Courseiva

Google Professional Cloud Architect (PCA) — Questions 601–675

955 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 8

Page 9 of 13

Page 10
601
MCQeasy

An engineer needs to list all Compute Engine instances in a project using the command line. Which gcloud command should they use?

A.gcloud compute instances describe
B.gcloud compute instances list
C.gcloud compute instance-groups list
D.gcloud compute machine-types list
AnswerB

This is the correct command to list all instances.

Why this answer

The correct command to list Compute Engine instances is 'gcloud compute instances list'. The other options are incorrect: 'gcloud compute machine-types list' lists machine types, 'gcloud compute instance-groups list' lists instance groups, and 'gcloud compute instances describe' describes a specific instance.

Full explanation →
602
MCQeasy

A development team wants to automate the process of building container images from their GitHub repository and storing them in Artifact Registry. Which Google Cloud service should they use to create a build trigger that runs on every push to the main branch?

A.Container Registry
B.Cloud Build
C.Artifact Registry
D.Cloud Deploy
AnswerB

Correct. Build triggers in Cloud Build can watch a repository branch and run a build automatically.

Why this answer

Cloud Build is the CI/CD service that can be configured with build triggers to automatically build images on source code changes and push them to Artifact Registry.

Full explanation →
603
MCQhard

Your company runs a multi-tier web application on Google Kubernetes Engine (GKE). The application consists of a frontend service, a backend API service, and a PostgreSQL database deployed using a StatefulSet with persistent volumes. The backend service exposes a gRPC endpoint. Recently, the team noticed that the backend service experiences intermittent high latency and occasional timeouts. The frontend service is stateless and scales well. The backend service is CPU-bound. The database is not the bottleneck. The cluster has three nodes of type n1-standard-4. The backend service is deployed with 10 replicas, each requesting 1 CPU and 2 Gi memory. Node utilization is around 70% CPU. The team suspects the network is the issue. However, after reviewing the GKE monitoring dashboard, they see that the network bytes sent/received per second for the backend pods is well below the node's network bandwidth limit. The latency spikes seem correlated with periods of high CPU throttling on the backend pods. The backend service's gRPC requests are small (under 1 KB), and the responses are also small. The team has already optimized the application code. What should the team do to reduce latency?

A.Increase the number of nodes in the cluster to reduce network contention.
B.Increase the number of backend replicas to 20.
C.Increase the CPU request for the backend pods to 2 CPUs.
D.Increase the memory request for the backend pods to 4 Gi.
AnswerC

More CPU will reduce throttling and latency.

Why this answer

The latency spikes correlate with CPU throttling, and increasing the CPU request to 2 CPUs ensures that each backend pod receives a guaranteed CPU share, reducing throttling under load. Since the backend is CPU-bound and node utilization is 70%, the current 1 CPU request may be insufficient, causing the Kubernetes CPU manager to throttle the pods when the node's CPU is contended. This directly addresses the root cause without adding unnecessary replicas or memory.

Exam trap

The trap here is that candidates may focus on network or scaling solutions (A or B) because the symptom is latency, but the monitoring data explicitly points to CPU throttling, not network saturation, making CPU request adjustment the precise fix.

How to eliminate wrong answers

Option A is wrong because network contention is not the issue—monitoring shows network bytes are well below node bandwidth limits, and the problem is CPU throttling, not network. Option B is wrong because increasing replicas to 20 would increase CPU contention on the existing nodes, worsening throttling and latency, and the frontend already scales well. Option D is wrong because the backend is CPU-bound, not memory-bound; increasing memory does not alleviate CPU throttling and would waste resources.

Full explanation →
604
MCQeasy

A company runs batch machine learning training jobs that can be interrupted. They want to reduce compute costs. Which Compute Engine VM pricing model is MOST cost-effective?

A.Preemptible VMs
B.Standard VMs
C.Sustained use discounts
D.Committed use discounts
AnswerA

Preemptible VMs are significantly cheaper and suitable for interruptible batch jobs.

Why this answer

Preemptible VMs offer up to 60-91% discount and can be terminated at any time, ideal for batch workloads that are fault-tolerant. Sustained use discounts are automatic but less aggressive. Committed use discounts require 1 or 3 year commitment.

Standard VMs are full price.

Full explanation →
605
MCQmedium

An application uses Cloud Bigtable and experiences high latency for reads. The row key is a timestamp prefix followed by a random ID. Queries often scan a range of timestamps for a specific ID. What design change would MOST improve read performance?

A.Change the row key to start with the random ID followed by timestamp
B.Add more Bigtable nodes
C.Use a separate column family for the ID
D.Enable Bigtable replication
AnswerA

This ensures rows for the same ID are clustered together, making timestamp range scans for a specific ID fast.

Why this answer

For Bigtable, row key design is critical. Scanning a range of timestamps for a specific ID is inefficient if the key starts with timestamp (scans across all IDs). Prepending the ID ensures all data for that ID is contiguous, making range scans efficient.

Adding nodes increases throughput but doesn't fix the key design issue. Using a column family is about grouping columns, not performance.

Full explanation →
606
MCQmedium

A company is migrating on-premises workloads to Google Cloud. They have a critical application that requires consistent low-latency access to a database, with read replicas in multiple regions for disaster recovery. The application is expected to grow by 10x over the next year. Which database service and configuration should the architect choose to meet these requirements?

A.Use Cloud Bigtable with multi-region replication
B.Use Cloud SQL for PostgreSQL with cross-region read replicas
C.Use Cloud Spanner with multi-region configuration
D.Use Firestore in native mode with multi-region location
AnswerC

Cloud Spanner offers global strong consistency, automatic replication, and horizontal scalability.

Why this answer

Cloud Spanner with a multi-region configuration is the correct choice because it provides strong global consistency, low-latency reads and writes across regions, and automatic horizontal scaling to handle a 10x growth in workload. Its multi-region replication ensures synchronous replication for disaster recovery while maintaining ACID transactions, which is critical for a database requiring consistent low-latency access.

Exam trap

The trap here is that candidates often confuse Cloud Spanner's multi-region capabilities with simpler replication options like Cloud SQL read replicas or Bigtable's eventual consistency, failing to recognize that only Spanner provides strong global consistency and horizontal scaling for transactional workloads.

How to eliminate wrong answers

Option A is wrong because Cloud Bigtable is a NoSQL wide-column database designed for high-throughput analytical workloads, not for transactional applications requiring strong consistency and low-latency access to a single database; its multi-region replication is asynchronous and does not guarantee strong consistency. Option B is wrong because Cloud SQL for PostgreSQL supports cross-region read replicas, but the primary database is single-region and cannot scale horizontally to handle a 10x growth; read replicas are asynchronous and do not provide strong consistency for writes, making it unsuitable for a critical application requiring consistent low-latency access. Option D is wrong because Firestore in native mode is a NoSQL document database with eventual consistency by default (unless using transactions) and does not support the strong global consistency and horizontal scaling needed for a relational database workload with 10x growth; its multi-region location provides replication but not the ACID transactional guarantees required.

Full explanation →
607
MCQeasy

A company wants to automatically apply security patches to Compute Engine instances running Windows Server. They need a solution that can schedule patch installations and report compliance. Which service should they use?

A.OS Config
B.Cloud Monitoring
C.Cloud Deploy
D.Cloud Build
AnswerA

OS Config provides patch management for VMs.

Why this answer

OS Config’s patch management feature allows scheduling and monitoring of OS patches across VM instances.

Full explanation →
608
MCQhard

An administrator creates a GKE cluster with the command above. After deployment, the cluster has 3 nodes, but the node pool autoscaler never scales up even under load. What is the most likely reason?

A.The autoscaler minimum nodes is set to 1 and maximum to 5.
B.The disk size of 100 GB is insufficient.
C.The cluster is zonal, but node locations include multiple zones.
D.The machine type e2-medium is too small for the workloads.
AnswerC

In a zonal cluster, nodes can only be in the cluster zone; node-locations is ignored.

Why this answer

The node pool autoscaler in GKE cannot scale up a cluster that uses multiple zones in a single zonal cluster. The autoscaler requires that all nodes in the pool be in the same zone to properly manage capacity; when node locations span multiple zones in a zonal cluster, the autoscaler is disabled and will not trigger scaling events, even under load.

Exam trap

The trap here is that candidates often assume the autoscaler is misconfigured due to limits or resource constraints, but this exam tests the subtle distinction that the autoscaler is disabled entirely when node locations span multiple zones in a zonal cluster.

How to eliminate wrong answers

Option A is wrong because setting minimum nodes to 1 and maximum to 5 is a valid autoscaler configuration and does not prevent scaling; it actually enables scaling within that range. Option B is wrong because a 100 GB disk size is sufficient for most workloads and disk size does not affect the autoscaler's ability to scale; the autoscaler responds to resource requests (CPU/memory), not disk capacity. Option D is wrong because the e2-medium machine type, while small, is not inherently too small for workloads; the autoscaler scales based on pending pods and resource requests, not the machine type itself, and a small machine type would actually trigger scaling if workloads exceed its capacity.

Full explanation →
609
Multi-Selecthard

A company is designing a DR strategy for their GKE workloads. They need to back up application data and cluster configuration. Which THREE resources should they include in their backup plan? (Choose THREE.)

Select 3 answers
A.etcd snapshot via Velero
B.Kubernetes resource manifests (Deployments, Services, etc.)
C.Service account keys for the cluster
D.PersistentVolume data and PVCs
E.Compute Engine node images
AnswersA, B, D

etcd snapshot captures cluster state including resources.

Why this answer

PersistentVolume data (application data), Kubernetes resource manifests (deployments, services), and etcd snapshots (cluster state) are essential. Node images can be recreated from configuration. Service accounts are IAM entities and not typically backed up as part of cluster backup.

Full explanation →
610
Multi-Selectmedium

A company is migrating to Google Cloud and needs to implement a least-privilege access model. Which THREE Google Cloud services or features support this goal? (Choose three.)

Select 3 answers
A.Cloud IAM Conditions
B.Cloud Audit Logs
C.VPC Service Controls
D.Cloud NAT
E.Organization Policy Service
AnswersA, C, E

Allow access based on attributes like time, IP, or resource type, enabling least privilege.

Why this answer

Cloud IAM Conditions allow you to define and enforce attribute-based, context-aware access control policies on Google Cloud resources. By specifying conditions such as time, resource type, or IP address in IAM policies, you can grant temporary or scoped permissions, ensuring users have only the access necessary for their specific task. This directly supports least-privilege by reducing standing privileges and preventing over-permissioning.

Exam trap

The trap here is confusing auditing and monitoring services (like Cloud Audit Logs) with access control mechanisms, leading candidates to select Cloud Audit Logs as a least-privilege tool when it only records actions without enforcing permissions.

Full explanation →
611
MCQhard

An application uses Cloud SQL (PostgreSQL) and experiences high connection overhead, often exhausting the max connections limit. The team wants to maintain a pool of persistent connections without modifying application code. Which solution should they implement?

A.Use Cloud Memorystore as a connection cache
B.Increase the max connections flag in Cloud SQL
C.Configure Cloud SQL Auth Proxy with max connections
D.Deploy PgBouncer on a Compute Engine instance
AnswerD

PgBouncer is a lightweight connection pooler for PostgreSQL that can be deployed to manage connections transparently.

Why this answer

PgBouncer is a connection pooler for PostgreSQL that manages a pool of connections, reducing overhead and preventing exhaustion. It can be deployed on Compute Engine or using Cloud SQL Auth Proxy with connection pooling.

Full explanation →
612
MCQmedium

Your team uses a GKE cluster with Autopilot mode. You want to ensure that your workloads can tolerate a node failure without manual intervention. What should you do?

A.Enable cluster multi-zonal and set pod anti-affinity rules
B.Create a node pool with multiple zones and enable cluster autoscaling
C.Configure a PodDisruptionBudget and deploy multiple replicas of your pods across different nodes
D.Use StatefulSets with persistent volumes that are replicated across zones
AnswerC

Autopilot automatically handles node failures, but you should ensure your application is resilient by having multiple replicas and a PDB.

Why this answer

GKE Autopilot automatically manages nodes and provides workload-level SLAs. By setting the pod's 'disruption budget' and ensuring replicas are distributed across nodes (which Autopilot does by default), the cluster will automatically reschedule pods if a node fails. No manual node management is required.

Full explanation →
613
Multi-Selecthard

A company runs a batch analytics job every hour on BigQuery. The job processes terabytes of data and the results are stored in Cloud Storage. The job must complete within 30 minutes. Which TWO actions can reduce query execution time? (Choose 2)

Select 2 answers
A.Use cached results from the previous run
B.Use a partitioned table based on the timestamp column
C.Convert the query to use legacy SQL
D.Export the data to Cloud Storage and query with an external table
E.Increase the number of BigQuery slots assigned to the project
AnswersB, E

Partition pruning limits the amount of data scanned, reducing query time.

Why this answer

Using partitioned tables allows BigQuery to scan only relevant partitions, reducing data scanned and improving speed. Increasing slot capacity provides more compute resources for the query. Partition elimination reduces data scanned; using clustering can also help but is not listed.

Caching results only helps if the query is repeated; the job runs hourly with new data. Using legacy SQL does not improve performance.

Full explanation →
614
MCQeasy

A data analytics team runs ad-hoc SQL queries on BigQuery to explore a 10 TB table. Queries are slow and expensive because they frequently scan the entire table. They want to reduce query costs and improve performance without changing the table schema. Which optimization should they apply first?

A.Create a materialized view of common aggregations.
B.Use clustering on the most-filtered column.
C.Partition the table by a date or timestamp column.
D.Switch to on-demand pricing from slot reservations.
AnswerC

Partitioning limits the data scanned per query, reducing cost and improving performance.

Why this answer

Partitioning the table by a time column (e.g., ingestion date) allows queries to filter on that column and scan only relevant partitions, reducing scanned data and cost. Clustering is also beneficial but partitioning is the first step for cost reduction.

Full explanation →
615
MCQmedium

Your team has deployed a microservices application on Google Kubernetes Engine (GKE) with multiple services communicating via internal ClusterIP services. You notice that some requests between services are failing intermittently with 'connection refused' errors. The services are defined with readiness probes. What is the most likely cause?

A.The readiness probes are not passing, causing the service endpoints to be removed.
B.The services are not exposed via a VPC peering connection to the client's VPC.
C.The services are using NodePort instead of LoadBalancer type, causing port conflicts.
D.The services are not associated with an Ingress resource.
AnswerA

Failing readiness probes cause the pod to be removed from service endpoints, leading to connection refused.

Why this answer

The 'connection refused' error indicates that the client is attempting to connect to a port on which no process is listening. In GKE, when a readiness probe fails, Kubernetes removes the pod's IP from the corresponding ClusterIP service's endpoints. If all pods for a service fail their readiness probes, the service has no healthy endpoints, and any request to the ClusterIP will be refused because there is no backend to accept the connection.

This matches the intermittent nature of the issue, as pods may temporarily fail the probe and then recover.

Exam trap

Google Cloud often tests the distinction between readiness and liveness probes, where candidates may incorrectly assume that a failing liveness probe (which restarts the pod) is the cause of 'connection refused', but the key is that readiness probes control endpoint membership, directly causing the error when all endpoints are removed.

How to eliminate wrong answers

Option B is wrong because VPC peering is used for connectivity between separate VPC networks, not for internal service-to-service communication within the same GKE cluster; ClusterIP services are inherently reachable within the cluster without any peering. Option C is wrong because NodePort and LoadBalancer are service types for external exposure, not for internal pod-to-pod communication; port conflicts are not a typical cause of 'connection refused' errors within a cluster, and NodePort does not affect internal ClusterIP functionality. Option D is wrong because an Ingress resource is used for external HTTP/S traffic routing to services, not for internal service-to-service communication; the absence of an Ingress has no impact on direct ClusterIP-based communication between microservices.

Full explanation →
616
MCQmedium

A startup is developing a real-time analytics dashboard that ingests data from IoT devices. The data volume is unpredictable but can spike to millions of events per second. The dashboard must display near real-time aggregations with sub-second latency. Which Google Cloud architecture should the architect recommend?

A.Ingest via Cloud IoT Core directly to Cloud Bigtable, then query with BigQuery.
B.Ingest via Cloud Pub/Sub, process with Cloud Dataproc, store in Cloud Storage, and query with BigQuery.
C.Ingest via Cloud Pub/Sub, store raw data in Cloud Storage, and use Cloud SQL for aggregations.
D.Ingest via Cloud Pub/Sub, process with Cloud Dataflow, store in Cloud Bigtable, and query from the dashboard.
AnswerD

This combination handles high ingest rates, stream processing, and low-latency queries.

Why this answer

Cloud Pub/Sub provides scalable, asynchronous ingestion for unpredictable IoT data spikes, Cloud Dataflow enables stream processing for near real-time aggregations with sub-second latency, and Cloud Bigtable offers low-latency, high-throughput storage ideal for serving aggregated results directly to a dashboard. This combination meets the requirements of unpredictable volume, real-time processing, and low-latency queries.

Exam trap

The trap here is that candidates often choose batch-oriented services like BigQuery or Dataproc for real-time requirements, overlooking that Cloud Dataflow's stream processing and Cloud Bigtable's low-latency storage are specifically designed for sub-second, high-throughput dashboard use cases.

How to eliminate wrong answers

Option A is wrong because Cloud IoT Core directly to Cloud Bigtable lacks a buffering layer for unpredictable spikes, and BigQuery is not designed for sub-second query latency on real-time dashboards. Option B is wrong because Cloud Dataproc is batch-oriented and introduces higher latency for stream processing, and Cloud Storage with BigQuery adds significant query latency unsuitable for sub-second dashboard responses. Option C is wrong because Cloud SQL cannot handle millions of events per second for real-time aggregations and lacks native stream processing capabilities.

Full explanation →
617
MCQmedium

Your organization runs a production Cloud SQL for PostgreSQL instance. You need to ensure that if the primary zone fails, the database automatically fails over to a standby with no data loss. Which configuration should you use?

A.Enable point-in-time recovery (PITR)
B.Configure a cross-region replica
C.Deploy a regional Cloud SQL instance with high availability
D.Create a read replica and promote it on failure
AnswerC

Regional HA instances automatically fail over to a standby in another zone with synchronous replication, ensuring no data loss.

Why this answer

Cloud SQL HA with regional instances uses synchronous replication to a standby in a different zone, ensuring zero data loss on automatic failover. Cross-region replication is for disaster recovery, not automatic failover. Point-in-time recovery is for restoration to a specific time, not failover.

Read replicas are for read scaling, not automatic failover.

Full explanation →
618
MCQmedium

A financial services company is migrating a monolithic Java application to Google Cloud. They want to minimize changes to the application code but take advantage of managed services. They plan to run the application on a VM with a specific OS configuration that is not supported by App Engine. Which migration strategy should they use?

A.Re-architect the application as microservices on GKE
B.Re-platform to App Engine Flexible Environment
C.Re-platform to Cloud Run
D.Lift-and-shift to Compute Engine with Cloud SQL for the database
AnswerD

This minimizes code changes (lift-and-shift) and uses managed Cloud SQL to offload database management.

Why this answer

Lift-and-shift is appropriate when minimal code changes are desired and the application can run on VMs. Re-platform would involve moving to a managed service like Cloud SQL but still typically requires some changes. Re-architect is a full rewrite.

Since they need a custom OS, App Engine is not an option.

Full explanation →
619
MCQmedium

Your company runs a stateful application on GKE that stores data in persistent volumes backed by Compute Engine persistent disks. You need to back up the application data and the Kubernetes resource configurations (deployments, services, etc.) for disaster recovery. Which tool should you use?

A.Velero
B.gcloud container clusters create --async
C.Cloud SQL for MySQL
D.Cloud Storage with object versioning and lifecycle policies
AnswerA

Velero backs up Kubernetes resources and persistent volumes to Cloud Storage.

Why this answer

Velero (formerly Heptio Ark) is an open-source tool for backing up and restoring Kubernetes cluster resources and persistent volumes. It supports GCP as a storage destination (Cloud Storage). Cloud Storage versioning can back up files but not Kubernetes resources. gcloud container clusters create does not back up.

Cloud SQL is for relational databases.

Full explanation →
620
MCQmedium

A company runs a web application behind a Cloud HTTP(S) Load Balancer. Static content (images, CSS, JS) is served from Cloud Storage. They want to reduce latency for users worldwide. Which action is MOST effective?

A.Enable Cloud CDN on the backend bucket
B.Increase the number of frontend instances
C.Use Cloud Armor to block high-latency requests
D.Use a multi-regional Cloud Storage bucket
AnswerA

Cloud CDN caches static content at edge locations worldwide, significantly reducing latency for users regardless of their location.

Why this answer

Cloud CDN caches content at global edge locations, reducing latency for users. Enabling Cloud CDN on the backend bucket serves static content from the edge. Using a multi-region bucket provides regional redundancy but does not reduce latency as effectively as CDN.

Increasing machine size does not help with static content serving.

Full explanation →
621
Multi-Selecthard

A company has a Cloud SQL for PostgreSQL instance that is experiencing high latency. They suspect a connection pooling issue. Which TWO configurations should be checked? (Choose two.)

Select 2 answers
A.Cloud SQL Auth Proxy configuration
B.max_connections database flag
C.Private IP assignment
D.Database query insights
E.Database version
AnswersA, B

Correct. The proxy handles connection pooling efficiently.

Why this answer

The Cloud SQL Auth Proxy is a common source of connection pooling issues because it can become a bottleneck if not configured with enough connections or if its connection limit is reached. It acts as a local intermediary, and if it exhausts its available connections, it will queue or drop new requests, causing high latency. Checking its configuration (e.g., the `--max-connections` flag or the number of proxy instances) is essential to diagnose pooling problems.

Exam trap

The trap here is that candidates may confuse network latency causes (like Private IP assignment) with connection pooling misconfigurations. In Google Cloud, connection pooling issues are often related to the Cloud SQL Auth Proxy's connection limits and the database's max_connections flag, not networking or version issues.

Full explanation →
622
Multi-Selectmedium

A company wants to implement a disaster recovery (DR) strategy for their Cloud SQL for MySQL databases. They need to be able to recover to a specific point in time (within seconds) in case of accidental data deletion. Which TWO actions should they take? (Choose TWO.)

Select 2 answers
A.Enable binary logging (binlog)
B.Configure a failover replica in another zone
C.Create a cross-region read replica
D.Enable automated backups
E.Export the database daily to Cloud Storage
AnswersA, D

Binary logging captures changes and enables point-in-time recovery.

Why this answer

Point-in-time recovery (PITR) in Cloud SQL uses transaction logs to restore to any point in time within the backup retention period. Automated backups are required to enable PITR. Cross-region replication is for regional DR but not point-in-time.

Full explanation →
623
MCQhard

Your company uses Cloud Spanner in a multi-region configuration to achieve 99.999% availability. You need to understand the impact of a regional failure on read and write availability. Which statement is correct?

A.Both reads and writes are fully available as long as at least one region remains healthy
B.Reads and writes remain fully available because Cloud Spanner uses synchronous replication across all regions
C.Writes are unavailable if the region containing the leader replica fails, but reads remain available
D.Writes are always available, but reads may be unavailable if the region with the closest replica fails
AnswerC

Leader region failure can cause write unavailability until a new leader is elected; reads can still be served.

Why this answer

Cloud Spanner multi-region configurations use a voting protocol. For read-write operations, a majority of replicas must be available. If one region fails, writes may be impacted if the remaining regions do not have a majority.

However, reads can still be served from healthy replicas in other regions (though they may be stale).

Full explanation →
624
Multi-Selecthard

A finance company needs to ensure that all compute instances in their VPC can only communicate with Google APIs (e.g., Cloud Storage) over internal IPs. Additionally, instances without external IPs should be able to access the internet for updates. Which TWO configurations should they implement?

Select 2 answers
A.Configure Cloud NAT
B.Create a firewall rule allowing egress to 0.0.0.0/0
C.Enable Private Google Access on the subnet
D.Assign external IPs to all instances
E.Use VPC peering with Google's public network
AnswersA, C

Cloud NAT provides outbound internet access to instances without external IPs.

Why this answer

Private Google Access allows VMs to use internal IPs to access Google APIs. Cloud NAT enables outbound internet access for instances without external IPs.

Full explanation →
625
MCQhard

A company requires a globally distributed relational database with strong consistency across regions and automatic replication. They need to support SQL queries and have a write throughput of 100,000 writes per second. Which Google Cloud database meets these requirements?

A.Cloud Spanner
B.Cloud Bigtable
C.BigQuery
D.Cloud SQL with cross-region replication
AnswerA

Cloud Spanner is designed for global distribution, strong consistency, high write throughput, and SQL.

Why this answer

Cloud Spanner is a globally distributed, strongly consistent relational database that supports SQL and can scale to millions of writes per second. Cloud SQL is regional, Bigtable is NoSQL and not relational, BigQuery is an analytics warehouse.

Full explanation →
626
MCQmedium

A team wants to deploy a microservice on Cloud Run that needs to access a Cloud Memorystore for Redis instance in the same region. The Redis instance is in a VPC network. Which configuration is required for Cloud Run to reach the Redis instance?

A.Configure a Cloud NAT gateway
B.Create a Serverless VPC Access connector and configure Cloud Run to use it
C.Use Private Google Access
D.Deploy Cloud Run within a VPC
AnswerB

The connector enables Cloud Run to send traffic to the VPC.

Why this answer

Cloud Run services can connect to a VPC using a Serverless VPC Access connector, which provides private network access.

Full explanation →
627
MCQmedium

Your organization has a policy that all Compute Engine instances must have specific labels (env, team, cost-center) applied. You want to enforce this automatically when instances are created. What should you do?

A.Enable Cloud Audit Logs and set up a metric-based alert to detect instances without labels.
B.Create a Cloud Function that listens for instance creation events and adds labels automatically.
C.Assign a custom IAM role that includes permission to label instances, and remove the default compute.instances.create permission.
D.Use the Organization Policy service with a custom constraint to require labels on Compute Engine instances.
AnswerD

Organization policies can enforce label requirements at creation time.

Why this answer

Organization Policy Service with a custom constraint allows you to enforce that all Compute Engine instances must have specific labels (env, team, cost-center) at creation time. This is a preventive control that blocks creation of non-compliant instances, unlike reactive or permission-based approaches. Custom constraints use the `compute.googleapis.com/instance` resource type and can require label keys or values using CEL (Common Expression Language) syntax.

Exam trap

The trap here is that candidates often choose reactive solutions (like Cloud Functions or alerts) because they seem simpler, but the exam emphasizes preventive enforcement using Organization Policy constraints for compliance-driven requirements.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs and metric-based alerts are reactive — they only detect non-compliant instances after creation, not prevent them, and do not enforce the policy automatically. Option B is wrong because a Cloud Function that listens for instance creation events and adds labels is also reactive; it can fail or be bypassed, and the instance is created without labels initially, violating the policy. Option C is wrong because removing the default `compute.instances.create` permission would prevent all instance creation, not just unlabeled ones, and a custom IAM role cannot enforce label requirements at creation time — it only controls who can create instances, not what labels they must include.

Full explanation →
628
Multi-Selecthard

Which THREE components are required to set up a private connection between an on-premises network and a VPC using Cloud VPN? (Choose three.)

Select 3 answers
A.Peer VPN gateway (on-premises).
B.Two VPN tunnels (for redundancy).
C.Cloud VPN gateway.
D.VPC Network Peering.
E.Cloud Router.
AnswersA, B, C

Required to terminate VPN on-premises.

Why this answer

A Peer VPN gateway represents the on-premises VPN device that terminates the IPsec tunnel from the Cloud VPN gateway. This is a required component to establish the encrypted tunnel between your on-premises network and the VPC, as it defines the public IP address and configuration of the remote endpoint.

Exam trap

Google Cloud often tests the misconception that Cloud Router is always required for Cloud VPN, but it is only needed for dynamic BGP routing; for static routes, Cloud Router is not a mandatory component.

Full explanation →
629
MCQmedium

Refer to the exhibit. This is an IAM policy for a BigQuery dataset. What does the policy allow?

A.Alice to view data and analysts to run jobs.
B.Alice and analysts to run jobs.
C.Alice to run jobs and analysts to view data.
D.Alice and analysts to view data.
AnswerA

dataViewer allows viewing, jobUser allows running jobs.

Why this answer

The policy grants the `roles/bigquery.dataViewer` role to Alice, which allows her to view dataset metadata and query data, and the `roles/bigquery.jobUser` role to analysts, which allows them to run jobs (queries, load, export) but not view data directly. This combination matches option A.

Exam trap

Google Cloud often tests the distinction between data viewing and job execution permissions in BigQuery, trapping candidates who assume that running a job automatically includes the ability to see the data.

How to eliminate wrong answers

Option B is wrong because Alice is assigned `roles/bigquery.dataViewer`, not `roles/bigquery.jobUser`, so she cannot run jobs; only analysts have the jobUser role. Option C is wrong because it reverses the permissions: Alice can view data (not run jobs) and analysts can run jobs (not view data). Option D is wrong because analysts are granted `roles/bigquery.jobUser`, which does not include data viewing permissions; only Alice has data viewing access.

Full explanation →
630
MCQeasy

A developer wants to automate the creation of a Google Cloud project with a specific VPC and firewall rules. Which tool should they use?

A.Cloud Shell
B.Cloud Console
C.Deployment Manager
D.Cloud SDK
AnswerC

Deployment Manager is Google Cloud's infrastructure as code service.

Why this answer

Deployment Manager is the correct tool because it allows you to define and manage Google Cloud resources, including projects, VPCs, and firewall rules, using declarative templates (YAML, Python, or Jinja2). This enables infrastructure-as-code (IaC) automation, which is essential for repeatable and version-controlled project creation. Unlike interactive tools, Deployment Manager handles the entire lifecycle of resources, including dependencies and updates, without manual intervention.

Exam trap

Google Cloud often tests the distinction between interactive tools (Cloud Shell, Cloud Console) and automation tools (Deployment Manager, Cloud SDK), but the trap here is that candidates confuse Cloud SDK (a set of command-line tools) with an automation framework, whereas Deployment Manager is the only option that provides declarative, template-based automation for complex multi-resource deployments.

How to eliminate wrong answers

Option A is wrong because Cloud Shell is an interactive command-line environment that provides temporary access to Cloud SDK tools, but it does not itself automate resource creation; it is merely a terminal for running commands manually. Option B is wrong because Cloud Console is a web-based GUI for manually managing resources, which is not suitable for automation and cannot be used in scripts or CI/CD pipelines. Option D is wrong because Cloud SDK is a set of command-line tools (like gcloud) that can be used to create resources individually, but it requires imperative scripting and does not provide declarative, repeatable infrastructure-as-code templates like Deployment Manager does.

Full explanation →
631
MCQeasy

You need to automatically roll back a GKE deployment if a new version causes a spike in 5xx errors. The deployment uses a canary strategy with Istio traffic splitting. What should you do?

A.Use Cloud Monitoring to watch the canary's error rate and trigger a Cloud Function that updates the Istio VirtualService to route all traffic back to the stable version.
B.Set the canary's traffic weight to 0 in the Istio VirtualService if errors exceed threshold using a Kubernetes Job.
C.Use GKE's built-in auto-repair feature to replace unhealthy pods.
D.Configure an Istio VirtualService with a retry policy that automatically redirects traffic on errors.
AnswerA

This automates rollback by shifting traffic back to the stable version based on error rate threshold.

Why this answer

Istio allows traffic splitting between versions. By integrating with Cloud Monitoring, you can create an alert that triggers a rollback via a Cloud Function or through a CI/CD pipeline that monitors the canary's error rate. Istio itself does not have built-in rollback; you need external automation.

Cloud Deploy can manage canary with automatic rollback, but the question mentions Istio traffic splitting, so a combination of monitoring and automation is needed.

Full explanation →
632
Drag & Dropmedium

Drag and drop the steps to set up a shared VPC in Google Cloud for a multi-project environment into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The host project holds the VPC network. Service projects use the subnets. IAM roles control who can use the subnets.

Full explanation →
633
MCQmedium

Refer to the exhibit. An application running on a GCE instance (ID: 1234567890) is unable to connect to a database at 10.0.0.1:5432. The logs show repeated 'Connection refused' errors. What is the most likely cause?

A.The firewall rule allowing traffic on port 5432 is missing or misconfigured.
B.The instance is using an outdated SSL certificate.
C.The database service is not running or is not listening on port 5432.
D.The VPC network has no route to the database subnet.
AnswerC

'Connection refused' indicates that the destination host is reachable but no service is listening on that port.

Why this answer

The 'Connection refused' error indicates that the TCP handshake was rejected by the target host, which typically means the database service is not actively listening on port 5432. This is distinct from a firewall block, which would result in a timeout or 'no route to host' error. Since the error is immediate and specific to port 5432, the most likely cause is that the PostgreSQL or other database service is not running or is bound to a different interface/port.

Exam trap

Google PCA exams often test the distinction between firewall blocks (timeout) and service unavailability (connection refused), so the trap here is that candidates confuse a missing firewall rule with a service not listening, even though the error messages are fundamentally different.

How to eliminate wrong answers

Option A is wrong because a missing or misconfigured firewall rule would cause a timeout or 'connection timed out' error, not an immediate 'Connection refused' — the latter requires the host to actively reject the connection. Option B is wrong because SSL certificate issues would manifest as TLS handshake failures or certificate validation errors, not a raw TCP-level 'Connection refused'. Option D is wrong because if there were no route to the database subnet, the error would be 'No route to host' or a network unreachable message, not a port-specific refusal.

Full explanation →
634
MCQhard

A large e-commerce company runs a multi-tier application on Google Cloud. The frontend is served by a global HTTP Load Balancer with a backend service pointing to a managed instance group (MIG) of nginx web servers. The application tier consists of a regional internal TCP/UDP load balancer distributing traffic to a MIG of Java application servers. The database tier uses Cloud SQL for PostgreSQL in a failover replica configuration. The architecture is deployed in the us-central1 region across three zones. Recently, the operations team noticed intermittent 502 Bad Gateway errors from the frontend load balancer during peak traffic hours. The errors last for a few minutes and then recover. The team suspects the application tier is overwhelmed. They need to implement a solution that can handle traffic spikes without manual intervention. Which course of action should they take?

A.Increase the maximum number of instances in the application tier MIG from 10 to 20.
B.Enable Cloud Armor on the frontend load balancer with a rate-limiting rule to block excessive traffic.
C.Configure HTTP health checks on the regional internal load balancer and set the autoscaler to use the 'HTTP load balancing utilization' metric for the application tier MIG.
D.Enable Cloud CDN on the frontend load balancer to cache static assets and reduce load on the application tier.
AnswerC

Health checks ensure the load balancer only sends traffic to healthy instances, and autoscaling based on load balancing utilization will automatically adjust capacity.

Why this answer

The intermittent 502 errors during peak traffic indicate that the application tier MIG is being overwhelmed. By configuring HTTP health checks on the regional internal load balancer and setting the autoscaler to use the 'HTTP load balancing utilization' metric, the autoscaler can scale the application tier MIG based on the actual load distribution from the internal load balancer, ensuring it handles traffic spikes without manual intervention. This directly addresses the root cause—insufficient application instances—by enabling dynamic scaling based on real-time utilization.

Exam trap

The trap here is that candidates often confuse frontend load balancer errors with frontend capacity issues and choose CDN or rate-limiting, but the 502 Bad Gateway error specifically indicates the backend (application tier) is failing to respond, so the solution must scale the application tier itself.

How to eliminate wrong answers

Option A is wrong because simply increasing the maximum number of instances from 10 to 20 does not enable autoscaling; the MIG would still need a scaling policy to trigger new instances during spikes, and without a metric-based autoscaler, the instances would not be created automatically. Option B is wrong because enabling Cloud Armor with rate-limiting would block excessive traffic at the frontend, but the 502 errors originate from the backend (application tier) being overwhelmed, not from the frontend; rate-limiting would reject legitimate traffic and degrade user experience without solving the capacity issue. Option D is wrong because enabling Cloud CDN caches static assets at the edge, which reduces load on the frontend web servers but does not address the application tier's inability to handle dynamic request spikes; the 502 errors are likely from the application tier timing out, not from static asset serving.

Full explanation →
635
MCQeasy

A company is migrating to Google Cloud and needs to connect their on-premises network to a VPC. They require high bandwidth and a reliable connection with a Service Level Agreement (SLA). Which solution should they choose?

A.Cloud VPN with dynamic routing
B.Dedicated Interconnect
C.Partner Interconnect via a service provider
D.Direct Peering
AnswerB

Dedicated Interconnect offers high bandwidth and an SLA.

Why this answer

Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google's network, offering high bandwidth (10 or 100 Gbps per link) and a 99.99% uptime SLA when configured with redundant links. This meets the requirements for high bandwidth and a reliable, SLA-backed connection better than any other option.

Exam trap

The trap here is that candidates often confuse Partner Interconnect with Dedicated Interconnect, assuming any 'Interconnect' offers an SLA, but only Dedicated Interconnect provides a direct physical link with a 99.99% SLA, while Partner Interconnect's SLA depends on the partner's network and is typically lower.

How to eliminate wrong answers

Option A is wrong because Cloud VPN uses the public internet with IPsec tunnels, offering no SLA and limited bandwidth (typically up to 3 Gbps per tunnel), making it unsuitable for high-bandwidth, SLA-backed requirements. Option C is wrong because Partner Interconnect relies on a third-party service provider's network, which may introduce additional latency and does not provide the same direct, dedicated SLA as Dedicated Interconnect; it is designed for cases where a direct physical connection is not feasible. Option D is wrong because Direct Peering is a non-SLA, best-effort connection established via public exchange points, intended for traffic exchange with Google services, not for dedicated, SLA-backed connectivity to a VPC.

Full explanation →
636
Matchingmedium

Match each GCP storage service to its typical use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Object storage for unstructured data

Managed NFS file server

Block storage for VM instances

NoSQL database for large analytical workloads

Globally distributed relational database

Why these pairings

Cloud Storage is for unstructured object storage, Cloud SQL for relational data, Cloud Bigtable for wide-column NoSQL analytics, and Firestore for document NoSQL apps. Common confusions involve mixing storage types with database services.

Full explanation →
637
MCQmedium

A company wants to use Customer-Managed Encryption Keys (CMEK) for data at rest in Cloud Storage, but also needs to ensure that the keys are stored in a hardware security module (HSM) to meet compliance requirements. Which Cloud KMS key type should they choose?

A.Predefined key
B.External key (Cloud External Key Manager)
C.Software-backed key
D.Cloud HSM key
AnswerD

Cloud HSM keys are stored in FIPS 140-2 Level 3 certified HSMs.

Why this answer

Cloud HSM provides HSM-backed keys that are FIPS 140-2 Level 3 certified. Using Cloud HSM for the CMEK ensures the key material is stored in a hardware security module.

Full explanation →
638
MCQmedium

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

A.Cloud Bigtable
B.Cloud Spanner
C.BigQuery
D.Firestore
AnswerA

Bigtable is the correct choice: wide-column NoSQL, designed for time-series and IoT workloads, single-digit ms latency, and scales to millions of QPS with additional nodes.

Why this answer

Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

Full explanation →
639
MCQhard

An organization runs a Cloud Run service that processes incoming HTTP requests. Under heavy load, some requests timeout. The team wants to reduce cold starts and ensure consistent performance. They set min instances to 1, but the issue persists. Which additional configuration should they change?

A.Reduce concurrency
B.Set CPU always allocated to true
C.Increase max instances
D.Increase request timeout
AnswerB

This ensures the instance always has CPU, reducing latency for requests that hit an idle instance.

Why this answer

Increasing CPU allocation ensures that even idle instances have CPU, reducing latency for incoming requests.

Full explanation →
640
Multi-Selectmedium

A company needs to ensure that only approved machine images can be used to create Compute Engine instances to meet security compliance. Which two methods should they use? (Choose two.)

Select 2 answers
A.Use VPC Service Controls to prevent creation from unauthorized images
B.Use a custom role with permissions restricted to specific image families
C.Use Cloud Asset Inventory to detect non-compliant images and trigger remediation
D.Use IAM conditions on compute.instances.create to require a specific family label
E.Use Organization Policy constraint compute.trustedImageProjects
AnswersB, E

Custom roles can limit which images a user can use by granting permissions on specific image projects.

Why this answer

A custom IAM role can be created with permissions restricted to specific image families (e.g., `compute.images.list` and `compute.instances.create` with conditions), ensuring that only approved image families can be used to launch instances. This directly enforces compliance by preventing the use of unapproved images at the IAM level.

Exam trap

The trap here is that candidates often confuse detection-based tools (like Cloud Asset Inventory) with preventive controls, or they incorrectly assume that IAM conditions can evaluate arbitrary resource metadata like image family labels, when in fact only specific resource attributes are supported.

Full explanation →
641
MCQhard

A company is migrating an on-premises application to Google Cloud. The application requires access to a legacy database that can only be reached from a specific on-premises IP address. The company has established a Cloud VPN tunnel. What is the MOST secure way to ensure that only the migrated application's Compute Engine instances can initiate connections to the on-premises database?

A.Create a Cloud NAT and assign the application instances a static IP, then allow that IP in the on-premises firewall
B.Create a firewall egress rule with destination IP range of the on-premises database and source service account of the application instances
C.Create a firewall egress rule with destination IP range of the on-premises database and source tags 'db-access'
D.Use VPC Service Controls to create a perimeter around the application VPC
AnswerB

Using service accounts ensures only instances with that specific identity can access the database.

Why this answer

Using firewall rules with target service accounts allows you to control egress traffic based on the identity of the source instances, which is more secure than using tags or IP ranges.

Full explanation →
642
MCQeasy

A company wants to test the performance of a new web application under high load. They need a tool that can generate traffic from multiple regions. Which Google Cloud service should they use?

A.Cloud Load Testing
B.Cloud Run
C.Cloud Shell
D.Locust
AnswerA

Cloud Load Testing is the GCP managed service for generating load from multiple regions.

Why this answer

Cloud Load Testing (formerly Cloud Load Balancing) is a managed service that can generate load from multiple regions. Locust is an open-source tool that can be deployed on Compute Engine but is not a managed GCP service. Cloud Shell is a development environment.

Cloud Run is for running containers.

Full explanation →
643
Multi-Selectmedium

A company is designing a disaster recovery plan for a critical application running on Compute Engine with a regional persistent disk. They want to minimize recovery time objective (RTO) and recovery point objective (RPO). Which TWO strategies should they implement? (Choose two.)

Select 2 answers
A.Use snapshot replication to a secondary region.
B.Take manual snapshots after a failure occurs.
C.Create an instance template in the same region.
D.Store backups in Cloud Storage with a lifecycle policy.
E.Create a custom image of the boot disk and copy it to another region.
AnswersA, E

Snapshots can be replicated to another region for quick restore.

Why this answer

Snapshot replication to a secondary region allows you to create and store disk snapshots in a different region, enabling rapid recovery of the application in that secondary region. This minimizes RTO by having the snapshots readily available for creating new disks and instances, and minimizes RPO by scheduling frequent, automated snapshots that capture incremental changes, ensuring data loss is limited to the snapshot interval.

Exam trap

Google Cloud often tests the distinction between regional persistent disks (which are synchronous within a region) and cross-region disaster recovery strategies, leading candidates to mistakenly think that a regional persistent disk alone provides cross-region redundancy, when in fact you must explicitly replicate snapshots or images to another region.

Full explanation →
644
MCQmedium

The exhibit shows a Cloud Storage bucket configuration. What does this configuration ensure?

A.Older versions of objects are automatically transferred to a different storage class.
B.Data is replicated to another region for disaster recovery.
C.Objects can only be permanently deleted after the retention period expires.
D.Objects older than 30 days will be automatically deleted.
AnswerC

A locked retention policy prevents permanent deletion before the retention period ends. Versioning retains noncurrent versions.

Why this answer

The exhibit shows a bucket configured with a retention policy. When a retention policy is set on a Cloud Storage bucket, objects cannot be deleted or overwritten until the retention period expires. This ensures that objects can only be permanently deleted after the retention period ends, which is exactly what option C describes.

Exam trap

The trap here is that candidates confuse retention policies with lifecycle management rules, mistakenly thinking retention policies automatically delete or transition objects, when in fact they only prevent deletion until the retention period expires.

How to eliminate wrong answers

Option A is wrong because retention policies do not automatically transfer objects to a different storage class; that is the function of lifecycle management rules, not retention policies. Option B is wrong because retention policies do not replicate data to another region; replication is configured separately using object replication or dual-region buckets. Option D is wrong because retention policies do not automatically delete objects after a period; they prevent deletion until the retention period expires, and automatic deletion is achieved via lifecycle rules with a Delete action.

Full explanation →
645
MCQhard

Refer to the exhibit. A Cloud Deploy pipeline has a release with two targets: staging and prod. The staging rollout succeeded, but the prod rollout failed with 'MANIFEST_INVALID'. What is the most likely cause of the failure?

A.The manifest for prod contains a syntax error or references a resource that does not exist in the prod cluster.
B.The prod target's applyManifest has a higher replica count than staging, which violates a cluster quota.
C.The prod cluster does not have the necessary permissions to pull the container image.
D.The release was not approved for the prod target.
AnswerA

'MANIFEST_INVALID' typically indicates that the Kubernetes manifest is malformed, has invalid references, or does not pass validation against the target cluster's API.

Why this answer

The 'MANIFEST_INVALID' error in Cloud Deploy indicates that the Kubernetes manifest provided for the prod target is syntactically incorrect or references a resource (e.g., a ConfigMap, Secret, or custom resource definition) that does not exist in the prod cluster. This is a validation failure that occurs before any deployment attempt, so it is not related to runtime issues like permissions or quotas.

Exam trap

A common trap is confusing 'MANIFEST_INVALID' with permission or quota issues, which are separate failure modes in the deployment pipeline.

How to eliminate wrong answers

Option B is wrong because a replica count exceeding a cluster quota would produce a different error, such as 'QUOTA_EXCEEDED' or a resource allocation failure during rollout, not a manifest validation error. Option C is wrong because insufficient permissions to pull a container image would result in an 'ImagePullBackOff' or 'ErrImagePull' error at the pod level, not a manifest validation error during the deploy step. Option D is wrong because a missing approval for the prod target would cause the rollout to be pending or skipped, not to fail with 'MANIFEST_INVALID'; approval gates are checked before the rollout begins.

Full explanation →
646
MCQeasy

A developer needs to pass a startup script to a Compute Engine instance during creation. Which method should be used to ensure the script runs on first boot?

A.Use gcloud compute instances create with --metadata=startup-script=...
B.Create a custom image with the script baked in.
C.Use gcloud compute instances add-metadata after creating the instance.
D.Use gcloud compute instances create with --startup-script flag.
AnswerA

This passes the startup script as instance metadata, which runs on first boot.

Why this answer

The `--metadata=startup-script=...` flag on `gcloud compute instances create` passes the script as instance metadata. Compute Engine automatically executes the value of the `startup-script` metadata key on every boot, including the first boot. This is the standard, documented method for providing a startup script at instance creation time.

Exam trap

The trap here is that candidates confuse the nonexistent `--startup-script` flag with the correct `--metadata=startup-script=...` syntax, or assume that adding metadata after creation will trigger the script on the first boot.

How to eliminate wrong answers

Option B is wrong because baking the script into a custom image makes it part of the image itself, not a dynamically assigned startup script; it would run on every boot of instances created from that image, but the question specifically asks for a method to pass the script during creation, not to embed it in the image. Option C is wrong because `gcloud compute instances add-metadata` modifies metadata on an already-running instance; the script would only run on the next boot, not on the first boot (which has already occurred). Option D is wrong because `gcloud compute instances create` does not support a `--startup-script` flag; the correct flag is `--metadata=startup-script=...`.

Full explanation →
647
MCQeasy

A small company wants to store sensitive files in Cloud Storage and ensure they are encrypted with a key that they control and rotate automatically every 90 days. They are currently using the default encryption provided by Google Cloud. They need a solution that is easy to manage and does not require manual key rotation. What should they do?

A.Use Cloud HSM to generate a key and handle encryption outside of Cloud Storage.
B.Create a Cloud KMS key ring and key with CMEK, set a rotation period of 90 days, and configure the bucket to use that key.
C.Use Customer-Supplied Encryption Keys (CSEK) and write a script to rotate the key every 90 days.
D.Continue using default encryption as it is automatically rotated by Google.
AnswerB

CMEK with automatic rotation meets the requirement of customer-controlled keys with no manual effort.

Why this answer

Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow the company to control the key while leveraging automatic rotation. By creating a key ring and key with a 90-day rotation period, and configuring the Cloud Storage bucket to use that key, the company meets the requirement for automated rotation without manual intervention. This solution is easy to manage and integrates natively with Cloud Storage, avoiding the complexity of external encryption or scripting.

Exam trap

The trap here is that candidates often confuse CMEK (customer-managed, automatic rotation) with CSEK (customer-supplied, manual rotation) or assume default encryption already meets the control requirement, but the question explicitly demands customer-controlled keys with automatic rotation.

How to eliminate wrong answers

Option A is wrong because Cloud HSM generates keys that are managed by the customer but encryption must be handled outside Cloud Storage, adding operational complexity and violating the 'easy to manage' requirement. Option C is wrong because Customer-Supplied Encryption Keys (CSEK) require the customer to supply the key with each API call and write a script for rotation, which is not automatic and contradicts the 'does not require manual key rotation' requirement. Option D is wrong because default encryption uses Google-managed keys, which the customer does not control, failing the requirement that they control the key.

Full explanation →
648
MCQmedium

A company deploys a microservices application on Google Kubernetes Engine (GKE). Pods in one deployment are frequently OOMKilled. The team sets memory requests and limits, but pods still crash. What is the most likely remaining cause?

A.CPU requests are too low, causing throttling and eventual crash.
B.The node pool is too small, causing memory pressure on the node.
C.Memory limits are set higher than the node's allocatable memory.
D.The application has a memory leak that eventually exceeds the limit.
AnswerD

A memory leak causes continuous memory growth until the limit is hit, resulting in OOMKill.

Why this answer

OOMKilled errors occur when a container exceeds its memory limit. Setting memory requests and limits prevents unbounded usage, but if the application has a memory leak, it will continue to consume memory until it hits the configured limit, causing the kernel's Out-Of-Memory (OOM) killer to terminate the pod. The fact that pods still crash after setting limits indicates the application itself is the root cause, not resource configuration.

Exam trap

The trap here is that candidates confuse OOMKilled (per-container limit) with node-pressure eviction (node-level memory), or assume that setting requests/limits automatically fixes all memory issues, ignoring application-level bugs like memory leaks.

How to eliminate wrong answers

Option A is wrong because CPU throttling does not cause OOMKilled; CPU limits throttle performance but do not trigger the OOM killer, which is specific to memory exhaustion. Option B is wrong because node-level memory pressure would cause pods to be evicted (not OOMKilled) or the node to become NotReady, but the question states pods are OOMKilled, which is a per-container limit violation, not a node-level issue. Option C is wrong because setting memory limits higher than the node's allocatable memory would prevent the pod from being scheduled (pending state), not cause it to run and then be OOMKilled.

Full explanation →
649
MCQhard

A company with multiple projects must ensure that no data can be exfiltrated from a specific project's Cloud Storage buckets to unauthorized locations outside the organization. They also need to allow access only from a corporate VPN IP range. Which configuration meets these requirements?

A.Configure a VPC Service Controls perimeter with an access level restricted to the corporate VPN IP range.
B.Set firewall rules to block all traffic except from the VPN.
C.Use IAM conditions to restrict access based on IP address.
D.Use Cloud Armor with IP whitelisting.
AnswerA

Why this answer

VPC Service Controls create a service perimeter around the project, preventing data exfiltration by default. Access levels (based on IP ranges) can be used to allow access only from the corporate VPN.

Full explanation →
650
MCQeasy

A company wants to protect their web application hosted on Google Cloud HTTP(S) Load Balancer from common web attacks like SQL injection and cross-site scripting (XSS). Which GCP service should they use?

A.Identity-Aware Proxy (IAP)
B.Cloud CDN
C.VPC Service Controls
D.Cloud Armor
AnswerD

Cloud Armor offers WAF policies to protect against web attacks.

Why this answer

Cloud Armor provides WAF (Web Application Firewall) capabilities including preconfigured rules to block OWASP Top 10 attacks like SQL injection and XSS. IAP is for access control, not attack prevention. VPC Service Controls are for data exfiltration prevention.

Cloud CDN is for caching content.

Full explanation →
651
MCQmedium

A Cloud Run service needs to access resources in a VPC network (e.g., a Cloud SQL instance). The service should be able to send requests to the VPC and receive responses. What is the correct configuration?

A.Create a VPC connector and configure the Cloud Run service to use it for egress
B.Place the Cloud Run service in a VPC subnet
C.Use Cloud NAT to allow Cloud Run to access the VPC
D.Use VPC peering between Cloud Run and the VPC
AnswerA

Correct. A VPC connector routes egress traffic from Cloud Run to the VPC.

Why this answer

Cloud Run can use a VPC connector (Serverless VPC Access) to send requests to a VPC. It does not allow inbound traffic from the VPC without additional setup.

Full explanation →
652
Multi-Selectmedium

Which TWO actions should you take to improve the reliability of a stateful application deployed on Compute Engine with regional persistent disks?

Select 2 answers
A.Use a regional persistent disk to replicate data across two zones.
B.Deploy the application across multiple zones in a managed instance group with autohealing.
C.Use preemptible VMs to reduce costs.
D.Place an HTTP(S) load balancer in front of the application.
E.Schedule regular snapshots of the persistent disk to Cloud Storage.
AnswersA, B

Regional persistent disks replicate data synchronously across zones, protecting against zone failure.

Why this answer

Regional persistent disks (RPDs) synchronously replicate data between two zones within a region, ensuring that if one zone fails, the data remains available in the other zone without data loss. This directly improves the reliability of a stateful application by providing a durable, zone-failure-tolerant storage layer that maintains data consistency across zones.

Exam trap

Google Cloud often tests the distinction between data durability (synchronous replication) and data backup (asynchronous snapshots), and candidates mistakenly choose scheduled snapshots (Option E) thinking they improve reliability, when in fact they only provide disaster recovery with a non-zero RPO.

Full explanation →
653
MCQmedium

A company is deploying a critical application on Compute Engine with an HTTP load balancer. They want to ensure that if an instance health check fails, traffic is automatically rerouted to healthy instances. Which configuration should they implement?

A.Use an HTTP(S) load balancer with a backend service configured with a health check and enable connection draining.
B.Use an internal load balancer with a backend service configured with a health check.
C.Use a network load balancer with a health check configured on the target pool.
D.Use an HTTP(S) load balancer with a backend service configured with a health check and enable session affinity.
E.Use a TCP proxy load balancer with a backend service configured with a health check.
AnswerA

HTTP(S) LB with health checks automatically reroutes traffic; connection draining adds graceful shutdown.

Why this answer

An HTTP(S) load balancer with a backend service configured with a health check automatically monitors instance health and reroutes traffic away from unhealthy instances. Enabling connection draining ensures that in-flight requests to an unhealthy instance are given time to complete before the instance is removed from the load balancing pool, preventing disruption to active sessions.

Exam trap

Google Cloud often tests the distinction between connection draining and session affinity, where candidates mistakenly think session affinity is needed for failover, but in reality session affinity prevents rerouting and should be avoided for high-availability scenarios.

How to eliminate wrong answers

Option B is wrong because an internal load balancer is used for private traffic within a VPC and does not handle external HTTP(S) traffic, nor does it provide the automatic rerouting required for a public-facing critical application. Option C is wrong because a network load balancer (TCP/UDP) operates at layer 4 and does not support HTTP(S) health checks or connection draining; it forwards traffic based on IP and port, not application-level health. Option D is wrong because session affinity (sticky sessions) pins a client to a specific instance, which would prevent traffic from being rerouted away from an unhealthy instance, defeating the purpose of health-check-based failover.

Option E is wrong because a TCP proxy load balancer terminates TCP connections and forwards traffic at layer 4, lacking HTTP(S)-specific health checks and the ability to reroute based on application-level health status.

Full explanation →
654
MCQmedium

A company runs a global application that requires strong consistency across regions for financial transactions. Which database should they choose?

A.Cloud SQL
B.Cloud Bigtable
C.Firestore
D.Cloud Spanner
AnswerD

Spanner provides globally distributed strong consistency with ACID transactions.

Why this answer

Cloud Spanner provides global strong consistency and horizontal scaling. Bigtable offers eventual consistency. Firestore provides strong consistency within a region but not globally.

Cloud SQL is regional.

Full explanation →
655
Multi-Selecthard

A company is planning a hybrid cloud architecture using Anthos to manage workloads across on-premises data centers and Google Cloud. They need to select two key components that enable consistent configuration, policy, and security across environments. Which two should they choose?

Select 2 answers
A.Cloud Interconnect
B.GKE on-prem
C.Cloud Build
D.Config Sync
E.Cloud Load Balancing
AnswersB, D

GKE on-prem enables running Kubernetes clusters on-premises with the same API and tooling as GKE, enabling consistent workload management.

Why this answer

GKE on-prem (now Anthos clusters on bare metal or VMware) is correct because it provides a consistent Kubernetes platform that runs on-premises, enabling the same container orchestration, policy enforcement, and security controls as GKE in Google Cloud. Config Sync is correct because it continuously reconciles the desired state of cluster configurations from a Git repository, ensuring that policies, RBAC, and security settings remain identical across all Anthos clusters, whether on-prem or in the cloud.

Exam trap

The trap here is that candidates often confuse connectivity services (Cloud Interconnect) or traffic management (Cloud Load Balancing) with configuration and policy consistency, failing to recognize that Anthos relies on GitOps-based tools like Config Sync and the on-prem Kubernetes runtime (GKE on-prem) to achieve unified management.

Full explanation →
656
MCQeasy

Refer to the exhibit. What is the primary benefit of the `--preemptible` flag in this command?

A.Significant cost reduction compared to standard instances.
B.Faster instance startup time due to optimized kernel.
C.Higher availability through automatic restart on failure.
D.Access to specialized hardware like GPUs at no extra cost.
AnswerA

Preemptible VMs cost about 60-90% less than standard VMs.

Why this answer

The `--preemptible` flag in Google Cloud Platform (GCP) creates preemptible VM instances, which are short-lived, cost-effective instances that can be terminated at any time by GCP. The primary benefit is a significant cost reduction—up to 60-91% lower than standard instances—making them ideal for batch jobs, fault-tolerant workloads, and non-critical tasks. This flag does not affect startup time, availability guarantees, or provide free access to specialized hardware.

Exam trap

Google Cloud often tests the misconception that `--preemptible` provides high availability or automatic restarts, when in reality it sacrifices availability for cost savings, and candidates may confuse it with managed instance groups or autohealing features.

How to eliminate wrong answers

Option B is wrong because the `--preemptible` flag does not optimize the kernel or affect instance startup time; startup time depends on the image and machine type, not the preemptible nature. Option C is wrong because preemptible instances have no automatic restart on failure—they are terminated after 24 hours or when capacity is needed, and they do not offer higher availability; in fact, they have lower availability than standard instances. Option D is wrong because preemptible instances do not provide access to specialized hardware like GPUs at no extra cost; GPUs are still billed separately, and preemptible instances with GPUs are subject to the same preemption risks and cost structure.

Full explanation →
657
MCQeasy

A developer needs to view the last 100 lines of logs from a specific Compute Engine instance in real time to debug an application issue. Which command should they use?

A.gcloud beta logging tail
B.gcloud app logs read --limit=100
C.gcloud logging read "resource.type=gce_instance AND resource.labels.instance_id=INSTANCE_ID" --limit=100 --freshness=1h
D.gcloud compute instances get-serial-port-output INSTANCE_NAME
AnswerC

This reads up to 100 log entries from the instance in the last hour. For real time, add --freshness=0m or use tail.

Why this answer

The gcloud logging read command can filter logs and tail them with the --freshness flag. gcloud compute instances get-serial-port-output retrieves serial console output, not application logs. gcloud app logs read is for App Engine. gcloud beta logging tail streams logs in real time.

Full explanation →
658
MCQhard

A company wants to deploy a microservice on Cloud Run that requires high throughput and low latency. The service processes requests that can spike unpredictably. The team wants to minimize cold starts and ensure availability during traffic bursts. Which combination of Cloud Run settings should they configure?

A.min-instances = 1, max-instances = 1, concurrency = 80
B.min-instances = 0, max-instances = 100, concurrency = 1
C.min-instances = 0, max-instances = 10, concurrency = 80
D.min-instances = 1, max-instances = 100, concurrency = 80
AnswerD

This combination ensures warm instances, allows scaling to handle bursts, and maximizes concurrent requests.

Why this answer

Setting min instances to 1 ensures at least one instance is always warm, eliminating cold starts. Max instances should be high to handle bursts. Concurrency should be set to the maximum the container can handle to maximize throughput.

Full explanation →
659
MCQmedium

An organization is implementing a data loss prevention (DLP) strategy for Cloud Storage. They want to automatically scan new objects uploaded to a specific bucket and redact sensitive data. Which service and configuration should they use?

A.Configure Cloud Armor with a WAF rule to inspect and redact data as it enters the bucket.
B.Enable Security Command Center (SCC) premium tier and configure it to scan the bucket for sensitive data.
C.Use Cloud DLP with a BigQuery external table to scan the bucket contents periodically.
D.Use Cloud Functions triggered by Cloud Storage events to call Cloud DLP API for each new object, and then store the redacted version.
AnswerD

Cloud Functions can process events from Cloud Storage and apply DLP transformations.

Why this answer

It uses Cloud Functions as an event-driven compute service that triggers on Cloud Storage object finalize events. The function then calls the Cloud DLP API to inspect and redact sensitive data from the new object, and writes the redacted version back to the bucket. This provides automatic, near-real-time scanning and redaction for each uploaded object, aligning with the requirement for an automated DLP strategy.

Exam trap

The trap here is that candidates may confuse Cloud DLP's batch scanning capabilities (e.g., via BigQuery or Cloud Storage inspect jobs) with the need for real-time, event-driven processing, leading them to choose Option C instead of recognizing that Cloud Functions provide the necessary automatic trigger for each new object.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) that protects HTTP(S) load-balanced traffic, not a service that inspects or redacts data inside Cloud Storage buckets; it operates at the network edge, not on stored objects. Option B is wrong because Security Command Center (SCC) is a security and risk management platform that provides visibility and threat detection, but it does not perform automated redaction of sensitive data in Cloud Storage; it can identify misconfigurations or vulnerabilities but cannot modify object content. Option C is wrong because using Cloud DLP with a BigQuery external table requires periodic batch scanning of the bucket, which does not meet the requirement for automatic scanning of new objects as they are uploaded; it introduces latency and lacks event-driven, per-object processing.

Full explanation →
660
MCQhard

An organization wants to deploy a containerized microservices architecture on Google Kubernetes Engine (GKE) and minimize operational overhead. They do not need to manage the node infrastructure and are willing to accept some limitations on node configuration. Which GKE mode should they choose?

A.GKE Standard mode with zonal cluster
B.Compute Engine with container-optimized OS and instance groups
C.Cloud Run for Anthos
D.GKE Autopilot mode
AnswerD

Autopilot is fully managed; Google handles nodes, scaling, and upgrades.

Why this answer

GKE Autopilot is a fully managed mode where Google manages the entire cluster infrastructure, including nodes. It abstracts away node management and automatically provisions, scales, and upgrades nodes. Standard mode requires manual node pool management.

Cloud Run is serverless but not Kubernetes. Compute Engine is not container orchestration.

Full explanation →
661
Multi-Selecteasy

A company wants to store application secrets such as API keys and database passwords securely and audit access. They also need to automatically rotate secrets periodically. Which TWO Google Cloud services should they use? (Choose 2)

Select 2 answers
A.Cloud Deployment Manager
B.Cloud Scheduler
C.Cloud Storage
D.Cloud Key Management Service
E.Secret Manager
AnswersB, E

Cloud Scheduler can be used to trigger periodic rotation of secrets (e.g., via Cloud Functions).

Why this answer

Secret Manager stores secrets with versioning and IAM control, and Cloud Scheduler can trigger rotations.

Full explanation →
662
Multi-Selectmedium

An organization wants to monitor and alert on custom application metrics from a GKE cluster. They also need to view logs in real-time and create metrics from log content. Which two GCP services should they use? (Choose two.)

Select 2 answers
A.Error Reporting
B.Cloud Monitoring
C.Cloud Profiler
D.Cloud Trace
E.Cloud Logging
AnswersB, E

Monitoring can collect custom metrics via the Monitoring API and set up alerting policies.

Why this answer

Cloud Monitoring collects metrics and provides alerting. Cloud Logging collects logs and supports log-based metrics. Cloud Profiler is for profiling.

Cloud Trace is for tracing. Error Reporting is for error grouping.

Full explanation →
663
MCQmedium

A company uses Cloud Interconnect to connect on-premises network to GCP. They want to ensure that if one interconnect link fails, traffic is automatically rerouted to another link. Which configuration should they implement?

A.Configure BGP sessions with equal-cost multi-path (ECMP) over multiple interconnect links.
B.Use a VPN as backup for the interconnect.
C.Use a single VLAN attachment with multiple interconnect links.
D.Create a second interconnect in a different metro and use BGP with MED.
E.Use multiple VLAN attachments with the same interconnect.
AnswerD

Two interconnects in different metro areas with BGP MED provide automatic failover.

Why this answer

Using a second interconnect in a different metro with BGP MED (Multi-Exit Discriminator) allows you to influence inbound traffic path selection and provides true geographic redundancy. If one interconnect link fails, BGP withdraws the routes, and traffic automatically fails over to the remaining interconnect via the alternate path, ensuring high availability without relying on a single point of failure.

Exam trap

The trap here is that candidates often confuse link-level redundancy (e.g., ECMP or multiple VLAN attachments on the same interconnect) with true geographic redundancy, failing to recognize that a single interconnect location is a single point of failure regardless of how many links or VLANs are used.

How to eliminate wrong answers

Option A is wrong because ECMP over multiple interconnect links requires all links to be active and does not provide automatic rerouting if a link fails; BGP would still need to withdraw routes, and ECMP alone does not handle failover. Option B is wrong because using a VPN as a backup introduces a different technology with lower bandwidth and higher latency, and it is not the recommended configuration for automatic rerouting over dedicated interconnect links. Option C is wrong because a single VLAN attachment cannot span multiple interconnect links; VLAN attachments are tied to a specific interconnect, so this configuration does not provide link-level redundancy.

Option E is wrong because multiple VLAN attachments on the same interconnect do not protect against the failure of that single interconnect; they only provide logical separation, not physical link redundancy.

Full explanation →
664
MCQeasy

A company is migrating a monolithic application to Google Cloud. They want to minimize changes to the application code while taking advantage of Cloud Run for serverless containers. Which approach should they take?

A.Deploy the application to App Engine standard environment with automatic scaling.
B.Lift and shift the application to Compute Engine instances behind a load balancer.
C.Refactor the application into microservices and deploy each as a separate Cloud Run service.
D.Use Cloud Run by packaging the existing application as a container and listening on a web server.
AnswerD

Minimal changes: containerize the existing app with a web server wrapper.

Why this answer

Cloud Run can run any containerized application that listens on HTTP requests on port 8080. By packaging the existing monolithic application as a container and adding a lightweight web server (e.g., Express, Flask, or Nginx), the company can deploy it to Cloud Run with minimal code changes, leveraging serverless scaling and pay-per-use pricing without refactoring into microservices.

Exam trap

Google Cloud often tests the misconception that serverless containers require microservices architecture, but Cloud Run can run any containerized application, including a monolithic one, as long as it listens for HTTP requests.

How to eliminate wrong answers

Option A is wrong because App Engine standard environment requires the application to conform to specific runtime constraints (e.g., Java Servlet, Python WSGI) and does not support arbitrary containers, so it would likely require significant code changes. Option B is wrong because lifting and shifting to Compute Engine instances behind a load balancer does not minimize changes but also fails to take advantage of serverless containers, requiring manual management of VMs, scaling, and patching. Option C is wrong because refactoring the monolithic application into microservices is a major architectural change that contradicts the requirement to minimize changes to the application code.

Full explanation →
665
MCQeasy

Your company runs an e-commerce platform on Google Cloud. The application is deployed on Compute Engine instances in a managed instance group (MIG) with autoscaling based on CPU utilization. The database uses Cloud SQL for MySQL with a single instance. During a recent flash sale, traffic spiked and the application became slow, resulting in a poor user experience. After analyzing the incident, you discovered that the MIG scaled up but the Cloud SQL instance reached its maximum connections limit, causing some requests to fail. You need to recommend a solution to improve the reliability of the application for future traffic spikes. What should you do?

A.Increase the maximum connections setting on the Cloud SQL instance and also increase the instance's tier to handle more concurrent connections.
B.Migrate the database to Cloud Spanner to provide unlimited scalability and automatic sharding.
C.Implement a connection pooling library in the application code to reuse database connections and reduce the number of new connections.
D.Deploy the Cloud SQL Proxy on each Compute Engine instance to manage database connections more efficiently, and configure a connection pool size that matches the maximum connections of the Cloud SQL instance.
AnswerD

Reduces the number of open connections and efficiently distributes them.

Why this answer

Deploying the Cloud SQL Proxy on each Compute Engine instance provides a secure, efficient way to manage database connections. The proxy can be configured with a connection pool size that matches the Cloud SQL instance's maximum connections, preventing the application from exhausting the database's connection limit. This approach also reduces the overhead of establishing new connections and improves connection reuse, directly addressing the bottleneck during traffic spikes.

Exam trap

The trap here is that candidates often assume increasing the database tier or max_connections is the simplest fix, but the PCA exam tests the understanding that connection pooling with a proxy is a more scalable and cost-effective reliability pattern, especially when combined with autoscaling compute instances.

How to eliminate wrong answers

Option A is wrong because simply increasing the maximum connections and tier on Cloud SQL does not address the root cause of connection exhaustion; it only delays the problem and increases cost without improving connection management efficiency. Option B is wrong because migrating to Cloud Spanner is an over-engineered solution for a MySQL-based application; it introduces significant complexity, cost, and potential application rewrites, and is not necessary for handling connection limits. Option C is wrong because implementing a connection pooling library in the application code alone does not prevent the application from opening too many connections if the pool size is not properly configured; it also does not provide the secure, managed connection handling that Cloud SQL Proxy offers, and the application may still exceed the database's connection limit without a centralized proxy.

Full explanation →
666
Multi-Selectmedium

A company is migrating 100 TB of on-premises file shares to Cloud Storage. The network bandwidth is limited to 100 Mbps and the migration must complete within 2 weeks. Which TWO services should they consider? (Choose 2)

Select 2 answers
A.Migrate for Compute Engine
B.Transfer Appliance
C.BigQuery Data Transfer Service
D.Storage Transfer Service
E.gsutil cp command with parallel processing
AnswersB, D

Offline transfer of large data sets when bandwidth is insufficient.

Why this answer

Transfer Appliance is ideal for large data volumes with limited bandwidth as it physically ships the data. Storage Transfer Service can handle the final synchronization from a temporary staging location. Migrate for Compute Engine is for VM migration, not file data.

Full explanation →
667
MCQmedium

A team is migrating a stateful application to GKE. The application requires persistent storage with ReadWriteMany (RWX) access across multiple pods. Which Kubernetes volume type should they use to meet this requirement on GKE?

A.Persistent Disk (Compute Engine persistent disks)
B.Cloud Storage FUSE
C.Filestore
D.ConfigMap
AnswerC

Filestore provides NFS shares that can be mounted as RWX volumes in GKE.

Why this answer

Filestore provides a managed NFS file share that supports RWX access. GKE can mount Filestore volumes via CSI driver. Persistent Disk supports only ReadWriteOnce (RWO).

Cloud Storage FUSE is not a standard Kubernetes volume and does not provide POSIX file system semantics. ConfigMap is for configuration data.

Full explanation →
668
Multi-Selectmedium

A company is migrating a legacy application that uses a file server to GCP. The application requires a shared file system that supports the NFS protocol and can be mounted by multiple Compute Engine instances. The team also needs to use Cloud NAT to allow the instances to download updates. Which TWO services should they use? (Choose 2)

Select 2 answers
A.Cloud NAT
B.Cloud VPN
C.Cloud Storage Fuse
D.Cloud Filestore
E.Private Google Access
AnswersA, D

Cloud NAT enables outbound internet access for private instances.

Why this answer

Filestore provides NFS file shares, and Cloud NAT allows instances without public IPs to access the internet for updates.

Full explanation →
669
MCQmedium

A company has a Cloud Run service that processes high-throughput requests. They want to reduce latency by keeping a baseline of warm instances always ready to handle traffic. Which Cloud Run configuration parameters should they adjust?

A.Set min-instances to 0 and max-instances to 100
B.Set max-instances to a high value and concurrency to 1
C.Set min-instances to 10 and CPU to always-on
D.Set max-instances to 0 (unlimited) and concurrency to 80
AnswerC

Min-instances ensures 10 warm instances are always ready, and CPU always-on reduces latency by keeping CPU allocated even when not serving requests.

Why this answer

Setting min-instances to a value greater than 0 ensures that Cloud Run keeps at least that many instances warm, ready to serve requests without cold start latency. Max-instances sets an upper limit. Concurrency controls how many requests each instance can handle.

CPU allocation can be set to always-on to reduce latency, but that is a separate setting.

Full explanation →
670
Multi-Selectmedium

A company is designing a disaster recovery plan for their Cloud SQL for PostgreSQL instance. They want to ensure that the database can be recovered in another region within minutes with minimal data loss. Which three actions should they take? (Choose three.)

Select 3 answers
A.Enable point-in-time recovery
B.Regularly test the failover procedure
C.Configure a failover replica in a different zone within the same region
D.Enable cross-region replication using Cloud SQL's replica feature
E.Enable automated backups with a retention period of 30 days
AnswersA, B, D

Allows recovery to a specific point in time, minimizing data loss.

Why this answer

Enabling point-in-time recovery (PITR) for Cloud SQL for PostgreSQL is correct because it allows you to restore the database to any specific point in time within the backup retention period, minimizing data loss to within seconds. PITR relies on write-ahead logs (WAL) archived continuously, which are essential for recovering to a precise timestamp in a disaster scenario. This directly supports the requirement of minimal data loss during cross-region recovery.

Exam trap

The trap here is that candidates often confuse zonal high availability (a failover replica in a different zone) with cross-region disaster recovery, mistakenly thinking a zonal replica satisfies the 'another region' requirement.

Full explanation →
671
MCQeasy

A team wants to automatically move data from Cloud Storage Standard class to Nearline class after 30 days, and to Archive class after 365 days. Which GCP feature should be used?

A.Cloud Storage Object Lifecycle Management (via gsutil lifecycle set)
B.Cloud Storage Transfer Service
C.Google Cloud Armor
D.Cloud Storage lifecycle management policies
AnswerD

Correct. Cloud Storage lifecycle management policies allow you to define rules for automatic transitions between storage classes based on object age, such as moving to Nearline after 30 days and to Archive after 365 days.

Why this answer

Cloud Storage lifecycle management policies allow you to define rules for automatic transitions between storage classes based on object age. Option A refers to the specific `gsutil lifecycle set` command used to apply these policies, but the feature itself is called lifecycle management policies (option D). Cloud Storage Transfer Service is for moving data between buckets or from external sources, not for lifecycle transitions.

Google Cloud Armor is a security service, unrelated to storage class transitions.

Full explanation →
672
MCQeasy

A company wants to store customer transaction logs for 7 years for compliance. The logs are accessed rarely but must be retrievable within 24 hours. Which storage option is most cost-effective?

A.Cloud Storage Archive class
B.Cloud Storage Nearline class
C.Cloud Storage Coldline class
D.Cloud Storage Standard class
AnswerA

Archive class offers lowest cost for long-term storage with retrieval within 24 hours.

Why this answer

Cloud Storage Archive class is the most cost-effective option for data that is accessed rarely and requires retrieval within 24 hours. Archive class offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of 12 hours, which comfortably meets the 24-hour requirement. This makes it ideal for long-term compliance retention of transaction logs that are infrequently accessed.

Exam trap

Google Cloud often tests the misconception that Coldline is the cheapest storage class, but Archive class actually has the lowest storage cost, with retrieval times up to 24 hours, making it the correct choice for rarely accessed data with flexible retrieval requirements.

How to eliminate wrong answers

Option B (Cloud Storage Nearline class) is wrong because it is designed for data accessed less than once a month, with a 30-day minimum storage duration, and its storage cost is higher than Archive, making it less cost-effective for 7-year retention. Option C (Cloud Storage Coldline class) is wrong because it targets data accessed less than once a quarter, with a 90-day minimum storage duration, and its storage cost is higher than Archive, so it is not the most cost-effective for rarely accessed logs. Option D (Cloud Storage Standard class) is wrong because it is optimized for frequently accessed data with no minimum storage duration and has the highest storage cost, making it prohibitively expensive for long-term archival of rarely accessed logs.

Full explanation →
673
MCQhard

A company is migrating a critical on-premises application to Google Cloud. The application consists of a frontend web server that handles user requests and a backend database server that stores session state and processed data. The application is stateful because session data is stored in memory on the backend server. The company wants to minimize downtime during migration and ensure that the application can scale horizontally in the future. The current on-premises architecture has the web server and database server on separate physical machines. The web server communicates with the database server via a private network. The company expects that after migration, the application will need to handle double the current traffic. They also need to ensure that the architecture is resilient to zone failures within a single region. They are considering using Compute Engine for both the web and database servers, but they are open to other Google Cloud services. They have a requirement that the database must be relational and support ACID transactions. The database currently uses Microsoft SQL Server, but they are willing to migrate to a different database engine if it reduces operational overhead and provides better scalability. The team has limited experience with Google Cloud and wants to minimize architectural changes. Which course of action should the company take?

A.Refactor the application to be stateless. Migrate the web server to App Engine and the database to Cloud SQL for PostgreSQL. Use Cloud Memorystore for session state.
B.Migrate the web server to Compute Engine and the database to Cloud Spanner. Use a global load balancer for the web server and Spanner for transactional consistency.
C.Migrate the web server to Compute Engine with a managed instance group and internal load balancer. Migrate the database to Cloud SQL for SQL Server with high availability across zones.
D.Lift and shift both web and database servers to Compute Engine. Use a managed instance group with autoscaling for the web server and a standalone VM for the database. Configure persistent disks for data.
AnswerC

Minimizes changes, provides HA, scaling, and managed database.

Why this answer

It preserves the existing stateful architecture by using Compute Engine with a managed instance group and internal load balancer for the web tier, and Cloud SQL for SQL Server with cross-zone high availability for the database. This minimizes architectural changes, supports horizontal scaling via the managed instance group, and provides zone-level resilience for the relational database with ACID transactions, meeting the requirement to handle double traffic while minimizing downtime.

Exam trap

The trap here is that candidates often choose a lift-and-shift option (D) thinking it minimizes changes, but they overlook the requirement for zone-level resilience, which a standalone VM cannot provide, or they incorrectly assume that Cloud Spanner (B) is the only option for ACID transactions at scale, ignoring that Cloud SQL for SQL Server meets the need with less complexity and no database engine migration.

How to eliminate wrong answers

Option A is wrong because refactoring the application to be stateless and using App Engine introduces significant architectural changes that the team wants to avoid, and Cloud Memorystore for session state adds complexity without addressing the requirement for a relational database with ACID transactions (Cloud SQL for PostgreSQL is relational, but the shift from SQL Server to PostgreSQL still requires migration effort). Option B is wrong because Cloud Spanner is a globally distributed, strongly consistent database that is overkill for a single-region workload and does not natively support SQL Server compatibility, requiring a full database migration; also, a global load balancer is unnecessary for a single-region deployment and adds latency. Option D is wrong because a standalone VM for the database lacks high availability across zones, failing the resilience requirement, and persistent disks alone do not provide the automated failover or managed backups that Cloud SQL offers, increasing operational overhead and downtime risk.

Full explanation →
674
MCQhard

A company is building a real-time data pipeline that ingests events from IoT devices, processes them with Apache Beam, and stores results in BigQuery for analytics. The pipeline must handle spikes in traffic and guarantee exactly-once processing. Which combination of services should they use?

A.Cloud Pub/Sub, Dataproc, and BigQuery.
B.Cloud IoT Core, Data Fusion, and Cloud Bigtable.
C.Cloud Storage, Cloud Functions, and BigQuery.
D.Cloud Pub/Sub, Dataflow, and BigQuery.
AnswerD

Cloud Pub/Sub handles event ingestion with scalability, Dataflow provides exactly-once processing for streaming, and BigQuery serves as the analytics data warehouse.

Why this answer

Cloud Pub/Sub provides scalable, asynchronous ingestion for IoT event spikes, Dataflow (which runs Apache Beam) offers exactly-once processing semantics via checkpointing and idempotent sinks, and BigQuery serves as the analytics destination. This combination meets all requirements: Pub/Sub decouples producers from consumers, Dataflow handles stateful processing with exactly-once guarantees, and BigQuery supports real-time streaming inserts.

Exam trap

Google Cloud often tests the misconception that any combination of Google Cloud services can achieve exactly-once processing, but the trap here is that only Dataflow (with its Beam runner) provides native exactly-once semantics for streaming pipelines, while Dataproc, Data Fusion, and Cloud Functions lack this guarantee.

How to eliminate wrong answers

Option A is wrong because Dataproc is a managed Hadoop/Spark service, not a native Apache Beam runner; while Spark can be used with Beam, Dataproc lacks Dataflow's built-in exactly-once semantics and auto-scaling optimizations for streaming pipelines. Option B is wrong because Cloud IoT Core is a device management service, not a messaging queue for event ingestion, and Data Fusion is a batch-oriented ETL tool (based on CDAP) that does not support real-time streaming or exactly-once processing; Cloud Bigtable is a NoSQL database, not an analytics warehouse like BigQuery. Option C is wrong because Cloud Storage is a batch-oriented object store with no native streaming ingestion (requiring polling or triggers), Cloud Functions has a 9-minute timeout and no exactly-once guarantee for streaming, and the combination lacks a managed stream processing engine like Dataflow.

Full explanation →
675
MCQeasy

A startup wants to deploy a containerized web application with zero server management and automatic scaling based on HTTP requests. They expect very low traffic initially but want to scale to thousands of requests per second without configuration changes. Which compute service is most appropriate?

A.Compute Engine with managed instance groups
B.Cloud Run
C.Google Kubernetes Engine (GKE) Standard
D.App Engine Standard
AnswerB

Serverless, auto-scales based on HTTP traffic, scales to zero, no infrastructure management.

Why this answer

Cloud Run is a fully managed serverless container platform that automatically scales to zero when not in use and scales up to handle traffic spikes, ideal for containerized apps with variable traffic.

Full explanation →
Page 8

Page 9 of 13

Page 10

All pages

12345678910111213

Practice PCA by domain

Target a specific domain to shore up weak areas.

Managing Implementation and Ensuring Solution and Operations ReliabilityManaging and Provisioning a Solution InfrastructureDesigning for Security and ComplianceAnalysing and Optimising Technical and Business ProcessesDesign and plan a cloud solution architectureManage and provision cloud infrastructureDesign for security and complianceAnalyze and optimize technical and business processesManage implementation of cloud architectureEnsure solution and operations reliability
See all domains with question counts →