PCA practice questions 311–320

1. Question 311 · 335 in bank

   Mountkirk Games wants you to secure the connectivity from the new gaming application platform to Google Cloud. You want to streamline the process and follow Google-recommended practices. What should you do?

   • AConfigure Workload Identity and service accounts to be used by the application platform.
   • BUse Kubernetes Secrets, which are obfuscated by default. Configure these Secrets to be used by the application platform.
   • CConfigure Kubernetes Secrets to store the secret, enable Application-Layer Secrets Encryption, and use Cloud Key Management Service (Cloud KMS) to manage the encryption keys. Configure these Secrets to be used by the application platform.
   • DConfigure HashiCorp Vault on Compute Engine, and use customer managed encryption keys and Cloud Key Management Service (Cloud KMS) to manage the encryption keys. Configure these Secrets to be used by the application platform.

   Show answer

   Answer: A

   Explanation

   A is correct . https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity Workload Identity is the recommended way to access Google Cloud services from applications running within GKE due to its improved security properties and manageability. For information about alternative ways to access Google Cloud APIs from GKE, refer to the alternatives section below.

   Source: Adapted from community discussion — muhasinem

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 312 · 335 in bank

   Your organization is going to migrate applications to Kubernetes and use managed cloud services to deploy applications. Your team is new to Kubernetes and wants to quickly onboard engineers. You want to reduce operational overhead, so the engineering team can focus on developing consumer requirements instead of maintaining the infrastructure. What should you do?

   • APackage your application into a Docker image, and deploy it to Kubernetes on Compute Engine.
   • BLeverage Cloud Build to create a container image, and deploy it automatically to Kubernetes on Compute Engine.
   • CAssess application and dependencies for containerization Develop a migration strategy for deployment to GKE in Standard mode.
   • DAssess application and dependencies for containerization. Develop a migration strategy for deployment to GKE in Autopilot mode.

   Show answer

   Answer: D

   Next question

3. Question 313 · 335 in bank

   Your development team has created a mobile game app. You want to test the new mobile app on Android and iOS devices with a variety of configurations. You need to ensure that testing is efficient and cost-effective. What should you do?

   • AUpload your mobile app to the Firebase Test Lab, and test the mobile app on Android and iOS devices.
   • BCreate Android and iOS VMs on Google Cloud, install the mobile app on the VMs, and test the mobile app.
   • CCreate Android and iOS containers on Google Kubernetes Engine (GKE), install the mobile app on the containers, and test the mobile app.
   • DUpload your mobile app with different configurations to Firebase Hosting and test each configuration.

   Show answer

   Answer: A

   Explanation

   Correct Answer: A - Firebase Test Lab is a cloud-based app testing infrastructure that lets you test your app on a range of devices and configurations, so you can get a better idea of how it'll perform in the hands of live users. - Firebase Test Lab Run tests on a wide range of Android and iOS devices hosted by Test Lab.

   Source: Adapted from community discussion — VishalB

   Next question

4. Question 314 · 335 in bank

   Your company runs a critical, revenue-generating ecommerce application that is served by a regional managed instance group (MIG) behind an external HTTP(S) Load Balancer. The operations team is currently overwhelmed with low-priority notifications and is starting to ignore alerts. Your team's service level objective (SLO) is to maintain 99.9% availability, which is measured by the ratio of successful requests (2xx status codes) to total requests. You want to minimize noise from non-critical events and ensure that the team is only notified of issues that are actionable and threaten the SLO. What should you do?

   • AFocus on cause-based alerts, creating alerting policies with thresholds for the Compute Engine instances, including CPU utilization, memory usage, disk I/O, and network traffic.
   • BCreate log-based alerts for only the WARN and ERROR log entries generated by the application to ensure that no potential issue is missed.
   • CImplement an error budget policy based on the availability of the SLO. Create a "page” alert that triggers only when the rate of burn of the error budget predicts a full exhaustion within the next 24 hours.
   • DConfigure alerts based on predictive metrics. Use the instance count of the MIG as the primary metric to trigger an alert.

   Show answer

   Answer: C

   Next question

5. Question 315 · 335 in bank

   TerramEarth's CTO wants to use the raw data from connected vehicles to help identify approximately when a vehicle in the field will have a catastrophic failure. You want to allow analysts to centrally query the vehicle data. Which architecture should you recommend? A.

   

   B.

   

   C.

   

   D.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The push endpoint can be a load balancer. A container cluster can be used. Cloud Pub/Sub for Stream Analytics Reference: https://cloud.google.com/pubsub/ https://cloud.google.com/solutions/iot/ https://cloud.google.com/solutions/designing-connected-vehicle-platform https://cloud.google.com/solutions/designing-connected-vehicle-platform#data_ingestion http://www.eweek.com/big-data-and-analytics/google-touts-value-of-cloud-iot-core-for-analyzing-connected-car-data https://cloud.google.com/solutions/iot/

   Source: Adapted from community discussion — hems4all

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • cloud.google.com documentation

   

   Next question

6. Question 316 · 335 in bank

   You manage a highly distributed, hybrid- and multi-cloud IT environment, and your developers rely heavily on Prometheus for their workflows. You need a cloud-based, highly scalable, low-maintenance enterprise solution that supports Prometheus Query Language (PromQL) queries, quick metric viewing, and efficient issue diagnosis. What should you do?

   • ADeploy a Prometheus operator in your existing Kubernetes and Serverless setup across multi-cloud environments.
   • BSet up Cloud Monitoring as a single pane of glass across multi-cloud environments.
   • CEnable Google Cloud Managed Service for Prometheus to monitor and alert on your workloads at scale.
   • DBuild a SaaS-based, Prometheus-compatible solution to display metrics for each cloud in a customizable way.

   Show answer

   Answer: C

   Next question

7. Question 317 · 335 in bank

   Select 2

   Your agricultural division is experimenting with fully autonomous vehicles. You want your architecture to promote strong security during vehicle operation. Which two architectures should you consider? (Choose two.)

   • ATreat every micro service call between modules on the vehicle as untrusted.
   • BRequire IPv6 for connectivity to ensure a secure address space.
   • CUse a trusted platform module (TPM) and verify firmware and binaries on boot.
   • DUse a functional programming language to isolate code execution cycles.
   • EUse multiple connectivity subsystems for redundancy.
   • FEnclose the vehicle's drive electronics in a Faraday cage to isolate chips.

   Show answer

   Answer: AC

   Explanation

   The question is taken from Google Practice Exam. A and C are the correct. The answer from Google (with different order) A is not correct because this improves system durability, but it doesn't have any impact on the security during vehicle operation. B is not correct because IPv6 doesn't have any impact on the security during vehicle operation, although it improves system scalability and simplicity. C is not correct because it doesn't have any impact on the security during vehicle operation, although it improves system durability. D is not correct because merely using a functional programming language doesn't guarantee a more secure level of execution isolation. Any impact on security from this decision would be incidental at best. E is correct because this improves system security by making it more resistant to hacking, especially through man-in-the-middle attacks between modules. F is correct because this improves system security by making it more resistant to hacking, especially rootkits or other kinds of corruption by malicious actors.

   Source: Adapted from community discussion — mlantonis

   Next question

8. Question 318 · 335 in bank

   Your organization uses Google Kubernetes Engine (GKE) and Amazon Elastic Kubernetes Service (EKS) to manage a complex Kubernetes environment across multiple cloud providers. You need to deploy a solution that streamlines configuration management, enforces security policies, and ensures consistent application deployment across all of the environments. You want to follow Google-recommended practices. What should you do?

   • ALeverage Argo CD for GitOps-based continuous delivery and Open Policy Agent (OPA) for policy enforcement, and develop a controller for multi-cluster configuration management.
   • BDeploy Crossplane for managing cloud resources as Kubernetes objects, FluxCD for GitOps-based configuration synchronization, and Kyverno for policy enforcement.
   • CDeploy Kustomize for configuration customization, Config Sync with multiple Git repositories, and a script to enforce security policies.
   • DUtilize Config Sync as part of GKE to synchronize configurations from a centralized repository, and utilize Policy Controller to enforce policies using OPA Gatekeeper.

   Show answer

   Answer: D

   Next question

9. Question 319 · 335 in bank

   Operational parameters such as oil pressure are adjustable on each of TerramEarth's vehicles to increase their efficiency, depending on their environmental conditions. Your primary goal is to increase the operating efficiency of all 20 million cellular and unconnected vehicles in the field. How can you accomplish this goal?

   • AHave you engineers inspect the data for patterns, and then create an algorithm with rules that make operational adjustments automatically
   • BCapture all operating data, train machine learning models that identify ideal operations, and run locally to make operational adjustments automatically
   • CImplement a Google Cloud Dataflow streaming job with a sliding window, and use Google Cloud Messaging (GCM) to make operational adjustments automatically
   • DCapture all operating data, train machine learning models that identify ideal operations, and host in Google Cloud Machine Learning (ML) Platform to make operational adjustments automatically

   Show answer

   Answer: B

   Explanation

   Both B and D starts with "Capture all operating data, train machine learning models that identify ideal operations, ..." so they are offering the same method for training the data. The keypoint here is "make operational adjustments" such as adjusting the oil pressure so if we host in GCP-ML, how are we going to instruct vehicles on field to adjust their oil pressure if they have no internet connection? There is no way to use GCP-ML model generated parameters to command the "not connected" field vehicles to make operational adjustments automatically. Therefore, I believe running it locally on the servers sitting in the vehicles is the only option. My answer: B

   Source: Adapted from community discussion — cetanx

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 320 · 335 in bank

    Select 2

    Your company is rapidly deploying containerized microservices on Google Kubernetes Engine (GKE) using a robust CI/CD pipeline. Security is a top priority, and you need to implement a comprehensive and efficient strategy to prevent container image vulnerabilities from reaching your GKE production environment. What should you do? (Choose two.)

    • AReview the security reports generated by Artifact Analysis for each container image before deployment to GKE.
    • BIncorporate vulnerability scanning before building container images, and use Google-maintained base images for your container deployments.
    • CEnable Artifact Analysis for the container images, and stop deployment if critical vulnerabilities are found.
    • DUse a custom security policy within your container image that restricts access to specific network ports and resources.
    • EEnable Shielded GKE Nodes on the production cluster to automatically block the execution of container images with known vulnerabilities.

    Show answer

    Answer: BC

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCA practice, question 311. 335 questions available.