline of events and the root cause
C.Define action items to prevent recurrence and improve detection
D.Assign blame to the engineer who made the mistake
AnswerC

A blameless postmortem includes root cause, timeline, and action items.

Why this answer

Postmortems should identify root cause, document timeline, and define action items to prevent recurrence. Blaming individuals is counterproductive. Only documenting the timeline is insufficient.

Ignoring is not acceptable.

Full explanation →
242
Multi-Selectmedium

A company is designing a disaster recovery plan for their Cloud SQL for PostgreSQL database. They need to ensure that they can recover from a regional outage with minimal data loss. Which TWO strategies should they implement? (Choose two.)

Select 2 answers
A.Export the database daily to Cloud Storage
B.Configure a failover replica in the same region
C.Use a Cloud SQL for PostgreSQL on-premises backup
D.Create a cross-region read replica
E.Enable automated backups and point-in-time recovery
AnswersD, E

A cross-region read replica can be promoted to primary in a disaster, minimizing data loss.

Why this answer

Cross-region replication (using a read replica in another region) and automated backups with PITR provide regional DR. A failover replica in the same region does not protect against region failure. On-premises backup is not mentioned.

Import/export is for migration, not DR.

Full explanation →
243
MCQeasy

A company wants to optimize their network costs for inter-region traffic using Cloud VPN. What is the most cost-effective configuration?

A.Use partner interconnect.
B.Use Cloud NAT.
C.Use dedicated interconnect.
D.Use a single VPN tunnel with dynamic routing.
AnswerD

VPN tunnels are low-cost and dynamic routing (BGP) provides redundancy and optimal path selection.

Why this answer

A single VPN tunnel with dynamic routing (BGP) is the most cost-effective configuration for inter-region traffic using Cloud VPN. Cloud VPN charges per tunnel-hour and per GB of data processed, so using a single tunnel minimizes the hourly cost while dynamic routing ensures automatic failover and route advertisement without needing multiple tunnels.

Exam trap

Google Cloud often tests the misconception that multiple VPN tunnels or dedicated interconnect solutions are required for inter-region traffic, when in fact a single VPN tunnel with dynamic routing is the most cost-effective option for Cloud VPN.

How to eliminate wrong answers

Option A is wrong because Partner Interconnect is a dedicated connectivity solution that incurs higher monthly costs and requires a service provider contract, making it less cost-effective than Cloud VPN for inter-region traffic. Option B is wrong because Cloud NAT is used for outbound internet access from private instances, not for inter-region traffic between VPC networks. Option C is wrong because Dedicated Interconnect provides high-bandwidth dedicated connections but is significantly more expensive than Cloud VPN and is designed for on-premises to VPC connectivity, not inter-region traffic.

Full explanation →
244
Multi-Selectmedium

You need to set up monitoring and alerting for a critical service that must maintain an error rate below 0.1%. You want to be notified if the error rate exceeds this threshold over a 5-minute window. Which THREE components should you configure?

Select 3 answers
A.Service Level Indicator (SLI) based on error rate
B.Log-based alert with filter for all errors
C.Service Level Objective (SLO) with a target of 99.9%
D.Cloud Audit Logs sink to BigQuery
E.Alerting policy with a notification channel (e.g., email, PagerDuty)
AnswersA, C, E

SLI measures the actual performance against the SLO.

Why this answer

A service-level objective (SLO) defines the target (99.9% error-free). A service-level indicator (SLI) measures the actual error rate. An alerting policy triggers when the SLO is breached.

Notification channels send alerts. Log-based alerts are for log content, not metrics. The correct combination: SLO, SLI, alerting policy with notification channels.

Full explanation →
245
MCQmedium

A gaming company needs to store player session data that is frequently updated and requires strong consistency within a single region. The data model is simple key-value with few attributes. They expect up to 1 million concurrent players, each performing 10 writes per second. Which database is most suitable?

A.Cloud SQL
B.Firestore
C.Cloud Bigtable
D.Memorystore
AnswerC

Bigtable handles high throughput writes, low latency, strong consistency within a cluster, and is ideal for player session data.

Why this answer

Cloud Bigtable is a NoSQL wide-column database designed for high-throughput, low-latency workloads. It can handle millions of writes per second and provides strong consistency within a single cluster.

Full explanation →
246
MCQhard

Your company runs a critical multi-tier application: a global HTTP(S) load balancer, multiple regional managed instance groups (MIGs) for the web tier, and Cloud Spanner for the data tier. You need to design for zone-level and region-level failures. What architecture ensures the highest availability?

A.Use a global HTTP(S) load balancer with a single global MIG and a multi-region Cloud Spanner instance.
B.Use a global HTTP(S) load balancer with a single zonal MIG and Cloud Spanner single-region.
C.Use a global HTTP(S) load balancer with regional MIGs in multiple regions, each spanning zones, and a multi-region Cloud Spanner instance.
D.Use a regional HTTP(S) load balancer with a regional MIG and Cloud SQL with cross-region replication.
AnswerC

Regional MIGs across zones handle zone failures; multiple regions and multi-region Spanner handle region failures.

Why this answer

It combines a global HTTP(S) load balancer (which can route traffic to healthy backends across regions), regional MIGs that span multiple zones within each region (providing zone-level redundancy), and a multi-region Cloud Spanner instance (which provides synchronous replication across regions for strong consistency and automatic failover). This architecture ensures that if an entire zone or region fails, traffic is automatically redirected to healthy backends in other zones/regions, and Spanner continues to serve reads and writes without manual intervention.

Exam trap

Google Cloud often tests the distinction between 'regional' and 'global' load balancers, and the trap here is that candidates might choose a regional load balancer (Option D) thinking it is sufficient, but it cannot route traffic across regions, making it unsuitable for region-level failure recovery.

How to eliminate wrong answers

Option A is wrong because a single global MIG (even if multi-zonal) is still deployed within a single region; if that entire region fails, the application becomes unavailable. Option B is wrong because a single zonal MIG cannot survive even a zone failure, and a single-region Cloud Spanner instance cannot survive a regional failure. Option D is wrong because a regional HTTP(S) load balancer cannot distribute traffic across multiple regions, and Cloud SQL with cross-region replication does not provide the same strong consistency and automatic failover as multi-region Spanner; also, Cloud SQL cross-region replication is asynchronous and may lose data during a failover.

Full explanation →
247
MCQmedium

A company has a fleet of Compute Engine instances that need to access a Cloud Storage bucket. The security team requires that only instances in specific VPC networks can access the bucket, and that the data is encrypted in transit. How can this be achieved?

A.Use a Cloud Storage bucket with encryption at rest using CSEK.
B.Use Cloud Armor with IP allowlists and enable TLS for the bucket.
C.Create a VPC Service Controls perimeter with access levels, and require HTTPS for the bucket.
D.Use a Cloud Storage bucket with encryption at rest using CMEK.
AnswerC

VPC Service Controls restrict access by network, and HTTPS ensures encryption in transit.

Why this answer

VPC Service Controls allows you to define a security perimeter around Cloud Storage, restricting access to only requests originating from specific VPC networks. By configuring an access level that requires HTTPS, you enforce encryption in transit, meeting both the network restriction and data-in-transit encryption requirements.

Exam trap

In the Google PCA exam, a common trap is confusing encryption at rest (CSEK/CMEK) with encryption in transit (HTTPS/TLS), and the fact that VPC Service Controls is the only option that combines network-level access restrictions with transport encryption enforcement.

How to eliminate wrong answers

Option A is wrong because encryption at rest using CSEK (Customer-Supplied Encryption Keys) does not restrict access to specific VPC networks nor does it enforce encryption in transit; it only protects data at rest. Option B is wrong because Cloud Armor is a web application firewall for HTTP(S) load balancing, not a mechanism to restrict Cloud Storage bucket access to specific VPC networks; IP allowlists alone cannot enforce VPC-level network boundaries. Option D is wrong because encryption at rest using CMEK (Customer-Managed Encryption Keys) similarly only protects data at rest and does not provide network-level access controls or enforce encryption in transit.

Full explanation →
248
MCQmedium

A company is running a critical application on Compute Engine that must be highly available. They want to distribute traffic across multiple instances in different zones and automatically redirect traffic if a zone fails. Which load balancing solution should they use?

A.External HTTP(S) Load Balancer
B.SSL Proxy Load Balancer
C.Internal HTTP(S) Load Balancer
D.External TCP/UDP Load Balancer
AnswerA

It is a global, proxy-based load balancer that distributes traffic across instances in multiple zones and provides automatic failover.

Why this answer

The external HTTP(S) Load Balancer is a global, proxy-based load balancer that can distribute traffic across multiple regions and zones. It supports health checks and automatically fails over if instances are unhealthy. The external TCP/UDP Load Balancer is regional and does not span zones.

Internal load balancers are for private VPC traffic. SSL proxy is for non-HTTP TCP traffic but is global; however, for HTTP traffic, HTTP(S) LB is the best choice.

Full explanation →
249
MCQhard

Refer to the exhibit. A security team wants to ensure that the service account 'sa-compute' can only be used by the instance admin role. Currently, any user with 'iam.serviceAccountUser' on the project can impersonate it. Which change should be made to the policy?

A.Add a condition to the 'roles/iam.serviceAccountUser' binding that restricts access to only the instance admin.
B.Modify the project policy to change the 'roles/iam.serviceAccountUser' member to 'user:developer@example.com'.
C.Remove the 'roles/iam.serviceAccountUser' binding from the project policy and add a resource-level policy on the service account granting 'roles/iam.serviceAccountUser' only to 'developer@example.com'.
D.Create a new custom role that combines 'roles/compute.instanceAdmin.v1' and 'roles/iam.serviceAccountUser' and assign it to 'developer@example.com'.
AnswerC

Correct: This restricts the ability to impersonate the service account to only the developer, not everyone with the project-level role.

Why this answer

The exhibit shows a project-level IAM policy. The service account 'sa-compute' is granted 'roles/iam.serviceAccountUser' at the project level, meaning any user with that role on the project can impersonate it. To restrict usage, the policy should grant 'roles/iam.serviceAccountUser' on the service account itself to only specific users, not at the project level.

The correct approach is to remove the project-level binding and add a resource-level policy on the service account.

Full explanation →
250
MCQhard

A global application uses Cloud Spanner with a multi-region configuration. During a regional outage, some transactions are failing. What is the recommended approach to maintain write availability?

A.Implement application-level retry with exponential backoff
B.Use a single-region Spanner instance with a standby in a different zone
C.Configure Spanner with leader-based replication and rely on automatic failover
D.Manually failover to a different region using a script
AnswerC

Spanner automatically fails over to another region if the leader region fails.

Why this answer

Cloud Spanner's multi-region configuration uses leader-based replication, where each region has a leader for its read-write replicas. During a regional outage, Spanner automatically fails over the leader to another region, ensuring write availability without manual intervention. This is the recommended approach because it leverages Spanner's built-in synchronous replication and automatic failover to maintain consistency and availability.

Exam trap

The trap here is that candidates confuse Spanner's automatic failover with manual failover approaches used in traditional databases, or assume that application-level retry alone can compensate for a regional outage, ignoring Spanner's built-in leader election and synchronous replication.

How to eliminate wrong answers

Option A is wrong because application-level retry with exponential backoff is a general resilience pattern but does not address the root cause of write unavailability during a regional outage; Spanner's automatic failover is required to restore write capability. Option B is wrong because a single-region Spanner instance with a standby in a different zone does not provide multi-region write availability; it only offers zone-level redundancy within a single region, which cannot survive a full regional outage. Option D is wrong because manual failover using a script is not recommended for Spanner; the service handles failover automatically via its leader-based replication, and manual intervention can lead to inconsistencies or extended downtime.

Full explanation →
251
MCQmedium

A company wants to use Cloud Deploy to automate deployments to GKE. They need to configure an approval gate that requires manual approval before promoting a release to a production cluster. Where is this approval gate defined?

A.In the delivery pipeline YAML under the 'target' definition
B.In the Cloud Scheduler job
C.In the GKE cluster as a constraint
D.In the cloudbuild.yaml file
AnswerA

Each target can have an 'requireApproval' field.

Why this answer

In Cloud Deploy, approval gates are defined per target in the delivery pipeline configuration. The target resource specifies whether an approval is required.

Full explanation →
252
MCQhard

A company has a production database running on Cloud SQL. They need to ensure high availability with automatic failover in the event of a zone outage. What should they do?

A.Export the database to Cloud Storage and import in another region.
B.Enable Cloud SQL High Availability (HA) configuration.
C.Create a cross-region read replica.
D.Configure automated backups.
AnswerB

HA provides automatic failover to standby in another zone.

Why this answer

Enabling Cloud SQL High Availability (HA) configuration provisions a standby instance in a different zone within the same region, using synchronous replication to ensure zero data loss. In the event of a zone outage, Cloud SQL automatically fails over to the standby instance, typically within 60 seconds, providing high availability without manual intervention.

Exam trap

Google Cloud often tests the distinction between high availability (automatic failover within a region) and disaster recovery (cross-region replication or backups), leading candidates to confuse read replicas or backups with HA solutions.

How to eliminate wrong answers

Option A is wrong because exporting to Cloud Storage and importing in another region is a manual, disaster recovery process that does not provide automatic failover and incurs significant downtime. Option C is wrong because a cross-region read replica is designed for read scaling and asynchronous replication, not for automatic failover; promoting a read replica requires manual steps and may result in data loss. Option D is wrong because automated backups protect against data corruption or accidental deletion but do not provide a standby instance for automatic failover during a zone outage.

Full explanation →
253
MCQeasy

Refer to the exhibit. What is the effect of this IAM policy on a Cloud Storage bucket?

A.All users from example.com can view objects.
B.Only Alice can view objects.
C.Alice and all users from example.com can view objects.
D.Alice can view objects but not list buckets.
AnswerC

The bindings include both Alice and the entire domain.

Why this answer

The IAM policy grants the `storage.objectViewer` role to both the user `alice@example.com` and the domain `example.com`. This means Alice and all authenticated users from the example.com domain (i.e., any Google account ending in @example.com) can view objects in the bucket. The correct answer is C because the policy explicitly includes both principals.

Exam trap

Google Cloud often tests the additive nature of IAM policies — candidates mistakenly think a more specific user binding overrides a broader domain binding, but in reality, all granted permissions are combined, not mutually exclusive.

How to eliminate wrong answers

Option A is wrong because it ignores the specific user `alice@example.com`; the policy grants access to Alice as well, not just all users from example.com. Option B is wrong because the policy also grants access to all users from example.com, not only Alice. Option D is wrong because the `storage.objectViewer` role includes the permission to list objects (via `storage.objects.list`) and view objects (via `storage.objects.get`); it does not restrict listing buckets, and the policy does not mention bucket listing at all.

Full explanation →
254
MCQeasy

An organization wants to manage Google Cloud infrastructure as code using declarative configuration files. They need a solution that supports Python and Jinja templating languages. Which service should they choose?

A.Cloud Composer
B.Terraform on Google Cloud
C.Cloud Deployment Manager
D.Cloud Build
AnswerC

Correct. Deployment Manager natively supports YAML templates and Python/Jinja.

Why this answer

Cloud Deployment Manager supports YAML templates with optional Python or Jinja helpers, making it the correct choice for declarative infrastructure management with those languages.

Full explanation →
255
MCQhard

What is the networking mode of this GKE cluster?

A.VPC-native networking
B.Hybrid networking
C.Standard networking
D.Routes-based networking
E.Private cluster networking
AnswerA

Correct. IP aliases and secondary ranges indicate VPC-native mode.

Why this answer

A is correct because VPC-native networking is the default and recommended networking mode for GKE clusters, where the cluster uses alias IP ranges (RFC 6598) on the VPC network. This mode assigns pod IP addresses directly from the VPC subnet's secondary IP range, enabling native integration with VPC features like Cloud NAT, VPC Flow Logs, and firewall rules without requiring manual route management.

Exam trap

The trap here is that candidates confuse 'private cluster' (a cluster with internal-only node IPs) with a networking mode, when in fact private clusters can use either VPC-native or routes-based networking, and the question specifically asks for the networking mode.

How to eliminate wrong answers

Option B is wrong because hybrid networking refers to connecting on-premises networks to Google Cloud via Cloud VPN or Dedicated Interconnect, not to the internal networking mode of a GKE cluster. Option C is wrong because standard networking is not a recognized GKE networking mode; GKE uses either VPC-native or routes-based networking. Option D is wrong because routes-based networking is a legacy mode that relies on custom static routes and iptables for pod-to-pod communication, but it is not the default and is being phased out in favor of VPC-native.

Option E is wrong because private cluster networking is a cluster configuration (where nodes have internal-only IPs) that can be used with either VPC-native or routes-based networking; it is not a distinct networking mode.

Full explanation →
256
MCQmedium

A company wants to allow users to authenticate to a web application running on Compute Engine using their existing corporate Active Directory credentials without exposing the application to the public internet. Which approach should they use?

A.Configure a Cloud VPN and allow only corporate IP addresses in firewall rules
B.Set up Identity-Aware Proxy (IAP) and sync Active Directory to Cloud Identity
C.Use Cloud Load Balancing with SSL and client certificates
D.Configure Cloud NAT and assign static IPs to users
AnswerB

IAP uses Cloud Identity for authentication, and Cloud Directory Sync can sync AD users.

Why this answer

Identity-Aware Proxy (IAP) provides zero-trust access to applications by verifying identity and context. It integrates with Cloud Identity, which can be synced with Active Directory via Cloud Directory Sync.

Full explanation →
257
MCQmedium

A company is migrating a stateful application to Google Cloud. The application requires persistent disks with low latency and high IOPS for database workloads. They plan to use Compute Engine instances with SSD persistent disks. However, the database performance is lower than expected. Which action should the company take to improve disk performance?

A.Change the persistent disk type to standard persistent disk.
B.Increase the disk size to increase baseline IOPS.
C.Use local SSDs with RAID 0 configuration for the database data.
D.Enable disk encryption to improve I/O throughput.
AnswerC

Local SSDs provide higher IOPS and lower latency than persistent disks. Using RAID 0 stripes data across multiple local SSDs for even higher performance.

Why this answer

Local SSDs provide the highest IOPS and lowest latency of any disk option on Compute Engine, and striping them with RAID 0 aggregates their performance. This directly addresses the need for high IOPS and low latency for database workloads, unlike persistent disks which have performance ceilings tied to disk size and instance limits.

Exam trap

The trap here is that candidates often assume increasing persistent disk size is the only way to improve IOPS, overlooking that local SSDs provide dramatically higher performance by being directly attached to the instance, and that RAID 0 is a common technique to aggregate their performance.

How to eliminate wrong answers

Option A is wrong because standard persistent disks have lower IOPS and higher latency than SSD persistent disks, which would worsen performance, not improve it. Option B is wrong because while increasing disk size does increase baseline IOPS for SSD persistent disks, the performance gain is limited by the persistent disk's architecture and does not match the raw throughput of local SSDs; it also increases cost without solving the latency issue. Option D is wrong because enabling disk encryption (e.g., using CMEK or CSEK) does not improve I/O throughput; encryption adds a small CPU overhead for encryption/decryption operations and can slightly reduce performance.

Full explanation →
258
Multi-Selectmedium

Which TWO are recommended practices for securing a Kubernetes Engine (GKE) cluster?

Select 2 answers
A.Disable HTTP load balancing to reduce attack surface.
B.Enable Binary Authorization to ensure only signed container images are deployed.
C.Use the default Compute Engine service account for all GKE nodes.
D.Use Workload Identity to bind Kubernetes service accounts to IAM service accounts.
E.Enable basic authentication for easier access management.
AnswersB, D

Binary Authorization enforces deployment of trusted images.

Why this answer

Binary Authorization enforces that only container images signed by trusted authorities (e.g., during a CI/CD pipeline) can be deployed to the cluster. This integrates with Google Cloud's Attestation Authority and ensures supply chain security by verifying signatures against a policy before admission.

Exam trap

Google Cloud often tests the misconception that disabling features like HTTP load balancing is a security best practice, when in reality it breaks functionality and security should be layered (e.g., using HTTPS, IAP, or network policies) rather than removing features.

Full explanation →
259
MCQmedium

A company is deploying a web application on Google Kubernetes Engine. The application serves HTTP traffic and needs to scale based on CPU utilization. They also need to expose the application to the internet with a single global IP address. They create a Deployment with a HorizontalPodAutoscaler. However, the application is not receiving traffic from the internet. What should they do to expose the application correctly?

A.Create an Ingress resource with the GCE ingress controller.
B.Create a Service of type NodePort and use a firewall rule to allow traffic.
C.Create a Service of type ClusterIP and a load balancer manually.
D.Define a Network Endpoint Group (NEG) and attach it to a backend service.
AnswerA

The GCE ingress controller provisions an external HTTP(S) load balancer with a single anycast IP address, which meets the requirement for a global IP.

Why this answer

The correct approach is to create an Ingress resource with the GCE ingress controller because it provides a single global IP address via an HTTP(S) load balancer, which is required for internet-facing traffic. The HorizontalPodAutoscaler scales the Deployment based on CPU utilization, but the application must be exposed through a Service (typically of type NodePort or ClusterIP) that the Ingress routes to. The GCE ingress controller automatically provisions a global HTTP(S) load balancer, satisfying the requirement for a single global IP address.

Exam trap

The trap here is that candidates often confuse exposing a service with a LoadBalancer type (which gives a regional IP) versus using an Ingress (which gives a global IP), and they overlook that the question explicitly requires a single global IP address, which only the GCE ingress controller can provide.

How to eliminate wrong answers

Option B is wrong because a Service of type NodePort exposes the application on a high port on each node's IP, but it does not provide a single global IP address; it requires a firewall rule and manual load balancing, which is not scalable or global. Option C is wrong because a Service of type ClusterIP is only reachable within the cluster, not from the internet, and manually creating a load balancer would not integrate with GKE's managed ingress or provide a single global IP efficiently. Option D is wrong because a Network Endpoint Group (NEG) is a lower-level construct used for container-native load balancing, but it must be attached to a backend service of a load balancer; simply defining a NEG does not expose the application to the internet without an Ingress or a load balancer configuration.

Full explanation →
260
Multi-Selectmedium

A company is migrating a critical database to Cloud SQL for MySQL. Which TWO actions ensure high availability?

Select 2 answers
A.Use read replicas in multiple zones.
B.Configure a failover replica with a different IP.
C.Enable automatic backups.
D.Enable high availability with a standby in another zone.
E.Enable multi-region failover.
AnswersC, D

Allows point-in-time recovery in case of data loss.

Why this answer

Enabling automatic backups in Cloud SQL for MySQL ensures that point-in-time recovery (PITR) and daily backups are automatically taken, which is a fundamental requirement for high availability. While backups alone do not provide instant failover, they are essential for data durability and recovery in case of a disaster, and the question asks for actions that 'ensure high availability'—backups are a core component of a high-availability strategy by enabling recovery from data loss or corruption.

Exam trap

The trap here is that candidates often confuse read replicas (which are for read scaling) with high-availability standby instances (which are for automatic failover), and they may also mistakenly think that multi-region failover is a built-in Cloud SQL feature when it is not supported for MySQL.

Full explanation →
261
MCQmedium

A company is using Cloud Load Balancing to expose a web application. They want to protect against common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they configure?

A.VPC Firewall rules
B.Identity-Aware Proxy
C.Cloud Armor
D.Cloud CDN
AnswerC

Cloud Armor offers WAF capabilities including preconfigured rules for OWASP top 10.

Why this answer

Cloud Armor is the correct service because it provides Web Application Firewall (WAF) capabilities that can inspect HTTP/HTTPS traffic and filter out common web attacks such as SQL injection and cross-site scripting (XSS). It integrates directly with Cloud Load Balancing to apply pre-configured or custom rules at the edge, blocking malicious requests before they reach the backend.

Exam trap

The trap here is confusing network-layer security (VPC Firewall rules) with application-layer security (Cloud Armor), leading candidates to pick VPC Firewall rules because they sound like a general security measure.

How to eliminate wrong answers

Option A is wrong because VPC Firewall rules operate at the network layer (L3/L4) and cannot inspect application-layer payloads like HTTP requests, so they cannot detect or block SQL injection or XSS. Option B is wrong because Identity-Aware Proxy (IAP) controls access based on user identity and context, not by inspecting traffic for attack signatures; it is an authentication/authorization layer, not a WAF. Option D is wrong because Cloud CDN is a content delivery network that caches static content to improve performance and reduce latency; it does not provide any security filtering against web application attacks.

Full explanation →
262
Multi-Selectmedium

A company is running a stateful web application on Compute Engine. They want to achieve high availability by distributing traffic across multiple zones in a region. Which TWO steps should they take? (Choose TWO.)

Select 2 answers
A.Create a managed instance group with instances in multiple zones.
B.Create a snapshot of the boot disk.
C.Use a single zone and configure automatic restart.
D.Create a TCP Load Balancer.
E.Create an HTTP(S) Load Balancer in front of the instances.
AnswersA, E

MIG across zones ensures instances run in at least two zones for HA.

Why this answer

Creating an HTTP(S) Load Balancer distributes traffic across instances in multiple zones. Using a managed instance group with multiple zones ensures instances are spread across zones for HA. A TCP Load Balancer is for non-HTTP traffic, and using a single zone or snapshot only does not provide HA.

Full explanation →
263
MCQeasy

A developer wants to deploy a containerized web application on Google Cloud that can scale to zero when not in use and charges only for resources consumed during request processing. Which compute service should they choose?

A.Cloud Run
B.Google Kubernetes Engine (GKE)
C.App Engine Flexible Environment
D.Compute Engine instance group
AnswerA

Cloud Run is serverless and can scale to zero, charging only for resources used during request processing. It is ideal for intermittent containerized workloads.

Why this answer

Cloud Run is a serverless container platform that scales to zero when idle and charges per request, making it cost-effective for intermittent traffic. GKE requires at least one node to be running, so it cannot scale to zero. Compute Engine instances incur costs even when idle.

App Engine Flexible Environment also runs at least one instance.

Full explanation →
264
MCQhard

A media streaming company wants to serve video content globally with low latency. They plan to cache static objects (thumbnails, manifest files) at edge locations, while dynamic API requests are handled by a backend in a single region. Which combination should they use?

A.Cloud CDN with an external HTTP(S) load balancer
B.Cloud CDN with an internal TCP/UDP load balancer
C.Cloud Armor with a TCP/SSL proxy load balancer
D.VPC peering with Cloud NAT
AnswerA

Cloud CDN integrates with external HTTP(S) Load Balancer to cache content at edge locations.

Why this answer

Cloud CDN caches static content at Google's edge locations, reducing latency for global users. An external HTTP(S) Load Balancer routes traffic, terminates SSL, and directs dynamic API requests to the backend. Cloud CDN is enabled on the backend bucket or backend service.

Internal LB is for internal traffic only. Cloud NAT is for outbound traffic. VPC peering does not cache.

Full explanation →
265
MCQeasy

A company runs a customer-facing web application on Google Kubernetes Engine (GKE) in us-central1. The application uses a Cloud SQL for PostgreSQL database for user data. Recently, they noticed that during peak hours, the application response times increase significantly, and some requests time out. The team has already scaled the GKE nodepool to the maximum size, but the issue persists. Database CPU utilization is at 80%, and connections are near the max limit. The application uses connection pooling via PgBouncer running as a sidecar. The team suspects the database is the bottleneck. They need to improve performance with minimal cost impact. What should they do?

A.Enable Cloud SQL automatic storage increase.
B.Increase the max connections parameter on Cloud SQL.
C.Increase the Cloud SQL machine type to the next tier.
D.Add read replicas and split read/write traffic.
AnswerD

Read replicas distribute read load, reducing primary database CPU and connection usage.

Why this answer

Adding read replicas and splitting read/write traffic offloads read queries from the primary Cloud SQL instance, reducing CPU and connection pressure. PgBouncer as a sidecar can be configured to route read-only transactions to replicas, while writes go to the primary. This directly addresses the 80% CPU and max connections issue without increasing costs as much as scaling up the machine type.

Exam trap

Google Cloud often tests the misconception that scaling up (increasing machine type) is always the first step for database performance issues, when in fact read replicas with read/write splitting can be more cost-effective and scalable for read-heavy workloads.

How to eliminate wrong answers

Option A is wrong because enabling automatic storage increase only adds disk space, which does not reduce CPU utilization or connection limits; the bottleneck is compute and connections, not storage. Option B is wrong because increasing the max connections parameter would allow more concurrent connections but would further strain the already high CPU (80%) and could lead to resource contention or crashes; it does not solve the underlying compute bottleneck. Option C is wrong because increasing the Cloud SQL machine type to the next tier would improve performance but at a higher cost, and the question specifies minimal cost impact; read replicas provide a more cost-effective scaling approach by distributing read load.

Full explanation →
266
MCQeasy

A startup wants to grant a contractor limited access to a single Cloud Storage bucket. The contractor should be able to view and download objects, but not delete or overwrite them. Which IAM role should be assigned?

A.roles/storage.admin
B.roles/storage.objectAdmin
C.roles/storage.objectCreator
D.roles/storage.objectViewer
AnswerD

Correct: read-only access to objects.

Why this answer

The roles/storage.objectViewer role grants read-only access to objects in a bucket, including listing and downloading objects, but does not allow modification or deletion.

Full explanation →
267
MCQmedium

A Cloud Run service needs to connect to a Cloud SQL MySQL instance privately without using public IP. What must be configured?

A.Set up VPC Network Peering between Cloud Run and Cloud SQL
B.Enable Private Google Access on the VPC subnet
C.Use Cloud SQL Proxy as a sidecar container
D.Deploy a VPC connector and attach it to the Cloud Run service
AnswerD

The VPC connector enables Cloud Run to send traffic to internal IP addresses in the VPC, such as Cloud SQL private IP.

Why this answer

To privately connect Cloud Run to Cloud SQL, you need a Serverless VPC Access connector in the same VPC as the Cloud SQL instance, and then use the private IP of Cloud SQL. Private Google Access is for on-prem, not Cloud Run. Direct VPC is not available for Cloud Run.

Full explanation →
268
Multi-Selectmedium

A company wants to reduce costs for their steady-state Compute Engine workloads. They have 10 n1-standard-4 VMs running 24/7. Which TWO actions will reduce costs? (Choose 2)

Select 2 answers
A.Purchase committed use discounts (1-year) for the VMs
B.Use preemptible VMs
C.Migrate to sole-tenant nodes
D.Enable sustained use discounts
E.Apply right-sizing recommendations from Active Assist
AnswersA, E

Committed use discounts offer lower prices in exchange for a 1- or 3-year commitment.

Why this answer

Committed use discounts provide significant savings (up to 70%) for steady-state workloads. Right-sizing recommendations help identify if VMs are over-provisioned, allowing downsizing. Preemptible VMs are for interruptible workloads; sustained use is automatic but less savings.

Full explanation →
269
MCQmedium

A company is designing a disaster recovery (DR) plan for their Cloud SQL for PostgreSQL instance. They need to recover the database to a specific point in time within the last 7 days, with a Recovery Point Objective (RPO) of less than 1 hour. Which feature should they use?

A.Exporting the database daily to Cloud Storage
B.Point-in-time recovery (PITR)
C.Failover replica
D.Automated backups only
AnswerB

PITR uses transaction logs to restore to any second within the retention period, meeting the <1 hour RPO.

Why this answer

Cloud SQL automated backups combined with point-in-time recovery (PITR) allow recovery to any point in time within the backup retention period (default 7 days) by using transaction logs. PITR enables RPO of less than 1 hour because it uses write-ahead logs.

Full explanation →
270
Multi-Selectmedium

Which THREE of the following are best practices when using Deployment Manager to manage infrastructure? (Choose three.)

Select 3 answers
A.Use raw REST API calls in templates.
B.Use templates to define resources modularly.
C.Use only YAML configuration files.
D.Use imports to reference shared configurations.
E.Use composite types to bundle related resources.
AnswersB, D, E

Correct. Templates are reusable.

Why this answer

Using templates promotes reusability and modularity. Imports allow you to define common resources across deployments. Composite types bundle related resources into a single entity.

YAML files are basic, but using Python or Jinja allows dynamic generation. The three best practices are using templates, imports, and composite types.

Full explanation →
271
MCQhard

A financial institution deploys a containerized application on GKE with Binary Authorization enabled. They want to ensure that only images signed by their internal CI/CD pipeline are deployed, and they also need to allow a break-glass procedure using a specific image from a curated registry. How should they configure Binary Authorization?

A.Create a policy with an evaluation mode to allow all images, but use a whitelist of approved registries.
B.Use Cloud Run instead, which has built-in image verification.
C.Create a policy with an evaluation mode to require all images to be signed, and configure a Cloud Build attestor.
D.Create a policy with a default deny rule, and add a custom rule to allow images from the curated registry.
AnswerD

Default deny ensures only signed images are allowed, except those from the curated registry break-glass.

Why this answer

Binary Authorization policies are deny-by-default, so you must create a custom rule to allow specific images (e.g., from a curated registry) while keeping the default deny rule in place. This satisfies both the requirement to enforce signed images from the CI/CD pipeline and the break-glass procedure using a trusted registry image.

Exam trap

A common misconception tested in Google Professional Cloud Architect exams is that you can use a whitelist of registries in evaluation mode (Option A) or that all images must be signed (Option C), but the correct approach is to combine a default deny rule with a custom allow rule for the break-glass registry.

How to eliminate wrong answers

Option A is wrong because setting the evaluation mode to allow all images would bypass signature verification entirely, defeating the requirement to enforce signed images from the CI/CD pipeline. Option B is wrong because Cloud Run does not have built-in image verification that integrates with Binary Authorization attestors; it relies on the same Binary Authorization policies as GKE. Option C is wrong because requiring all images to be signed would block the break-glass image from the curated registry unless that image is also signed by the same attestor, which contradicts the break-glass requirement.

Full explanation →
272
MCQeasy

A company is migrating a monolithic application to Google Cloud and wants to minimize operational overhead for scaling. Which service should they use?

A.Google Kubernetes Engine
B.Cloud Run
C.Compute Engine with managed instance groups
D.App Engine Standard
AnswerD

Fully managed platform with automatic scaling, minimal operational overhead.

Why this answer

App Engine Standard is the correct choice because it provides a fully managed, autoscaling platform that abstracts away all infrastructure management, including server configuration, scaling, and load balancing. This minimizes operational overhead for scaling a monolithic application by automatically adjusting resources based on traffic without any manual intervention or cluster management.

Exam trap

The trap here is that candidates often choose Google Kubernetes Engine or Cloud Run because they are modern container-based services, but the question emphasizes minimizing operational overhead for a monolithic application, where App Engine Standard's fully managed platform requires the least manual configuration and ongoing management.

How to eliminate wrong answers

Option A is wrong because Google Kubernetes Engine requires managing a Kubernetes cluster, including node pools, pod autoscaling, and cluster upgrades, which adds operational overhead compared to a fully managed platform. Option B is wrong because Cloud Run is designed for containerized stateless applications and may require refactoring a monolithic application into containers, and it has a request timeout limit of 60 minutes (or up to 60 minutes with async processing), which can be restrictive for long-running monolithic workloads. Option C is wrong because Compute Engine with managed instance groups still requires managing virtual machine images, instance templates, health checks, and autoscaling policies, and does not provide the same level of abstraction as a fully managed platform like App Engine.

Full explanation →
273
MCQmedium

A Cloud Function fails to connect to a Cloud SQL instance. The Cloud SQL instance has a private IP. What should the developer check?

A.Ensure the Cloud SQL Proxy is running and configured.
B.Verify the Cloud Function's network settings.
C.Ensure either Cloud SQL Proxy is running or a VPC connector is configured, and IAM permissions are correct.
D.Configure a VPC connector for the Cloud Function.
AnswerC

Both connectivity and authorization must be in place.

Why this answer

A Cloud Function with a private IP Cloud SQL instance requires either the Cloud SQL Proxy (which uses the Cloud SQL Auth proxy to establish an encrypted connection via the public IP, but if the instance has only a private IP, the proxy must be run within the same VPC) or a VPC connector to enable private networking. Additionally, proper IAM permissions (e.g., Cloud SQL Client role) are necessary for the proxy or connector to authenticate and connect. Without both the network path and IAM permissions, the connection will fail.

Exam trap

Google Cloud often tests the misconception that either a VPC connector or the Cloud SQL Proxy alone is sufficient, when in fact both the network path (via VPC connector or proxy in the VPC) and correct IAM permissions are required for private IP connectivity.

How to eliminate wrong answers

Option A is wrong because simply ensuring the Cloud SQL Proxy is running and configured is insufficient if the Cloud Function is not in the same VPC or lacks a VPC connector; the proxy alone cannot reach a private IP Cloud SQL instance from outside the VPC. Option B is wrong because verifying the Cloud Function's network settings is too vague and does not address the specific requirement of establishing a private network path via a VPC connector or proxy within the VPC. Option D is wrong because configuring a VPC connector alone is not enough; the Cloud SQL Proxy must also be running (or the connector must be paired with proper IAM permissions and the Cloud SQL Auth proxy) to handle authentication and encryption, and IAM permissions must be correct.

Full explanation →
274
MCQmedium

A media company runs a stateless web application on Compute Engine behind an HTTP(S) load balancer. They want to automatically replace unhealthy VMs and maintain a fixed number of running instances across two zones. What should they use?

A.An unmanaged instance group with health checks
B.A zonal managed instance group with autoscaling
C.Compute Engine with instance templates and no group
D.A regional managed instance group with a fixed target size and autohealing
AnswerD

Regional MIG distributes instances across zones, maintains a fixed size, and autohealing replaces unhealthy VMs.

Why this answer

A managed instance group (MIG) with autoscaling based on average CPU utilization can maintain a target CPU level, but to keep a fixed number of instances, they should use a MIG without autoscaling and rely on autohealing to replace unhealthy VMs.

Full explanation →
275
MCQeasy

What is the effective access of the service account sa@project.iam.gserviceaccount.com to the bucket?

A.Full admin access to objects
B.Owner access
C.Read-only access
D.No access
AnswerA

objectAdmin provides full control over objects.

Why this answer

The service account sa@project.iam.gserviceaccount.com is a Google Cloud IAM service account. When it is granted the 'Storage Admin' role (roles/storage.admin) at the project level, it gains full admin access to all buckets in the project, including the ability to create, delete, and manage objects. This role provides full control over objects, equivalent to 'Full admin access to objects'.

Exam trap

The trap here is that candidates often confuse 'Owner access' (a primitive role) with the specific IAM role that grants full admin access to objects, or they assume that a service account with a project-level role only has read access, missing that Storage Admin provides full object control.

How to eliminate wrong answers

Option B is wrong because 'Owner access' is a project-level primitive role (roles/owner) that includes all permissions, but the question specifically asks about access to the bucket, and the service account's effective access is determined by the IAM roles granted, not by a generic 'Owner' label. Option C is wrong because 'Read-only access' would require a role like 'Storage Object Viewer' (roles/storage.objectViewer), which only allows reading objects, not full admin actions. Option D is wrong because the service account has been granted an IAM role (e.g., Storage Admin) that explicitly provides access, so 'No access' is incorrect.

Full explanation →
276
MCQhard

What is the most likely reason the NetworkPolicy is not taking effect?

A.The developer used the networking.k8s.io/v1 API version instead of the Calico CRD projectcalico.org/v3.
B.The cluster has a global network policy that overrides per-namespace policies.
C.The pod labels do not match because of a capitalization mismatch.
D.The NetworkPolicy is missing a spec.podSelector.matchLabels entry.
AnswerA

GKE with Calico expects Calico-specific CRDs for full functionality.

Why this answer

The NetworkPolicy is not taking effect because the developer used the standard Kubernetes API version `networking.k8s.io/v1`, which defines a different schema and behavior than the Calico CRD `projectcalico.org/v3`. Calico NetworkPolicies support advanced features like order-of-precedence, global policies, and non-IP match criteria that are not available in the native Kubernetes NetworkPolicy API. When a Calico-specific policy is defined using the wrong API version, the cluster's policy engine (Calico) ignores it, resulting in no enforcement.

Exam trap

Google Cloud often tests the distinction between native Kubernetes NetworkPolicies and CNI-specific CRDs (like Calico), trapping candidates who assume all NetworkPolicies use the same API version and ignore the need to match the policy engine's schema.

How to eliminate wrong answers

Option B is wrong because global network policies in Calico (or Kubernetes) do not override per-namespace policies; instead, they are evaluated with a specific precedence order, and a correctly defined per-namespace policy would still take effect unless explicitly denied by a higher-priority global policy. Option C is wrong because label matching in Kubernetes is case-sensitive, but a capitalization mismatch would cause the policy to not match pods, not prevent the policy from being recognized or taking effect at all; the question asks for the most likely reason the policy is not taking effect, and the API version mismatch is a more fundamental issue. Option D is wrong because a NetworkPolicy can use `spec.podSelector` without `matchLabels` (e.g., using `matchExpressions`), and omitting `matchLabels` entirely is valid if the selector is empty (matches all pods); the absence of `matchLabels` does not prevent the policy from taking effect.

Full explanation →
277
Multi-Selectmedium

A company needs to connect two VPC networks in different Google Cloud regions. The VPCs are in separate projects under the same organization. The connection must use private IP addresses and support high throughput. Which TWO options meet these requirements? (Choose 2.)

Select 2 answers
A.HA VPN Gateway
B.VPC Network Peering
C.Cloud NAT
D.Cloud VPN (HA VPN Classic)
E.Shared VPC
AnswersB, D

Correct: Cross-region and cross-project VPC peering is supported, using private IPs with high throughput.

Why this answer

VPC Network Peering allows direct private IP connectivity between two VPCs in different projects and regions, using RFC 1918 addresses without internet gateways or VPNs. It supports high throughput because traffic stays within Google's network backbone and does not rely on encrypted tunnels that can introduce overhead.

Exam trap

The trap here is that candidates often confuse Shared VPC with VPC Network Peering, not realizing Shared VPC merges projects into one VPC rather than connecting two independent VPCs.

Full explanation →
278
MCQhard

A team uses BigQuery for real-time dashboarding. Queries on a large table take over 30 seconds. The table is date-partitioned and has high cardinality in the `user_id` column. Which optimization is MOST likely to reduce query latency?

A.Cluster the table on user_id
B.Use materialized views for all queries
C.Avoid using SELECT * in queries
D.Increase BigQuery slot reservations
AnswerA

Clustering on a high-cardinality column like user_id reduces the amount of data scanned for queries filtering on user_id.

Why this answer

Clustering sorts data within partitions based on the clustering columns, which significantly improves query performance for filter and aggregation on those columns. `user_id` is high cardinality, so clustering on it helps. Partitioning alone is already done. Avoiding `SELECT *` helps but is not the most impactful here.

Materialized views would help if the same aggregation is reused. Increasing slots costs money.

Full explanation →
279
MCQmedium

A team uses Cloud CDN to cache static assets. They update assets by deploying new versions with new URLs. However, sometimes they need to invalidate the cache for a critical fix immediately without changing the URL. What should they do?

A.Increase the TTL to max
B.Change the URL to a new version
C.Use cache invalidation to remove the cached objects
D.Set a short TTL (e.g., 1 minute)
AnswerC

Cache invalidation is designed to immediately purge cached content.

Why this answer

Cloud CDN supports cache invalidation via gcloud CLI or API. Setting short TTL reduces cache duration but not immediate. Using cache-busting (changing URL) is the recommended approach but not feasible for this immediate fix.

Increasing TTL makes it worse.

Full explanation →
280
MCQmedium

A security engineer wants to prevent data exfiltration from a project 'prod-data' by ensuring that only approved VPC networks can access BigQuery datasets. Which GCP service should be used?

A.Private Google Access
B.Cloud Armor
C.Cloud NAT
D.VPC Service Controls
AnswerD

VPC Service Controls creates perimeters to prevent data exfiltration from managed services like BigQuery.

Why this answer

VPC Service Controls create service perimeters that protect resources by restricting access from outside the perimeter. They can be used to limit BigQuery access to specific VPC networks or IP ranges.

Full explanation →
281
MCQmedium

A company runs a batch processing workload that can tolerate interruptions. The job runs for 4 hours every night and can be restarted from checkpoints. They want to minimize compute costs. Which Compute Engine machine configuration is MOST cost-effective?

A.Preemptible VMs
B.Standard VMs with sustained use discounts
C.Spot VMs with a specific reservation
D.Committed use VMs (1-year commitment)
AnswerA

Preemptible VMs are cost-effective for fault-tolerant batch jobs that can handle interruptions.

Why this answer

Preemptible VMs are up to 80% cheaper than standard VMs and can be terminated at any time, but the workload is checkpointable and runs overnight, so interruptions are manageable. Committed use discounts require a 1-year or 3-year commitment and are not ideal for short daily jobs. Standard VMs are more expensive.

Full explanation →
282
MCQmedium

A company uses Terraform to manage Google Cloud infrastructure. They want to store the Terraform state file in a remote backend with state locking to prevent concurrent modifications. Which Google Cloud service supports this natively?

A.Cloud Firestore
B.Cloud Spanner
C.Bigtable
D.Cloud Storage
E.Cloud SQL
AnswerD

Correct. Cloud Storage is the native Terraform backend for GCP.

Why this answer

Google Cloud Storage (GCS) is the only option that natively supports Terraform's remote state backend with state locking. Terraform uses GCS's object versioning and a write-lock mechanism via a separate lock file (e.g., `default.tflock`) stored in the same bucket, leveraging GCS's strong consistency for atomic operations. This prevents concurrent `terraform apply` commands from corrupting the state.

Exam trap

Google Cloud often tests the misconception that any database with locking (like Cloud Spanner or Cloud SQL) can serve as a Terraform backend, but the exam requires knowing that only services with a native Terraform backend implementation—specifically Cloud Storage—are supported for state locking.

How to eliminate wrong answers

Option A is wrong because Cloud Firestore is a NoSQL document database designed for mobile/web apps, not for Terraform state locking; it lacks native Terraform backend support. Option B is wrong because Cloud Spanner is a globally distributed relational database with strong consistency, but Terraform does not provide a native Spanner backend for state storage. Option C is wrong because Bigtable is a wide-column NoSQL database optimized for high-throughput analytics, not for Terraform state management; it has no native Terraform backend integration.

Option E is wrong because Cloud SQL is a managed relational database service (MySQL/PostgreSQL/SQL Server) that Terraform does not support as a native state backend; it would require custom tooling for locking.

Full explanation →
283
MCQmedium

A company wants to encrypt data at rest in Cloud Storage using their own keys stored on-premises. They need to rotate the key every 30 days. Which encryption option should they use?

A.Default encryption with Google-managed keys
B.Customer-Managed Encryption Keys (CMEK) with Cloud KMS
C.Customer-Supplied Encryption Keys (CSEK)
D.Cloud HSM
AnswerC

CSEK allows customers to supply their own keys, which are used server-side but not stored by Google.

Why this answer

Customer-Supplied Encryption Keys (CSEK) allow users to provide their own keys for encrypting Cloud Storage objects. The keys are managed on-premises and can be rotated as needed.

Full explanation →
284
MCQeasy

You need to run a load test against a web application hosted on Compute Engine. Which tool is recommended for generating HTTP traffic and measuring performance?

A.Stackdriver Monitoring (now Cloud Monitoring)
B.gcloud compute ssh to manually send requests
C.Cloud Load Testing (based on Locust)
D.Cloud Shell's built-in load generator
AnswerC

It is a Google Cloud solution for load testing.

Why this answer

Google Cloud's recommended load testing tool is the Cloud Load Testing tool (also known as Distributed Load Testing using Kubernetes), which can deploy Locust or other load generators. Alternatively, you can use Locust or Apache JMeter directly. The Cloud Load Testing solution is a ready-to-use option.

Full explanation →
285
MCQeasy

Which GCP service can be used to detect and redact sensitive data such as credit card numbers in text files stored in Cloud Storage?

A.Security Command Center
B.Cloud Key Management Service
C.Cloud Audit Logs
D.Cloud Data Loss Prevention (DLP)
AnswerD

Cloud DLP inspects and de-identifies sensitive data.

Why this answer

Cloud DLP provides built-in detectors for many sensitive data types and can redact or tokenize them.

Full explanation →
286
MCQmedium

A company is migrating its on-premises application to Google Cloud. The application requires low-latency access to a shared filesystem that can be mounted by multiple Compute Engine instances across different zones. Which storage solution should they use?

A.Provision a Filestore instance and mount it on the instances.
B.Create a Persistent Disk and attach it to all instances.
C.Attach Local SSD to each instance and replicate data between them.
D.Use Cloud Storage FUSE to mount a bucket on each instance.
AnswerA

Filestore provides a managed NFS filesystem that can be mounted by multiple VMs across zones for low-latency shared access.

Why this answer

Filestore provides a fully managed, NFS-based shared filesystem that can be mounted by multiple Compute Engine instances across different zones with low-latency access. It supports the required multi-writer, multi-mount scenario natively, making it the ideal choice for shared storage in a zonal-distributed architecture.

Exam trap

The trap here is that candidates often confuse Persistent Disk's multi-attach capability (which is read-only only) with a writable shared filesystem, or assume Cloud Storage FUSE can replace a POSIX-compliant NFS share for low-latency workloads.

How to eliminate wrong answers

Option B is wrong because a Persistent Disk can only be attached to a single instance in read-write mode, or to multiple instances in read-only mode, so it cannot serve as a writable shared filesystem across multiple instances. Option C is wrong because Local SSDs are ephemeral and tied to a single instance; replicating data between them manually introduces complexity, latency, and consistency issues, and does not provide a shared filesystem. Option D is wrong because Cloud Storage FUSE presents an object store as a filesystem, which does not offer POSIX-compliant locking, low-latency metadata operations, or consistent shared-write semantics required for a shared filesystem.

Full explanation →
287
Multi-Selecthard

Which TWO of the following are valid methods to control access to Google Cloud resources using Identity and Access Management (IAM)?

Select 2 answers
A.Attach an IAM policy to an organization
B.Attach an IAM policy to a project
C.Attach an IAM policy to a user
D.Assign an IAM role directly to a user
E.Attach an IAM policy to a service account
AnswersA, B

IAM policies can be attached at the organization level.

Why this answer

Attaching an IAM policy to an organization (option A) is a valid method because it allows you to set organization-wide policies that apply to all projects and resources within that organization. This is a fundamental feature of Google Cloud's hierarchical resource management, where policies can be inherited from the organization node down to folders and projects, enabling centralized control over access.

Exam trap

Google Cloud often tests the distinction between attaching a policy to a resource versus assigning a role to an identity, where candidates mistakenly think that attaching a policy to a user or service account is valid, when in fact policies are always attached to resources, not to identities.

Full explanation →
288
MCQhard

A company deploys a web application on Compute Engine behind a global HTTP(S) Load Balancer. Users report intermittent 502 errors. Investigation shows backend instances are healthy. What is the MOST likely cause?

A.The SSL certificate has expired
B.The firewall rules are blocking traffic from the load balancer
C.The backend instances are running out of memory
D.The backend service's timeout setting is too low
AnswerD

If the timeout is too low, the load balancer may close the connection prematurely, resulting in a 502 from the client's perspective.

Why this answer

HTTP 502 errors from a load balancer often indicate that the backend is closing the connection or not responding in time. The backend connection timeout or request timeout might be too low. Instance health checks passing means the instance is responsive to health check probes, but the actual application requests may be timing out.

SSL certificate errors usually cause 400-level errors. Insufficient capacity would cause 503 or 504 errors. Incorrect firewall rules would prevent health checks from passing.

Full explanation →
289
MCQhard

A team is running a GKE cluster with a workload that has variable CPU and memory usage. They want to automatically adjust pod resource requests and limits based on historical usage to improve resource efficiency. Which feature should they use?

A.Vertical Pod Autoscaler (VPA)
B.PodDisruptionBudget (PDB)
C.Horizontal Pod Autoscaler (HPA)
D.Cluster Autoscaler
AnswerA

VPA adjusts CPU and memory requests/limits based on usage, improving resource efficiency.

Why this answer

Vertical Pod Autoscaler (VPA) automatically adjusts CPU and memory requests and limits of pods based on historical usage, making it ideal for right-sizing. Horizontal Pod Autoscaler (HPA) scales the number of pods based on metrics, but does not modify resource requests. Cluster Autoscaler adjusts the number of nodes.

PodDisruptionBudget controls pod disruptions during maintenance.

Full explanation →
290
MCQmedium

A media company stores large video files that are accessed infrequently (once a quarter) and must be retained for 10 years for compliance. They want to minimize storage cost. Which Cloud Storage class should they use?

A.Standard storage class
B.Archive storage class
C.Coldline storage class
D.Nearline storage class
AnswerB

Archive is the lowest-cost class, designed for data accessed less than once a year, with retrieval costs higher but storage cheapest.

Why this answer

Archive storage is the lowest-cost class for data accessed less than once a year. It is ideal for long-term archival with 10-year retention. Standard is for frequent access, Nearline for 30 days, Coldline for 90 days.

Archive is the cheapest for infrequent access.

Full explanation →
291
Multi-Selectmedium

Which TWO practices improve the security of a Cloud Run service?

Select 2 answers
A.Enable Cloud Armor for the service.
B.Use Identity-Aware Proxy (IAP) to authenticate users.
C.Run the service in a VPC with firewall rules.
D.Use a canary deployment strategy.
E.Require client-side TLS certificates.
AnswersA, B

Cloud Armor provides WAF and DDoS protection.

Why this answer

A is correct because Cloud Armor provides web application firewall (WAF) capabilities that protect Cloud Run services from common web attacks like SQL injection and cross-site scripting (XSS). B is correct because Identity-Aware Proxy (IAP) verifies user identity and context before allowing access, enforcing authentication at the Google Cloud edge before requests reach the Cloud Run service.

Exam trap

The PCA exam often tests the misconception that VPC firewall rules apply to Cloud Run services directly, but Cloud Run is a serverless product that does not run inside a customer VPC, making firewall rules irrelevant for inbound traffic control.

Full explanation →
292
MCQmedium

A company needs to encrypt data at rest in Cloud Storage using their own keys. They require that the keys are stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 certified. Which key management option should they choose?

A.Google-managed encryption keys
B.Customer-Supplied Encryption Keys (CSEK)
C.Customer-Managed Encryption Keys (CMEK) with Cloud HSM
D.Customer-Managed Encryption Keys (CMEK) with Cloud KMS
AnswerC

Cloud HSM provides FIPS 140-2 Level 3 HSM for CMEK keys.

Why this answer

Cloud HSM is a FIPS 140-2 Level 3 certified HSM service that allows you to manage your own encryption keys for CMEK. CSEK requires you to supply keys yourself, but they are not stored in an HSM. Cloud KMS without HSM is only Level 1.

Google-managed keys do not use customer keys.

Full explanation →
293
Multi-Selectmedium

A company is deploying a critical application on GKE and needs to ensure high availability for the Kubernetes control plane and etcd data. Which TWO approaches should they implement? (Choose TWO.)

Select 2 answers
A.Manually manage the control plane on Compute Engine
B.Increase the machine type of the node pool
C.Use a regional GKE cluster with multiple zones
D.Use a single-zone cluster with a large node pool
E.Use Velero to back up etcd data regularly
AnswersC, E

Regional clusters replicate control plane across zones for HA.

Why this answer

GKE automatically manages control plane availability with regional clusters. For etcd backups, using Velero is a standard approach. Increasing node size does not improve control plane availability.

Manual control plane management is not needed in GKE. Single-zone clusters do not provide HA.

Full explanation →
294
MCQeasy

A company wants to migrate an on-premises MySQL database to GCP with minimal downtime and support for automated failover in case of a zone outage. Which GCP service should they use?

A.Cloud SQL for PostgreSQL
B.Cloud SQL for MySQL
C.Cloud Bigtable
D.Firestore
AnswerB

Cloud SQL for MySQL offers High Availability (HA) configuration with automatic failover across zones.

Why this answer

Cloud SQL for MySQL provides managed MySQL with zone-level high availability via a standby instance in a different zone. Automated failover is built-in. Bigtable and Firestore are NoSQL databases, and Cloud SQL for PostgreSQL is not MySQL.

Full explanation →
295
MCQhard

An organization wants to enforce a policy that prohibits the creation of Cloud Storage buckets with uniform bucket-level access disabled. What should they use?

A.Organization policy with a list constraint.
B.IAM roles with custom permissions to deny bucket creation.
C.Cloud Audit Logs to monitor bucket creation.
D.Cloud Armor security policies.
AnswerA

Organization policies can enforce configuration constraints on resources.

Why this answer

Organization policies can enforce constraints like constraints/storage.uniformBucketLevelAccess to require uniform bucket-level access. Option B (IAM roles with custom permissions) cannot deny bucket creation with specific settings. Option C (Cloud Audit Logs) is for logging, not enforcement.

Option D (Cloud Armor) is for security policies at the edge.

Full explanation →
296
MCQeasy

Which GCP service provides distributed tracing to help analyze latency in microservices applications?

A.Cloud Profiler
B.Cloud Trace
C.Cloud Logging
D.Cloud Monitoring
AnswerB

Trace is a distributed tracing system that captures latency data.

Why this answer

Cloud Trace collects latency data from applications and provides near-real-time traces. Cloud Profiler provides continuous profiling. Cloud Monitoring provides metrics and dashboards.

Cloud Logging provides log management.

Full explanation →
297
MCQeasy

A security engineer needs to restrict access to a Google Cloud project so that only a specific set of IP addresses can reach Cloud Storage buckets. Which feature should be configured?

A.VPC Service Controls
B.IAM Conditions
C.Firewall Rules
D.Cloud Armor
AnswerA

Why this answer

VPC Service Controls allow you to define perimeters that restrict access based on context, including IP addresses via access levels.

Full explanation →
298
MCQhard

A company has a Cloud Bigtable instance with 10 nodes. They notice read latency increases during peak hours. Monitoring shows CPU utilization at 70%. Which action will most effectively reduce read latency?

A.Switch from HDD to SSD
B.Redesign row keys to avoid hotspots
C.Increase the number of nodes
D.Split the tables into more tablets
AnswerC

Adding nodes reduces CPU load and read latency.

Why this answer

High CPU utilization (70%) indicates the cluster is stressed. Adding nodes increases throughput and reduces latency. SSDs are default, so not a factor.

Row key redesign would require application changes. Table splitting is automatic.

Full explanation →
299
Multi-Selectmedium

A company stores large amounts of data in Cloud Storage and wants to reduce costs. Which two actions should they take? (Choose two.)

Select 2 answers
A.Disable object versioning to prevent multiple versions.
B.Enable object versioning and configure lifecycle rules to delete noncurrent versions after 90 days.
C.Add bucket labels to track cost by department.
D.Configure lifecycle management to transition objects to Nearline or Coldline storage classes after 30 days.
E.Change the default storage class to Standard for all buckets.
AnswersB, D

Removes outdated versions, saving storage.

Why this answer

Enabling object versioning and configuring lifecycle rules to delete noncurrent versions after 90 days directly reduces storage costs by automatically removing older object versions that are no longer needed. Option D is correct because transitioning objects to Nearline or Coldline storage classes after 30 days leverages lower-cost storage tiers for infrequently accessed data, aligning cost with access patterns.

Exam trap

Google Cloud often tests the distinction between cost allocation (labels) and direct cost reduction (lifecycle rules), leading candidates to mistakenly choose labeling as a cost-saving measure.

Full explanation →
300
Multi-Selecthard

A company wants to allow a Kubernetes pod in GKE to authenticate to Google Cloud APIs without storing service account keys in the cluster. Which three components need to be configured to enable Workload Identity? (Choose three.)

Select 3 answers
A.Google Cloud service account
B.Kubernetes service account with annotation
C.Firewall rule to allow traffic to metadata server
D.IAM policy binding granting the GCP SA roles/iam.workloadIdentityUser on the GCP SA
E.Cloud NAT for outbound access
AnswersA, B, D

The GCP SA that the pod will impersonate.

Why this answer

Workload Identity requires: (1) a Google Cloud IAM service account (GCP SA), (2) a Kubernetes service account (KSA) annotated with the GCP SA email, and (3) an IAM policy binding between the KSA and GCP SA to allow impersonation.

Full explanation →
Page 3

Page 4 of 13

Page 5

All pages

12345678910111213

Practice PCA by domain

Target a specific domain to shore up weak areas.

Managing Implementation and Ensuring Solution and Operations ReliabilityManaging and Provisioning a Solution InfrastructureDesigning for Security and ComplianceAnalysing and Optimising Technical and Business ProcessesDesign and plan a cloud solution architectureManage and provision cloud infrastructureDesign for security and complianceAnalyze and optimize technical and business processesManage implementation of cloud architectureEnsure solution and operations reliability
See all domains with question counts →