PCA Practice Questions

Question 1

A DevOps team is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the pods can securely access Google Cloud APIs (e.g., Cloud Storage) without managing service account keys. Which TWO steps should they take? (Choose two.)

Accepted Answer

Create a dedicated GCP service account with necessary roles and bind it to Kubernetes service accounts via Workload Identity.. Option A is correct because Workload Identity requires creating a dedicated Google Cloud service account with the necessary IAM roles and binding it to a Kubernetes service account (via an IAM policy binding with roles/iam.workloadIdentityUser), which lets the pod impersonate the GCP service account without keys. Option D is correct because Workload Identity must first be enabled on the GKE cluster (e.g., with gcloud container clusters update --workload-pool=PROJECT_ID.svc.id.goog), which sets up the cluster's identity pool and OIDC issuer so Kubernetes service accounts can federate to Google Cloud IAM. Option B is wrong because using the Compute Engine default service account on nodes grants broad, shared credentials to every pod and does not provide per-pod identity or keyless access. Option C is wrong because storing service account keys in Vault still involves managing long-lived keys, which is exactly what the team wants to avoid. Option E is wrong because mounting service account keys from a Kubernetes Secret also relies on static, manually managed credentials rather than keyless Workload Identity.

Answer

Use the Compute Engine default service account on each node.

Answer

Use a secrets management solution like HashiCorp Vault to store service account keys and retrieve them at runtime.

Answer

Store service account keys in a Kubernetes Secret and mount them into pods.

Question 2

A cloud architect is designing a CI/CD pipeline for a microservices application. Each service is deployed to Cloud Run. They want to use Cloud Build to automate building and deploying services only when changes occur in their respective directories. Which Cloud Build feature should they configure?

Accepted Answer

Build triggers with included files filter. Build triggers with an included files filter is correct because Cloud Build triggers support an 'includedFiles' field that uses glob patterns to fire a build only when files in specified paths change. This lets a monorepo deploy each microservice independently — for example, a trigger scoped to 'services/payments/**' runs only when payment-service code is modified. This is the native, supported mechanism for path-based CI/CD in Cloud Build.

Answer

Build steps in cloudbuild.yaml

Answer

Cloud Build's 'includedFiles' option in the build configuration

Answer

Artifact Registry triggers

Question 3

An enterprise is planning to migrate 200 on-premises VMs to Google Cloud. The CIO wants to ensure that the migration aligns with the business goal of reducing IT operational overhead by 30% while maintaining application performance. The team has already completed a technical assessment of the VMs. Which additional step should the cloud architect take to ensure the migration plan is aligned with the stated business goal?

Accepted Answer

Conduct a business impact analysis to map each application to business processes and identify criticality and dependencies.. The business goal is to reduce IT operational overhead by 30% while maintaining performance. A business impact analysis (BIA) identifies which applications are critical, their dependencies, and how they support business processes. This allows the architect to prioritize migrations, retire redundant systems, and consolidate workloads, directly contributing to overhead reduction. Technical assessments alone do not ensure business alignment.

Answer

Perform a detailed network latency test between on-premises and Google Cloud to determine the best interconnect option.

Answer

Develop a detailed total cost of ownership (TCO) model comparing on-premises and Google Cloud costs for all 200 VMs.

Answer

Create a proof of concept for migrating a single non-critical VM to validate the migration process.

Question 4

An organization wants to receive alerts when their Cloud SQL instance's CPU utilization exceeds 80% for 5 minutes. They want to send the alert to both email and a Pub/Sub topic for further processing. What should they do?

Accepted Answer

Create a Cloud Monitoring alerting policy with a metric threshold condition on CPU utilization and add both email and Pub/Sub notification channels. Cloud Monitoring alerting policies support metric threshold conditions (e.g., CPU utilization > 80% for 5 minutes) and allow multiple notification channels, including email and Pub/Sub. Creating an alerting policy with a metric threshold condition on the Cloud SQL CPU metric and adding both email and Pub/Sub channels satisfies the requirement directly. This is the native, event-driven approach in Google Cloud.

Answer

Configure a Cloud Scheduler job to check CPU utilization and publish to Pub/Sub

Answer

Create a log-based alert for CPU utilization using Logging and route to email and Pub/Sub

Answer

Use Cloud Functions to poll the Cloud Monitoring API every minute and send notifications

Question 5

A team wants to define an SLO for a service that requires 99.9% availability over a 30-day window. They need to measure the ratio of successful requests to total requests. Which SLI should they use?

Accepted Answer

Request success rate. An SLI is a measure of service performance. For availability, the standard SLI is the proportion of successful requests (e.g., HTTP 2xx) to total requests. Latency SLI measures response times. Error budget is derived from SLO. SRE is the practice.

Answer

SRE

Answer

Request latency

Answer

Error budget

Question 6

An engineer is designing a Bigtable schema for time-series data consisting of sensor readings. Each sensor emits a reading every second. The access pattern is to retrieve all readings for a specific sensor within a time range. Which row key design will provide the best performance?

Accepted Answer

Use row key: [sensor_id]#[reverse_timestamp]. Bigtable stores rows sorted by key. A row key structured as [sensor_id]#[reverse_timestamp] ensures that all data for a sensor is contiguous, and sorting by reverse timestamp allows recent data to be retrieved first. A single row key per sensor with column qualifiers would cause hotspots and limit scalability.

Answer

Use a single row per sensor with column qualifiers as timestamps

Answer

Use timestamp as the row key and sensor ID as column qualifier

Answer

Use a random prefix to distribute writes evenly

Question 7

A company wants to migrate a MySQL database running on-premises to Cloud SQL with minimal downtime. Which GCP service should they use?

Accepted Answer

Database Migration Service. Database Migration Service (DMS) is purpose-built for migrating MySQL, PostgreSQL, and SQL Server databases to Cloud SQL with minimal downtime. It handles continuous replication and cutover, which is exactly what's needed for a live database migration.

Answer

Migrate for Compute Engine

Answer

Storage Transfer Service

Answer

Transfer Appliance

Question 8

A company is migrating an on-premises PostgreSQL database (5 TB) to Cloud SQL. They need minimal downtime and automated schema conversion if needed. Which GCP service should they use?

Accepted Answer

Database Migration Service (DMS). Database Migration Service (DMS) is the correct choice because it is a fully managed GCP service designed to migrate databases to Cloud SQL with minimal downtime, supporting continuous replication and automated schema conversion via the Database Migration Service conversion workspace. It handles homogeneous migrations like PostgreSQL to Cloud SQL for PostgreSQL and can perform schema conversion when needed. Datastream is a change data capture service, not a full migration tool, and the other options are for different migration scenarios.

Answer

Datastream

Answer

Migrate for Compute Engine (formerly Velostrata)

Answer

Transfer Appliance

Question 9

Your company has a production Cloud SQL for PostgreSQL instance in us-central1 with automated backups enabled. You need to ensure that if the zone fails, the database automatically fails over to a standby in a different zone with minimal downtime. What should you do?

Accepted Answer

Configure the instance as a highly available (regional) instance.. Configuring the Cloud SQL instance as a highly available (regional) instance provisions a standby in a different zone within the same region and automatically fails over during a zone failure with minimal downtime. This is the native HA mechanism for Cloud SQL and directly satisfies the requirement.

Answer

Enable deletion protection on the instance.

Answer

Create a cross-region read replica and manually promote it during a failure.

Answer

Enable point-in-time recovery (PITR) and keep 30 days of transaction logs.

Question 10

A company is building a microservices architecture on Google Kubernetes Engine (GKE) and needs to ensure each microservice can only access specific Cloud Storage buckets. IAM permissions should be assigned at the pod level, not at the node level. What is the recommended approach?

Accepted Answer

Use Workload Identity to bind a Kubernetes service account to a GCP service account. Workload Identity is the recommended approach because it allows you to bind a Kubernetes service account (KSA) to a Google Cloud service account (GSA), enabling pods to authenticate to Google Cloud APIs without managing or storing service account keys. This satisfies the requirement for pod-level IAM permissions, as each pod can inherit the GSA's roles (e.g., roles/storage.objectViewer) for specific Cloud Storage buckets, while avoiding node-level assignment.

Answer

Store service account keys in Kubernetes secrets and mount them into each pod

Answer

Use a CSI driver to mount IAM credentials into pods

Answer

Assign a service account to each node pool and configure pod security policies

Question 11

A security engineer wants to configure Identity-Aware Proxy (IAP) for an HTTPS load-balanced application to enforce zero-trust access. Users will authenticate with their Google accounts. What is the minimum set of IAM roles needed for a user to access the application behind IAP?

Accepted Answer

roles/iap.httpsResourceAccessor. To access an application protected by IAP over HTTPS, a user must have the IAP-secured Web App User role (roles/iap.httpsResourceAccessor) on the resource. This role grants permission to access the resource through IAP. The other roles are not sufficient: roles/iam.serviceAccountUser is for managing service accounts, roles/iap.tunnelResourceAccessor is for TCP forwarding, and roles/compute.viewer only allows viewing Compute Engine resources, not accessing the application.

Answer

roles/iam.serviceAccountUser

Answer

roles/iap.tunnelResourceAccessor

Answer

roles/compute.viewer

Question 12

A company is designing a disaster recovery strategy for a Cloud SQL for PostgreSQL database with a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 2 hours. They are using the Regional Cloud SQL tier. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Configure cross-region replication by creating a cross-region replica.. Option C is correct because a cross-region replica protects against a regional outage, which the Regional tier alone cannot survive; promoting the cross-region replica gives a failover target that can meet the 2-hour RTO, and Cloud SQL's asynchronous replication keeps replica lag well within the 1-hour RPO. Option E is correct because automated backups combined with point-in-time recovery let you restore the instance to any moment within the retention window (transaction logs are retained, typically up to 7 days by default), which is essential for recovering from data corruption or accidental deletion within the 1-hour RPO. Option A is not correct because adding CPUs only improves performance and does not provide any recovery capability or reduce RPO/RTO. Option B is not correct because a read replica in the same region shares the same regional failure domain as the primary, so it cannot satisfy a disaster recovery strategy for a regional outage. Option D is not correct because deletion protection only prevents accidental instance deletion; it does not provide backup, replication, or recovery capability to meet the stated RPO and RTO.

Answer

Increase the number of CPUs on the primary instance.

Answer

Create a read replica in the same region.

Answer

Enable deletion protection on the database.

Question 13

A developer needs to grant a Compute Engine instance the ability to read from a Cloud Storage bucket. The instance does not have a service account attached. What should the developer do?

Accepted Answer

Create a service account and assign it the Storage Object Viewer role, then attach the service account to the instance.. A Compute Engine instance must have a service account attached to obtain Google Cloud credentials for API calls. The developer should create a service account, grant it the Storage Object Viewer role (or a custom role with storage.objects.get/list), and attach it to the instance. The instance can then use the metadata server to obtain short-lived tokens and read the bucket.

Answer

Add the instance's external IP to the bucket permissions.

Answer

Generate a JSON key for a user account and store it on the instance.

Answer

Create a firewall rule to allow access to Cloud Storage.

Question 14

An organization wants to manage Google Cloud infrastructure as code using declarative configuration files. They need a solution that supports Python and Jinja templating languages. Which service should they choose?

Accepted Answer

Cloud Deployment Manager. Cloud Deployment Manager is Google Cloud's native infrastructure-as-code service that uses YAML declarative configuration files and explicitly supports Python and Jinja2 templating for parameterization and reuse. It integrates directly with GCP IAM and APIs, making it the correct choice when the requirement calls out Python and Jinja support. Terraform uses HCL, not Python/Jinja, so it fails the stated requirement.

Answer

Cloud Composer

Answer

Terraform on Google Cloud

Answer

Cloud Build

Question 15

Match each GCP monitoring/logging tool to its purpose.

Accepted Answer

Cloud Monitoring: Provides visibility into performance, uptime, and health of applications and infrastructure.. Correct matches: Cloud Monitoring monitors performance, Cloud Logging manages logs, Error Reporting tracks errors. Confusion often arises between logging and monitoring roles.

Answer

Cloud Monitoring: Real-time log management and analysis for applications and services.

Answer

Cloud Logging: Counts, analyzes, and aggregates errors in cloud services.

Google Professional Cloud Architect PCA practice test

Three ways to study

Study PCA by domain

Study PCA by topic

Analysing and Optimising Technical and Business Processes practice questions

Managing Implementation and Ensuring Solution and Operations Reliability practice questions

Managing and Provisioning a Solution Infrastructure practice questions

Designing for Security and Compliance practice questions

Design for security and compliance practice questions

Design and plan a cloud solution architecture practice questions

Manage and provision cloud infrastructure practice questions

Analyze and optimize technical and business processes practice questions

Ensure solution and operations reliability practice questions

Manage implementation of cloud architecture practice questions

PCA fundamentals practice questions

PCA scenario practice questions

Top PCA questions

Google Professional Cloud Architect practice questions