Medium — PCA Practice Quiz

Question 1

A financial services company must satisfy a regulator's requirement that any access to their data by the cloud provider's support and engineering staff be logged, justified, and subject to explicit customer approval before the access occurs. The compliance team also wants near-real-time visibility into these provider-initiated access events. Which combination of Google Cloud capabilities best satisfies this requirement?

Accepted Answer

Enable Access Transparency logs and configure Access Approval to require explicit customer approval for Google support access.

Answer

Enable Cloud Audit Logs (Admin Activity and Data Access) and rely on them to capture Google staff access.

Answer

Apply VPC Service Controls perimeters around all data resources and enable Access Context Manager policies.

Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud HSM so Google cannot access the data without customer keys.

Question 2

A development team reports that a newly deployed application running on a Compute Engine VM in a custom VPC cannot reach a Cloud SQL instance over a private IP. Before making any changes, they ask you, the architect, how they can programmatically confirm whether the network path and firewall rules actually permit the traffic without generating live application requests. Which Google Cloud approach should you advise them to use first?

Accepted Answer

Run a Network Intelligence Center Connectivity Test specifying the VM as the source and the Cloud SQL private IP and port as the destination.

Answer

SSH into the VM and repeatedly run curl against the Cloud SQL endpoint until a connection succeeds.

Answer

Enable VPC Flow Logs on the subnet and wait for traffic samples to appear in Cloud Logging before analyzing them.

Answer

Temporarily create an allow-all ingress firewall rule and observe whether the application connects.

Question 3

A development team runs an automated shell script in Cloud Shell to create resources across several projects. The script relies on the default gcloud project configured in the active configuration. During a nightly batch run, resources were accidentally created in the wrong project because a teammate had earlier changed the active gcloud config. As the cloud architect, what should you advise the team to do to make the script safe and unambiguous regardless of the active configuration?

Accepted Answer

Explicitly pass the --project flag on every gcloud command in the script so the target project is never inferred from the active configuration.

Answer

Add a 'gcloud config set project' command at the start of the script so the active configuration is updated before resources are created.

Answer

Instruct all team members to avoid changing the active gcloud configuration while any batch job might be running.

Answer

Set the CLOUDSDK_CORE_PROJECT environment variable once in the user's shell profile so all sessions share the same default project.

Question 4

A platform team is about to update the autoscaling and machine-type configuration of a production managed instance group via a shell script during a maintenance window. The team lead is nervous about applying an incorrect change and asks you how to let engineers preview exactly what the gcloud command would do—without actually modifying any resources—before running it for real. What do you advise?

Accepted Answer

Run the gcloud command with the --dry-run flag first, then re-run it without the flag once the previewed changes look correct.

Answer

Add the --quiet flag so gcloud suppresses prompts and reports the intended changes before applying them.

Answer

Set the --verbosity=debug flag so the command prints the API calls it would make instead of executing them.

Answer

Run the command with --format=json so the output can be inspected and the change can be rolled back if incorrect.

Question 5

A developer on your team needs to run a one-off gcloud command to list objects in a Cloud Storage bucket that only a specific service account (data-reader@project.iam.gserviceaccount.com) has permission to access. The developer's own user account has been granted the Service Account Token Creator role on that service account, but no direct access to the bucket. Company policy prohibits creating and downloading service account keys. What is the recommended way for the developer to execute the command using the service account's permissions?

Accepted Answer

Add the --impersonate-service-account=data-reader@project.iam.gserviceaccount.com flag to the gcloud storage ls command.

Answer

Run gcloud auth activate-service-account after generating a JSON key file for the service account.

Answer

Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a downloaded key file, then run the command.

Answer

Grant the developer's user account the Storage Object Viewer role directly on the bucket and run the command as themselves.

Question 6

A platform team is writing a shell script that runs on a scheduled Compute Engine VM to inventory all VM instances across several projects. The script must extract specific fields (instance name, zone, and machine type) from the gcloud command output and feed them into a downstream tool that only accepts structured input it can parse reliably. The team currently parses the default human-readable table output using tools like grep and awk, but the script breaks whenever gcloud changes column spacing or adds columns. As the architect, what should you advise them to do to make the parsing robust?

Accepted Answer

Use the '--format' flag with a JSON or projection specification (e.g., '--format=json' or '--format="value(name,zone,machineType)"') so the output is machine-readable and stable.

Answer

Add the '--quiet' flag to all commands so gcloud suppresses formatting changes and returns only the raw values.

Answer

Pipe the default table output through 'sort' and 'sed' to normalize spacing before passing it to awk.

Answer

Set the 'core/disable_prompts' property in the gcloud configuration so the CLI output format never changes between releases.

Question 7

A development team writes a Bash script that runs 'gcloud compute instances create' as part of a nightly automated job to ensure a set of standard utility VMs exists in a project. Occasionally the job fails because some of the VMs already exist from a previous run, causing the entire script to exit with an error and skip the creation of the remaining VMs. As the cloud architect, what should you advise the team to do to make the automation reliable and idempotent while still using the Cloud SDK?

Accepted Answer

Before each create command, run a 'gcloud compute instances describe' check for the instance and only invoke 'create' when the describe command returns a not-found result, allowing the script to skip existing VMs and continue.

Answer

Add the '--quiet' flag to every 'gcloud compute instances create' command so that the CLI suppresses prompts and errors and always returns a success exit code.

Answer

Wrap the whole script in a single 'gcloud compute instances create' call with multiple instance names and rely on the API to ignore any that already exist.

Answer

Schedule the script to first delete all utility VMs with 'gcloud compute instances delete', then recreate them from scratch on every run.

Question 8

A development team building a batch job that runs on an on-premises VM needs to authenticate to Google Cloud APIs. A junior developer asks you to help them create and download a service account JSON key so the application can call the APIs. Your organization enforces an org policy that blocks service account key creation. As the cloud architect advising the team, what should you recommend they implement for the on-premises workload?

Accepted Answer

Configure Workload Identity Federation with an external identity provider so the on-premises workload obtains short-lived Google Cloud credentials without a downloaded key.

Answer

Request a temporary exception to the org policy so a single downloadable key can be generated and stored in the application's config file.

Answer

Have the developer run 'gcloud auth login' with their personal Google account on the on-premises VM and reuse those user credentials in the batch job.

Answer

Enable the Compute Engine default service account and attach it to the on-premises VM through the metadata server.

Question 9

A DevOps team has a deployment script that creates a Compute Engine managed instance group and then immediately runs a smoke test against the group's instances. The script frequently fails because the instances are not yet running when the smoke test executes. The team asks you how to make the script reliably proceed only after the instances are fully ready, without hardcoding arbitrary sleep timers. What do you advise?

Accepted Answer

Use 'gcloud compute instance-groups managed wait-until --stable' to block until the group reaches a stable, fully provisioned state before running the smoke test.

Answer

Insert a fixed 'sleep 300' command after the create step to guarantee the instances have time to boot before testing.

Answer

Wrap the smoke test in a retry loop that re-runs the entire deployment from scratch each time it fails.

Answer

Add '--async' to the instance group create command so the script continues immediately and the instances self-register when ready.

Question 10

A development team manages all production infrastructure with Terraform, but recent outages were traced to manual changes made directly in the Google Cloud Console that were later overwritten by an automated pipeline. As the cloud architect, you must advise the team on a process that both prevents unreviewed changes from reaching production and surfaces any out-of-band modifications before they cause conflicts. Which recommendation best addresses this?

Accepted Answer

Require that every change be submitted as a pull request that runs `terraform plan` in CI, block merges without approval, and schedule a periodic `terraform plan` job to detect drift from the actual state.

Answer

Grant developers only read-only Console access and require all changes to be made exclusively through the gcloud CLI.

Answer

Enable an organization policy that disables the Google Cloud Console entirely for the production project.

Answer

Increase the frequency of the automated `terraform apply` pipeline so manual changes are corrected faster.

Question 11

Your operations team currently manages all Google Cloud infrastructure using Deployment Manager templates. Leadership has asked you, as the cloud architect, to advise the team on adopting a widely supported infrastructure-as-code tool that supports multi-cloud state management and a large community module ecosystem, while ensuring the team can programmatically preview changes before applying them. Which recommendation should you give the team?

Accepted Answer

Migrate the infrastructure definitions to Terraform, use remote state in a Cloud Storage backend, and adopt 'terraform plan' as a required step before every apply.

Answer

Continue using Deployment Manager and add gcloud shell scripts to preview changes, since Deployment Manager is Google's strategic IaC direction.

Answer

Replace all IaC with manually documented gcloud commands stored in a runbook so operators can execute them consistently.

Answer

Use the Cloud Console's import feature to recreate resources manually and disable automated deployments to reduce configuration drift.

Question 12

A media company runs a data analytics platform on Google Cloud with a stable baseline of Compute Engine instances that operate 24/7 for at least the next three years. During monthly reporting periods, the workload spikes with additional short-lived instances that run for a few hours. The finance team wants to minimize total compute cost while keeping the architecture simple and avoiding upfront lump-sum payments. Which pricing strategy should the architect recommend?

Accepted Answer

Purchase 3-year committed use discounts for the steady-state baseline and rely on standard on-demand pricing for the monthly reporting spikes.

Answer

Run the entire workload, including the baseline, on Spot VMs to achieve the deepest possible discount.

Answer

Purchase 3-year committed use discounts sized to cover both the baseline and the peak reporting capacity.

Answer

Rely entirely on sustained use discounts for both the baseline and the reporting spikes without any commitments.

Question 13

A retail company builds container images in a CI pipeline. Currently, each environment (dev, staging, production) rebuilds the image from source using its own environment-specific Dockerfile. The team frequently discovers that code passing all staging tests fails in production due to subtle differences in the built artifacts. As the architect, what change should you recommend to the SDLC process to eliminate these environment-specific defects?

Accepted Answer

Build the image once in CI, store it in Artifact Registry with an immutable digest, and promote that same artifact through dev, staging, and production.

Answer

Add more integration tests in each environment so defects are caught before the image reaches production.

Answer

Standardize on a single base OS image across all environment-specific Dockerfiles while continuing to rebuild in each environment.

Answer

Run production builds on larger machine types to ensure the compiler behaves consistently with staging.

Question 14

A US-based defense contractor is migrating a workload to Google Cloud that must comply with FedRAMP High and IL4 requirements. The security team mandates that the environment enforce data residency in US regions, restrict Google support personnel to US persons, and continuously monitor for configuration drift away from the compliance baseline. They want a Google-managed solution that packages these controls rather than assembling individual org policies and IAM constraints manually. Which approach best meets these requirements?

Accepted Answer

Deploy the workload into an Assured Workloads environment configured for the FedRAMP High / IL4 compliance regime

Answer

Create a folder and apply org policy constraints for resource location, plus custom monitoring scripts to detect drift

Answer

Enable VPC Service Controls perimeters around all projects and rely on Access Transparency logs for support personnel tracking

Answer

Purchase a dedicated Cloud Interconnect and host the workload in a Sovereign Controls partner region

Question 15

A logistics company is building a new fleet-management backend on Google Cloud. The application must store structured shipment records with a well-defined relational schema, support ACID transactions across multiple tables, and serve a moderate but steady workload from a single region. The engineering team wants a fully managed database and expects data to grow to a few hundred gigabytes, with no requirement for global distribution or horizontal write scaling beyond a single primary. Which storage service best meets these requirements at the lowest operational and licensing overhead?

Accepted Answer

Cloud SQL for PostgreSQL with a regional high-availability configuration

Answer

Cloud Spanner with a multi-region instance configuration

Answer

Firestore in Native mode with composite indexes

Answer

Bigtable with a single-cluster instance

Question 16

A genomics research startup runs nightly batch pipelines that process large datasets on Compute Engine. The jobs are fault-tolerant, can be checkpointed, and can restart if interrupted. They currently run on 200 standard on-demand n2 instances and take about 6 hours. Leadership wants to reduce compute cost as much as possible without missing the 10-hour nightly processing window, and the workload has no strict per-instance uptime requirement. Which compute design best meets these business and technical requirements?

Accepted Answer

Run the pipeline on Spot VMs (preemptible) in a managed instance group, relying on checkpointing to resume interrupted work.

Answer

Purchase 3-year committed use discounts for 200 on-demand n2 instances to lock in the lowest rate.

Answer

Migrate the workload to a single large sole-tenant node to guarantee no interruptions.

Answer

Keep the on-demand instances but enable a regional managed instance group with autoscaling to add capacity.

Question 17

A logistics company runs a nightly analytics pipeline composed of several dependent steps: extracting data from Cloud SQL, transforming it with a Dataflow job, loading results into BigQuery, and finally triggering a report-generation Cloud Run service. The steps must execute in strict order, with automatic retries on transient failures and clear visibility into which step failed. The team currently chains these steps with brittle cron jobs and shell scripts that offer no dependency management or observability. As the cloud architect, which Google Cloud service should you recommend to orchestrate this multi-step, dependency-aware workflow?

Accepted Answer

Cloud Workflows to define the ordered steps as a serverless orchestration with built-in retries and error handling

Answer

Cloud Scheduler with multiple independent cron jobs, one per pipeline step, spaced by fixed time intervals

Answer

Pub/Sub topics between each step so that completing one step publishes a message that triggers the next

Answer

A single large Cloud Run job that sequentially calls each step inside application code

Question 18

A financial services company runs microservices on GKE and must satisfy an auditor requirement that only container images built and scanned by the approved CI/CD pipeline can be deployed to production clusters. Developers must not be able to run arbitrary or manually pushed images. Which Google Cloud approach best enforces this control at deploy time?

Accepted Answer

Enable Binary Authorization on the production clusters with a policy requiring attestations signed by the trusted build and scan attestors before any image can be deployed.

Answer

Restrict IAM so that only the CI/CD service account has the Kubernetes Engine Developer role on the production namespace.

Answer

Enable vulnerability scanning in Artifact Registry and configure alerts when images with critical CVEs are pushed.

Answer

Use a VPC Service Controls perimeter around the GKE clusters to prevent images from outside the organization being pulled.

Question 19

A mid-sized company has migrated several projects to Google Cloud. The finance team is frustrated because they only discover budget overruns weeks later when the invoice arrives, and engineering teams have no visibility into their spending until it is too late to react. Leadership wants a process where teams are automatically notified as they approach their monthly spending thresholds, and wants the option to programmatically trigger automated responses (such as capping non-critical workloads) when a threshold is exceeded. Which approach best meets these business process requirements?

Accepted Answer

Configure Cloud Billing budgets with alert thresholds per project, sending notifications via email and publishing to a Pub/Sub topic that can trigger Cloud Functions for automated responses.

Answer

Export detailed billing data to BigQuery and have the finance team run a scheduled monthly query to review spending after each billing cycle closes.

Answer

Set organization policy constraints to hard-limit the number of resources each project can create, preventing any spending above the budget.

Answer

Enable Cloud Monitoring dashboards showing resource utilization and ask engineering leads to manually check them daily for signs of overspending.

Question 20

A large enterprise runs dozens of teams' workloads across several projects in a single Google Cloud organization. The finance department wants to hold each business unit accountable for its actual cloud spend and produce monthly internal invoices per team. Engineering leadership also wants dashboards showing cost trends by application and environment (prod, staging, dev). What is the most effective approach to enable accurate cost allocation and reporting across the organization?

Accepted Answer

Apply a consistent set of resource labels (e.g., team, application, environment) and cost allocation tags, export detailed Cloud Billing data to BigQuery, and build reports and dashboards grouped by those labels.

Answer

Create a separate billing account for every team and manually reconcile spend at the end of each month using exported PDF invoices.

Answer

Rely on the default Cloud Billing reports in the console and filter by project, assigning one project per resource so costs can be traced.

Answer

Enable budgets and budget alerts on each project so finance receives an email whenever a team exceeds its allocated threshold.

Question 21

A financial services company runs a Cloud Build CI/CD pipeline that deploys to production several times a day. An external auditor requires that every production deployment be traceable to a specific approved change request, and that the identity of the approver, the artifact version, and the timestamp be independently verifiable and retained for seven years. The engineering team wants to satisfy this requirement while keeping deployments fully automated where possible. Which approach best meets the audit and process requirements?

Accepted Answer

Introduce a manual approval gate in the release pipeline that records approver identity, then export Cloud Build and Cloud Audit Logs of each deployment to a retention-locked Cloud Storage bucket for the required period.

Answer

Require developers to email a manager before each deployment and keep the email threads in a shared inbox as the audit record.

Answer

Enable verbose logging in Cloud Build and rely on the 400-day default log retention in Cloud Logging to provide the deployment history.

Answer

Grant the auditor the Cloud Build Editor role so they can inspect build triggers and configurations whenever a review is needed.

Question 22

A retail company deploys its customer-facing web application to Google Kubernetes Engine several times per day. After a recent release caused a checkout outage that went undetected until customer complaints arrived, the release engineering team wants a deployment strategy that automatically exposes new versions to a small subset of live traffic, monitors error rates and latency against defined thresholds, and rolls back automatically if metrics degrade—without requiring a full duplicate production environment. Which approach best meets these requirements?

Accepted Answer

Use a canary deployment managed by Cloud Deploy with automated rollback triggered by Cloud Monitoring SLO-based alerting on error rate and latency.

Answer

Provision a full parallel blue-green environment and cut over 100% of traffic to the green environment after manual smoke testing.

Answer

Adopt a recreate deployment strategy that terminates all old pods before starting new ones to guarantee version consistency.

Answer

Deploy all changes directly to production during a nightly maintenance window and rely on daily database backups for recovery.

Question 23

A pharmaceutical company is designing a data platform for clinical trial results. Regulators require that all raw trial data be retained for 15 years and remain retrievable within a few hours if audited. Only the most recent 90 days of data is queried frequently by analysts; older data is accessed at most once or twice a year. The company wants to minimize total storage cost while satisfying the retention and retrievability requirements. Which storage design should the architect recommend?

Accepted Answer

Store recent data in Cloud Storage Standard, and use Object Lifecycle Management to transition objects to Nearline after 90 days and to Archive after one year, with a bucket retention policy of 15 years.

Answer

Store all data in Cloud Storage Standard class and rely on a 15-year retention policy to prevent deletion.

Answer

Load all trial data into BigQuery and use long-term storage pricing for partitions older than 90 days.

Answer

Store recent data in Cloud Storage Standard and move older data to Coldline immediately after 90 days, deleting objects manually after 15 years.

Question 24

A development team uses Cloud Build to run their CI/CD pipelines. Their build steps need to run integration tests against a Cloud SQL instance and a Memorystore instance that are only reachable through private IP addresses inside their VPC. The default Cloud Build workers cannot reach these private resources. As the architect, what should you advise the team to implement so the builds can connect to the private resources with the least operational overhead?

Accepted Answer

Configure a Cloud Build private pool (private worker pool) with a peered VPC connection to the team's network so build workers can reach the private IP resources.

Answer

Assign external IP addresses to the Cloud SQL and Memorystore instances and restrict access with authorized networks pointing at Cloud Build IP ranges.

Answer

Run a self-managed Jenkins server on a Compute Engine VM inside the VPC and migrate all pipelines off Cloud Build.

Answer

Create a Serverless VPC Access connector and attach it to the default Cloud Build worker pool to route traffic into the VPC.

Question 25

A development team maintains a single Cloud Build pipeline that must deploy the same application to three GKE clusters (dev, staging, and prod) in different projects. They want to avoid maintaining three separate cloudbuild.yaml files and instead pass the target project ID, cluster name, and image tag at build-submission time without hardcoding values. As the architect, what approach should you advise the team to adopt?

Accepted Answer

Use user-defined substitution variables in the cloudbuild.yaml and pass their values with --substitutions at build submission (or via triggers).

Answer

Create three copies of the build config, one per environment, and edit the hardcoded values in each before submitting the build.

Answer

Store the environment values as build artifacts in Cloud Storage and have each build step download them at runtime.

Answer

Encode the environment-specific values directly into the container image and select behavior with a startup flag.