PCA practice questions 191–200

1. Question 191 · 335 in bank

   All Compute Engine instances in your VPC should be able to connect to an Active Directory server on specific ports. Any other traffic emerging from your instances is not allowed. You want to enforce this using VPC firewall rules. How should you configure the firewall rules?

   • ACreate an egress rule with priority 1000 to deny all traffic for all instances. Create another egress rule with priority 100 to allow the Active Directory traffic for all instances.
   • BCreate an egress rule with priority 100 to deny all traffic for all instances. Create another egress rule with priority 1000 to allow the Active Directory traffic for all instances.
   • CCreate an egress rule with priority 1000 to allow the Active Directory traffic. Rely on the implied deny egress rule with priority 100 to block all traffic for all instances.
   • DCreate an egress rule with priority 100 to allow the Active Directory traffic. Rely on the implied deny egress rule with priority 1000 to block all traffic for all instances.

   Show answer

   Answer: A

   Explanation

   Should be A, there is no implied deny egress but only implied allow egress https://cloud.google.com/vpc/docs/firewalls#default_firewall_rules Every VPC network has two implied firewall rules. These rules exist, but are not shown in the Cloud Console: The implied allow egress rule: An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination, except for traffic blocked by GCP. Outbound access may be restricted by a higher priority firewall rule. Internet access is allowed if no other firewall rules deny outbound traffic and if the instance has an external IP address or uses a NAT instance. Refer to Internet access requirements for more details. The implied deny ingress rule: An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming traffic to them. Incoming access may be allowed by a higher priority rule. Note that the default network includes some additional rules that override this one, allowing certain types of incoming traffic.

   Source: Adapted from community discussion — wk

   References

   • Google Cloud documentation

   Next question

2. Question 192 · 335 in bank

   Your customer runs a web service used by e-commerce sites to offer product recommendations to users. The company has begun experimenting with a machine learning model on Google Cloud Platform to improve the quality of results. What should the customer do to improve their model's results over time?

   • AExport Cloud Machine Learning Engine performance metrics from Stackdriver to BigQuery, to be used to analyze the efficiency of the model.
   • BBuild a roadmap to move the machine learning model training from Cloud GPUs to Cloud TPUs, which offer better results.
   • CMonitor Compute Engine announcements for availability of newer CPU architectures, and deploy the model to them as soon as they are available for additional performance.
   • DSave a history of recommendations and results of the recommendations in BigQuery, to be used as training data.

   Show answer

   Answer: D

   Explanation

   A,B,C is defining about the performance of ML but not the result....only the training data will give good ML result/predictions

   Source: Adapted from community discussion — sgofficial

   References

   • Google Cloud documentation

   Next question

3. Question 193 · 335 in bank

   A development team at your company has created a dockerized HTTPS web application. You need to deploy the application on Google Kubernetes Engine (GKE) and make sure that the application scales automatically. How should you deploy to GKE?

   • AUse the Horizontal Pod Autoscaler and enable cluster autoscaling. Use an Ingress resource to load-balance the HTTPS traffic.
   • BUse the Horizontal Pod Autoscaler and enable cluster autoscaling on the Kubernetes cluster. Use a Service resource of type LoadBalancer to load-balance the HTTPS traffic.
   • CEnable autoscaling on the Compute Engine instance group. Use an Ingress resource to load-balance the HTTPS traffic.
   • DEnable autoscaling on the Compute Engine instance group. Use a Service resource of type LoadBalancer to load-balance the HTTPS traffic.

   Show answer

   Answer: A

   Explanation

   My bad, as stated by other, Service doesn't support L7 load balancing. Hence, need to setup ingress resource. Correct answer is A.

   Source: Adapted from community discussion — Smart

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 194 · 335 in bank

   You need to design a solution for global load balancing based on the URL path being requested. You need to ensure operations reliability and end-to-end in- transit encryption based on Google best practices. What should you do?

   • ACreate a cross-region load balancer with URL Maps.
   • BCreate an HTTPS load balancer with URL Maps.
   • CCreate appropriate instance groups and instances. Configure SSL proxy load balancing.
   • DCreate a global forwarding rule. Configure SSL proxy load balancing.

   Show answer

   Answer: B

   Explanation

   B is the correct Answer, Google Cloud HTTP(S) load balancers and Traffic Director use a Google Cloud configuration resource called a URL map to route HTTP(S) requests to backend services or backend buckets. For example, with an external HTTP(S) load balancer, you can use a single URL map to route requests to different destinations based on the rules configured in the URL map: Requests for https://example.com/video go to one backend service. Requests for https://example.com/audio go to a different backend service. Requests for https://example.com/images go to a Cloud Storage backend bucket. Requests for any other host and path combination go to a default backend service. URL maps are used with the following Google Cloud products: External HTTP(S) Load Balancing (global, regional, and classic modes) Internal HTTP(S) Load Balancing Traffic Director https://cloud.google.com/load-balancing/docs/url-map-concepts

   Source: Adapted from community discussion — examch

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 195 · 335 in bank

   You have an application that makes HTTP requests to Cloud Storage. Occasionally the requests fail with HTTP status codes of 5xx and 429. How should you handle these types of errors?

   • AUse gRPC instead of HTTP for better performance.
   • BImplement retry logic using a truncated exponential backoff strategy.
   • CMake sure the Cloud Storage bucket is multi-regional for geo-redundancy.
   • DMonitor https://status.cloud.google.com/feed.atom and only make requests if Cloud Storage is not reporting an incident.

   Show answer

   Answer: B

   Explanation

   Answer is B You should use exponential backoff to retry your requests when receiving errors with 5xx or 429 response codes from Cloud Storage. https://cloud.google.com/storage/docs/request-rate

   Source: Adapted from community discussion — bigob4ek

   References

   • Google Cloud documentation
   • cloud.google.com documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 196 · 335 in bank

   You need to develop procedures to test a disaster plan for a mission-critical application. You want to use Google-recommended practices and native capabilities within GCP. What should you do?

   • AUse Deployment Manager to automate service provisioning. Use Activity Logs to monitor and debug your tests.
   • BUse Deployment Manager to automate service provisioning. Use Stackdriver to monitor and debug your tests.
   • CUse gcloud scripts to automate service provisioning. Use Activity Logs to monitor and debug your tests.
   • DUse gcloud scripts to automate service provisioning. Use Stackdriver to monitor and debug your tests.

   Show answer

   Answer: B

   Explanation

   Boom, everyone studied and did their labs, stackdriver is google's recommended tool for monitoring and debbuging. I agree with u all that B is the correct answer

   Source: Adapted from community discussion — passnow

   References

   • Google Cloud documentation

   Next question

7. Question 197 · 335 in bank

   Your company creates rendering software which users can download from the company website. Your company has customers all over the world. You want to minimize latency for all your customers. You want to follow Google-recommended practices. How should you store the files?

   • ASave the files in a Multi-Regional Cloud Storage bucket.
   • BSave the files in a Regional Cloud Storage bucket, one bucket per zone of the region.
   • CSave the files in multiple Regional Cloud Storage buckets, one bucket per zone per region.
   • DSave the files in multiple Multi-Regional Cloud Storage buckets, one bucket per multi-region.

   Show answer

   Answer: D

   Explanation

   What is point of Multi-Regional bucket, if this need to saved multiple times. I believe option (D) is for creating confusion only. It should be (A)..

   Source: Adapted from community discussion — AmitAr

   References

   • Google Cloud documentation

   Next question

8. Question 198 · 335 in bank

   Your company acquired a healthcare startup and must retain its customers' medical information for up to 4 more years, depending on when it was created. Your corporate policy is to securely retain this data, and then delete it as soon as regulations allow. Which approach should you take?

   • AStore the data in Google Drive and manually delete records as they expire.
   • BAnonymize the data using the Cloud Data Loss Prevention API and store it indefinitely.
   • CStore the data in Cloud Storage and use lifecycle management to delete files when they expire.
   • DStore the data in Cloud Storage and run a nightly batch script that deletes all expired data.

   Show answer

   Answer: C

   Explanation

   Answer is C. Noteworthy if you are moving PHI from an on-prem source into cloud storage bucket, the object creation date recorded is the current date and not the original creation date as seen in on-prem source. To port original creation date you could script a function to write to the object metadata field called "Custom time" which is referenced in object lifecycle rules. So to delete objects up to 4 years, you add an object lifecycle rule specifying the following form parameters: Action = "Delete object" Object conditions = select ""Days since custom time" checkbox and specify 1460 days.

   Source: Adapted from community discussion — JohnWick2020

   References

   • Google Cloud documentation

   Next question

9. Question 199 · 335 in bank

   You are deploying a PHP App Engine Standard service with Cloud SQL as the backend. You want to minimize the number of queries to the database. What should you do?

   • ASet the memcache service level to dedicated. Create a key from the hash of the query, and return database values from memcache before issuing a query to Cloud SQL.
   • BSet the memcache service level to dedicated. Create a cron task that runs every minute to populate the cache with keys containing query results.
   • CSet the memcache service level to shared. Create a cron task that runs every minute to save all expected queries to a key called ג€cached_queriesג€.
   • DSet the memcache service level to shared. Create a key called ג€cached_queriesג€, and return database values from the key before using a query to Cloud SQL.

   Show answer

   Answer: A

   Explanation

   A dedicated memset is always better than shared until cost-effectiveness specify in the exam as objective. So Option C and D are ruled out. From A and B, Option B is sending and updating query every minutes which is over killing. So reasonable option left with A which balance performance and cost. My answer will be A

   Source: Adapted from community discussion — hiteshrup

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 200 · 335 in bank

    For this question, refer to the TerramEarth case study. You start to build a new application that uses a few Cloud Functions for the backend. One use case requires a Cloud Function func_display to invoke another Cloud Function func_query. You want func_query only to accept invocations from func_display. You also want to follow Google's recommended best practices. What should you do?

    • ACreate a token and pass it in as an environment variable to func_display. When invoking func_query, include the token in the request. Pass the same token to func_query and reject the invocation if the tokens are different.
    • BMake func_query 'Require authentication.' Create a unique service account and associate it to func_display. Grant the service account invoker role for func_query. Create an id token in func_display and include the token to the request when invoking func_query.
    • CMake func_query 'Require authentication' and only accept internal traffic. Create those two functions in the same VPC. Create an ingress firewall rule for func_query to only allow traffic from func_display.
    • DCreate those two functions in the same project and VPC. Make func_query only accept internal traffic. Create an ingress firewall for func_query to only allow traffic from func_display. Also, make sure both functions use the same service account.

    Show answer

    Answer: B

    Explanation

    B Authentication function to function calls. Add calling function service account as a member on the receiving function and grant that member the cloud functions invoker https://cloud.google.com/functions/docs/securing/authenticating

    Source: Adapted from community discussion — raf2121

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCA practice, question 191. 335 questions available.