How many Troubleshooting Scenario Questions questions are on this page?

This page has 8 Troubleshooting Scenario Questions scenario questions for the PCA exam, each with detailed explanations and wrong-answer analysis.

How should I approach PCA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Google Professional Cloud Architect questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Google Professional Cloud Architect practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PCA

exam code

Google Cloud

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymultiple choice

Full question →

Refer to the exhibit. A user (ops@example.com) is unable to create a new VPC network in the project. What should the administrator verify first?

Exhibit

{
  "bindings": [
    {
      "role": "roles/compute.viewer",
      "members": [
        "user:ops@example.com"
      ]
    }
  ]
}

A
The user has been granted roles/compute.admin.
Why it fails: roles/compute.admin does include compute.networks.create, so it would permit VPC creation; however, the question asks what to verify first, and the exhibit shows the user already holds this role, making it the wrong starting point for diagnosis.
B
The user has the project owner role.
Why it fails: roles/owner grants full project control including network creation, so it would work; but the exhibit indicates the user's existing bindings, and verifying an already-satisfied condition wastes effort. It is tempting as the broadest role, yet it is not the first thing to check.
C
The user has the roles/storage.admin role.
Why it fails: roles/storage.admin governs Cloud Storage buckets and objects, granting no permission over Compute Engine networks. It is tempting because storage roles appear in IAM listings, but creating a VPC requires compute.networks.create, which this role does not include.
D
The user has appropriate IAM roles such as roles/compute.networkAdmin.
Verify that ops@example.com holds roles/compute.networkAdmin or equivalent permissions on the project. VPC network creation requires compute.networks.create, granted through IAM roles rather than Microsoft Entra ID directory roles. Checking this binding first confirms whether the authorisation failure stems from missing project-level permissions.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

Refer to the exhibit. An application running on a GCE instance (ID: 1234567890) is unable to connect to a database at 10.0.0.1:5432. The logs show repeated 'Connection refused' errors. What is the most likely cause?

Network Topology

A
The firewall rule allowing traffic on port 5432 is missing or misconfigured.
Why it fails: A missing or misconfigured firewall rule on port 5432 blocks the connection, and the correct answer here is the database service not listening on that port. Firewall rules are the right focus when traffic is silently dropped rather than actively refused.
B
The instance is using an outdated SSL certificate.
Why it fails: An outdated certificate would cause TLS handshake or validation failures, not the immediate TCP refusal logged here. Certificate renewal is the right fix when clients report expired or untrusted certificate errors, but a refused connection means nothing is listening on that port.
C
The database service is not running or is not listening on port 5432.
A refused TCP connection means the host is reachable but nothing accepts traffic on port 5432, indicating the database process is stopped or bound elsewhere. Firewall or routing problems would typically produce timeouts, not refusals.
D
The VPC network has no route to the database subnet.
Why it fails: A missing route produces a no-route-to-host or timeout error, not an immediate connection refusal. Route configuration is the correct focus when packets cannot reach the destination subnet at all, whereas refusal means the host was reached but the port rejected the connection.

Full breakdown with real-world context →

Question 3hardmultiple choice

Review the full subnetting walkthrough →

A company runs multiple microservices on Cloud Run. Each service uses a Serverless VPC Access connector to connect to a shared Cloud Memorystore for Redis instance (standard tier) in a VPC network. The Redis instance is configured with a firewall rule that allows TCP connections on port 6379 from the VPC connector's subnet (10.8.0.0/28). After a recent code update, the order-service fails to connect to Redis, while the user-service continues to work. The error logs in order-service show 'connection refused'. The engineer verifies that both services use the same VPC connector, the same Redis instance IP, and the same service account. The VPC connector's metrics show no errors. What is the most likely cause?

A
The order-service is deployed in a different region than the Redis instance.
Why it fails: A cross-region deployment would not produce "connection refused" on port 6379, since the connector's subnet firewall rule and routing remain valid regardless of the service's region. It is tempting because Serverless VPC Access connectors are regional resources, so region mismatch is a genuine failure mode when a service cannot reach a connector at all.
B
The order-service code now attempts to connect to Redis on port 6380.
Redis standard tier listens on TCP 6379, so a firewall rule permitting only that port would refuse a connection on 6380. The unchanged user-service confirms the connector and instance are healthy, isolating the port change in order-service code.
C
The VPC connector is out of memory.
Why it fails: A memory-exhausted connector drops or queues packets, producing timeouts rather than the immediate TCP RST that "connection refused" indicates, and its metrics would show failures — yet the stem reports none, and user-service shares the same connector. Connector memory sizing matters when scaling many concurrent connections across services, not for a single service's refused connection.
D
The Redis instance has reached its maximum number of connections.
Why it fails: A connection-limit exhaustion would produce errors across every client sharing the instance, yet user-service still connects through the same connector and IP. Redis maxclients rejections also surface as "max number of clients reached", not "connection refused". This cause fits scenarios where many clients saturate a fixed connection ceiling, not one failing service.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

A company has a Shared VPC with a service project hosting GKE clusters. The GKE nodes need to access Cloud SQL instances in the host project. The team wants to avoid public IP and use Private Service Access. They have configured a VPC peering between the host VPC and the service producer VPC for Cloud SQL. However, the GKE pods cannot reach the Cloud SQL instance. What is the most likely cause?

A
The Cloud SQL instance is not configured with a private IP
Why it fails: Incorrect. The Cloud SQL instance is configured with a private IP via Private Service Access (VPC peering), so this is not the cause of the connectivity issue.
B
The service project needs a Private Service Connect endpoint to access the Cloud SQL instance
Why it fails: Incorrect. Private Service Connect is not required because VPC peering (Private Service Access) already provides network connectivity between the service project and Cloud SQL. The issue is lack of authorization.
C
The service project is not authorized in the Cloud SQL instance
Correct. After setting up VPC peering with Private Service Access, you must also authorize the service project's VPC network in the Cloud SQL instance's private network settings. Without this authorization, the Cloud SQL instance rejects connections from the GKE pods.
D
The firewall rules in the host VPC block egress from the service project
Why it fails: Incorrect. VPC peering allows traffic between the peered networks by default; firewall rules in the host VPC do not block egress from the service project over the peering connection. The problem is authorization, not firewall rules.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A Cloud Function fails to connect to a Cloud SQL instance. The Cloud SQL instance has a private IP. What should the developer check?

A
Ensure the Cloud SQL Proxy is running and configured.
Why it fails: Cloud SQL Proxy is not required for private IP; VPC connector is needed.
B
Verify the Cloud Function's network settings.
Why it fails: Too vague.
C
Ensure either Cloud SQL Proxy is running or a VPC connector is configured, and IAM permissions are correct.
Both connectivity and authorization must be in place.
D
Configure a VPC connector for the Cloud Function.
Why it fails: While necessary, it's not the only thing to check; also need IAM.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Exhibit

Refer to the exhibit.

gcloud compute instances create my-instance \
    --zone=us-central1-a \
    --machine-type=n1-standard-4 \
    --image-family=ubuntu-2004-lts \
    --image-project=ubuntu-os-cloud \
    --boot-disk-size=50GB \
    --boot-disk-type=pd-ssd \
    --scopes=cloud-platform \
    --service-account=my-sa@project.iam.gserviceaccount.com \
    --tags=http-server,https-server

A
The service account is not attached to the instance
Why it fails: If no service account is attached, the instance uses the default Compute Engine service account, which may lack Storage Object Viewer on the bucket, causing reads to fail. Attaching the intended service account and granting it bucket IAM roles resolves this. This option is correct whenever the instance genuinely lacks an attached service account.
B
The tags http-server and https-server block outbound traffic
Why it fails: The http-server and https-server tags are network tags that enable inbound firewall rules for web traffic; they do not restrict outbound traffic to Cloud Storage. Egress to Google APIs is governed by IAM permissions and access scopes. These tags would be relevant when configuring inbound HTTP or HTTPS access to the web server itself.
C
The boot disk type is SSD, which is not compatible with Cloud Storage
Why it fails: Boot disk type is unrelated to Cloud Storage access; SSD and standard persistent disks both support the same network and IAM permissions. The failure stems from the instance's identity or scopes, not its disk. SSD would be the correct choice when the requirement is higher disk throughput for the boot volume, not storage bucket access.
D
The service account lacks IAM permissions to read from Cloud Storage
The instance's attached service account has no IAM role granting storage.objects.get on the bucket, so Cloud Storage returns 403 regardless of network or scope settings. Access scopes only gate the API surface; IAM bindings authorise the actual read, making missing permissions the direct cause of the failure.

Full breakdown with real-world context →

Question 7easymulti select

Full question →

An engineer needs to troubleshoot a production issue on a Compute Engine instance. They suspect the instance is running out of memory. Which THREE actions should they take to diagnose the problem? (Choose THREE.)

A
SSH into the instance and run 'free -m' to check memory usage
Running 'free -m' over SSH reads the instance's actual memory counters, showing total, used, free and swap usage plus buffer/cache. This directly confirms or rules out memory exhaustion on the guest OS, which external metrics alone cannot attribute to specific processes.
B
Check Cloud Logging for OOM (out-of-memory) kernel messages
The Linux kernel logs OOM killer messages to the system log when it terminates processes to reclaim memory. Searching Cloud Logging for these entries confirms memory exhaustion occurred and identifies which process was killed, giving definitive evidence beyond utilisation graphs.
C
Increase the instance's memory by changing the machine type
Why it fails: Changing the machine type resizes the instance, which is a remediation step, not diagnosis; it also requires a stop/start and destroys the evidence before metrics are gathered. It is tempting because vertical scaling is the eventual fix once memory exhaustion is confirmed, making it correct after diagnosis rather than during troubleshooting.
D
Create a snapshot of the boot disk
Why it fails: A boot disk snapshot captures persistent disk contents, not live RAM, so it reveals nothing about memory exhaustion. It is tempting because snapshots are the standard tool for recovering or cloning a failed instance's disk, which would be the right action if the suspected fault were disk corruption or data loss rather than memory pressure.
E
View the instance's memory utilization metric in Cloud Monitoring
The Cloud Monitoring memory utilisation metric, collected by the Ops Agent, shows historical and current memory consumption for the instance. Trending this metric reveals whether memory is climbing toward exhaustion, correlating the suspected condition with the production incident's timeframe.

Full breakdown with real-world context →

Question 8hardmulti select

Full question →

A company has set up an external HTTP(S) load balancer with a backend service pointing to a managed instance group. Some instances are failing health checks. Which TWO actions should the company take to troubleshoot the issue?

A
Ensure the health check path specified in the backend service returns a 200 OK status.
A failing health check often stems from the probe path returning a non-200 response, so verifying it returns 200 OK directly addresses the backend service's health check configuration. Google Cloud load balancer health checks mark instances unhealthy on any other status code, removing them from rotation, so confirming the path's response satisfies the stem's troubleshooting requirement.
B
Verify that the firewall rules allow traffic from the load balancer health check IP ranges.
Health checks originate from Google's fixed probe ranges (130.211.0.0/22 and 35.191.0.0/16), not from the load balancer's frontend address. If ingress firewall rules omit these source ranges, probes are dropped and instances report unhealthy despite serving traffic correctly. Verifying these rules directly addresses the stem's failing health checks.
C
Disable session affinity to allow better distribution of traffic.
Why it fails: Session affinity governs how the load balancer routes subsequent requests from a client, not whether health check probes succeed. Disabling it changes nothing about probe responses. Affinity is configured when sticky client sessions are required for stateful applications, which is unrelated to diagnosing failing health checks.
D
Change the health check interval from 5 seconds to 30 seconds.
Why it fails: Lengthening the health check interval only delays failure detection; it does not diagnose why instances fail probes. It is tempting to reduce false positives from transient blips, and it would be correct when probes time out under brief load spikes rather than a persistent configuration fault.
E
Increase the number of instances in the instance group to distribute the load.
Why it fails: Adding instances does not repair the health check configuration or application fault causing existing instances to fail; new instances would fail identically. Scaling out suits genuine capacity shortfalls under load, not troubleshooting probe failures, which require inspecting health check paths, firewall rules and backend logs.

Full breakdown with real-world context →

These PCA practice questions are part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style PCA questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related PCA topic practice pages

Analysing and Optimising Technical and Business Processes practice questions

Managing Implementation and Ensuring Solution and Operations Reliability practice questions

Managing and Provisioning a Solution Infrastructure practice questions

Designing for Security and Compliance practice questions

Design for security and compliance practice questions

Design and plan a cloud solution architecture practice questions

Manage and provision cloud infrastructure practice questions

Analyze and optimize technical and business processes practice questions

Ensure solution and operations reliability practice questions

Manage implementation of cloud architecture practice questions

PCA fundamentals practice questions

PCA scenario practice questions

Practice scenarios

Refer to the exhibit. A user (ops@example.com) is unable to create a new VPC network in the project. What should the administrator verify first?

Exhibit

Refer to the exhibit. An application running on a GCE instance (ID: 1234567890) is unable to connect to a database at 10.0.0.1:5432. The logs show repeated 'Connection refused' errors. What is the most likely cause?

A Cloud Function fails to connect to a Cloud SQL instance. The Cloud SQL instance has a private IP. What should the developer check?

The exhibit shows a command to create a Compute Engine instance. The instance is intended to run a web server that needs to access Cloud Storage buckets using its service account. However, the web server fails to read from a storage bucket. What is the most likely cause?

Exhibit

An engineer needs to troubleshoot a production issue on a Compute Engine instance. They suspect the instance is running out of memory. Which THREE actions should they take to diagnose the problem? (Choose THREE.)

A company has set up an external HTTP(S) load balancer with a backend service pointing to a managed instance group. Some instances are failing health checks. Which TWO actions should the company take to troubleshoot the issue?