← PCA·Google Cloud

Question 470 of 509

Ensure solution and operations reliability →hardMultiple ChoiceObjective-mapped

Quick Answer

The answer is that the Vertex AI Workbench instance shows UNHEALTHY status because the container image gcr.io/my-project/my-image:latest either does not exist in the registry or the instance’s service account lacks the storage.objectViewer permission on the container registry bucket. This occurs because Workbench instances run as containers; if the specified image cannot be pulled during startup, the container creation fails, leaving the instance in an UNHEALTHY state. On the Google Professional Cloud Architect exam, this scenario tests your understanding of IAM permissions tied to container registries and how missing images or insufficient access directly impact managed services. A common trap is assuming the image exists without verifying the service account’s roles, or confusing storage.objectViewer with storage.objectAdmin. Remember the memory tip: “No viewer, no pull—UNHEALTHY is the result.”

Google PCA Ensure solution and operations reliability Practice Question

This PCA practice question tests your understanding of ensure solution and operations reliability. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Network Topology

You are investigating a Vertex AI Workbench instance (instance-2) that is showing UNHEALTHY status. Based on the exhibit, what is the most likely cause of the issue?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

Question 1hardmultiple choice

Full question →

Network Topology

A
The container image gcr.io/my-project/my-image:latest does not exist, or the service account used by the Workbench instance does not have storage.objectViewer access to the container registry.
Option C is correct because the error is an image pull failure, which is typically due to missing image or insufficient permissions.
B
The container registry endpoint is blocked by a firewall rule that does not allow egress to gcr.io.
Why wrong: Option B is plausible but the error message indicates a timeout, which could be due to network issues, but the most direct cause is the image pull failure due to permissions or image existence.
C
The instance's underlying Compute Engine resources are exhausted, causing the container creation to timeout.
Why wrong: Option A is wrong because the error specifically says 'image pull failed', not resource exhaustion.
D
The Workbench instance is using an outdated custom image that is not compatible with the latest runtime version.
Why wrong: Option D is incorrect because the error is about pulling a specific image, not about compatibility.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The container image gcr.io/my-project/my-image:latest does not exist, or the service account used by the Workbench instance does not have storage.objectViewer access to the container registry.

The UNHEALTHY status in Vertex AI Workbench typically occurs when the instance fails to start its container. The most likely cause is that the specified container image (gcr.io/my-project/my-image:latest) does not exist in the Container Registry, or the service account attached to the instance lacks the storage.objectViewer role on the registry bucket. Without this permission, the instance cannot pull the image, leading to a container creation failure and an UNHEALTHY state.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The container image gcr.io/my-project/my-image:latest does not exist, or the service account used by the Workbench instance does not have storage.objectViewer access to the container registry.
Why this is correct
Option C is correct because the error is an image pull failure, which is typically due to missing image or insufficient permissions.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The container registry endpoint is blocked by a firewall rule that does not allow egress to gcr.io.
Why it's wrong here
Option B is plausible but the error message indicates a timeout, which could be due to network issues, but the most direct cause is the image pull failure due to permissions or image existence.
✗
The instance's underlying Compute Engine resources are exhausted, causing the container creation to timeout.
Why it's wrong here
Option A is wrong because the error specifically says 'image pull failed', not resource exhaustion.
✗
The Workbench instance is using an outdated custom image that is not compatible with the latest runtime version.
Why it's wrong here
Option D is incorrect because the error is about pulling a specific image, not about compatibility.

Common exam traps

Common exam trap: answer the scenario, not the keyword

Google Cloud often tests the distinction between container image availability/permissions and network-level issues; the trap here is that candidates may assume a firewall or resource exhaustion is the cause, but the exhibit's focus on a specific container image points directly to a missing image or insufficient IAM permissions on the Container Registry.

Detailed technical explanation

How to think about this question

Vertex AI Workbench instances run as containers on Compute Engine VMs. When a custom container is specified, the instance pulls the image from the specified registry (e.g., gcr.io) using the instance's service account. The storage.objectViewer role is required on the Cloud Storage bucket backing the Container Registry (e.g., gcr.io/my-project) to list and read image blobs. If the image tag does not exist or the service account lacks this permission, the container runtime (Docker) fails to pull the image, and the instance health check reports UNHEALTHY. This is distinct from a firewall block, which would manifest as a network timeout error in the instance logs.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related PCA practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Design and plan a cloud solution architecture practice questions

Practise PCA questions linked to Design and plan a cloud solution architecture.

Manage and provision cloud infrastructure practice questions

Practise PCA questions linked to Manage and provision cloud infrastructure.

Design for security and compliance practice questions

Practise PCA questions linked to Design for security and compliance.

Analyze and optimize technical and business processes practice questions

Practise PCA questions linked to Analyze and optimize technical and business processes.

Manage implementation of cloud architecture practice questions

Practise PCA questions linked to Manage implementation of cloud architecture.

Ensure solution and operations reliability practice questions

Practise PCA questions linked to Ensure solution and operations reliability.

PCA fundamentals practice questions

Practise PCA questions linked to PCA fundamentals.

PCA scenario practice questions

Practise PCA questions linked to PCA scenario.

PCA troubleshooting practice questions

Practise PCA questions linked to PCA troubleshooting.

Practice this exam

Start a free PCA practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PCA practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PCA question test?

Ensure solution and operations reliability — This question tests Ensure solution and operations reliability — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: The container image gcr.io/my-project/my-image:latest does not exist, or the service account used by the Workbench instance does not have storage.objectViewer access to the container registry. — The UNHEALTHY status in Vertex AI Workbench typically occurs when the instance fails to start its container. The most likely cause is that the specified container image (gcr.io/my-project/my-image:latest) does not exist in the Container Registry, or the service account attached to the instance lacks the storage.objectViewer role on the registry bucket. Without this permission, the instance cannot pull the image, leading to a container creation failure and an UNHEALTHY state.

What should I do if I get this PCA question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.