How many Troubleshooting Scenario Questions questions are on this page?

This page has 6 Troubleshooting Scenario Questions scenario questions for the PCA exam, each with detailed explanations and wrong-answer analysis.

How should I approach PCA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Google Professional Cloud Architect questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Google Professional Cloud Architect practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PCA

exam code

Google Cloud

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymultiple choice

Full question →

A startup uses Cloud Functions with a Pub/Sub trigger to process incoming orders. They notice that the function sometimes fails to process messages, and those messages are lost. What is the most likely cause?

A
The subscription has an ackDeadlineSeconds of 600.
Why wrong: High ack deadline is not a problem.
B
The Cloud Function has a timeout of 540 seconds.
Why wrong: Long timeout is fine.
C
The Pub/Sub topic has a retention duration of 10 minutes.
Why wrong: Even with short retention, messages are not lost if acknowledged quickly.
D
The Cloud Function is configured with retry on failure set to false.
If retry is disabled, failed messages are dropped.

Full breakdown with real-world context →

Question 2hardmulti select

Full question →

A company has set up an external HTTP(S) load balancer with a backend service pointing to a managed instance group. Some instances are failing health checks. Which TWO actions should the company take to troubleshoot the issue?

A
Ensure the health check path specified in the backend service returns a 200 OK status.
If the health check path does not respond correctly, the instance will be considered unhealthy.
B
Verify that the firewall rules allow traffic from the load balancer health check IP ranges.
The load balancer's health check probes come from specific IP ranges that must be allowed.
C
Disable session affinity to allow better distribution of traffic.
Why wrong: Session affinity is unrelated to health check outcomes.
D
Change the health check interval from 5 seconds to 30 seconds.
Why wrong: Changing the interval only affects how often checks are performed, not the success of the check.
E
Increase the number of instances in the instance group to distribute the load.
Why wrong: Adding instances does not fix the health check failure; the root cause is not load but the health check response.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

A Cloud Function fails to connect to a Cloud SQL instance. The Cloud SQL instance has a private IP. What should the developer check?

A
Ensure the Cloud SQL Proxy is running and configured.
Why wrong: Cloud SQL Proxy is not required for private IP; VPC connector is needed.
B
Verify the Cloud Function's network settings.
Why wrong: Too vague.
C
Ensure either Cloud SQL Proxy is running or a VPC connector is configured, and IAM permissions are correct.
Both connectivity and authorization must be in place.
D
Configure a VPC connector for the Cloud Function.
Why wrong: While necessary, it's not the only thing to check; also need IAM.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

An engineer is troubleshooting a Cloud Build trigger that fails with the error 'PERMISSION_DENIED: Cloud Build service account does not have permission to access Artifact Registry'. The build needs to push a Docker image to Artifact Registry. What is the correct IAM role to assign to the Cloud Build service account?

A
roles/artifactregistry.writer
This role allows uploading artifacts to Artifact Registry, which includes pushing Docker images.
B
roles/artifactregistry.viewer
Why wrong: Viewer only allows reading, not writing.
C
roles/editor
Why wrong: Editor includes many permissions but is too broad and not required; specific roles are preferred.
D
roles/storage.objectAdmin
Why wrong: Artifact Registry is not Cloud Storage; this role does not grant Artifact Registry permissions.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full NAT/PAT explanation →

A startup is deploying a microservices application on Google Kubernetes Engine (GKE) with a regional cluster. They have services that need to communicate with each other and also with external APIs. The cluster uses VPC-native routing. They have enabled Cloud NAT to allow outbound internet access for nodes without external IPs. However, the development team reports that some pods cannot reach the external APIs, while others can. All pods are in the same namespace and are not using any network policies. The pods that fail have the annotation 'cloud.google.com/gke-nat-ips' set to a list of static IP addresses. The pods that work do not have this annotation. What is the most likely cause of the failure?

A
Network policies are blocking outbound traffic for those pods.
Why wrong: No network policies are in use.
B
The VPC-native routing is misconfigured for the pods with the annotation.
Why wrong: VPC-native routing works regardless of annotation.
C
The annotation is used to assign static IPs for inbound traffic only.
Why wrong: The annotation is for outbound traffic, but not with Cloud NAT.
D
The annotation 'cloud.google.com/gke-nat-ips' is not compatible with Cloud NAT for outbound traffic.
The annotation is used for specific use cases, not with Cloud NAT.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

A company runs a critical web application behind an external HTTPS load balancer. The backend consists of a managed instance group of Compute Engine instances. Users report intermittent 502 Bad Gateway errors. The load balancer logs show occasional health check failures for some instances. The instances have a custom health check endpoint that returns a 200 status code only if the application is fully healthy. The application logs do not show any errors, and CPU/memory usage on the instances is normal. What should be the first troubleshooting step to identify the root cause?

A
Change the health check to a TCP check on the application's port
Why wrong: Incorrect. A TCP check only checks if the port is open, not if the application is fully healthy. Changing to TCP would not reveal the root cause.
B
Increase the health check check interval and decrease the unhealthy threshold
Why wrong: Incorrect. Increasing the check interval and decreasing the unhealthy threshold does not address why the health check is failing; it may mask the issue or delay detection.
C
Increase the number of instances in the managed instance group
Why wrong: Incorrect. Adding instances does not fix the health check problem; it only distributes traffic if some instances are unhealthy, but the root cause remains.
D
Check the application's logs on the instances to see why the health check endpoint sometimes returns non-200
Correct. The health check endpoint is custom and returns a 200 only when fully healthy. Since instances appear normal, checking the application logs will reveal why the endpoint sometimes returns non-200.

Full breakdown with real-world context →

These PCA practice questions are part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style PCA questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related PCA topic practice pages

Managing Implementation and Ensuring Solution and Operations Reliability practice questions

Managing and Provisioning a Solution Infrastructure practice questions

Designing for Security and Compliance practice questions

Analysing and Optimising Technical and Business Processes practice questions

Design and plan a cloud solution architecture practice questions

Manage and provision cloud infrastructure practice questions

Design for security and compliance practice questions

Analyze and optimize technical and business processes practice questions

Manage implementation of cloud architecture practice questions

Ensure solution and operations reliability practice questions

PCA fundamentals practice questions

PCA scenario practice questions

Practice scenarios

A startup uses Cloud Functions with a Pub/Sub trigger to process incoming orders. They notice that the function sometimes fails to process messages, and those messages are lost. What is the most likely cause?

A company has set up an external HTTP(S) load balancer with a backend service pointing to a managed instance group. Some instances are failing health checks. Which TWO actions should the company take to troubleshoot the issue?

A Cloud Function fails to connect to a Cloud SQL instance. The Cloud SQL instance has a private IP. What should the developer check?