PCA practice questions 51–60

1. Question 51 · 335 in bank

   You are responsible for the Google Cloud environment in your company. Multiple departments need access to their own projects, and the members within each department will have the same project responsibilities. You want to structure your Google Cloud environment for minimal maintenance and maximum overview of IAM permissions as each department's projects start and end. You want to follow Google-recommended practices. What should you do?

   • AGrant all department members the required IAM permissions for their respective projects.
   • BCreate a Google Group per department and add all department members to their respective groups. Create a folder per department and grant the respective group the required IAM permissions at the folder level. Add the projects under the respective folders.
   • CCreate a folder per department and grant the respective members of the department the required IAM permissions at the folder level. Structure all projects for each department under the respective folders.
   • DCreate a Google Group per department and add all department members to their respective groups. Grant each group the required IAM permissions for their respective projects.

   Show answer

   Answer: B

   Explanation

   B is the answer. https://cloud.google.com/resource-manager/docs/access-control-folders#best-practices-folders-iam Use groups whenever possible to manage principals. https://cloud.google.com/resource-manager/docs/creating-managing-folders A folder can contain projects, other folders, or a combination of both. Organizations can use folders to group projects under the organization node in a hierarchy. For example, your organization might contain multiple departments, each with its own set of Google Cloud resources. Folders allow you to group these resources on a per-department basis.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 52 · 335 in bank

   Your company has an application running as a Deployment in a Google Kubernetes Engine (GKE) cluster. You have separate clusters for development, staging, and production. You have discovered that the team is able to deploy a Docker image to the production cluster without first testing the deployment in development and then staging. You want to allow the team to have autonomy but want to prevent this from happening. You want a Google Cloud solution that can be implemented quickly with minimal effort. What should you do?

   • AConfigure a Kubernetes lifecycle hook to prevent the container from starting if it is not approved for usage in the given environment.
   • BImplement a corporate policy to prevent teams from deploying Docker images to an environment unless the Docker image was tested in an earlier environment.
   • CConfigure binary authorization policies for the development, staging, and production clusters. Create attestations as part of the continuous integration pipeline.
   • DCreate a Kubernetes admissions controller to prevent the container from starting if it is not approved for usage in the given environment.

   Show answer

   Answer: C

   Explanation

   A good option for quickly implementing a solution to prevent deployments to the production cluster without first testing in development and staging would be to configure binary authorization policies for the development, staging, and production clusters. You can then create attestations as part of the continuous integration pipeline. Option C, "Configure binary authorization policies for the development, staging, and production clusters. Create attestations as part of the continuous integration pipeline," would be the correct choice for this scenario. Binary authorization is a feature of Google Kubernetes Engine that allows you to enforce policies on the images that are deployed to your clusters. By configuring binary authorization policies for the development, staging, and production clusters, you can ensure that only images that have been attested by an authorized entity are allowed to be deployed to those clusters. You can create the attestations as part of the continuous integration pipeline, which will allow you to verify that the image has been tested before it is deployed to the next environment.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation

   Next question

3. Question 53 · 335 in bank

   Your company wants to migrate their 10-TB on-premises database export into Cloud Storage. You want to minimize the time it takes to complete this activity, the overall cost, and database load. The bandwidth between the on-premises environment and Google Cloud is 1 Gbps. You want to follow Google-recommended practices. What should you do?

   • ADevelop a Dataflow job to read data directly from the database and write it into Cloud Storage.
   • BUse the Data Transfer appliance to perform an offline migration.
   • CUse a commercial partner ETL solution to extract the data from the on-premises database and upload it into Cloud Storage.
   • DCompress the data and upload it with gsutil -m to enable multi-threaded copy.

   Show answer

   Answer: B

   Explanation

   This is pretty simple. Time to transfer using Transfer Appliance: 1-3 weeks (I've used it twice and had a 2-3 week turnaround total) Time to transfer using 1Gbps : 30 hours (https://cloud.google.com/architecture/migration-to-google-cloud-transferring-your-large-datasets) Answer is D, using gsutil

   Source: Adapted from community discussion — pr2web

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 54 · 335 in bank

   Your company has an enterprise application running on Compute Engine that requires high availability and high performance. The application has been deployed on two instances in two zones in the same region in active-passive mode. The application writes data to a persistent disk. In the case of a single zone outage, that data should be immediately made available to the other instance in the other zone. You want to maximize performance while minimizing downtime and data loss. What should you do?

   • A1. Attach a persistent SSD disk to the first instance. 2. Create a snapshot every hour. 3. In case of a zone outage, recreate a persistent SSD disk in the second instance where data is coming from the created snapshot.
   • B1. Create a Cloud Storage bucket. 2. Mount the bucket into the first instance with gcs-fuse. 3. In case of a zone outage, mount the Cloud Storage bucket to the second instance with gcs-fuse.
   • C1. Attach a regional SSD persistent disk to the first instance. 2. In case of a zone outage, force-attach the disk to the other instance.
   • D1. Attach a local SSD to the first instance disk. 2. Execute an rsync command every hour where the target is a persistent SSD disk attached to the second instance. 3. In case of a zone outage, use the second instance.

   Show answer

   Answer: C

   Explanation

   C is right answer. C. 1. Attach a regional SSD persistent disk to the first instance. 2. In case of a zone outage, force-attach the disk to the other instance. gcs-fuse is slower than of regional SSD PD. **** Admin: You need to correct lots of questions. Some of the marked answers are nonsense, these must be revisited based on experts comments.

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 55 · 335 in bank

   You are designing a Data Warehouse on Google Cloud and want to store sensitive data in BigQuery. Your company requires you to generate the encryption keys outside of Google Cloud. You need to implement a solution. What should you do?

   • AGenerate a new key in Cloud Key Management Service (Cloud KMS). Store all data in Cloud Storage using the customer-managed key option and select the created key. Set up a Dataflow pipeline to decrypt the data and to store it in a new BigQuery dataset.
   • BGenerate a new key in Cloud KMS. Create a dataset in BigQuery using the customer-managed key option and select the created key.
   • CImport a key in Cloud KMS. Store all data in Cloud Storage using the customer-managed key option and select the created key. Set up a Dataflow pipeline to decrypt the data and to store it in a new BigQuery dataset.
   • DImport a key in Cloud KMS. Create a dataset in BigQuery using the customer-supplied key option and select the created key.

   Show answer

   Answer: D

   Explanation

   The answer is easy. It says keys must be left outside of Google Cloud. This automatically eliminates A / B. Now the C option says decrypts before storing it in BigQuery which the point is to encrypt the data while been in BigQuery, D is the only possible answer.

   Source: Adapted from community discussion — alexandercamachop

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 56 · 335 in bank

   Your organization has stored sensitive data in a Cloud Storage bucket. For regulatory reasons, your company must be able to rotate the encryption key used to encrypt the data in the bucket. The data will be processed in Dataproc. You want to follow Google-recommended practices for security. What should you do?

   • ACreate a key with Cloud Key Management Service (KMS). Encrypt the data using the encrypt method of Cloud KMS.
   • BCreate a key with Cloud Key Management Service (KMS). Set the encryption key on the bucket to the Cloud KMS key.
   • CGenerate a GPG key pair. Encrypt the data using the GPG key. Upload the encrypted data to the bucket.
   • DGenerate an AES-256 encryption key. Encrypt the data in the bucket using the customer-supplied encryption keys feature.

   Show answer

   Answer: B

   Explanation

   B. Create a key with Cloud Key Management Service (KMS). Set the encryption key on the bucket to the Cloud KMS key. To rotate the encryption key used to encrypt data in a Cloud Storage bucket, it is recommended to use Cloud KMS. You can create a new key version, set it as the primary version, and update the bucket's default KMS key to the new key version. This allows you to rotate the encryption key while still allowing access to the data. You can then process the data in Dataproc while the encryption key is being rotated. This approach provides security and compliance with regulations, as well as easy key rotation without disrupting access to data.

   Source: Adapted from community discussion — JC0926

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 57 · 335 in bank

   Your application needs to process credit card transactions. You want the smallest scope of Payment Card Industry (PCI) compliance without compromising the ability to analyze transactional data and trends relating to which payment methods are used. How should you design your architecture?

   • ACreate a tokenizer service and store only tokenized data
   • BCreate separate projects that only process credit card data
   • CCreate separate subnetworks and isolate the components that process credit card data
   • DStreamline the audit discovery phase by labeling all of the virtual machines (VMs) that process PCI data
   • EEnable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor

   Show answer

   Answer: A

   Explanation

   Final Decision to go with Option A. I have done PCI DSS Audit for my project and thats the best suited case. 100% sure to use tokenised data instead of actual card number

   Source: Adapted from community discussion — AD2AD4

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 58 · 335 in bank

   Your team needs to create a Google Kubernetes Engine (GKE) cluster to host a newly built application that requires access to third-party services on the internet. Your company does not allow any Compute Engine instance to have a public IP address on Google Cloud. You need to create a deployment strategy that adheres to these guidelines. What should you do?

   • AConfigure the GKE cluster as a private cluster, and configure Cloud NAT Gateway for the cluster subnet.
   • BConfigure the GKE cluster as a private cluster. Configure Private Google Access on the Virtual Private Cloud (VPC).
   • CConfigure the GKE cluster as a route-based cluster. Configure Private Google Access on the Virtual Private Cloud (VPC).
   • DCreate a Compute Engine instance, and install a NAT Proxy on the instance. Configure all workloads on GKE to pass through this proxy to access third-party services on the Internet.

   Show answer

   Answer: A

   Explanation

   ** Admins: More than 60% of the answers you have selected are wrong. Please correct them ASAP. I must appreciate community here for taking out time to share their perspective and help fellow learners. "B" can never be an answer here as the Private Google Access enables internal access to Google APIs only whereas in question the ask is "access to third-party services on the internet"

   Source: Adapted from community discussion — RitwickKumar

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 59 · 335 in bank

   Your company has a support ticketing solution that uses App Engine Standard. The project that contains the App Engine application already has a Virtual Private Cloud (VPC) network fully connected to the company's on-premises environment through a Cloud VPN tunnel. You want to enable the App Engine application to communicate with a database that is running in the company's on-premises environment. What should you do?

   • AConfigure private Google access for on-premises hosts only.
   • BConfigure private Google access.
   • CConfigure private services access.
   • DConfigure serverless VPC access.

   Show answer

   Answer: D

   Explanation

   Answer is D. Here the explanation since I didn't see any good answer: 1- We have a VPC. 2- We have an onpremisses DB. 3- We have App Engine (that runs on a isolated network that does not belong to the VPC). 4- We can connect the VPC to the onpremisses network using Cloud VPN, which is the main purpose of Cloud VPN (let's say to simplify this answer). 5 - Now how we connect the AppEngine that is isolated from the VPC and needs to use "something" to reach out the onpremisses DB directly (no public ip, only private ip)? Here we will have to have somehow access to the VPC and then the VPN and then the on premisses DB. That is the serverless vpc access. 6- So flow can be something like app engine --> serverless vpc access --> cloud VPN ---> on premessises db through private ip.

   Source: Adapted from community discussion — theBestStudent

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 60 · 335 in bank

    Your company is planning to upload several important files to Cloud Storage. After the upload is completed, they want to verify that the uploaded content is identical to what they have on-premises. You want to minimize the cost and effort of performing this check. What should you do?

    • A1. Use Linux shasum to compute a digest of files you want to upload. 2. Use gsutil -m to upload all the files to Cloud Storage. 3. Use gsutil cp to download the uploaded files. 4. Use Linux shasum to compute a digest of the downloaded files. 5. Compare the hashes.
    • B1. Use gsutil -m to upload the files to Cloud Storage. 2. Develop a custom Java application that computes CRC32C hashes. 3. Use gsutil ls -L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files. 4. Compare the hashes.
    • C1. Use gsutil -m to upload all the files to Cloud Storage. 2. Use gsutil cp to download the uploaded files. 3. Use Linux diff to compare the content of the files.
    • D1. Use gsutil -m to upload the files to Cloud Storage. 2. Use gsutil hash -c FILE_NAME to generate CRC32C hashes of all on-premises files. 3. Use gsutil ls -L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files. 4. Compare the hashes.

    Show answer

    Answer: D

    Explanation

    Seems most of the questions are having wrong answers.. If there is no discussion , its highly difficult to get the right answers.

    Source: Adapted from community discussion — Bahubali1988

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCA practice, question 51. 335 questions available.