Google PCA Manage and provision cloud infrastructure Practice Question

Exhibit

resources:
- name: my-firewall
  type: compute.v1.firewall
  properties:
    network: https://www.googleapis.com/compute/v1/projects/my-project/global/networks/default
    allowed:
    - IPProtocol: tcp
      ports: ['80','443']
    sourceRanges: ['0.0.0.0/0']
- name: my-instance
  type: compute.v1.instance
  properties:
    zone: us-central1-a
    machineType: https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/machineTypes/n1-standard-1
    networkInterfaces:
    - network: https://www.googleapis.com/compute/v1/projects/my-project/global/networks/default
      accessConfigs:
      - name: External NAT
        type: ONE_TO_ONE_NAT

Refer to the exhibit. A Cloud Deployment Manager deployment fails with the error 'Resource 'my-firewall' already exists'. What is the most likely cause?

⚠ Common exam trap

Google Cloud often tests the distinction between resource name conflicts and other common errors (permissions, invalid references) to see if candidates can interpret the exact error message rather than guessing based on general troubleshooting.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A firewall rule with the name 'my-firewall' already exists in the project.

The error message 'Resource 'my-firewall' already exists' directly indicates that a firewall rule with the exact name 'my-firewall' is already present in the project. Cloud Deployment Manager creates resources by name, and if a resource with the same name exists (even if it was created outside the deployment), the deployment will fail unless the deployment is configured to adopt or manage that existing resource. The error is not about permissions, network references, or missing delete policies—it is a name collision.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user lacks IAM permissions to create firewall rules.
Why it's wrong here
An IAM permission gap produces an authorisation or 403 error, not a conflict stating the resource already exists; that message means the firewall rule is already present in the project or was created outside the deployment. It is tempting because permission failures are common in deployments, but the specific 'already exists' text points to a naming collision, not access rights.
✗
The network reference in the firewall rule is incorrect.
Why it's wrong here
An incorrect network reference would surface as a validation or reference-resolution error, not an 'already exists' conflict. It tempts because firewall rules do reference networks, and misconfiguration is a common deployment failure, but the specific error indicates a naming collision with a resource outside the deployment's management.
✓
A firewall rule with the name 'my-firewall' already exists in the project.
Why this is correct
A pre-existing firewall rule named 'my-firewall' in the project directly triggers the "already exists" conflict, because Cloud Deployment Manager refuses to create a resource whose name is already taken. The stem's constraint is a naming collision within the target project, so the deployment cannot proceed until that rule is renamed or removed.
✗
The deployment does not include a 'delete' policy for existing resources.
Why it's wrong here
Deployment Manager does not reconcile pre-existing resources unless the config declares them as existing via an 'action: acquire' or the resource is imported; a delete policy governs teardown, not creation conflicts. It tempts because deletion policies matter for cleanup scenarios, but the error stems from an unmanaged resource occupying the name.

Go deeper

Google PCA Manage and provision cloud infrastructure Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question