Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 261Question →

A fintech enterprise is designing a hybrid network architecture to connect its on-premises transactional data center to a Google Cloud Virtual Private Cloud (VPC) hosting microservices across two GCP regions. The connection must support a aggregate throughput of 2 Gbps, mandate IPsec encryption for all data in transit over the wire, and automatically handle failover across both regions. The company does not reside in a Google Cloud colocation facility. Which TWO architectural options should the lead cloud architect select to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy High Availability (HA) Cloud VPN gateways in each GCP region to connect to the on-premises VPN devices.; Configure Cloud Router with dynamic Border Gateway Protocol (BGP) routing in both GCP regions.

Answer

The correct architecture requires deploying High Availability (HA) Cloud VPN gateways in each region combined with Cloud Router running BGP dynamic routing.
Deploying HA Cloud VPN gateways satisfies the mandatory IPsec encryption and the 2 Gbps bandwidth requirement (as HA VPN supports 3 Gbps per tunnel). Combining HA VPN with Cloud Router running BGP enables automated dynamic routing, multi-region path selection, and high-availability failover without manual static route updates.

Step-by-Step Solution

1
Evaluate throughput and encryption constraints
The required bandwidth is 2 Gbps with mandatory IPsec encryption. A single HA VPN tunnel pair supports up to 3 Gbps, satisfying throughput requirements while natively supplying IPsec encryption.
HA VPN avoids the physical colocation prerequisites of Dedicated Interconnect while meeting SLA and security standards.
2
Determine dynamic routing and multi-region failover mechanism
Deploying Cloud Router in both GCP regions enables dynamic BGP route propagation.
BGP dynamic routing automates failover and traffic rerouting across multiple regions if a tunnel or endpoint experiences downtime.

Key Concept

Designing High-Availability Encrypted Hybrid Connectivity with HA VPN and Cloud Router
Question 262Question →

An enterprise organization needs to connect its primary on-premises data center to a Google Cloud Virtual Private Cloud (VPC) network. The workload requires a sustained throughput of 15 Gbps with a high availability (HA) SLA of 99.99%. Which hybrid networking architecture should a Cloud Architect recommend to satisfy these requirements?

Show answer & explanation

Answer: Deploy redundant 10 Gbps Dedicated Interconnect circuits terminating in separate edge availability domains with Cloud Routers configured for dynamic BGP routing.

Answer

Deploy redundant 10 Gbps Dedicated Interconnect circuits terminating in separate edge availability domains with Cloud Routers configured for dynamic BGP routing.
Providing a 99.99% SLA with 15 Gbps sustained bandwidth requires Dedicated Interconnect connections deployed across two separate edge availability domains with redundant Cloud Routers running BGP. This architecture satisfies both the strict throughput demands and high availability design guidelines.

Step-by-Step Solution

1
Analyze bandwidth and connection requirements.
The requirement specifies sustained 15 Gbps traffic, exceeding single Cloud VPN tunnel capacity limits (3 Gbps per tunnel).
Dedicated Interconnect offers 10 Gbps or 100 Gbps pipe capacities, making it the appropriate choice for high-bandwidth traffic.
2
Evaluate high availability requirements for 99.99% SLA.
Google Cloud requires dual Dedicated Interconnect circuits terminating at two distinct edge availability domains (metros or locations) paired with redundant Cloud Routers.
Single-circuit topologies only support up to 99.9% availability, whereas production-critical 99.99% availability requires dual-facility redundant topologies.

Key Concept

Hybrid network architecture design for high availability and high throughput using Dedicated Interconnect.
Estimated Time:1m 0s
Question 263Question →

An enterprise logistics provider is architecting a mission-critical fleet tracking solution on Google Cloud. The application requires global high availability with a target SLA of 99.999%99.999\% uptime, zero Recovery Point Objective (RPO=0RPO = 0), and sub-second failover across continental regions for write-heavy relational transactions. Additionally, the network architecture requires high-throughput hybrid connectivity from on-premises data centers exceeding 10 Gbps10\text{ Gbps} per link, along with strict perimeter security to prevent data exfiltration. Which TWO architectural decisions should the cloud architect implement to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Provision a Multi-Region Cloud Spanner instance to serve the transactional data tier across multi-region failure domains.; Establish Dedicated Interconnect for hybrid connectivity and enforce VPC Service Controls around the Google Cloud project resources.

Answer

The team must deploy Cloud Spanner in a multi-region configuration for multi-region zero-RPO transactional data, and establish Dedicated Interconnect paired with VPC Service Controls for high-bandwidth hybrid ingress and exfiltration prevention.
To satisfy a 99.999% availability SLA with zero RPO across multi-region failure domains for relational data, Multi-Region Cloud Spanner is required. Synchronous multi-region Paxos consensus enables continuous operations without data loss. Furthermore, for hybrid network bandwidth requirements exceeding 10 Gbps per link, Dedicated Interconnect provides 10 Gbps or 100 Gbps dedicated circuits, while VPC Service Controls define a security perimeter that prevents unauthorized data exfiltration.

Step-by-Step Solution

1
Evaluate multi-region transactional database requirements (99.999%99.999\% SLA and RPO=0RPO = 0).
Identify that Cloud Spanner's multi-region configuration is the only GCP relational storage product offering multi-region synchronous replication with a 99.999% availability SLA.
Cloud SQL supports synchronous replication only within a single region across zones, whereas cross-region replication in Cloud SQL is asynchronous (RPO > 0).
2
Evaluate hybrid network throughput requirements (>10 Gbps>10\text{ Gbps}).
Select Dedicated Interconnect, which offers native 10 Gbps or 100 Gbps physical circuits.
HA Cloud VPN tunnels are capped at 3 Gbps per tunnel and cannot natively deliver >10 Gbps without complex tunnel aggregation.
3
Evaluate data exfiltration control requirements.
Apply VPC Service Controls around Google Cloud resources.
VPC Service Controls create a security perimeter that prevents unauthorized data transfers to external storage locations even if IAM credentials are compromised.

Key Concept

Multi-Region High Availability & Hybrid Infrastructure Design
Question 264Question →

A global gaming company is preparing for the launch of a new multiplayer game. The matchmaking service is deployed on Compute Engine Managed Instance Groups (MIGs) and communicates heavily over network sockets with minimal CPU overhead per connection. Historical load testing reveals that as concurrent player connections double, instance memory usage and active TCP socket connections saturate long before CPU utilization reaches 30%. What should you do to ensure the workload scales effectively during peak launch traffic while staying within Google Cloud resource limits?

Show answer & explanation

Answer: Configure the MIG autoscaling policy based on a custom Cloud Monitoring metric for active network connections, and verify/request regional CPU and instance quota increases in advance.

Answer

Configure the MIG autoscaling policy based on a custom Cloud Monitoring metric for active network connections, and verify/request regional CPU and instance quota increases in advance.
For workloads where network sockets or memory exhaust before CPU load increases, autoscaling policies must target a custom Cloud Monitoring metric reflecting connection count. Additionally, effective capacity planning requires preemptive quota verification and increase requests before event launches to avoid resource allocation caps.

Step-by-Step Solution

1
Identify the primary workload scaling bottleneck.
The application saturates memory and TCP socket connections before CPU utilization rises significantly, making standard CPU-based autoscaling ineffective.
I/O-bound or connection-heavy workloads require custom metrics (such as active socket count or memory utilization) to trigger scaling events accurately.
2
Evaluate infrastructure scaling prerequisites and capacity limits.
Proactively reviewing regional GCP quotas for Compute Engine vCPUs and in-use IP addresses ensures autoscaling is not blocked during launch surges.
GCP quotas act as hard boundaries that require explicit request and approval in advance of planned capacity expansions.

Key Concept

Capacity Planning and Custom Metric Workload Scaling
Estimated Time:1m 30s
Question 265Question →

An international media organization is migrating its digital asset management platform to Google Cloud. The architecture requires a single-region relational database (400 GB size) for content metadata that supports standard SQL queries and high availability (HA). Additionally, the organization needs to transfer 800 TB of legacy video archives from an on-premises data center to Cloud Storage Coldline within a 2-week migration window, but their available internet connection bandwidth is capped at 100 Mbps.

To minimize baseline operational costs while satisfying all technical and timeframe requirements, which TWO architectural decisions should you recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision Cloud SQL for MySQL configured with High Availability (HA) for the relational metadata database.; Order a Google Cloud Transfer Appliance to ingest the 800 TB historical video archive offline and ship it for data upload.

Answer

The organization should provision Cloud SQL for MySQL configured with High Availability for the database workload, and order a Google Cloud Transfer Appliance to transfer the 800 TB video archive offline.
Provisioning Cloud SQL for MySQL with High Availability fulfills single-region HA relational database requirements while keeping baseline infrastructure costs low compared to enterprise multi-region databases. Utilizing a Google Cloud Transfer Appliance provides an offline migration path capable of transferring 800 TB within the requested 2-week window, bypassing the throughput limitations of a 100 Mbps link.

Step-by-Step Solution

1
Evaluate relational database requirements and cost implications.
Cloud SQL supports regional HA workloads up to several terabytes cost-effectively, whereas Cloud Spanner introduces unnecessary cost for non-global, sub-terabyte relational needs.
Choosing Cloud SQL satisfies the high availability and SQL requirement without incurring Cloud Spanner baseline multi-node costs.
2
Calculate data transfer rate capabilities over the 100 Mbps WAN connection.
At a maximum theoretical bandwidth of 100 Mbps (12.5 MB/s12.5\text{ MB/s}), transferring 800 TB800\text{ TB} (800,000,000 MB800,000,000\text{ MB}) requires approximately 64,000,000 seconds (740 days740\text{ days}), exceeding the 2-week limit.
Online migration via Storage Transfer Service is infeasible, necessitating an offline appliance transfer.
3
Select appropriate offline migration tooling.
Google Cloud Transfer Appliance allows rackable appliance data capture on-premises and physical shipment to Google for rapid ingestion.
Transfer Appliance meets the 2-week completion requirement cost-effectively.

Key Concept

Cost-Optimized Database Selection and Large-Scale Offline Data Migration
Question 266Question →

An enterprise DevOps team needs to collect high-severity application logs across all projects within a Google Cloud folder and publish them to a centralized Pub/Sub topic for real-time automated incident response. The solution must capture only error-level logs and adhere strictly to Google Cloud security best practices and least-privilege access. Which TWO actions should the team take to implement this logging architecture?

Select all that apply

Show answer & explanation

Answer: Create an aggregated log sink at the folder level with an inclusion filter specifying severity >= ERROR, setting the centralized Pub/Sub topic as the destination.; Grant the Pub/Sub Publisher role (roles/pubsub.publisher) to the writer service account generated by the folder log sink on the target Pub/Sub topic.

Answer

To establish real-time centralized error log routing, the enterprise should create a folder-level aggregated log sink configured with an inclusion filter of severity >= ERROR pointing to the Pub/Sub topic, and grant the sink's unique writer service account the Pub/Sub Publisher role (roles/pubsub.publisher) on that topic.
Centralized cross-project logging across a resource hierarchy requires a folder-level aggregated log sink. Setting an inclusion filter for severity >= ERROR ensures that only high-severity operational logs are routed to the central Pub/Sub topic destination. Furthermore, Cloud Logging generates a unique writer service account for the sink; granting this service account the predefined Pub/Sub Publisher role (roles/pubsub.publisher) on the target topic complies with the principle of least privilege.

Step-by-Step Solution

1
Define the aggregated sink at the folder hierarchy
Creating an aggregated log sink at the folder level enables log capture across all child projects in one central configuration.
Folder-level sinks simplify operational monitoring management by aggregating logs across multi-project environments.
2
Apply an inclusion filter for high-severity logs
Setting severity >= ERROR filters out non-critical debug and info logs, focusing processing on actionable operational incidents.
Filtering at the sink level ensures only targeted log entries consume downstream bandwidth and Pub/Sub resources.
3
Grant fine-grained IAM permissions to the sink writer identity
Assigning roles/pubsub.publisher to the writer service account grants precise permissions required to publish to the target Pub/Sub topic.
Following least privilege avoids security risks associated with overly permissive primitive roles.

Key Concept

Aggregated Log Sinks and Least-Privilege IAM Sink Authorization
Question 267Question →

An enterprise operating a multi-folder Google Cloud resource hierarchy needs to stream all Data Access audit logs and Security Command Center (SCC) Premium findings to a third-party SIEM hosted on Google Kubernetes Engine (GKE). The security architecture must adhere to the principle of least privilege and ensure zero log loss. What is the correct sequence of steps to implement this centralized logging and threat export pipeline?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: First, provision the Pub/Sub topic and subscription in the central SecOps project. Second, create the organization-level aggregated log sink with include-children enabled. Third, grant the sink's writer identity the Pub/Sub Publisher role on the topic. Fourth, configure the SCC continuous export at the organization level pointing to the Pub/Sub topic. Fifth, bind the GKE Workload Identity service account to the Pub/Sub Subscriber role on the subscription.
Building a centralized security logging pipeline in Google Cloud requires creating target ingestion infrastructure (Pub/Sub topic/subscription) before referencing it in log sinks or SCC exports. Once the aggregated sink is created with `--include-children`, GCP generates a service account (writer identity) that must be explicitly granted `roles/pubsub.publisher` on the topic. After establishing log flow authorization, SCC continuous export is configured. Finally, the consumer SIEM workload on GKE is authorized using Workload Identity with `roles/pubsub.subscriber` on the subscription.

Step-by-Step Solution

1
Provision Pub/Sub Topic and Subscription
Destinations are created and ready to receive streaming logs and findings.
Log sinks and continuous exports require an existing target resource URI during creation validation.
2
Create Organization-Level Aggregated Log Sink
Aggregated log sink is instantiated across all folders/projects and generates a unique writer identity service account.
Creating the sink defines the filter rules and generates the service account identity needed for IAM authorization.
3
Authorize Log Sink Writer Identity
Writer identity is granted `roles/pubsub.publisher` on the destination Pub/Sub topic.
Google Cloud log sinks do not automatically receive write access to destination resources across project boundaries.
4
Configure SCC Continuous Export
Security Command Center streams real-time threat findings to the Pub/Sub topic.
Continuous export streams findings as they occur once the target Pub/Sub topic infrastructure is established.
5
Grant Subscriber Permissions via Workload Identity
SIEM workload on GKE securely pulls audit logs and findings using Workload Identity.
Adheres to least privilege security requirements for application ingestion without managing exported service account keys.

Key Concept

Organization-level log aggregation, service account authorization for log sinks, Security Command Center continuous export, and GKE Workload Identity integration.
Estimated Time:3m 0s
Question 268Question →

A media streaming company is preparing for a live global festival expected to draw five times its standard user traffic. The event processing pipeline consumes messages from Cloud Pub/Sub using a Compute Engine Managed Instance Group (MIG). Which TWO capacity planning and auto-scaling configurations should the Cloud Architect implement to ensure operational reliability during peak load? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Request regional Compute Engine resource quota increases well in advance of the event to ensure sufficient capacity is available for peak scaling.; Configure the Managed Instance Group autoscaler using a Cloud Monitoring metric based on Cloud Pub/Sub queue depth per instance.

Answer

The Cloud Architect should request regional compute quota increases in advance of the event and configure the Managed Instance Group autoscaler using a Cloud Pub/Sub queue depth metric.
To ensure reliable auto-scaling during high-demand events, capacity limits must be expanded beforehand by requesting regional quota increases. Additionally, for queue-driven workloads consuming Pub/Sub messages, auto-scaling should be driven by queue depth per instance rather than CPU utilization.

Step-by-Step Solution

1
Evaluate capacity limits for peak load.
Identify that default project quota limits may cap the maximum instance count during scaling events.
Requesting regional quota increases ahead of time prevents provisioning failures during traffic surges.
2
Select the appropriate auto-scaling metric for a queue-based processing workload.
Choose queue depth per worker (Pub/Sub unacknowledged messages) instead of standard CPU utilization.
Queue depth directly measures work backlog, enabling the autoscaler to scale instances up or down based on actual workload volume.

Key Concept

Capacity Planning and Queue-Based Auto-Scaling
Question 269Question →

A multinational retail enterprise is configuring connectivity between its main on-premises data center and a multi-region Google Cloud Virtual Private Cloud (VPC). The workload requires 15 Gbps of dedicated bandwidth, high availability backed by a 99.99% Service Level Agreement (SLA), and mandatory end-to-end IPsec encryption over private network paths. Which TWO architectural steps must be implemented together to satisfy all technical and SLA requirements?

Select all that apply

Show answer & explanation

Answer: Provision four Dedicated Interconnect connections (10 Gbps each) distributed across two distinct edge availability domains (metropolitan areas) and attach them to pair-configured Cloud Routers.; Deploy HA VPN gateways using private IP addressing (HA VPN over Interconnect) anchored to the Interconnect VLAN attachments.

Answer

To achieve a 99.99% SLA with >15 Gbps throughput and mandatory IPsec encryption, the architecture requires provisioning four 10 Gbps Dedicated Interconnect circuits across two distinct metropolitan locations attached to dual Cloud Routers, combined with HA VPN gateways configured over private IPs (HA VPN over Interconnect).
Achieving a 99.99% SLA for Dedicated Interconnect requires dual circuits across dual edge availability domains in two separate metros connected to distinct Cloud Routers in GCP. To satisfy the requirement for end-to-end IPsec encryption over this dedicated link without routing over public internet, HA VPN gateways must be established over the Interconnect attachments using private IP addresses.

Step-by-Step Solution

1
Analyze SLA and Bandwidth Requirements
99.99% SLA for Dedicated Interconnect requires 4 circuits total: 2 circuits in edge availability domain 1 and 2 circuits in edge availability domain 2 (across two metros), connected to two separate Cloud Routers in GCP.
Single circuits or single metro deployments only qualify for 99.9% SLA or no SLA.
2
Analyze Encryption and Private Path Requirements
Deploying HA VPN over Dedicated Interconnect using private IP addressing provides IPsec line-rate encryption over the dedicated private connections.
Standard Interconnect provides private transport but lacks native IPsec encryption; HA VPN overlay supplies required transit security.

Key Concept

High Availability Hybrid Connectivity with Encrypted Dedicated Interconnect
Estimated Time:2m 30s
Question 270Question →

A global autonomous transportation enterprise is designing a hybrid network architecture to connect diverse operational sites to Google Cloud. Match each hybrid connectivity requirement on the left with the most appropriate Google Cloud networking solution on the right.

Click a left item, then click its matching right item

Items

A primary data center requiring a private, unencrypted link supporting 20 Gbps bandwidth and a 99.99% availability SLA using direct physical connections to Google edge facilities across two metropolitan locations.
A regional telemetry center requiring up to 2 Gbps of encrypted, redundant connectivity over the public internet with dynamic routing provided by BGP.
A remote testing facility requiring SLA-backed 4 Gbps private connectivity where the enterprise does not co-locate in a Google Cloud Interconnect location and must rely on a third-party service provider.
A global multi-branch topology requiring site-to-site WAN connectivity and site-to-cloud routing using Google's global network infrastructure as a transit hub.

Matches

Show answer & explanation

Answer

The primary data center requirement (20 Gbps direct connection, 99.99% SLA) matches Dedicated Interconnect; the regional telemetry center requirement (2 Gbps encrypted link over public internet) matches HA VPN; the remote testing facility requirement (4 Gbps provider-managed private link) matches Partner Interconnect; and the multi-branch global WAN requirement matches Network Connectivity Center.
Matching high bandwidth (20 Gbps) and physical co-location to Dedicated Interconnect ensures 99.99% availability via redundant Cloud Routers across two metro areas. Matching encrypted 2 Gbps public internet traffic to HA VPN satisfies security and routing constraints. Partner Interconnect provides provider-managed sub-10 Gbps private links where direct co-location is unavailable. Network Connectivity Center enables site-to-site transit connectivity using Google Cloud's global backbone.

Step-by-Step Solution

1
Analyze bandwidth, physical co-location, and SLA requirements for the 20 Gbps primary data center connection.
Since bandwidth exceeds 10 Gbps and physical connection at Google edge facilities is specified, Dedicated Interconnect with redundant circuits across two metros is required to achieve a 99.99% SLA.
Cloud VPN cannot meet 20 Gbps bandwidth demands natively, and Partner Interconnect is meant for environments where direct co-location is not present.
2
Evaluate the regional telemetry center requirement for encrypted transmission over the public internet at 2 Gbps.
HA VPN provides dual active-active IPsec tunnels delivering up to 3 Gbps per tunnel bandwidth with dynamic BGP routing.
Interconnect solutions do not encrypt traffic by default and operate over dedicated private connections rather than the public internet.
3
Assess the remote facility requirement for 4 Gbps private SLA-backed connectivity without direct co-location presence.
Partner Interconnect enables connection through a supported service provider at sub-10 Gbps capacities without requiring colocation in a Google facility.
Dedicated Interconnect requires direct facility co-location, whereas Cloud VPN operates over public internet rather than private provider links.
4
Evaluate the global multi-branch site-to-site routing requirement.
Network Connectivity Center (NCC) allows using Google's global backbone for site-to-site WAN transit between hybrid networks.
Standard VPC Peering is non-transitive and cannot act as a transit network for on-premises-to-on-premises traffic.

Key Concept

Selecting and architecting Google Cloud hybrid connectivity services based on SLA, bandwidth, encryption, co-location, and WAN transit topology.
Question 271Question →

An online retail enterprise is migrating a stateless REST API service to Google Cloud. The workload experiences unpredictable traffic spikes during flash sale events but remains idle for extended periods overnight. The primary business goals are to minimize infrastructure costs by eliminating payment for idle compute capacity and to reduce operational overhead for an engineering team with no Kubernetes experience. Which architectural solution should a Cloud Architect recommend?

Show answer & explanation

Answer: Deploy the application using Cloud Run, configuring minimum instances to zero and leveraging pay-per-use request-based billing.

Answer

Deploy the application using Cloud Run, configuring minimum instances to zero and leveraging pay-per-use request-based billing.
Deploying the containerized application on Cloud Run directly satisfies all business and operational requirements. Because Cloud Run allows scaling down to zero instances, the enterprise incurs no compute costs during idle overnight periods. Furthermore, as a fully managed serverless product, it requires no underlying cluster administration or Kubernetes expertise.

Step-by-Step Solution

1
Analyze business goals and technical constraints
Identified a stateless REST API with variable and idle traffic patterns, strict requirements to eliminate idle compute costs, and a constraint to avoid Kubernetes management.
Understanding the workload pattern and organizational capabilities dictates the selection of compute paradigms.
2
Evaluate GCP compute options for cost optimization and operational overhead
Cloud Run provides fully managed serverless container execution that automatically scales down to zero instances when no requests are being processed.
Serverless request-driven platforms align cost directly with actual utilization, eliminating baseline infrastructure charges.
3
Assess alternative options against requirements
GKE cluster deployments and fixed MIG provisioning with CUDs incur continuous baseline charges even during zero-traffic periods, failing the requirement to minimize idle costs.
Fixed or cluster-based compute allocations incur static costs that are inefficient for bursty, intermittent workloads.

Key Concept

Selecting serverless compute platforms (Cloud Run) over cluster-based or VM-based infrastructure to optimize costs for bursty, idle workloads while minimizing operational overhead.
Question 272Question →

A retail enterprise is designing hybrid connectivity between its primary on-premises data center and Google Cloud. The architecture requires transferring continuous backup data streams at a rate of 12 Gbps. Additionally, multiple project VPC networks need to communicate centrally with on-premises services without relying on non-supported routing behaviors between VPC networks. Which TWO architectural decisions should the cloud architect implement to fulfill these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision a Dedicated Interconnect connection to support the required throughput of 12 Gbps between the on-premises facility and Google Cloud.; Design a Shared VPC topology or hub-and-spoke model using VPN/Interconnect gateways in a host project rather than expecting VPC Network Peering to route traffic transitively across spoke VPCs.

Answer

The architect must provision Dedicated Interconnect for high-bandwidth data transfers exceeding 10 Gbps and adopt a Shared VPC or central hub architecture instead of assuming VPC Network Peering provides transitive routing.
Dedicated Interconnect delivers physical 10 Gbps or 100 Gbps connections necessary for bandwidth requirements of 12 Gbps, while adopting Shared VPC or central hub routing accounts for the fundamental non-transitive limitation of VPC Network Peering.

Step-by-Step Solution

1
Evaluate hybrid connectivity bandwidth requirements.
Since the transfer requirement is 12 Gbps, HA VPN (limited to 3 Gbps per tunnel) is insufficient, requiring Dedicated Interconnect.
Dedicated Interconnect scales up to 10 Gbps or 100 Gbps links designed for heavy data throughput.
2
Evaluate network topology for multi-VPC access to on-premises.
Recognize that VPC Network Peering is non-transitive, so spokes cannot reach on-premises through a peered transit VPC.
Shared VPC or centralized router hub patterns are mandatory to route hybrid traffic across multiple managed environments.

Key Concept

Hybrid Cloud Connectivity and VPC Peering Transitivity Constraints
Question 273Question →

A regulatory compliance audit requires a healthcare organization to capture all Google Cloud Data Access audit logs across all projects and securely retain them for seven years. The solution must ensure that log data is encrypted using customer-managed encryption keys (CMEK) and protected against premature deletion or tampering by any privileged user, including organization admins. In which chronological order should a Cloud Security Architect perform the required implementation steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts by enabling Data Access audit logging at the organization level, provisioning a Cloud KMS key and granting the Cloud Logging service agent necessary crypto permissions, building the CMEK-encrypted log bucket with a 7-year retention window, creating the organization-aggregated log sink targeting this bucket, and finally locking the log bucket retention policy.
The sequence follows the logical dependency chain for secure compliance logging in GCP: first generating the required audit log stream (Data Access logs), then preparing encryption keys and granting key-access permissions to the logging service agent, followed by creating the target CMEK-enabled log bucket with the required retention period. Next, the organization-level aggregated sink is configured to route logs to the target bucket. Finally, after verification, the retention policy is locked to enforce immutable WORM compliance.

Step-by-Step Solution

1
Configure organization-wide Audit Config policy to capture Data Access logs for the designated services.
GCP services begin generating Data Access audit trail logs for data read and write calls across all current and future projects.
Data Access logs are disabled by default due to high volume, so they must be explicitly turned on at the hierarchy root.
2
Provision a KMS Key Ring and Key, then assign roles/cloudkms.cryptoKeyEncrypterDecrypter to the logging service service account.
Cloud Logging is authorized to use the customer-managed key for encrypting and decrypting log data.
Creating a CMEK-encrypted log bucket will fail if the Cloud Logging service account lacks active encrypter/decrypter permissions on the specified key.
3
Provision a custom Cloud Logging bucket with 2555 days of retention bound to the created Cloud KMS key.
A secure, CMEK-backed log bucket destination is established within Cloud Logging.
The log sink destination must exist and be properly configured before an aggregated sink can start routing log entries to it.
4
Establish an organization-level aggregated log sink pointing to the custom log bucket with an explicit filter targeting Data Access logs.
Data Access audit logs generated across all child projects and folders automatically aggregate into the custom CMEK log bucket.
Aggregated sinks catch logs across the entire organizational hierarchy, avoiding project-by-project manual sink management.
5
Execute the bucket retention lock command against the custom log bucket.
The retention policy becomes permanent and immutable, enforcing strict compliance against deletion.
Locking the policy enforces WORM (Write Once Read Many) guarantees required by legal and regulatory frameworks.

Key Concept

Organization-level CMEK-encrypted log retention and immutable bucket lock implementation for compliance audit logging.
Estimated Time:2m 30s
Question 274Question →

A DevOps engineering team is evaluating their CI/CD pipeline in Google Cloud to ensure secure deployments to Google Kubernetes Engine (GKE). Which of the following security practices should the team incorporate into their software development lifecycle and Cloud Build pipeline? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Cloud Build triggers to execute using a dedicated user-managed service account granted only the specific IAM roles required for the build and deployment tasks.; Enable automated container image vulnerability scanning in Artifact Registry to detect security issues prior to deployment.

Answer

The team should configure Cloud Build to use a dedicated user-managed service account with minimal necessary permissions and enable container image vulnerability scanning in Artifact Registry.
Configuring Cloud Build to execute using a dedicated user-managed service account adhering to least privilege minimizes security exposure. Additionally, integrating automated container vulnerability scanning in Artifact Registry identifies security vulnerabilities early in the CI/CD pipeline.

Step-by-Step Solution

1
Analyze pipeline identity and IAM permissions management.
Create a dedicated user-managed service account with granular IAM roles rather than using primitive roles or hardcoded credentials.
Applying least privilege limits the blast radius of build pipelines.
2
Analyze artifact security within the CI/CD workflow.
Integrate Artifact Registry container vulnerability scanning into the release process.
Scanning images automatically detects vulnerabilities before deployment to GKE.

Key Concept

Securing CI/CD pipelines with least privilege service accounts and automated vulnerability scanning
Question 275Question →

An enterprise gaming studio manages its multi-region multiplayer backend infrastructure using Terraform across multiple Google Cloud projects. The cloud architecture team needs to establish a secure Infrastructure as Code (IaC) governance model. The model must prevent concurrent deployment state corruption, eliminate security risks associated with exporting service account keys, and ensure any manual out-of-band infrastructure changes are rapidly identified. Which TWO actions should the lead architect mandate to achieve these requirements?

Select all that apply

Show answer & explanation

Answer: Configure a Google Cloud Storage (GCS) remote backend with object versioning enabled, and authenticate the CI/CD pipeline using Workload Identity Federation with fine-grained predefined roles.; Schedule continuous execution of terraform plan in the CI/CD pipeline to detect configuration drift against real-world infrastructure and require all environment updates to occur exclusively through pull-request pipelines.

Answer

The team should configure a Google Cloud Storage remote backend with versioning and Workload Identity Federation for keyless authentication, and schedule automated terraform plan runs to continuously detect out-of-band configuration drift.
Configuring a Cloud Storage remote backend ensures automated state locking and versioning protection, while Workload Identity Federation eliminates exported long-lived service account keys. Coupling this with automated scheduled terraform plan pipelines guarantees early drift detection and enforces IaC as the single source of truth.

Step-by-Step Solution

1
Configure backend state management and keyless CI/CD authentication
Cloud Storage remote backend provides native state locking and state versioning, while Workload Identity Federation avoids storing long-lived service account keys in CI/CD platforms.
Eliminates state corruption from concurrent applies while establishing secure least-privilege authentication.
2
Implement automated pipeline-driven drift detection and enforcement
Running scheduled terraform plan operations alerts the team when live infrastructure diverges from defined HCL code.
Ensures out-of-band modifications are immediately flagged and prevents manual changes from breaking future deployments.

Key Concept

Building and Managing Infrastructure as Code (IaC) governance with remote state management, least privilege CI/CD security, and automated drift detection.
Question 276Question →

A financial platform hosts its mission-critical transactions API on Compute Engine Managed Instance Groups (MIGs) behind an External HTTP(S) Load Balancer. The engineering team is planning a zero-downtime blue-green deployment for a major application version that includes database schema changes. To ensure high availability and prevent deployment pipeline failures during the environment cutover, which TWO architectural and operational steps must the team implement?

Select all that apply

Show answer & explanation

Answer: Apply database schema modifications using an expand-contract migration pattern to ensure full backward compatibility with the active blue environment prior to shifting traffic.; Verify and request regional Compute Engine CPU and instance quota increases in advance to accommodate running blue and green environments in parallel.

Answer

The team must apply database schema modifications using an expand-contract migration pattern and verify/request regional Compute Engine resource quota increases prior to deployment.
In a blue-green deployment pattern with a shared database, database schema changes must be backward-compatible (using an expand-contract pattern) so that the active blue environment continues to function normally while the green environment is deployed. Additionally, because blue-green deployments require running two identical environments side-by-side during validation and cutover, regional Compute Engine resource quotas must be requested and verified in advance to prevent provisioning errors.

Step-by-Step Solution

1
Analyze database migration strategy for zero-downtime blue-green deployments.
Identified that breaking DDL changes on shared database backends ruin backward compatibility for active blue nodes.
An expand-contract pattern allows new columns/tables to be added without invalidating queries from older application versions.
2
Evaluate infrastructure resource requirements during parallel blue and green execution.
Determined that concurrent execution requires double compute capacity during validation and cutover phases.
If regional CPU quotas are not increased ahead of time, green MIG auto-scaling or provisioning will fail during deployment.
3
Assess alternative compute platform suggestions.
Rejected platform migration to GKE as an over-engineered solution.
Compute Engine MIGs natively support backend service traffic shifting via HTTP(S) Load Balancing without incurring GKE cluster management overhead.

Key Concept

Blue-Green Deployment Infrastructure Requirements and Database Schema Compatibility
Question 277Question →

An enterprise architecture team is implementing a centralized compliance auditing strategy across their Google Cloud Organization. They need to export all admin activity and data access audit logs from multiple production projects into a single BigQuery dataset hosted in a dedicated security monitoring project. To meet strict security governance guidelines, they must grant minimal necessary permissions to the automated export mechanism. Which configuration approach correctly fulfills these compliance and least-privilege requirements?

Show answer & explanation

Answer: Create an organization-level aggregated Cloud Logging sink targeting the destination BigQuery dataset, and grant the sink's writer identity the BigQuery Data Editor role (roles/bigquery.dataEditor) on the target dataset.

Answer

Create an organization-level aggregated Cloud Logging sink targeting the destination BigQuery dataset, and grant the sink's writer identity the BigQuery Data Editor role (roles/bigquery.dataEditor) on the target dataset.
When exporting logs across projects via Cloud Logging sinks, Cloud Logging provisions a service account writer identity. To adhere to Google Cloud security best practices and least privilege, this writer identity must be granted fine-grained dataset-level permissions—specifically the BigQuery Data Editor role (roles/bigquery.dataEditor)—on the target dataset, rather than broad project-level or primitive roles.

Step-by-Step Solution

1
Configure Centralized Logging
An organization-level aggregated Cloud Logging sink collects audit logs across all resource hierarchies and routes them to the centralized BigQuery dataset.
Aggregated sinks provide centralized visibility and stream logs efficiently across multi-project organizations.
2
Retrieve Unique Writer Identity
Cloud Logging generates a dedicated service account identity specific to the sink.
Automated log export uses service account identities to authenticate data delivery across project boundaries.
3
Apply Least Privilege Permissions
Grant the BigQuery Data Editor role (roles/bigquery.dataEditor) to the writer identity strictly at the target dataset level.
This grants the exact write permissions required to stream log data into BigQuery tables without exposing broader project-level or administrative access.

Key Concept

Aggregated Cloud Logging Sinks and Least-Privilege IAM Authorization
Estimated Time:1m 30s
Question 278Question →

An e-commerce enterprise is reviewing its Google Cloud architecture to eliminate technical debt accumulated during a rapid cloud migration. The audit identified two core issues: simple stateless HTTP microservices are running on a custom Google Kubernetes Engine (GKE) cluster requiring heavy administrative maintenance, and a single-region relational database is running on Cloud Spanner, causing excessive operational cost. Which TWO architectural refactoring decisions directly mitigate this technical debt? (Select TWO answers)

Select all that apply

Show answer & explanation

Answer: Migrate the stateless HTTP microservices to Cloud Run to remove Kubernetes cluster management overhead.; Migrate the single-region relational database to Cloud SQL to reduce unnecessary cost and operational complexity.

Answer

Migrate the stateless HTTP microservices to Cloud Run to remove Kubernetes cluster management overhead, and migrate the single-region relational database to Cloud SQL to reduce unnecessary cost and operational complexity.
Refactoring stateless microservices from self-managed GKE clusters to Cloud Run eliminates ongoing cluster maintenance overhead. Replacing Cloud Spanner with Cloud SQL for single-region relational database needs aligns infrastructure sizing with actual requirements and significantly lowers operational expenses.

Step-by-Step Solution

1
Assess the compute workload technical debt
Simple stateless HTTP microservices do not require full Kubernetes orchestration overhead.
Moving stateless containers from GKE to fully managed Cloud Run eliminates cluster patching, node management, and baseline cost.
2
Assess the database workload technical debt
Single-region relational requirements do not justify Cloud Spanner.
Replacing Cloud Spanner with Cloud SQL matches single-region relational requirements at significantly reduced cost and complexity.

Key Concept

Technical Debt Mitigation via Serverless and Right-Sized Cloud Resources
Question 279Question →

An enterprise organization is establishing an automated, highly reliable Infrastructure as Code (IaC) continuous integration and deployment pipeline using Cloud Build and Terraform to provision multi-region production environments on Google Cloud. The architecture must guarantee state safety, strictly enforce security guardrails before resource creation, and prevent deployment rollouts if operational verification fails. In what sequential order should the pipeline execute these environment provisioning steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with authenticating and acquiring the backend state lock, followed by generating the plan with automated policy validation, applying the resource changes, executing post-provisioning verification tests, and finally recording deployment audit logs while releasing the state lock.
A reliable IaC deployment pipeline follows a strict sequence: lock state and authenticate, validate plan against security policies, apply changes, verify live health post-deployment, and unlock state while logging audit events.

Step-by-Step Solution

1
Authenticate using keyless service account impersonation and acquire the GCS backend state lock.
Establishes secure, short-lived IAM credentials and prevents concurrent state file access.
Acquiring state lock prior to execution ensures state consistency and prevents race conditions across CI/CD workers.
2
Run static analysis and policy checking tools against the output of 'terraform plan'.
Identifies compliance violations and security misconfigurations prior to resource deployment.
Evaluating infrastructure plans against policy-as-code ensures security and compliance guardrails are enforced before infrastructure modification.
3
Execute 'terraform apply' targeting the specified GCP environment configuration.
Provisions and configures GCP infrastructure components defined in the Terraform configuration files.
Resource creation can only safely proceed after the plan passes both syntax and policy validation checks.
4
Run automated post-deployment validation and health verification testing.
Confirms operational readiness, network routing, and service health against SLO criteria.
Verifying infrastructure functionality ensures that misconfigured resources are detected before routing live business workloads.
5
Log pipeline deployment completion metrics and release the remote GCS state lock.
Completes the pipeline execution lifecycle and frees the state file for subsequent pipeline runs.
Unlocking the state backend and updating compliance audit trails must be executed as the final step in the pipeline lifecycle.

Key Concept

Reliable Infrastructure as Code Pipeline Lifecycle and State Lock Management
Estimated Time:3m 0s
Question 280Question →

A regulatory compliance framework requires a media streaming enterprise to maintain full control over the lifecycle and rotation schedules of encryption keys protecting sensitive API secrets stored in Secret Manager. The regulatory standard mandates that keys must reside in FIPS 140-2 Level 3 validated hardware security modules (HSMs) managed within Google Cloud, and key management administrative duties must be strictly separated from key usage permissions assigned to services. Which security architecture fulfills these compliance and least-privilege requirements?

Show answer & explanation

Answer: Configure Secret Manager to use Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM, assigning the Cloud KMS Admin role (roles/cloudkms.admin) to the security operations team and the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) to the Secret Manager Service Agent.

Answer

Configure Secret Manager to use Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM, assigning the Cloud KMS Admin role (roles/cloudkms.admin) to the security operations team and the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) to the Secret Manager Service Agent.
Configuring Secret Manager to use Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM satisfies compliance mandates for FIPS 140-2 Level 3 hardware key protection while allowing the enterprise to manage key lifecycle and rotation. Granting the Cloud KMS Admin role to security administrators and the Cloud KMS CryptoKey Encrypter/Decrypter role to the Secret Manager Service Agent implements strict separation of duties and least privilege.

Step-by-Step Solution

1
Select the appropriate Google Cloud encryption key deployment model based on compliance specifications.
Identify Cloud KMS with Customer-Managed Encryption Keys (CMEK) backed by Cloud HSM as the solution that meets FIPS 140-2 Level 3 hardware security module requirements without requiring manual handling of raw key material.
Google-default encryption does not give customers key lifecycle control, while CSEK forces raw key management on the client rather than leveraging cloud-managed HSM infrastructure.
2
Configure the Identity and Access Management (IAM) permission structure to enforce separation of duties.
Grant the administrative role `roles/cloudkms.admin` to the security operations team and `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Secret Manager service agent (`service-PROJECT_NUMBER@gcp-sa-secretmanager.iam.gserviceaccount.com`).
Separating administrative key management from cryptographic operation permissions ensures least privilege, and granting permissions to the service agent enables Secret Manager to perform encryption/decryption on behalf of users.

Key Concept

Customer-Managed Encryption Keys (CMEK) with Cloud HSM and IAM Least Privilege
PreviousPage 14 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin