Free GCP-PCA sample questions

Correct answer: Provision a Dedicated Interconnect and configure MACsec encryption.

Dedicated Interconnect provides private, high-bandwidth (10 Gbps or 100 Gbps) connectivity. To meet the requirement of wire-level encryption without using the public internet, MACsec (Media Access Control Security) is the supported method for securing traffic directly on the Interconnect link. HA VPN over Interconnect is another option but adds IPsec overhead; MACsec is layer 2 encryption specifically for high-speed protection.

Correct answer: Configure Private Service Connect (PSC) for Vertex AI and enforce an Organization Policy to restrict resource locations to `europe-west1`.

To satisfy the requirements: 1) Private Service Connect (PSC) allows private consumption of services without traversing the public internet. 2) The Organization Policy constraint `gcp.resourceLocations` ensures all resources and processing remain within `europe-west1`, satisfying data residency. VPC Service Controls augment this but PSC + Org Policy is the direct architectural answer for connectivity and residency.

Correct answer: Lift and shift the workload to Google Cloud VMware Engine (GCVE).

Google Cloud VMware Engine (GCVE) is ideal for legacy workloads that require specific kernel support, Layer 2 networking, or cannot be refactored. It allows you to run a native VMware stack in Google Cloud, preserving the existing operating model and OS configurations without modification.

Correct answer: Configure Binary Authorization with an attestor that verifies the vulnerability scan and signature.

Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed to GKE. By configuring an Attestor, the system verifies that specific requirements (like passing a vulnerability scan and being signed) are met before the image is allowed to run. This enforces the secure supply chain requirement technically, rather than just via policy.

Correct answer: Coldline Storage with a lifecycle rule to delete data after 3 years.

Coldline Storage is designed for data accessed less than once a quarter, offering a lower storage cost than Nearline/Standard but with millisecond access times (unlike Archive which can have higher retrieval costs or be intended for >1 year storage with very low access). While Archive is cheaper for storage, the 'once per year' access fits Coldline well if the retention is exactly 3 years, but Archive is also a strong contender. However, for 'auditing' which implies potential urgency, Coldline is the safer balance. Wait—Archive also has millisecond access in GCP (unlike AWS Glacier). However, Archive has a 365-day minimum storage duration. Given 'rarely accessed (once per year)' and strict budget, Archive is actually the MOST cost-effective. Let's re-evaluate. Actually, Archive is best for data accessed less than once a year. If it's accessed 'once per year', Archive is valid. BUT, looking at the options, Coldline is often the standard answer for 'infrequent but immediate access' in older exams. However, in modern GCP, Archive is immediate too. Let's look at the options again. Option C suggests Archive. Option D suggests Coldline. Archive is cheaper ($0.0012/GB vs $0.004/GB). Both have immediate access. Therefore Archive is better for budget. I will select Archive if the minimum duration is met. 3 years > 365 days. So Archive is the correct answer.

Correct answer: Set the `max-instances` limit on the Cloud Run service.

Setting `max-instances` acts as a concurrency limit for the entire service. This prevents serverless auto-scaling from spinning up thousands of containers during a traffic spike, which would exhaust the database connection pool and crash the DB. This is a critical pattern for protecting downstream non-serverless resources.