Google PCA Design and plan a cloud solution architecture Practice Question
Your company has migrated its legacy web application from a single Compute Engine instance to a managed instance group (MIG) behind an HTTP(S) load balancer. The application was updated to a new version as part of the migration. After the migration, users report intermittent 502 Bad Gateway errors. The application logs show no errors, and the load balancer backend health checks are reported as healthy. On investigation, the developers discover that the new version requires a specific environment variable for authentication to a downstream service. This variable was set manually on the original instance but is missing from the MIG's instance template. The health check endpoint does not depend on this variable and always returns a 200 status even when the variable is absent. As a result, instances created from the template are considered healthy by the load balancer, but when they receive requests that require authentication, they fail and return a 502 error to the client. What is the most likely cause of the 502 errors?
⚠ Common exam trap
Watch out — candidates often assume healthy health checks guarantee the application is fully functional, but Google Cloud tests the nuance that health checks may not cover all dependencies, leading to 'false healthy' instances that fail on real requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The missing environment variable causes authentication failures on new instances.
The 502 errors occur because the new application version requires a specific environment variable for authentication to a downstream service. The health check endpoint does not depend on this variable, so instances are marked healthy even though they cannot authenticate real requests. When the load balancer routes traffic to these instances, the missing variable causes authentication failures, leading to 502 Bad Gateway errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The missing environment variable causes authentication failures on new instances.
Why this is correct
The instance template omits the downstream authentication variable, so every MIG instance starts without it. Because the health check endpoint never exercises that authentication path, the load balancer keeps routing traffic to instances that fail downstream calls, producing 502s. Supplying the variable in the template restores authentication.
- ✗
The health check is configured to check the old application path, which no longer exists.
Why it's wrong here
A stale health check path would mark instances unhealthy and remove them from rotation, not leave them healthy while returning 502s. It is tempting because the application version changed, but the stem states health checks report healthy, so the missing environment variable is the actual fault.
- ✗
The load balancer's backend timeout is too short for the application's response time.
Why it's wrong here
A short backend timeout produces 504 Gateway Timeout, not 502, and would affect all requests rather than only those needing authentication. Timeout tuning is the right fix when healthy backends respond too slowly for the configured limit, which the stem's instant authentication failures do not describe.
- ✗
The MIG is not scaling out fast enough to handle peak traffic.
Why it's wrong here
Scaling capacity cannot produce 502s when health checks pass and application logs are clean; the missing environment variable is the concrete fault. It is tempting because MIGs exist to scale, but insufficient capacity yields timeouts or 503s, not authentication-triggered 502s from healthy instances.
Go deeper
Related to this question
Learn chapter
Google Kubernetes Engine (GKE)
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
This PCA question is part of Courseiva's 807-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.