PCA practice questions 121–130

1. Question 121 · 335 in bank

   Auditors visit your teams every 12 months and ask to review all the Google Cloud Identity and Access Management (Cloud IAM) policy changes in the previous 12 months. You want to streamline and expedite the analysis and audit process. What should you do?

   • ACreate custom Google Stackdriver alerts and send them to the auditor
   • BEnable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor
   • CUse cloud functions to transfer log entries to Google Cloud SQL and use ACLs and views to limit an auditor's view
   • DEnable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket

   Show answer

   Answer: B

   Explanation

   1. Comprehensive Audit Trail: Cloud Logging automatically captures audit logs for all Cloud IAM activity. Exporting these logs to BigQuery provides a centralized and comprehensive audit trail for analysis. 2. Powerful Analysis: BigQuery's analytical capabilities allow auditors to efficiently query and analyze IAM policy changes over the 12-month period. They can filter, aggregate, and generate reports to identify any anomalies or security concerns. 3. Granular Access Control: BigQuery's Access Control Lists (ACLs) and views enable you to precisely control which data the auditors can access. This ensures that they only see the information relevant to their audit without exposing sensitive data. Note: While exporting logs to Cloud Storage is possible, it's less efficient for analysis compared to BigQuery.

   Source: Adapted from community discussion — Ekramy_Elnaggar

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 122 · 335 in bank

   You are designing a large distributed application with 30 microservices. Each of your distributed microservices needs to connect to a database back-end. You want to store the credentials securely. Where should you store the credentials?

   • AIn the source code
   • BIn an environment variable
   • CIn a secret management system
   • DIn a config file that has restricted access through ACLs

   Show answer

   Answer: C

   Explanation

   C is the answer, since key management systems generate, use, rotate, encrypt, and destroy cryptographic keys and manage permissions to those keys. A is incorrect because storing credentials in source code and source control is discoverable, in plain text, by anyone with access to the source code. This also introduces the requirement to update code and do a deployment each time the credentials are rotated. B is not correct because consistently populating environment variables would require the credentials to be available, in plain text, when the session is started. D is incorrect because instead of managing access to the config file and updating manually as keys are rotated, it would be better to leverage a key management system. Additionally, there is increased risk if the config file contains the credentials in plain text.

   Source: Adapted from community discussion — shandy

   References

   • Google Cloud documentation

   Next question

3. Question 123 · 335 in bank

   Select 3

   The operations manager asks you for a list of recommended practices that she should consider when migrating a J2EE application to the cloud. Which three practices should you recommend? (Choose three.)

   • APort the application code to run on Google App Engine
   • BIntegrate Cloud Dataflow into the application to capture real-time metrics
   • CInstrument the application with a monitoring tool like Stackdriver Debugger
   • DSelect an automation framework to reliably provision the cloud infrastructure
   • EDeploy a continuous integration tool with automated testing in a staging environment
   • FMigrate from MySQL to a managed NoSQL database like Google Cloud Datastore or Bigtable

   Show answer

   Answer: CDE

   Explanation

   This is talking about the APPLICATION not the infrastructure, therefore I believe we should focus on the APP-side of things: 1. port the app to app engine for content delivery 2. add monitoring for troubleshooting 3. use a CI/CD workflow for continuous delivery w/testing for a stable application so, for me: A, C and E should be the answers

   Source: Adapted from community discussion — NapoleonBorntoparty

   Next question

4. Question 124 · 335 in bank

   Select 2

   A lead engineer wrote a custom tool that deploys virtual machines in the legacy data center. He wants to migrate the custom tool to the new cloud environment. You want to advocate for the adoption of Google Cloud Deployment Manager. What are two business risks of migrating to Cloud Deployment Manager? (Choose two.)

   • ACloud Deployment Manager uses Python
   • BCloud Deployment Manager APIs could be deprecated in the future
   • CCloud Deployment Manager is unfamiliar to the company's engineers
   • DCloud Deployment Manager requires a Google APIs service account to run
   • ECloud Deployment Manager can be used to permanently delete cloud resources
   • FCloud Deployment Manager only supports automation of Google Cloud resources

   Show answer

   Answer: CF

   Explanation

   E. Cloud Deployment Manager can be used to permanently delete cloud resources F. Cloud Deployment Manager only supports automation of Google Cloud resources

   Source: Adapted from community discussion — victory108

   Next question

5. Question 125 · 335 in bank

   A development manager is building a new application. He asks you to review his requirements and identify what cloud technologies he can use to meet them. The application must: 1. Be based on open-source technology for cloud portability 2. Dynamically scale compute capacity based on demand 3. Support continuous software delivery 4. Run multiple segregated copies of the same application stack 5. Deploy application bundles using dynamic templates 6. Route network traffic to specific services based on URL Which combination of technologies will meet all of his requirements?

   • AGoogle Kubernetes Engine, Jenkins, and Helm
   • BGoogle Kubernetes Engine and Cloud Load Balancing
   • CGoogle Kubernetes Engine and Cloud Deployment Manager
   • DGoogle Kubernetes Engine, Jenkins, and Cloud Load Balancing

   Show answer

   Answer: A

   Explanation

   it should be A .. helm is needed for "Deploy application bundles using dynamic templates" Load Balancing should be part of GKE Already

   Source: Adapted from community discussion — rsamant

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 126 · 335 in bank

   You have created several pre-emptible Linux virtual machine instances using Google Compute Engine. You want to properly shut down your application before the virtual machines are preempted. What should you do?

   • ACreate a shutdown script named k99.shutdown in the /etc/rc.6.d/ directory
   • BCreate a shutdown script registered as a xinetd service in Linux and configure a Stackdriver endpoint check to call the service
   • CCreate a shutdown script and use it as the value for a new metadata entry with the key shutdown-script in the Cloud Platform Console when you create the new virtual machine instance
   • DCreate a shutdown script, registered as a xinetd service in Linux, and use the gcloud compute instances add-metadata command to specify the service URL as the value for a new metadata entry with the key shutdown-script-url

   Show answer

   Answer: C

   Explanation

   I have doubts with the answer C because the question states that "You have created the instances" so C works too but the solution cannot apply to the already created instances. D seems correct to me... Reference: https://cloud.google.com/compute/docs/shutdownscript#apply_a_shutdown_script_to_running_instances

   Source: Adapted from community discussion — Gini

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 127 · 335 in bank

   Your organization has a 3-tier web application deployed in the same network on Google Cloud Platform. Each tier (web, API, and database) scales independently of the others. Network traffic should flow through the web to the API tier and then on to the database tier. Traffic should not flow between the web and the database tier. How should you configure the network?

   • AAdd each tier to a different subnetwork
   • BSet up software based firewalls on individual VMs
   • CAdd tags to each tier and set up routes to allow the desired traffic flow
   • DAdd tags to each tier and set up firewall rules to allow the desired traffic flow

   Show answer

   Answer: D

   Explanation

   Let's go with option elimination A. Add each tier to a different subnetwork >> Adding tiers to different subnets does not prevent or block them from accessing each other. Until specific firewall rules on VM or subnet allow access traffic on a specific port in the rule. B. Set up software-based firewalls on individual VMs >> Not a recommended practice will have to enable firewall anyway. C. Add tags to each tier and set up routes to allow the desired traffic flow >> Can be done but. D. Add tags to each tier and set up firewall rules to allow the desired traffic flow >> Recommended way Hence D

   Source: Adapted from community discussion — amxexam

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 128 · 335 in bank

   Select 3

   Your development team has installed a new Linux kernel module on the batch servers in Google Compute Engine (GCE) virtual machines (VMs) to speed up the nightly batch process. Two days after the installation, 50% of the batch servers failed the nightly batch run. You want to collect details on the failure to pass back to the development team. Which three actions should you take? (Choose three.)

   • AUse Stackdriver Logging to search for the module log entries
   • BRead the debug GCE Activity log using the API or Cloud Console
   • CUse gcloud or Cloud Console to connect to the serial console and observe the logs
   • DIdentify whether a live migration event of the failed server occurred, using in the activity log
   • EAdjust the Google Stackdriver timeline to match the failure time, and observe the batch server metrics
   • FExport a debug VM into an image, and run the image on a local server where kernel log messages will be displayed on the native screen

   Show answer

   Answer: ACE

   Explanation

   ACE A. Use Stackdriver Logging to search for the module log entries = Check logs C. Use gcloud or Cloud Console to connect to the serial console and observe the logs = Check grub messages, remember new kernel module was installed. E. Adjust the Google Stackdriver timeline to match the failure time, and observe the batch server metrics = Zoom into the time window when problem happened.

   Source: Adapted from community discussion — rishab86

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 129 · 335 in bank

   Select 2

   Your company wants to try out the cloud with low risk. They want to archive approximately 100 TB of their log data to the cloud and test the analytics features available to them there, while also retaining that data as a long-term disaster recovery backup. Which two steps should you take? (Choose two.)

   • ALoad logs into Google BigQuery
   • BLoad logs into Google Cloud SQL
   • CImport logs into Google Stackdriver
   • DInsert logs into Google Cloud Bigtable
   • EUpload log files into Google Cloud Storage

   Show answer

   Answer: AE

   Explanation

   Answers: A is correct because BigQuery is the fully managed cloud data warehouse for analytics and supports the analytics requirement. E is correct because Cloud Storage provides the Coldline storage class to support long-term storage with infrequent access, which would support the long-term disaster recovery backup requirement. https://cloud.google.com/bigquery/ https://cloud.google.com/stackdriver/ https://cloud.google.com/storage/docs/storage-classes#coldline https://cloud.google.com/sql/ https://cloud.google.com/bigtable/

   Source: Adapted from community discussion — andeu

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 130 · 335 in bank

    You created a pipeline that can deploy your source code changes to your infrastructure in instance groups for self-healing. One of the changes negatively affects your key performance indicator. You are not sure how to fix it, and investigation could take up to a week. What should you do?

    • ALog in to a server, and iterate on the fox locally
    • BRevert the source code change, and rerun the deployment pipeline
    • CLog into the servers with the bad code change, and swap in the previous code
    • DChange the instance group template to the previous one, and delete all instances

    Show answer

    Answer: B

    Explanation

    Let's go with option elimination A. Log in to a server, and iterate on the fix locally >> Long step, hence eliminate B. Revert the source code change and rerun the deployment pipeline >> This revert will be logged in the source repo. Will go with this way although D also is correct. C. login to the servers with the bad code change, and swap in the previous code >> C is manually doing what can be automatically done by B and C, hence eliminate. D. Change the instance group template to the previous one and delete all instances >> This is similar to B but why manually do something which is automated. Hence eliminate. But is also correct. But B is better from code lifecycle perspective. Hence B

    Source: Adapted from community discussion — amxexam

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCA practice, question 121. 335 questions available.