Managing implementation — PCA Practice Quiz

Question 1

A development team reports that a newly deployed application running on a Compute Engine VM in a custom VPC cannot reach a Cloud SQL instance over a private IP. Before making any changes, they ask you, the architect, how they can programmatically confirm whether the network path and firewall rules actually permit the traffic without generating live application requests. Which Google Cloud approach should you advise them to use first?

Accepted Answer

Run a Network Intelligence Center Connectivity Test specifying the VM as the source and the Cloud SQL private IP and port as the destination.

Answer

SSH into the VM and repeatedly run curl against the Cloud SQL endpoint until a connection succeeds.

Answer

Enable VPC Flow Logs on the subnet and wait for traffic samples to appear in Cloud Logging before analyzing them.

Answer

Temporarily create an allow-all ingress firewall rule and observe whether the application connects.

Question 2

A development team runs an automated shell script in Cloud Shell to create resources across several projects. The script relies on the default gcloud project configured in the active configuration. During a nightly batch run, resources were accidentally created in the wrong project because a teammate had earlier changed the active gcloud config. As the cloud architect, what should you advise the team to do to make the script safe and unambiguous regardless of the active configuration?

Accepted Answer

Explicitly pass the --project flag on every gcloud command in the script so the target project is never inferred from the active configuration.

Answer

Add a 'gcloud config set project' command at the start of the script so the active configuration is updated before resources are created.

Answer

Instruct all team members to avoid changing the active gcloud configuration while any batch job might be running.

Answer

Set the CLOUDSDK_CORE_PROJECT environment variable once in the user's shell profile so all sessions share the same default project.

Question 3

A platform team is about to update the autoscaling and machine-type configuration of a production managed instance group via a shell script during a maintenance window. The team lead is nervous about applying an incorrect change and asks you how to let engineers preview exactly what the gcloud command would do—without actually modifying any resources—before running it for real. What do you advise?

Accepted Answer

Run the gcloud command with the --dry-run flag first, then re-run it without the flag once the previewed changes look correct.

Answer

Add the --quiet flag so gcloud suppresses prompts and reports the intended changes before applying them.

Answer

Set the --verbosity=debug flag so the command prints the API calls it would make instead of executing them.

Answer

Run the command with --format=json so the output can be inspected and the change can be rolled back if incorrect.

Question 4

A development team writes an automation script that repeatedly runs 'gcloud projects add-iam-policy-binding' to grant a service account the roles/storage.objectViewer role across dozens of projects. During a code review, an operations engineer warns that concurrent executions of this command against the same project could silently overwrite each other's changes and lose bindings. As the cloud architect, what should you advise the team to do to make these IAM updates safe under concurrency?

Accepted Answer

Advise the team to use 'gcloud projects set-iam-policy' after fetching the policy with an etag, so updates are rejected if the policy changed since it was read.

Answer

Advise the team to keep using 'add-iam-policy-binding' but add a '--quiet' flag so the command skips confirmation prompts and completes faster.

Answer

Advise the team to wrap the calls in a retry loop with exponential backoff, which fully eliminates the possibility of lost updates.

Answer

Advise the team to grant the role at the organization level once so no per-project binding scripts are ever needed.

Question 5

A developer on your team needs to run a one-off gcloud command to list objects in a Cloud Storage bucket that only a specific service account (data-reader@project.iam.gserviceaccount.com) has permission to access. The developer's own user account has been granted the Service Account Token Creator role on that service account, but no direct access to the bucket. Company policy prohibits creating and downloading service account keys. What is the recommended way for the developer to execute the command using the service account's permissions?

Accepted Answer

Add the --impersonate-service-account=data-reader@project.iam.gserviceaccount.com flag to the gcloud storage ls command.

Answer

Run gcloud auth activate-service-account after generating a JSON key file for the service account.

Answer

Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a downloaded key file, then run the command.

Answer

Grant the developer's user account the Storage Object Viewer role directly on the bucket and run the command as themselves.

Question 6

A platform team is writing a shell script that runs on a scheduled Compute Engine VM to inventory all VM instances across several projects. The script must extract specific fields (instance name, zone, and machine type) from the gcloud command output and feed them into a downstream tool that only accepts structured input it can parse reliably. The team currently parses the default human-readable table output using tools like grep and awk, but the script breaks whenever gcloud changes column spacing or adds columns. As the architect, what should you advise them to do to make the parsing robust?

Accepted Answer

Use the '--format' flag with a JSON or projection specification (e.g., '--format=json' or '--format="value(name,zone,machineType)"') so the output is machine-readable and stable.

Answer

Add the '--quiet' flag to all commands so gcloud suppresses formatting changes and returns only the raw values.

Answer

Pipe the default table output through 'sort' and 'sed' to normalize spacing before passing it to awk.

Answer

Set the 'core/disable_prompts' property in the gcloud configuration so the CLI output format never changes between releases.

Question 7

A development team writes a Bash script that runs 'gcloud compute instances create' as part of a nightly automated job to ensure a set of standard utility VMs exists in a project. Occasionally the job fails because some of the VMs already exist from a previous run, causing the entire script to exit with an error and skip the creation of the remaining VMs. As the cloud architect, what should you advise the team to do to make the automation reliable and idempotent while still using the Cloud SDK?

Accepted Answer

Before each create command, run a 'gcloud compute instances describe' check for the instance and only invoke 'create' when the describe command returns a not-found result, allowing the script to skip existing VMs and continue.

Answer

Add the '--quiet' flag to every 'gcloud compute instances create' command so that the CLI suppresses prompts and errors and always returns a success exit code.

Answer

Wrap the whole script in a single 'gcloud compute instances create' call with multiple instance names and rely on the API to ignore any that already exist.

Answer

Schedule the script to first delete all utility VMs with 'gcloud compute instances delete', then recreate them from scratch on every run.

Question 8

A development team building a batch job that runs on an on-premises VM needs to authenticate to Google Cloud APIs. A junior developer asks you to help them create and download a service account JSON key so the application can call the APIs. Your organization enforces an org policy that blocks service account key creation. As the cloud architect advising the team, what should you recommend they implement for the on-premises workload?

Accepted Answer

Configure Workload Identity Federation with an external identity provider so the on-premises workload obtains short-lived Google Cloud credentials without a downloaded key.

Answer

Request a temporary exception to the org policy so a single downloadable key can be generated and stored in the application's config file.

Answer

Have the developer run 'gcloud auth login' with their personal Google account on the on-premises VM and reuse those user credentials in the batch job.

Answer

Enable the Compute Engine default service account and attach it to the on-premises VM through the metadata server.

Question 9

A DevOps team has a deployment script that creates a Compute Engine managed instance group and then immediately runs a smoke test against the group's instances. The script frequently fails because the instances are not yet running when the smoke test executes. The team asks you how to make the script reliably proceed only after the instances are fully ready, without hardcoding arbitrary sleep timers. What do you advise?

Accepted Answer

Use 'gcloud compute instance-groups managed wait-until --stable' to block until the group reaches a stable, fully provisioned state before running the smoke test.

Answer

Insert a fixed 'sleep 300' command after the create step to guarantee the instances have time to boot before testing.

Answer

Wrap the smoke test in a retry loop that re-runs the entire deployment from scratch each time it fails.

Answer

Add '--async' to the instance group create command so the script continues immediately and the instances self-register when ready.

Question 10

A development team manages all production infrastructure with Terraform, but recent outages were traced to manual changes made directly in the Google Cloud Console that were later overwritten by an automated pipeline. As the cloud architect, you must advise the team on a process that both prevents unreviewed changes from reaching production and surfaces any out-of-band modifications before they cause conflicts. Which recommendation best addresses this?

Accepted Answer

Require that every change be submitted as a pull request that runs `terraform plan` in CI, block merges without approval, and schedule a periodic `terraform plan` job to detect drift from the actual state.

Answer

Grant developers only read-only Console access and require all changes to be made exclusively through the gcloud CLI.

Answer

Enable an organization policy that disables the Google Cloud Console entirely for the production project.

Answer

Increase the frequency of the automated `terraform apply` pipeline so manual changes are corrected faster.

Question 11

Your operations team currently manages all Google Cloud infrastructure using Deployment Manager templates. Leadership has asked you, as the cloud architect, to advise the team on adopting a widely supported infrastructure-as-code tool that supports multi-cloud state management and a large community module ecosystem, while ensuring the team can programmatically preview changes before applying them. Which recommendation should you give the team?

Accepted Answer

Migrate the infrastructure definitions to Terraform, use remote state in a Cloud Storage backend, and adopt 'terraform plan' as a required step before every apply.

Answer

Continue using Deployment Manager and add gcloud shell scripts to preview changes, since Deployment Manager is Google's strategic IaC direction.

Answer

Replace all IaC with manually documented gcloud commands stored in a runbook so operators can execute them consistently.

Answer

Use the Cloud Console's import feature to recreate resources manually and disable automated deployments to reduce configuration drift.

Question 12

A development team uses Cloud Build to run their CI/CD pipelines. Their build steps need to run integration tests against a Cloud SQL instance and a Memorystore instance that are only reachable through private IP addresses inside their VPC. The default Cloud Build workers cannot reach these private resources. As the architect, what should you advise the team to implement so the builds can connect to the private resources with the least operational overhead?

Accepted Answer

Configure a Cloud Build private pool (private worker pool) with a peered VPC connection to the team's network so build workers can reach the private IP resources.

Answer

Assign external IP addresses to the Cloud SQL and Memorystore instances and restrict access with authorized networks pointing at Cloud Build IP ranges.

Answer

Run a self-managed Jenkins server on a Compute Engine VM inside the VPC and migrate all pipelines off Cloud Build.

Answer

Create a Serverless VPC Access connector and attach it to the default Cloud Build worker pool to route traffic into the VPC.

Question 13

A development team maintains a single Cloud Build pipeline that must deploy the same application to three GKE clusters (dev, staging, and prod) in different projects. They want to avoid maintaining three separate cloudbuild.yaml files and instead pass the target project ID, cluster name, and image tag at build-submission time without hardcoding values. As the architect, what approach should you advise the team to adopt?

Accepted Answer

Use user-defined substitution variables in the cloudbuild.yaml and pass their values with --substitutions at build submission (or via triggers).

Answer

Create three copies of the build config, one per environment, and edit the hardcoded values in each before submitting the build.

Answer

Store the environment values as build artifacts in Cloud Storage and have each build step download them at runtime.

Answer

Encode the environment-specific values directly into the container image and select behavior with a startup flag.

Question 14

A development team currently uses hand-written shell scripts invoked from a Cloud Build step to promote container images through dev, staging, and production GKE clusters. Promotions are error-prone, lack a consistent approval step, and offer no easy way to roll back to a previously deployed release. As the architect, you must advise the team on a Google Cloud managed service that provides a declarative delivery pipeline with defined promotion sequences between targets, approval gates, and one-command rollback, while minimizing custom scripting. What do you recommend?

Accepted Answer

Adopt Cloud Deploy, defining a delivery pipeline with ordered targets for dev, staging, and production, using its built-in promotion, approvals, and rollback.

Answer

Continue with Cloud Build but move the shell scripts into a reusable custom builder image stored in Artifact Registry.

Answer

Use Config Sync to reconcile each cluster against a Git repository, relying on directory structure to represent each environment.

Answer

Deploy directly with kubectl apply from a Cloud Scheduler job that runs on a fixed nightly cadence for each cluster.

Question 15

A platform engineer keeps a collection of operational bash scripts and gcloud helper aliases that they use daily from Cloud Shell to administer several Google Cloud projects. They report that after a few weeks of inactivity, some files they saved appear to be missing, while others in their home directory remain. They want to understand the behavior so they can reliably store their tooling. Which statement correctly describes Cloud Shell persistence and the recommended practice?

Accepted Answer

Files stored in the $HOME directory persist in a 5 GB user-scoped disk, but the disk is deleted after 120 days of inactivity, so scripts should be committed to a source repository for durable storage.

Answer

Cloud Shell provides no persistent storage at all; any file must be re-uploaded each session, so scripts should be pasted into the terminal manually every time.

Answer

The entire VM including installed system packages persists indefinitely, so no external backup is ever required for anything stored in Cloud Shell.

Answer

Only files outside $HOME persist across sessions, so scripts should be saved to /tmp or /usr/local to survive session recycling.

Question 16

An operations engineer maintains automation scripts that must run gcloud commands against three different projects (dev, staging, prod), each requiring different service account credentials and default regions. The scripts currently break because commands intermittently target the wrong project when multiple team members run them concurrently on a shared jump host. As the architect, what should you advise to make the automation reliably target the correct project and credentials per invocation without relying on the global active configuration?

Accepted Answer

Create named gcloud configurations for each environment and invoke commands with the '--configuration' flag (or CLOUDSDK_ACTIVE_CONFIG_NAME environment variable) so each invocation uses an isolated configuration.

Answer

Have each script run 'gcloud config set project' and 'gcloud config set account' before its commands, then reset them at the end.

Answer

Instruct team members to open separate SSH sessions and never run scripts at the same time to avoid configuration collisions.

Answer

Store all three service account keys in a single file and let gcloud automatically select the right one based on the target project.

Question 17

A development team wrote a shell script that loops over 400 project IDs and runs a gcloud command to enable an API in each one. When they run it, many commands begin failing with HTTP 429 quota errors, and the run takes hours because it processes projects one at a time. They ask you how to make the automation both faster and more resilient without requesting quota increases. What should you advise?

Accepted Answer

Introduce bounded parallelism (for example, using xargs -P with a modest concurrency limit) combined with exponential backoff retries on transient 429 responses in the script

Answer

Replace gcloud with direct REST calls using curl and a static OAuth token so the requests bypass client-side rate limiting

Answer

Run the same script simultaneously from 400 separate Cloud Shell sessions so every project is processed at once

Answer

Add a fixed sleep of 30 seconds between each iteration to guarantee the quota is never exceeded

Question 18

A development team reports that a newly deployed pod on a private GKE cluster is stuck in CrashLoopBackOff. As the cloud architect, you need to guide an on-call engineer who only has access to a browser to inspect the pod's container logs and recent events without provisioning any local tools or bastion host. Which approach should you advise?

Accepted Answer

Open Cloud Shell, run 'gcloud container clusters get-credentials' to fetch cluster credentials, then use 'kubectl logs' and 'kubectl describe pod' to inspect the failing pod.

Answer

Instruct the engineer to install the gcloud CLI and kubectl on their laptop, configure kubeconfig manually, and connect over the public endpoint.

Answer

SSH directly into the underlying GKE node VM using the Compute Engine console and read the container runtime logs from the node's local filesystem.

Answer

Enable Serial console access on the node pool and read the pod logs from the VM serial output stream in the console.

Question 19

A platform team manages all Google Cloud infrastructure with Terraform. Multiple engineers run 'terraform apply' from their laptops against the same configuration, and the team has recently experienced corrupted state and conflicting resource changes when two people apply at the same time. As the cloud architect, what should you recommend to prevent concurrent modifications and enable safe collaboration?

Accepted Answer

Store the Terraform state file in a Cloud Storage bucket configured as the backend, which provides state storage with automatic state locking.

Answer

Have each engineer keep the state file locally and commit it to the Git repository after every apply so others can pull the latest version.

Answer

Instruct engineers to coordinate over chat and agree on a schedule so only one person runs 'terraform apply' at a time.

Answer

Split the configuration into separate copies per engineer, each managing its own state file for the same resources.

More PCA practice