Hard — PCA Practice Quiz

Question 1

A development team writes an automation script that repeatedly runs 'gcloud projects add-iam-policy-binding' to grant a service account the roles/storage.objectViewer role across dozens of projects. During a code review, an operations engineer warns that concurrent executions of this command against the same project could silently overwrite each other's changes and lose bindings. As the cloud architect, what should you advise the team to do to make these IAM updates safe under concurrency?

Accepted Answer

Advise the team to use 'gcloud projects set-iam-policy' after fetching the policy with an etag, so updates are rejected if the policy changed since it was read.

Answer

Advise the team to keep using 'add-iam-policy-binding' but add a '--quiet' flag so the command skips confirmation prompts and completes faster.

Answer

Advise the team to wrap the calls in a retry loop with exponential backoff, which fully eliminates the possibility of lost updates.

Answer

Advise the team to grant the role at the organization level once so no per-project binding scripts are ever needed.

Question 2

A logistics company is deploying a Cloud Bigtable cluster to store real-time vehicle tracking events. Each record includes a vehicle ID, a timestamp, and GPS coordinates. During load testing with millions of concurrent writes, engineers observe that most traffic is hitting a single node while others remain nearly idle, causing high write latency. The current row key is a monotonically increasing timestamp prefix. What is the most appropriate change to resolve the throughput bottleneck?

Accepted Answer

Redesign the row key to lead with a hashed or field-promoted value such as vehicle ID, followed by a reverse timestamp, to distribute writes evenly across tablets.

Answer

Increase the number of nodes in the Bigtable cluster to spread the write load across more compute resources.

Answer

Enable Bigtable replication to a second cluster so that write traffic is split between the two clusters.

Answer

Switch the table to use column families with garbage collection policies to reduce the size of each row.

Question 3

A financial services company runs a production trading platform in Google Cloud and requires a private, high-throughput connection to its on-premises data center. The network team demands a connectivity architecture that qualifies for the 99.99% availability SLA from Google. They plan to use Dedicated Interconnect. Which configuration must the architect implement to meet the 99.99% SLA requirement?

Accepted Answer

Provision at least four Dedicated Interconnect connections across two metropolitan areas, with two connections in separate edge availability domains within each metro.

Answer

Provision four Dedicated Interconnect connections in a single metropolitan area (metro) attached to a single Cloud Router.

Answer

Provision two Dedicated Interconnect connections in a single edge availability domain, each terminating on separate Cloud Routers.

Answer

Provision a single 100 Gbps Dedicated Interconnect connection with a Partner Interconnect connection as a backup path.

Question 4

Your SRE team manages a customer-facing payments API running on GKE. Leadership has approved a 99.9% availability SLO measured over a rolling 28-day window. The team wants an automated, low-noise way to be alerted while there is still enough error budget remaining to react, rather than only after the SLO is already breached. Which approach in Google Cloud Observability best meets this requirement?

Accepted Answer

Configure a Cloud Monitoring SLO with multi-window, multi-burn-rate alerting policies that fire on fast and slow error-budget consumption.

Answer

Create a single threshold alert that fires whenever the 28-day availability metric drops below 99.9%.

Answer

Set up an uptime check that pings the API every minute and pages the on-call engineer on any single failed probe.

Answer

Build a Cloud Monitoring dashboard showing request success rate and have engineers visually review it during business hours.

Question 5

You operate a customer-facing payments API on Cloud Run and have defined a 99.9% availability SLO over a rolling 30-day window. Your on-call team complains that they receive too many pages for tiny, transient dips that self-resolve, yet they occasionally miss slow-burning degradations until customers report problems. You want an alerting strategy that pages urgently for fast burns and creates lower-priority tickets for slow burns while minimizing false pages. Which approach should you configure in Cloud Monitoring?

Accepted Answer

Configure multiwindow, multi-burn-rate alerting policies on the SLO error budget — a fast-burn policy over short windows for urgent paging and a slow-burn policy over longer windows for ticketing.

Answer

Create a single threshold alert that fires whenever the request error rate exceeds 0.1% for one minute.

Answer

Set an uptime check every 60 seconds against the API and page the on-call team whenever a single check fails.

Answer

Alert only when the remaining 30-day error budget drops below 10%, paging the on-call team immediately when that occurs.

Question 6

A payments team is defining an SLO for their checkout API using Cloud Monitoring service monitoring. Their stated reliability goal is that 99.5% of requests should complete in under 400 ms, measured over a rolling 28-day period. The team wants the SLO configuration to accurately reflect this goal so error budget calculations and burn-rate alerts behave as expected. Which SLO configuration correctly represents this objective?

Accepted Answer

A request-based, latency-threshold SLI with a 400 ms threshold, a 99.5% goal, and a rolling 28-day compliance period.

Answer

A windows-based availability SLI with a 99.5% goal and a calendar-month compliance period, using uptime checks as the signal.

Answer

A request-based availability SLI counting HTTP 2xx responses with a 99.5% goal and a rolling 7-day compliance period.

Answer

A windows-based latency SLI with a 400 ms threshold, a 99.5% goal, and a calendar 28-day compliance period.

Question 7

A financial analytics company runs hundreds of Compute Engine instances across multiple subnets in a Shared VPC. These instances have no external IP addresses but must make frequent outbound HTTPS calls to a third-party market-data provider's public API. During peak trading hours, engineers observe connection failures and log entries indicating dropped outbound connections, while off-peak traffic works fine. Investigation shows the instances are hitting a limit on simultaneous outbound connections to the same destination endpoint. What is the most appropriate action to resolve this?

Accepted Answer

Increase the minimum number of ports per VM (or enable dynamic port allocation) on the Cloud NAT gateway and add more external NAT IP addresses.

Answer

Assign external IP addresses to each instance so outbound connections bypass the NAT gateway entirely.

Answer

Replace Cloud NAT with a VPC peering connection to the third-party provider's network.

Answer

Enable Private Google Access on the subnets so the instances can reach the third-party API privately.

Question 8

A retail company runs a microservices platform on GKE and has enabled Cloud Trace to diagnose latency. During a major sales event, engineers report that traces for many slow requests are missing, making it hard to find the bottleneck. The default automatic sampling is capturing only a small fraction of requests under high load. The team wants to increase the likelihood of capturing traces for the slowest requests without a massive increase in ingestion cost or code changes across all services. What should the architect recommend?

Accepted Answer

Configure custom sampling in the instrumentation (e.g., OpenTelemetry) to increase the sampling rate and apply tail-based sampling that prioritizes high-latency and error spans.

Answer

Disable Cloud Trace and rely on Cloud Logging structured logs with latency fields to reconstruct request timing manually.

Answer

Increase the number of GKE nodes so that each service has spare CPU to emit 100% of traces during the event.

Answer

Export all traces to BigQuery and query them there to find slow requests after the event ends.

Question 9

A financial services company stores customer records in Cloud Storage buckets encrypted with customer-managed encryption keys (CMEK) in Cloud KMS. To comply with a data protection regulation, when a customer requests deletion of their data, the company must guarantee that all copies—including any that may persist in backups or replicated storage—become permanently unrecoverable, and must be able to prove the data is cryptographically inaccessible. What is the most effective approach to meet this requirement?

Accepted Answer

Store each customer's data under a dedicated CMEK key and destroy that key version in Cloud KMS when the customer requests deletion (crypto-shredding).

Answer

Delete the customer's objects from the bucket and rely on Cloud Storage soft delete and object versioning to purge older copies after the retention window.

Answer

Rotate the single shared CMEK key used for all customers so the old key version is no longer primary, then delete the customer's objects.

Answer

Disable the CMEK key temporarily and set an object lifecycle rule to delete the customer's objects after 30 days.

Question 10

A multinational bank must store customer records in Cloud Storage and BigQuery. A new regulatory requirement mandates that the bank retain sole control of the encryption keys outside of Google Cloud, so that Google can never access key material even under a lawful access request. The security team also needs the ability to instantly and permanently revoke Google's ability to decrypt the data. Which encryption approach satisfies these requirements?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with keys held in an approved external key management partner controlled by the bank.

Answer

Use Google-managed default encryption and rely on Google's data residency guarantees for the region.

Answer

Use customer-managed encryption keys (CMEK) with keys stored in Cloud KMS in the same region as the data.

Answer

Use customer-supplied encryption keys (CSEK) uploaded to Cloud KMS and rotated automatically by Google.

Question 11

A financial services company stores highly sensitive customer records in Cloud Storage buckets encrypted with Cloud KMS customer-managed encryption keys (CMEK). Regulators require that any decryption of this data by cloud provider personnel or automated processes be explicitly justified and, in certain cases, blocked unless the organization approves the reason. The security team wants a mechanism where each request to use the key includes a reason code, and the organization can define policies that automatically deny key access for unapproved justification categories. Which capability should the architect implement?

Accepted Answer

Enable Key Access Justifications (KAJ) on the CMEK keys and configure a justification policy that denies unapproved reason codes.

Answer

Turn on Access Transparency logs and manually review each key-usage entry after the fact.

Answer

Rotate the CMEK keys more frequently and restrict IAM roles on the key ring to a small group.

Answer

Move the keys to Cloud HSM and enable audit logging on the key ring.

Question 12

A financial services company runs a fleet of Compute Engine VMs supporting a customer-facing trading platform. Analysis of the last 18 months shows a stable baseline of 40 n2-standard-8 instances running 24/7, with occasional bursts to 65 instances during market volatility. The finance team wants to reduce Compute Engine spend without sacrificing the ability to scale during bursts, and they want the commitment strategy to survive changes in machine family if engineering later re-architects onto a different VM type. Which approach best optimizes cost while preserving flexibility?

Accepted Answer

Purchase spend-based (flexible) committed use discounts covering the baseline compute spend, and let burst capacity run on on-demand pricing.

Answer

Purchase resource-based committed use discounts (CUDs) for 40 n2-standard-8 instances for 3 years, and let burst capacity above the baseline run on on-demand pricing.

Answer

Run the entire fleet, including the baseline, on Spot VMs to maximize discount rates.

Answer

Purchase resource-based CUDs sized for the peak of 65 n2-standard-8 instances for 1 year to guarantee coverage of all usage.

Question 13

A financial services company runs its core banking application on Compute Engine in the us-central1 region. Regulators require the ability to recover from a full regional outage with a Recovery Time Objective (RTO) of 30 minutes and a Recovery Point Objective (RPO) of 5 minutes. The company wants to minimize ongoing costs while still meeting these targets. Which disaster recovery strategy should the architect design?

Accepted Answer

Implement a warm standby in us-east1 with a scaled-down set of instances kept running, combined with asynchronous database replication that meets the 5-minute RPO, scaling up on failover

Answer

Deploy a full active-active configuration with equal capacity in us-central1 and us-east1, load-balanced by a global HTTPS load balancer

Answer

Take daily snapshots of persistent disks and store them in a multi-region bucket, restoring instances in us-east1 only when an outage occurs

Answer

Use a cold standby with pre-built instance templates in us-east1 and rely on Cloud SQL automated backups restored on demand during a disaster

Question 14

A financial services company runs a nightly batch job that consolidates transactions and must complete within a strict 4-hour window to meet regulatory reporting deadlines. The job is fault-tolerant and can checkpoint and resume from partial results. Leadership wants to minimize compute cost while guaranteeing the deadline is never missed. Which compute strategy on Google Cloud best meets these business and technical requirements?

Accepted Answer

Provision a managed instance group that mixes a baseline of standard on-demand VMs with additional Spot VMs, and configure autoscaling so the on-demand baseline can complete the job within the window if Spot capacity is reclaimed.

Answer

Run the job entirely on Spot VMs to achieve the lowest possible cost, relying on the checkpointing to recover from preemptions.

Answer

Run the job on a fixed fleet of on-demand VMs sized for peak load and purchase no committed use discounts, since the job runs only once per night.

Answer

Deploy the job on a single large on-demand VM with a 3-year committed use discount to reduce the hourly rate as much as possible.

Question 15

A European retail company stores customer profiles and purchase history in Cloud Storage and BigQuery. Under GDPR, customers can submit a 'right to erasure' request requiring the company to delete all their personal data across systems within a defined timeframe. The architect needs a design that guarantees a specific individual's data can be located and permanently removed on demand, while keeping the deletion process auditable. Which approach best supports this compliance requirement?

Accepted Answer

Tag or index all records with a consistent customer identifier, maintain a data map of every location containing personal data, and implement automated deletion jobs that remove or overwrite those records, logging each action to a tamper-evident audit sink.

Answer

Rely on Cloud Storage Object Lifecycle Management to automatically delete all objects after a fixed retention period so personal data is eventually purged.

Answer

Enable CMEK on all buckets and datasets so that data can be rendered inaccessible for individual customers by rotating the encryption key.

Answer

Move all personal data to a single EU region using Organization Policy resource location constraints, ensuring GDPR compliance through data residency alone.

Question 16

A healthcare SaaS company is designing a new multi-tenant platform on Google Cloud. Each tenant is a separate hospital that must have strong data isolation to satisfy contractual and regulatory obligations, but the company also wants to minimize operational overhead and control costs as it onboards hundreds of tenants over time. Tenants share the same application code but must never be able to access another tenant's data, and the company must be able to demonstrate isolation boundaries to auditors. Which design approach best meets these business requirements?

Accepted Answer

Use a shared application layer but isolate each tenant's data into its own project or resource boundary with IAM policies, while standardizing deployment through infrastructure-as-code templates.

Answer

Deploy a single shared application layer and store all tenant data in one shared database, using an application-enforced tenant_id column to filter every query.

Answer

Provision an entirely separate Google Cloud project, VPC, and dedicated infrastructure for every tenant to guarantee complete isolation.

Answer

Store all tenants in one database but encrypt each tenant's rows with a distinct customer-managed key to enforce isolation.

Question 17

A retail company runs applications on Compute Engine instances in a VPC connected to their on-premises data center via Cloud VPN. The Compute Engine workloads must resolve private hostnames for internal on-premises services (e.g., ldap.corp.internal), and on-premises servers must resolve the private DNS names of Google Cloud resources managed in a Cloud DNS private zone. What should the architect configure to enable bidirectional private DNS resolution?

Accepted Answer

Configure Cloud DNS with a private forwarding zone pointing to the on-premises DNS servers, and set up an inbound DNS server policy so on-premises servers can query Cloud DNS via forwarding to Google Cloud.

Answer

Enable public Cloud DNS zones for both the on-premises domain and the Google Cloud domain, and allow public internet resolution.

Answer

Add host entries for every on-premises and Google Cloud resource to the /etc/hosts file on each Compute Engine instance and each on-premises server.

Answer

Deploy a self-managed BIND DNS server on a Compute Engine instance and repoint all resolution to it without using Cloud DNS features.

Question 18

A financial services company grants broad Editor roles to several project owners for agility. The security team must ensure that, regardless of any IAM allow bindings, no principal outside the company's security group can ever delete Cloud KMS keys or key versions across the entire organization — even if a project owner mistakenly grants such permissions. Which approach best enforces this organization-wide restriction?

Accepted Answer

Create an IAM deny policy at the organization node that denies the cloudkms.cryptoKeyVersions.destroy and related permissions to all principals except members of the security group

Answer

Remove all Editor role bindings and replace them with custom roles that exclude KMS delete permissions in every project

Answer

Configure an organization policy constraint to restrict KMS key deletion across all projects

Answer

Enable VPC Service Controls around all projects containing Cloud KMS keys to block delete operations

Question 19

A retail company is deploying a new payment processing application on Google Cloud that must be compliant with PCI DSS. The cardholder data environment (CDE) must be isolated from the rest of the corporate workloads, and the auditors require that the scope of PCI assessment be minimized to only the systems that store, process, or transmit cardholder data. Which design approach BEST reduces PCI DSS audit scope while maintaining strong isolation?

Accepted Answer

Place the cardholder data environment in a dedicated project (or folder) with its own VPC, restricted IAM bindings, and VPC Service Controls perimeter, keeping non-CDE workloads in separate projects.

Answer

Deploy all workloads into a single project and use firewall rules with network tags to separate the CDE from other systems.

Answer

Enable Google-managed default encryption at rest for all resources and document that as sufficient PCI DSS network segmentation.

Answer

Deploy the CDE and corporate workloads in the same VPC but apply Access Context Manager device policies to end users accessing the applications.

Question 20

A retail company runs a stateful order-management application on Compute Engine behind a global external load balancer, backed by a Cloud SQL for PostgreSQL instance. The engineering team wants to adopt a deployment process that lets them release a new application version with a backward-incompatible database schema change while guaranteeing near-instant rollback if production monitoring detects elevated error rates. Business stakeholders require that customer transactions never be lost during the release and that any rollback take effect within seconds. Which release strategy best satisfies these technical and business requirements?

Accepted Answer

Use an expand-and-contract (backward-compatible) schema migration, deploy the new version to a parallel green environment sharing the same database, and shift traffic via the load balancer with the ability to switch back instantly.

Answer

Perform an in-place rolling update of the instance group and apply the schema change directly to the production database before the new code deploys.

Answer

Provision an entirely separate blue-green stack including a cloned Cloud SQL database, cut all traffic to green, then reconcile the two databases after go-live.

Answer

Take the application offline during a maintenance window, apply the destructive schema change, deploy the new version, and restore service once validation completes.

Question 21

A national retailer runs its customer-facing web platform on Compute Engine managed instance groups behind a global external HTTP(S) load balancer. Traffic is steady most of the year, but during a two-week holiday sale the site experiences roughly 8x normal load, with sharp, unpredictable spikes tied to flash promotions announced on social media. During last year's sale, autoscaling reacted too slowly and customers saw elevated latency and timeouts for several minutes after each promotion went live. Leadership wants the architecture to meet a 99.95% availability target and absorb sudden spikes without over-provisioning capacity year-round. Which approach best meets these performance and reliability requirements?

Accepted Answer

Combine load-balancing serving-capacity autoscaling with a scale-in control (stabilization) window, and create scheduled scaling to pre-warm a baseline of instances ahead of each announced promotion.

Answer

Configure autoscaling based only on average CPU utilization with the default cool-down period, and increase the maximum instance count for the holiday period.

Answer

Switch the instance groups to Spot VMs during the holiday season to reduce cost and allow a much higher maximum instance count for spikes.

Answer

Replace the managed instance groups with a single very large machine type sized for peak holiday traffic to eliminate autoscaling lag.

Question 22

A financial services company must satisfy an external auditor's requirement that the security team responsible for reviewing activity logs cannot alter, delete, or disable the logs they inspect. The security analysts currently hold the project Editor role, which the auditor has flagged as a violation of separation-of-duties controls. As the cloud architect, what is the most appropriate IAM change to make?

Accepted Answer

Remove the Editor role and grant the analysts only the Private Logs Viewer (roles/logging.privateLogViewer) role, while restricting log configuration and sink management to a separate platform team.

Answer

Grant the security analysts the Logging Admin (roles/logging.admin) role so they have full control over log configuration and viewing.

Answer

Keep the Editor role but add an organization policy that prevents anyone from deleting log entries.

Answer

Grant the security analysts the Project Viewer (roles/viewer) role at the project level so they can read logs without any write access.

Question 23

A media startup runs an on-demand video transcoding service. Users upload source files, and the system must transcode them into multiple resolutions. Jobs are stateless, each takes 2-15 minutes, and demand is highly unpredictable—sometimes zero jobs for hours, then hundreds arriving in minutes. The CTO wants to minimize idle cost while ensuring jobs start processing within seconds of arrival and complete reliably even if the platform reclaims capacity. Which compute design best meets these business and technical requirements?

Accepted Answer

Run transcoding on a managed instance group of Spot VMs with autoscaling driven by a Pub/Sub queue depth metric, and design workers to checkpoint and re-enqueue interrupted jobs.

Answer

Deploy transcoding as containers on a GKE cluster with a fixed pool of on-demand nodes sized for peak load, using the Horizontal Pod Autoscaler.

Answer

Use a single large Compute Engine instance kept always-on to process the queue sequentially as jobs arrive.

Answer

Trigger a Cloud Function per uploaded file to perform the transcoding synchronously within the request.