PCA practice questions 181–190

1. Question 181 · 335 in bank

   Your customer wants to do resilience testing of their authentication layer. This consists of a regional managed instance group serving a public REST API that reads from and writes to a Cloud SQL instance. What should you do?

   • AEngage with a security company to run web scrapers that look your for users' authentication data om malicious websites and notify you if any is found.
   • BDeploy intrusion detection software to your virtual machines to detect and log unauthorized access.
   • CSchedule a disaster simulation exercise during which you can shut off all VMs in a zone to see how your application behaves.
   • DConfigure a read replica for your Cloud SQL instance in a different zone than the master, and then manually trigger a failover while monitoring KPIs for our REST API.

   Show answer

   Answer: C

   Explanation

   As per google documentation(https://cloud.google.com/solutions/scalable-and-resilient-apps) answer is C. C: A well-designed application should scale seamlessly as demand increases and decreases, and be resilient enough to withstand the loss of one or more compute resources. Resilience: designed to withstand the unexpected A highly-available, or resilient, application is one that continues to function despite expected or unexpected failures of components in the system. If a single instance fails or an entire zone experiences a problem, a resilient application remains fault tolerant—continuing to function and repairing itself automatically if necessary. Because stateful information isn’t stored on any single instance, the loss of an instance—or even an entire zone—should not impact the application’s performance.

   Source: Adapted from community discussion — Kri_2525

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 182 · 335 in bank

   Your BigQuery project has several users. For audit purposes, you need to see how many queries each user ran in the last month. What should you do?

   • AConnect Google Data Studio to BigQuery. Create a dimension for the users and a metric for the amount of queries per user.
   • BIn the BigQuery interface, execute a query on the JOBS table to get the required information.
   • CUse 'bq show' to list all jobs. Per job, use 'bq ls' to list job information and get the required information.
   • DUse Cloud Audit Logging to view Cloud Audit Logs, and create a filter on the query operation to get the required information.

   Show answer

   Answer: B

   Explanation

   D- reasons: 1.-Cloud Audit Logs maintains audit logs for admin activity, data access and system events. BIGQUERY is automatically send to cloud audit log functionality. 2.- In the filter you can filter relevant BigQuery Audit messages, you can express filters as part of the export https://cloud.google.com/logging/docs/audit https://cloud.google.com/bigquery/docs/reference/auditlogs#ids https://cloud.google.com/bigquery/docs/reference/auditlogs#auditdata_examples

   Source: Adapted from community discussion — Googler2

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 183 · 335 in bank

   You want to automate the creation of a managed instance group. The VMs have many OS package dependencies. You want to minimize the startup time for new VMs in the instance group. What should you do?

   • AUse Terraform to create the managed instance group and a startup script to install the OS package dependencies.
   • BCreate a custom VM image with all OS package dependencies. Use Deployment Manager to create the managed instance group with the VM image.
   • CUse Puppet to create the managed instance group and install the OS package dependencies.
   • DUse Deployment Manager to create the managed instance group and Ansible to install the OS package dependencies.

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Create a custom VM image with all OS package dependencies. Use Deployment Manager to create the managed instance group with the VM image. Managed instance groups are a way to manage a group of Compute Engine instances as a single entity. If you want to automate the creation of a managed instance group, you can use tools such as Terraform, Deployment Manager, or Puppet to automate the process. To minimize the startup time for new VMs in the instance group, you should create a custom VM image with all of the OS package dependencies pre-installed. This will allow you to create new VMs from the custom image, which will significantly reduce the startup time compared to installing the dependencies on each VM individually. You can then use Deployment Manager to create the managed instance group with the custom VM image.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 184 · 335 in bank

   Your company captures all web traffic data in Google Analytics 360 and stores it in BigQuery. Each country has its own dataset. Each dataset has multiple tables. You want analysts from each country to be able to see and query only the data for their respective countries. How should you configure the access rights?

   • ACreate a group per country. Add analysts to their respective country-groups. Create a single group 'all_analysts', and add all country-groups as members. Grant the 'all_analysts' group the IAM role of BigQuery jobUser. Share the appropriate dataset with view access with each respective analyst country-group.
   • BCreate a group per country. Add analysts to their respective country-groups. Create a single group 'all_analysts', and add all country-groups as members. Grant the 'all_analysts' group the IAM role of BigQuery jobUser. Share the appropriate tables with view access with each respective analyst country-group.
   • CCreate a group per country. Add analysts to their respective country-groups. Create a single group 'all_analysts', and add all country-groups as members. Grant the 'all_analysts' group the IAM role of BigQuery dataViewer. Share the appropriate dataset with view access with each respective analyst country- group.
   • DCreate a group per country. Add analysts to their respective country-groups. Create a single group 'all_analysts', and add all country-groups as members. Grant the 'all_analysts' group the IAM role of BigQuery dataViewer. Share the appropriate table with view access with each respective analyst country-group.

   Show answer

   Answer: A

   Explanation

   It should be A. The question requires that user from each country can only view a specific data set, so BQ dataViewer cannot be assigned at project level. Only A could limit the user to query and view the data that they are supposed to be allowed to.

   Source: Adapted from community discussion — Sebatian

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 185 · 335 in bank

   You have been engaged by your client to lead the migration of their application infrastructure to GCP. One of their current problems is that the on-premises high performance SAN is requiring frequent and expensive upgrades to keep up with the variety of workloads that are identified as follows: 20 TB of log archives retained for legal reasons; 500 GB of VM boot/data volumes and templates; 500 GB of image thumbnails; 200 GB of customer session state data that allows customers to restart sessions even if off-line for several days. Which of the following best reflects your recommendations for a cost-effective storage allocation?

   • ALocal SSD for customer session state data. Lifecycle-managed Cloud Storage for log archives, thumbnails, and VM boot/data volumes.
   • BMemcache backed by Cloud Datastore for the customer session state data. Lifecycle-managed Cloud Storage for log archives, thumbnails, and VM boot/data volumes.
   • CMemcache backed by Cloud SQL for customer session state data. Assorted local SSD-backed instances for VM boot/data volumes. Cloud Storage for log archives and thumbnails.
   • DMemcache backed by Persistent Disk SSD storage for customer session state data. Assorted local SSD-backed instances for VM boot/data volumes. Cloud Storage for log archives and thumbnails.

   Show answer

   Answer: B

   Explanation

   B is correct. WHY NOT OTHERS. A: is wrong Local SSD in non-persistent therefore cannot be used for session state (as questions also need to save data for users who are offline for several days). C: Again Local SSD cannot be used for boot volume (because its Non-persistent again) and always used for temporary data storage. D: Same reason as C. WHY B? Left with B that's why, but the question is how to store Boot/Data volume on Cloud Storage? - Storing other type of data is easy but most comments were about boot volume. - Boot volume can be stored to Cloud Storage by creating an Custom Image. https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#selecting_image_storage_location ---- Upvote if agree for the clarification of others ----

   Source: Adapted from community discussion — OSNG

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 186 · 335 in bank

   Your web application uses Google Kubernetes Engine to manage several workloads. One workload requires a consistent set of hostnames even after pod scaling and relaunches. Which feature of Kubernetes should you use to accomplish this?

   • AStatefulSets
   • BRole-based access control
   • CContainer environment variables
   • DPersistent Volumes

   Show answer

   Answer: A

   Explanation

   StatefulSets is a feature of Kubernetes, which the question asks about. Yes, Persistent volumes are required by StatefulSets (https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/). See the Google documentations for mentioning of hostnames (https://cloud.google.com/kubernetes-engine/docs/concepts/statefulset)... Answer A

   Source: Adapted from community discussion — Eroc

   References

   • Kubernetes documentation
   • Google Cloud documentation
   • Kubernetes documentation
   • Kubernetes documentation

   Next question

7. Question 187 · 335 in bank

   You are using Cloud CDN to deliver static HTTP(S) website content hosted on a Compute Engine instance group. You want to improve the cache hit ratio. What should you do?

   • ACustomize the cache keys to omit the protocol from the key.
   • BShorten the expiration time of the cached objects.
   • CMake sure the HTTP(S) header ג€Cache-Regionג€ points to the closest region of your users.
   • DReplicate the static content in a Cloud Storage bucket. Point CloudCDN toward a load balancer on that bucket.

   Show answer

   Answer: A

   Explanation

   A. Customize the cache keys to omit the protocol from the key. To improve the cache hit ratio with Cloud CDN, you should customize the cache keys to omit the protocol (e.g. HTTP or HTTPS) from the key. This will allow Cloud CDN to cache the same content under both HTTP and HTTPS, which can help to improve the hit ratio by allowing Cloud CDN to serve content from cache more frequently. To customize the cache keys, you can use the --key-include-protocol flag when enabling Cloud CDN for your Compute Engine instance group or load balancer. Setting this flag to false will cause Cloud CDN to omit the protocol from the cache key. Other options, such as shortening the expiration time of cached objects or replicating content in Cloud Storage, may also help to improve the cache hit ratio, but customizing the cache keys to omit the protocol is likely to have the greatest impact.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 188 · 335 in bank

   Your architecture calls for the centralized collection of all admin activity and VM system logs within your project. How should you collect these logs from both VMs and services?

   • AAll admin and VM system logs are automatically collected by Stackdriver.
   • BStackdriver automatically collects admin activity logs for most services. The Stackdriver Logging agent must be installed on each instance to collect system logs.
   • CLaunch a custom syslogd compute instance and configure your GCP project and VMs to forward all logs to it.
   • DInstall the Stackdriver Logging agent on a single compute instance and let it collect all audit and access logs for your environment.

   Show answer

   Answer: B

   Explanation

   Admin and event logs are configured by default. VM System logs require a logging agent to be configured. So A is not valid. Answer is B

   Source: Adapted from community discussion — shandy

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 189 · 335 in bank

   You set up an autoscaling instance group to serve web traffic for an upcoming launch. After configuring the instance group as a backend service to an HTTP(S) load balancer, you notice that virtual machine (VM) instances are being terminated and re-launched every minute. The instances do not have a public IP address. You have verified the appropriate web response is coming from each instance using the curl command. You want to ensure the backend is configured correctly. What should you do?

   • AEnsure that a firewall rules exists to allow source traffic on HTTP/HTTPS to reach the load balancer.
   • BAssign a public IP to each instance and configure a firewall rule to allow the load balancer to reach the instance public IP.
   • CEnsure that a firewall rule exists to allow load balancer health checks to reach the instances in the instance group.
   • DCreate a tag on each instance with the name of the load balancer. Configure a firewall rule with the name of the load balancer as the source and the instance tag as the destination.

   Show answer

   Answer: C

   Explanation

   "A" and "B" wouldn't turn the VMs on or off, it would jsut prevent traffic. "C" would turn them off if the health check is configured to terminate the VM is it fails. "D" is the start of a pseudo health check without any logic, so it also isn't an answer because it is like "A" and "B". Correct Answer: "C"

   Source: Adapted from community discussion — Eroc

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 190 · 335 in bank

    You have an App Engine application that needs to be updated. You want to test the update with production traffic before replacing the current application version. What should you do?

    • ADeploy the update using the Instance Group Updater to create a partial rollout, which allows for canary testing.
    • BDeploy the update as a new version in the App Engine application, and split traffic between the new and current versions.
    • CDeploy the update in a new VPC, and use Google's global HTTP load balancing to split traffic between the update and current applications.
    • DDeploy the update as a new App Engine application, and use Google's global HTTP load balancing to split traffic between the new and current applications.

    Show answer

    Answer: B

    Explanation

    B. Deploy the update as a new version in the App Engine application, and split traffic between the new and current versions. To test an update to an App Engine application with production traffic before replacing the current version, you can deploy the update as a new version in the App Engine application and split traffic between the new and current versions. This is known as a "blue-green" deployment, and it allows you to test the new version with a portion of production traffic while the current version is still serving the remainder of traffic. To split traffic between the new and current versions, you can use the App Engine traffic splitting feature. This feature allows you to specify the percentage of traffic that should be sent to each version, and it can be used to gradually ramp up traffic to the new version over time. This allows you to test the new version with a small portion of traffic initially, and gradually increase the traffic as you become more confident in the update.

    Source: Adapted from community discussion — omermahgoub

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCA practice, question 181. 335 questions available.