All practice questions

1598 questions

All types1,598 Multiple choice815 Multiple select537 Numeric8 Matching64 Ordering174

A healthcare enterprise needs to migrate $1.5\text{ PB}$ of historical medical imaging archives from an on-premises data center to Google Cloud Storage within a strict deadline of $30\text{ days}$ . The organization has an existing $1\text{ Gbps}$ Dedicated Interconnect link, but baseline daily operations consistently consume $80\%$ of its total bandwidth capacity. Corporate security governance mandates that all migrated data must be encrypted using Customer-Managed Encryption Keys (CMEK). Which data transfer strategy should you recommend to meet both the operational constraints and completion timeline?

Order GCP Transfer Appliance devices to perform an offline bulk data copy on-premises, ship the devices to Google for ingestion into Cloud Storage, and apply CMEK encryption during bucket setup.

Configure Storage Transfer Service to perform an online data migration over the existing Dedicated Interconnect connection using parallel agent pools.

Provision multiple high-throughput HA VPN tunnels over the public internet to bypass the bandwidth constraints of the existing Dedicated Interconnect link.

Stage the dataset in public Cloud Storage buckets via gsutil over the internet, relying exclusively on IAM roles for data protection without configuring VPC Service Controls.

Show answer & explanation

Answer: Order GCP Transfer Appliance devices to perform an offline bulk data copy on-premises, ship the devices to Google for ingestion into Cloud Storage, and apply CMEK encryption during bucket setup.

Answer

Order GCP Transfer Appliance devices to transfer the petabyte-scale data offline to Cloud Storage, and secure the ingested data using Customer-Managed Encryption Keys (CMEK).

For petabyte-scale datasets (

1.5\text{ PB}

) where usable network bandwidth is restricted to

200\text{ Mbps}

, online network transfer would take over 23 months. Utilizing Transfer Appliance allows secure offline capture and rapid physical delivery, satisfying both the 30-day migration timeframe and CMEK security compliance requirements.

Step-by-Step Solution

Calculate usable network bandwidth throughput for online transfer.

The usable bandwidth on the

1\text{ Gbps}

line is

20\%

, which equals

200\text{ Mbps}

(

25\text{ MB/s}

Baseline operational workloads take up

800\text{ Mbps}

of the available

1\text{ Gbps}

capacity.

Calculate time required to transfer

1.5\text{ PB}

over the network.

Transferring

1.5\text{ PB}

(

1,500,000\text{ GB}

) at

25\text{ MB/s}

requires approximately

60,000,000\text{ seconds}

694\text{ days}

Network-based online transfer cannot complete within the required

30\text{ day}

window.

Select the appropriate data migration product for offline petabyte-scale data.

Choose GCP Transfer Appliance, which physically ingests

1.5\text{ PB}

of data locally and is shipped directly to Google Cloud data centers for fast upload.

Transfer Appliance bypasses WAN bandwidth limitations and comfortably meets the 30-day timeline requirement while supporting CMEK integration.

Key Concept

Selecting between online network transfer (Storage Transfer Service) and offline physical transfer (Transfer Appliance) based on dataset size, available bandwidth, and completion timelines.

Question 282Question →

A financial technology company hosts a legacy transaction processing application on Compute Engine Virtual Machines (VMs). The operations team must collect detailed system memory metrics and custom application logs, ensuring that telemetry data is securely ingested into Cloud Monitoring and Cloud Logging following Google Cloud security best practices. Which architectural approach should the Cloud Architect recommend?

Install the Google Cloud Ops Agent on the Compute Engine instances and attach a dedicated service account configured with minimal predefined roles for log ingestion and metric writing.

Install the Google Cloud Ops Agent on the Compute Engine instances and assign the Editor primitive IAM role to the default Compute Engine service account to simplify telemetry authorization.

Install the Google Cloud Ops Agent on the Compute Engine instances and configure an aggregate Cloud Logging exclusion filter that drops all logs with severity level ERROR and above to reduce telemetry volume.

Configure identity permissions for metric write access and rely solely on IAM permissions without establishing VPC Service Controls perimeters to prevent unauthorized exfiltration of operational telemetry.

Show answer & explanation

Answer: Install the Google Cloud Ops Agent on the Compute Engine instances and attach a dedicated service account configured with minimal predefined roles for log ingestion and metric writing.

Answer

Install the Google Cloud Ops Agent on the Compute Engine instances and attach a dedicated service account configured with minimal predefined roles for log ingestion and metric writing.

Installing the Google Cloud Ops Agent provides unified logging and metrics collection (including memory utilization) on Compute Engine VMs. Attaching a dedicated service account with fine-grained predefined roles ensures compliance with security best practices and the principle of least privilege.

Step-by-Step Solution

Identify telemetry collection requirements for Compute Engine instances

Determine that both custom application logs and OS-level system metrics (such as memory) require the Google Cloud Ops Agent.

Compute Engine default metrics do not capture internal OS memory or custom log files without an agent installed.

Evaluate security and IAM authorization requirements

Select a dedicated service account equipped with standard IAM roles (`roles/logging.logWriter` and `roles/monitoring.metricWriter`).

This adheres to Google Cloud least privilege recommendations instead of using primitive roles.

Key Concept

Monitoring, Logging, and Observability Integration

Question 283Question →

A global financial services platform is migrating its core ledger database to Google Cloud. The system requires a relational database that provides ACID compliance across multiple geographic regions with automatic multi-region failover and horizontal write scalability. Security governance demands that data at rest be encrypted using keys managed in Cloud KMS, with key permissions granted following the principle of least privilege prior to resource creation. Which provisioning strategy should the cloud architecture team implement to meet these technical and compliance requirements?

Provision a Cloud Spanner instance with a multi-region configuration, grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Spanner service agent, and reference the CMEK key URI during database creation.

Provision a Cloud SQL for PostgreSQL instance with High Availability enabled across multiple zones, configure cross-region read replicas, and set up manual failover routines for regional outages.

Provision a multi-region Cloud Spanner instance by supplying 256-bit raw customer-supplied encryption keys directly in the API call headers during database creation.

Provision a multi-region Cloud Spanner instance using local Terraform state files stored on the operator workstation to manage resource dependencies and key encryption bindings.

Show answer & explanation

Answer: Provision a Cloud Spanner instance with a multi-region configuration, grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Spanner service agent, and reference the CMEK key URI during database creation.

Answer

The scenario requires horizontal write scalability across multiple geographic regions combined with strict ACID compliance. Cloud Spanner is Google Cloud's fully managed relational database built specifically for global scale and multi-region automatic availability. To enforce CMEK encryption, the Cloud Spanner service agent must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role prior to database instantiation.

Step-by-Step Solution

Evaluate database requirements for multi-region scale and transactional integrity

Identify Cloud Spanner as the target database service, as Cloud SQL cannot provide global multi-region horizontal write scaling.

Cloud Spanner delivers synchronous multi-region replication and globally distributed ACID transactions.

Determine the security and encryption provisioning process

Identify Customer-Managed Encryption Keys (CMEK) via Cloud KMS as the required encryption mechanism.

Cloud Spanner does not support raw CSEK keys, making CMEK via Cloud KMS mandatory for custom key control.

Establish key access permissions prior to resource creation

Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Cloud Spanner service agent (`[email protected]`).

The service account must have explicit permissions to encrypt and decrypt using the specified KMS key before database creation can succeed.

Key Concept

Provisioning Cloud Spanner with Customer-Managed Encryption Keys (CMEK)

Estimated Time:2m 0s

Question 284Question →

A game development studio is preparing to deploy a global multiplayer backend that requires thousands of GPU-accelerated Compute Engine instances across multiple Google Cloud regions. The platform must also enforce strict cost governance and access control over billing data across distinct development and production folder hierarchies. Which two architectural actions should the Cloud Architect execute to ensure seamless resource provisioning and billing governance? (Select TWO.)

Select all that apply

Proactively submit regional GPU quota increase requests via the Google Cloud Console or Service Quotas API well in advance of the scheduled deployment.

Configure Cloud Billing export to a centralized BigQuery dataset and grant fine-grained roles such as Cost Management Viewer and BigQuery Data Viewer to authorized FinOps personnel.

Rely on Compute Engine Managed Instance Group (MIG) autoscaling to dynamically request and increase regional GPU quotas in real time as user traffic surges.

Assign the primitive Owner role to deployment service accounts at the Organization level to allow automated quota modification and billing account configuration.

Show answer & explanation

Answer: Proactively submit regional GPU quota increase requests via the Google Cloud Console or Service Quotas API well in advance of the scheduled deployment.; Configure Cloud Billing export to a centralized BigQuery dataset and grant fine-grained roles such as Cost Management Viewer and BigQuery Data Viewer to authorized FinOps personnel.

Answer

The correct architecture requires proactively requesting regional GPU quota increases prior to launch and configuring Cloud Billing data export to BigQuery governed by fine-grained IAM roles.

Proactively requesting regional GPU quota increases ensures that Compute Engine instance groups can scale to the required capacity without encountering quota blockages during launch. Exporting Cloud Billing data to BigQuery while applying predefined least-privilege roles (e.g., Cost Management Viewer) enables comprehensive financial analytics and governance without over-privileging identities.

Step-by-Step Solution

Assess quota requirements for GPU accelerators across target regions.

Identified that default regional quotas are insufficient for peak multiplayer load.

Quota increases are not instantaneous and require administrative evaluation by Google Cloud.

Submit quota increase requests in advance for the affected regions.

Regional limits are raised prior to deployment, eliminating quota exhaustion risks during autoscaling.

MIG autoscaling can only scale up to the hard quota limit set on the project and region.

Establish automated Cloud Billing export to a central BigQuery dataset and enforce granular IAM access controls.

FinOps and operations teams gain real-time cost transparency using least-privilege roles without primitive permission risks.

BigQuery billing export provides complete visibility into resource consumption across folder hierarchies.

Key Concept

Managing Resource Quotas, Hierarchies, and Cost Optimization

Question 285Question →

A enterprise healthcare organization requires immutable, real-time security auditing for all Cloud Key Management Service (KMS) operations across its Google Cloud resource hierarchy. Project administrators must not be able to disable audit logging or modify the export destination. Additionally, all cryptographic key access events must be centralized for security analysis. Which TWO actions should the cloud security architect take to meet these governance requirements?

Select all that apply

Configure an organization-level aggregated log sink with includeChildren set to true that routes audit logs to a central Pub/Sub topic in a dedicated security project.

Enable Data Access audit logs for Cloud KMS at the organization level audit config to capture cryptographic key read and write operations across all projects.

Grant the primitive Owner role to individual service accounts handling log sinks to ensure they have administrative permissions to bypass exclusion filters.

Require each project administrator to manage log destinations locally using Customer-Supplied Encryption Keys (CSEK) for Cloud Storage audit buckets.

Show answer & explanation

Answer: Configure an organization-level aggregated log sink with includeChildren set to true that routes audit logs to a central Pub/Sub topic in a dedicated security project.; Enable Data Access audit logs for Cloud KMS at the organization level audit config to capture cryptographic key read and write operations across all projects.

Answer

The architect must configure an organization-level aggregated log sink with child inclusion enabled, and explicitly turn on Cloud KMS Data Access audit logs at the organization level.

To achieve tamper-proof, real-time central auditing across all projects, an organization-level aggregated log sink with child project inclusion ensures that all log entries are captured automatically regardless of project admin actions. Concurrently, Cloud KMS key usage events require enabling Data Access audit logs explicitly at the organization level because Admin Activity logs only record resource creation and metadata changes.

Step-by-Step Solution

Identify log capture scope requirements

Recognize that Admin Activity audit logs do not capture key usage operations; Data Access audit logs must be enabled for Cloud KMS.

Cryptographic operations like encrypt, decrypt, and sign generate Data Access audit logs which are disabled by default.

Ensure centralized enforcement and immutability

Deploy an organization-level aggregated log sink targeting a central Pub/Sub topic with child project inclusion enabled.

Organization-level sinks enforce uniform logging policies across all present and future projects while preventing project-level admins from altering log sinks.

Key Concept

Centralized Organization Audit Logging and Cloud KMS Audit Configuration

Question 286Question →

An automotive telematics enterprise needs to migrate its platform to Google Cloud within a strict 10-day maintenance window. The existing environment consists of $800\text{ TB}$ of historical vehicle sensor log archives stored on an on-premises NAS and a $1.5\text{ TB}$ operational MySQL database. The enterprise has a dedicated $200\text{ Mbps}$ network uplink allocated for migration traffic. The solution must ensure minimal downtime for the live transaction database while completing the bulk historical data transfer within the 10-day constraint. Which migration strategy should the cloud architect recommend?

Order a Google Cloud Transfer Appliance to migrate the

800\text{ TB}

historical sensor logs, and use Database Migration Service (DMS) with continuous replication for the

1.5\text{ TB}

MySQL database.

Use Storage Transfer Service over the

200\text{ Mbps}

connection to transfer the

800\text{ TB}

historical sensor logs, and use Database Migration Service (DMS) with continuous replication for the

1.5\text{ TB}

MySQL database.

Provision an HA VPN tunnel to increase network throughput for transferring the

800\text{ TB}

sensor logs via Storage Transfer Service, and export database dump files to Cloud Storage via Transfer Appliance.

Migrate the

1.5\text{ TB}

MySQL database to Cloud Spanner using Database Migration Service, and stream the

800\text{ TB}

sensor logs over the network using Storage Transfer Service.

Show answer & explanation

Answer: Order a Google Cloud Transfer Appliance to migrate the $800\text{ TB}$ historical sensor logs, and use Database Migration Service (DMS) with continuous replication for the $1.5\text{ TB}$ MySQL database.

Answer

Order a Google Cloud Transfer Appliance to migrate the

800\text{ TB}

historical sensor logs, and use Database Migration Service (DMS) with continuous replication for the

1.5\text{ TB}

MySQL database.

The optimal strategy pairs Transfer Appliance for the

800\text{ TB}

unstructured file archives with Database Migration Service (DMS) utilizing continuous CDC replication for the

1.5\text{ TB}

MySQL database. Transferring

800\text{ TB}

over a

200\text{ Mbps}

link requires approximately 370 days, making physical appliance shipping mandatory to achieve the 10-day deadline. Conversely, the

1.5\text{ TB}

database initial load requires approximately 16.6 hours over

200\text{ Mbps}

, allowing DMS to establish an online baseline and stream ongoing updates for a near-zero downtime cutover.

Step-by-Step Solution

Calculate data transfer time for the unstructured historical dataset over the available network uplink.

800\text{ TB} = 6.4 \times 10^{15}\text{ bits}

. At

200\text{ Mbps}

(

2 \times 10^8\text{ bps}

), transfer duration is

\frac{6.4 \times 10^{15}}{2 \times 10^8} = 32,000,000\text{ seconds} \approx 370\text{ days}

. Online network transfer is impossible within 10 days.

Large dataset scale (

800\text{ TB}

) under constrained bandwidth (

200\text{ Mbps}

) mandates an offline physical transfer appliance.

Evaluate network transfer feasibility for the

1.5\text{ TB}

relational database.

1.5\text{ TB} = 1.2 \times 10^{13}\text{ bits}

. At

200\text{ Mbps}

, initial bulk copy takes

\frac{1.2 \times 10^{13}}{2 \times 10^8} = 60,000\text{ seconds} \approx 16.6\text{ hours}

, which fits comfortably within the timeline.

The initial snapshot can load over the network in less than a day, followed by continuous Change Data Capture (CDC) replication.

Synthesize the optimal hybrid migration plan.

Ship an offline Transfer Appliance for the

800\text{ TB}

file archives while running Database Migration Service with CDC for the

1.5\text{ TB}

MySQL database.

This strategy satisfies both the 10-day total window constraint and the minimal downtime requirement for the live transactional workload.

Key Concept

Selecting between online network transfer mechanisms and offline physical transport appliances based on bandwidth calculations, dataset scale, and database cutover constraints.

Question 287Question →

A financial enterprise is expanding its hybrid cloud architecture and requires a dedicated hybrid connection between its on-premises data center infrastructure and a Google Cloud Virtual Private Cloud (VPC) network. The network architecture must guarantee a 99.99% availability Service Level Agreement (SLA) for production database sync traffic, utilize dynamic routing over Border Gateway Protocol (BGP), and maintain full redundancy against single-location failures. Which TWO configuration steps must you implement to establish this hybrid topology in accordance with Google Cloud best practices?

Select all that apply

Provision four Dedicated Interconnect circuits distributed across two distinct Google Cloud locations (metropolitan areas) and two Edge Availability Domains (EADs) per location.

Configure VLAN attachments on the interconnect circuits associated with Cloud Routers deployed across redundant regions within the VPC network.

Deploy two Dedicated Interconnect circuits in a single metropolitan location and supplement them with an HA VPN tunnel pair over the public internet to satisfy the 99.99% SLA cost-effectively.

Establish Dedicated Interconnect attachments in a single transit VPC and rely on VPC Network Peering to transit hybrid traffic to isolated spoke VPCs without adding interconnect attachments or custom route advertisements to the spokes.

Apply IAM primitive roles to the VLAN attachments as the sole security boundary to prevent unauthorized cross-project data exfiltration from on-premises endpoints.

Show answer & explanation

Answer: Provision four Dedicated Interconnect circuits distributed across two distinct Google Cloud locations (metropolitan areas) and two Edge Availability Domains (EADs) per location.; Configure VLAN attachments on the interconnect circuits associated with Cloud Routers deployed across redundant regions within the VPC network.

Answer

To achieve a 99.99% SLA for Dedicated Interconnect, the architecture requires four Dedicated Interconnect connections provisioned across two distinct metropolitan locations and two Edge Availability Domains (EADs) per location, combined with VLAN attachments linked to redundant Cloud Routers across separate GCP regions.

Google Cloud specifies that achieving a 99.99% availability SLA for Dedicated Interconnect requires deploying four physical circuits across two distinct metropolitan locations and two Edge Availability Domains (EADs) per location, attached to redundant Cloud Routers in two different GCP regions with dynamic BGP routing.

Step-by-Step Solution

Determine the physical infrastructure requirements for a 99.99% SLA on Dedicated Interconnect.

GCP mandates 4 connections across 2 different metropolitan locations (or locations in different EADs) with redundant on-premises routers.

Single-location deployments only qualify for a 99.9% SLA or no SLA depending on topology.

Configure the logical routing layer using Cloud Routers and BGP.

Deploy VLAN attachments to Cloud Routers in two different GCP regions within the target VPC network.

Dynamic routing via BGP across multi-region Cloud Routers enables continuous failover and traffic engineering.

Key Concept

99.99% Availability Architecture for GCP Dedicated Interconnect

Estimated Time:2m 0s

Question 288Question →

A smart utility company is architecting a new RESTful microservice on Google Cloud to collect and validate incoming telemetry data from millions of smart electric meters. The HTTP payload handling is entirely stateless, containerized, and experiences unpredictable traffic spikes throughout the day, dropping to near-zero volume overnight. The engineering team prioritizes minimizing operational maintenance, avoiding idle capacity charges, and deploying without managing underlying server infrastructure or Kubernetes cluster configurations. Which compute platform should the Cloud Architect recommend?

Deploy the containerized service on Cloud Run.

Provision a Standard Google Kubernetes Engine (GKE) cluster with an Autopilot node pool.

Deploy the service on a Compute Engine Managed Instance Group (MIG) backed by 1-year Committed Use Discounts.

Deploy the application to Compute Engine virtual machines configured with CPU-based autoscaling policies.

Show answer & explanation

Answer: Deploy the containerized service on Cloud Run.

Answer

Deploying the containerized service on Cloud Run is the optimal architecture choice.

Deploying on Cloud Run is correct because it directly executes stateless containers in a fully managed serverless environment. It automatically handles scaling up for incoming traffic bursts and scaling down to zero when there are no incoming HTTP requests, fulfilling the requirement of zero idle costs and zero cluster maintenance.

Step-by-Step Solution

Analyze workload requirements

Workload is stateless, HTTP-based, containerized, experiences highly variable traffic patterns, and must minimize operational management.

Understanding key constraints helps eliminate compute options requiring cluster upkeep or minimum baseline infrastructure costs.

Evaluate Google Cloud compute platforms against constraints

Cloud Run provides serverless container execution that automatically scales down to zero when idle and manages all cluster infrastructure.

Selecting fully managed serverless compute satisfies zero idle costs and minimal operational overhead.

Key Concept

Selecting serverless compute vs. cluster-based compute for stateless web workloads

Question 289Question →

An organization is deploying a multi-VPC environment in Google Cloud consisting of a Management VPC, a Workload VPC, and a Hybrid Connectivity VPC connected to an on-premises data center using HA VPN and Cloud Router. The team requires direct private connectivity between the Management VPC and Workload VPC, as well as multi-region reachability for hybrid routes across all deployed subnets. Which TWO actions should the cloud architect take to configure this network topology according to Google Cloud recommended practices?

Select all that apply

Establish direct VPC Network Peering between the Management VPC and the Workload VPC to enable direct, non-transitive communication between their resources.

Peer both the Management VPC and the Workload VPC to the Hybrid Connectivity VPC so on-premises traffic can reach both VPCs via transitive peering routing.

Configure the VPC network dynamic routing mode to Global on the Hybrid Connectivity VPC to allow Cloud Router to propagate routes across all regions.

Replace HA VPN with Classic VPN configured with static routes to achieve continuous dynamic routing updates across all subnets.

Rely strictly on standard IAM roles to prevent unauthorized cross-VPC data access without deploying VPC Service Controls or firewall rules.

Show answer & explanation

Answer: Establish direct VPC Network Peering between the Management VPC and the Workload VPC to enable direct, non-transitive communication between their resources.; Configure the VPC network dynamic routing mode to Global on the Hybrid Connectivity VPC to allow Cloud Router to propagate routes across all regions.

Answer

Establish direct VPC Network Peering between the Management VPC and the Workload VPC, and set the dynamic routing mode to Global on the Hybrid Connectivity VPC's Cloud Router configuration.

Establishing direct VPC Network Peering ensures low-latency, private connectivity between the Management and Workload VPCs without relying on non-supported transitive routing. Setting the VPC dynamic routing mode to Global ensures Cloud Router dynamically propagates BGP routes from on-premises to subnets in all regions across the VPC.

Step-by-Step Solution

Analyze cross-VPC communication requirements between Management and Workload VPCs.

Direct VPC Network Peering must be configured directly between the two VPCs because Google Cloud VPC Peering does not support transitive routing through a central hub VPC.

VPC Peering routes are not forwarded across multiple peering hops.

Evaluate hybrid dynamic routing propagation across regions.

Configuring the VPC dynamic routing mode to Global allows BGP routes learned by Cloud Router in one region to be shared with resources in all other regions within the VPC.

Regional dynamic routing restricts route propagation to resources located in the same region as the Cloud Router.

Key Concept

VPC Network Peering Non-Transitivity and Global Dynamic Routing

Question 290Question →

A multinational enterprise operates a multi-folder Google Cloud organization housing sensitive financial microservices. The security compliance team requires immediate notification when service account keys are created outside automated CI/CD pipelines, alongside real-time forwarding of threat findings to an on-premises Security Information and Event Management (SIEM) system. Additionally, security architects must ensure authorized internal operators cannot copy centralized audit logs to unauthorized external Google Cloud storage locations. Which architectural design satisfies these security logging, auditing, and compliance requirements?

Enable Security Command Center Premium with Event Threat Detection, configure continuous findings export via Pub/Sub to the SIEM, and enforce a VPC Service Controls perimeter encompassing the log sinks and storage resources.

Rely strictly on Cloud IAM role bindings on the log sink Cloud Storage buckets to prevent authorized security analysts from exporting sensitive log files to external projects.

Grant the primitive Owner role across all projects to the automated SIEM integration service account so it can continuously poll Cloud Audit Logs and Security Health Analytics findings.

Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the SIEM integration connector service account so it can monitor service account activity and key creation across the organization hierarchy.

Show answer & explanation

Answer: Enable Security Command Center Premium with Event Threat Detection, configure continuous findings export via Pub/Sub to the SIEM, and enforce a VPC Service Controls perimeter encompassing the log sinks and storage resources.

Answer

Combining Security Command Center Premium Event Threat Detection with continuous Pub/Sub export satisfies the real-time detection and SIEM integration requirements. Enforcing VPC Service Controls establishes a security perimeter that prevents authorized users from copying audit logs to destination buckets outside the perimeter, mitigating data exfiltration risks.

Step-by-Step Solution

Evaluate real-time threat detection and alerting capabilities.

Security Command Center Premium Event Threat Detection (ETD) analyzes Cloud Audit Logs automatically to identify suspicious activities like unauthorized service account key creation in near real-time.

Standard log queries or manual polling introduce detection latency, whereas SCC ETD natively parses log streams for security threats.

Establish real-time forwarding to the external SIEM.

Configure a continuous notification export from Security Command Center to a Pub/Sub topic connected to the on-premises SIEM ingestion pipeline.

Continuous export pushes threat findings immediately without custom API polling overhead.

Address data exfiltration risks for security audit logs.

Implement VPC Service Controls around the central audit logging storage resources and projects.

VPC Service Controls restricts ingress and egress of data regardless of IAM permissions, preventing authorized users from copying audit logs to external resources.

Key Concept

Security Command Center Event Threat Detection and VPC Service Controls Perimeter Protection

Question 291Question →

A financial services company is modernizing a stateless web microservice that processes incoming webhook events. The microservice receives HTTPS traffic that drops to zero outside of business hours but experiences unpredictable bursts reaching thousands of concurrent requests per second during peak trading events. The application is packaged in a Docker container that requires standard Linux binaries. The operations team has mandated two strict requirements: zero infrastructure management overhead and zero compute cost when there is no incoming traffic. Which Google Cloud compute platform and configuration should you recommend to satisfy these requirements?

Deploy the application container to Cloud Run fully managed, setting the minimum instance count to zero and enabling autoscaling based on concurrent requests.

Deploy the application container to a Google Kubernetes Engine (GKE) Autopilot cluster using a Horizontal Pod Autoscaler (HPA) configured for CPU utilization.

Deploy the container on a Compute Engine Managed Instance Group (MIG) using a custom VM image and configure scaling policies exclusively on CPU utilization metrics.

Provision a fixed capacity Compute Engine VM cluster sized for peak load and purchase 3-year Committed Use Discounts (CUDs) to minimize compute unit cost.

Show answer & explanation

Answer: Deploy the application container to Cloud Run fully managed, setting the minimum instance count to zero and enabling autoscaling based on concurrent requests.

Answer

Deploying the containerized application on Cloud Run fully managed with a minimum instance count of zero matches all technical and operational requirements.

Deploying the containerized application on Cloud Run fully managed with a minimum instance count of zero fulfills all constraints. Cloud Run provides serverless container execution for stateless HTTP/HTTPS services, handles request-based autoscaling automatically, requires zero infrastructure or cluster maintenance, and scales to zero instances during idle periods so no compute charges accrue.

Step-by-Step Solution

Evaluate workload characteristics and requirements

The application is stateless, containerized, receives HTTPS webhook traffic, requires rapid autoscaling from 0 to thousands of requests, and requires zero idle cost and zero management overhead.

Identifying key constraints narrows down compute platform choices from IaaS to Serverless PaaS.

Compare serverless compute platforms in Google Cloud

Cloud Run runs arbitrary stateless container workloads, scales to zero automatically when idle, handles request-based concurrency scaling without cluster administration, and bills strictly on consumed execution time.

GKE adds cluster/Kubernetes management overhead, while Compute Engine MIGs require VM provisioning and maintenance without scale-to-zero capabilities.

Select optimal compute option

Cloud Run fully managed configured with min-instances=0 directly fulfills the zero-overhead and zero-idle-cost mandates.

It avoids compute misallocation like GKE overkill or VM fixed provisioning for stateless containerized web APIs.

Key Concept

Selecting Serverless Compute Platforms (Cloud Run vs. GKE vs. Compute Engine) based on operational overhead, containerization, statelessness, and scale-to-zero requirements.

Question 292Question →

An enterprise organization is establishing an automated CI/CD pipeline using Terraform to manage infrastructure across hundreds of Google Cloud projects. The lead architect requires a solution that guarantees state file resilience against accidental deletion, prevents state corruption from concurrent automated pipeline runs, eliminates long-lived service account keys, and adheres to the principle of least privilege. Which deployment architecture and state management configuration should the Cloud Architect recommend?

Configure a central Cloud Storage bucket backend with Object Versioning and uniform bucket-level access enabled, rely on native Cloud Storage object locking for state concurrency control, and authenticate the CI/CD runners using Workload Identity Federation with short-lived tokens bound to specific predefined IAM roles.

Configure a central Cloud Storage bucket backend without Object Versioning, disable backend state locking to minimize pipeline execution latency, rely on job-level sequential queuing in the CI/CD tool for concurrency control, and assign the primitive Editor role to the automated deployment identity.

Export service account JSON key files into repository secret variables for build runner authentication, assign the Service Account Admin role across target projects, and track state files in local git repositories associated with each application codebase.

Deploy state files onto a shared Compute Engine persistent disk mounted across build worker instances, grant developer user accounts the Service Account Admin role directly to execute impersonation, and run Terraform apply steps via remote SSH execution scripts.

Show answer & explanation

Answer: Configure a central Cloud Storage bucket backend with Object Versioning and uniform bucket-level access enabled, rely on native Cloud Storage object locking for state concurrency control, and authenticate the CI/CD runners using Workload Identity Federation with short-lived tokens bound to specific predefined IAM roles.

Answer

Configure a Cloud Storage backend with Object Versioning, native object state locking, Workload Identity Federation keyless authentication, and least-privilege predefined IAM roles.

Combining a Cloud Storage backend with native object locking and Object Versioning ensures state durability and concurrency control. Integrating Workload Identity Federation replaces static service account keys with short-lived tokens, while predefined IAM roles maintain strict operational security boundaries.

Step-by-Step Solution

Select remote state storage and locking architecture.

Google Cloud Storage backends provide built-in object locking and versioning to prevent race conditions and preserve state historical snapshots.

Unversioned backends or local disk storage risk data loss and state corruption during concurrent pipeline runs.

Determine runner authentication and credential lifecycle management.

Workload Identity Federation enables external CI/CD pipelines to impersonate GCP service accounts without generating or storing long-lived service account JSON keys.

Static service account keys present high security risks if leaked, committed to repositories, or improperly rotated.

Define IAM permissions for deployment identities.

Assign fine-grained predefined roles specific to the target resources being provisioned rather than primitive roles or identity management administrative roles.

Primitive roles grant excessive rights that compromise boundary security if the pipeline identity is hijacked.

Key Concept

Enterprise Infrastructure as Code Automation with Terraform Backend and Identity Best Practices

Question 293Question →

A global gaming company structures its Google Cloud resource hierarchy with an Organization node containing top-level folders named Game-Services and Corporate-IT. The infrastructure team needs to grant a group of site reliability engineers (SREs) full administrative access to Compute Engine resources across all current and future projects nested inside the Game-Services folder. The security team requires strict compliance with the principle of least privilege while minimizing management overhead. Which IAM assignment strategy should be implemented?

Grant the Compute Admin role (roles/compute.admin) to the SRE group at the Game-Services folder level.

Grant the Editor primitive role (roles/editor) to the SRE group at the Game-Services folder level.

Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the SRE group at the Game-Services folder level.

Grant IAM permissions at the individual project level and configure VPC Service Controls to restrict Compute Engine management across folders.

Show answer & explanation

Answer: Grant the Compute Admin role (roles/compute.admin) to the SRE group at the Game-Services folder level.

Answer

Grant the Compute Admin role (roles/compute.admin) to the SRE group at the Game-Services folder level.

In Google Cloud IAM, policies applied at a folder node are inherited by all resource containers beneath it, including current and future projects. Assigning the predefined Compute Admin role (roles/compute.admin) at the Game-Services folder level satisfies least privilege for Compute Engine resources while eliminating the administrative burden of granting per-project permissions.

Step-by-Step Solution

Identify the required scope and permissions

Permissions must grant full management over Compute Engine resources across all nested projects in the Game-Services folder.

SREs need to manage compute resources across all existing and future projects within that specific folder branch.

Apply Google Cloud resource hierarchy inheritance rules

Granting roles at a parent folder level propagates permissions down to all existing and future child projects automatically.

This satisfies the requirement to minimize operational management overhead when projects are added.

Select the appropriate IAM role adhering to least privilege

The predefined role Compute Admin (roles/compute.admin) provides full control of Compute Engine resources without granting access to unrelated GCP services.

Primitive roles like Editor grant excessive broad access, violating security requirements.

Key Concept

Resource Hierarchy IAM Policy Inheritance and Predefined Roles

Estimated Time:1m 30s

Question 294Question →

A scientific research institute is migrating a specialized numerical simulation workload to Google Cloud. The simulation software requires custom Linux kernel modules that must be loaded directly into the host operating system kernel, executes continuous batch runs lasting up to 10 hours per job, and requires local high-speed NVMe storage. The operations team wants to ensure minimal cost when no simulation jobs are running while keeping infrastructure management simple. Which compute platform should the cloud architect select to meet these technical constraints?

Compute Engine virtual machines utilizing custom OS images and Spot VMs, configured to terminate upon job completion.

Google Kubernetes Engine (GKE) Autopilot mode deployed with custom DaemonSets to load the required kernel drivers.

Cloud Run jobs configured with max instances and Cloud Storage FUSE volume mounts.

Cloud Functions (2nd gen) triggered by Cloud Pub/Sub events with maximum memory allocations.

Show answer & explanation

Answer: Compute Engine virtual machines utilizing custom OS images and Spot VMs, configured to terminate upon job completion.

Answer

Compute Engine virtual machines utilizing custom OS images and Spot VMs, configured to terminate upon job completion.

Compute Engine is the only option that offers complete administrative access to the guest operating system, allowing the installation of custom Linux kernel modules. Additionally, Compute Engine supports jobs running up to 10 hours without timeout limits, allows local NVMe SSD attachments, and supports Spot VMs to dramatically lower compute costs for batch processing.

Step-by-Step Solution

Analyze OS Kernel and Infrastructure Control Requirements

The requirement for custom Linux host kernel modules eliminates fully managed serverless platforms (Cloud Run, Cloud Functions) and managed container node platforms (GKE Autopilot) where host kernel access is restricted.

Serverless and managed container platforms hide host node kernel management to maintain security and multi-tenancy abstraction.

Evaluate Job Duration and Storage Constraints

The 10-hour execution duration exceeds standard serverless execution limits (such as Cloud Functions' 60-minute cap), requiring IaaS Virtual Machines.

Compute Engine instances have no job duration execution caps and support direct attachment of local NVMe SSDs.

Optimize Cost Efficiency for Batch Workloads

Using Spot VMs with custom images allows for up to 60-91% cost savings for fault-tolerant or scheduled batch jobs.

Terminating instances when no rendering or simulation jobs are active prevents idle resource charges.

Key Concept

Selecting GCP Compute Platforms based on Kernel Control, Execution Limits, and Custom Hardware Needs

Question 295Question →

A Lead Cloud Architect is designing an automated CI/CD pipeline using Google Cloud Build and Terraform to provision infrastructure across multiple enterprise Google Cloud projects. Security compliance requires eliminating long-lived service account JSON keys while maintaining strict adherence to the principle of least privilege. The pipeline running in a central management project must provision compute and networking resources inside target workload projects. Which authentication and IAM delegation strategy should you implement?

Grant the Cloud Build service account the roles/iam.serviceAccountTokenCreator role on dedicated deployment service accounts in each target project, configure Terraform to use short-lived credential impersonation, and assign fine-grained predefined roles to the target service accounts.

Grant the central Cloud Build service account the roles/iam.serviceAccountAdmin role across all target projects so Terraform can dynamically elevate permissions and manage target service accounts during execution.

Grant the central Cloud Build service account the primitive roles/owner role at the organization level so Terraform has full resource creation authority across all current and future target projects.

Configure the pipeline script to dynamically generate service account JSON keys at build start, store them in the local Terraform workspace, and delete them immediately after terraform apply finishes.

Show answer & explanation

Answer: Grant the Cloud Build service account the roles/iam.serviceAccountTokenCreator role on dedicated deployment service accounts in each target project, configure Terraform to use short-lived credential impersonation, and assign fine-grained predefined roles to the target service accounts.

Answer

Grant the Cloud Build service account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on target project deployment service accounts, configure Terraform Google provider service account impersonation, and assign specific predefined roles to the target deployment service accounts.

The correct approach leverages native GCP IAM service account impersonation by granting `roles/iam.serviceAccountTokenCreator` on target service accounts to the central Cloud Build service account. Terraform's Google provider natively supports `alias` blocks with `access_token` impersonation, allowing completely keyless pipeline authentication that strictly obeys least-privilege principles.

Step-by-Step Solution

Identify the keyless authentication requirement for enterprise CI/CD pipelines.

Avoid downloading or storing static service account JSON key files.

Static service account keys present high security risks related to credential leakages and key rotation management overhead.

Configure IAM delegation using Service Account Impersonation.

Cloud Build service account impersonates target deployment service accounts using short-lived tokens.

Granting `roles/iam.serviceAccountTokenCreator` on specific target service accounts allows short-lived token acquisition without exposing raw key credentials.

Apply least-privilege permissions to target deployment service accounts.

Target service accounts possess only the fine-grained predefined IAM roles necessary to provision specific resources within target projects.

Ensures central pipeline operations strictly conform to least privilege without using primitive roles or overly broad administrative access.

Key Concept

Keyless IAM Service Account Impersonation in Terraform CI/CD Pipelines

Question 296Question →

Your engineering team is migrating legacy infrastructure management to an automated CI/CD pipeline using Terraform across multiple Google Cloud projects. You need to configure state storage and pipeline access permissions to ensure concurrency safety, auditability, and adherence to least-privilege security principles. Which architecture configuration should you implement?

Store the state file in a Cloud Storage backend with Object Versioning enabled, and configure the automated pipeline to impersonate a dedicated service account using the Service Account Token Creator role.

Store the Terraform state file in the application source control repository, and execute the automated pipeline using a service account assigned the primitive Owner role.

Store the state file in an unversioned Cloud Storage bucket, and grant the pipeline service account the Service Account Admin role to ensure it can manage all identity resources during execution.

Store the Terraform state in local execution storage, and configure the pipeline script to request GCP regional quota increases automatically after a state apply failure occurs.

Show answer & explanation

Answer: Store the state file in a Cloud Storage backend with Object Versioning enabled, and configure the automated pipeline to impersonate a dedicated service account using the Service Account Token Creator role.

Answer

Configuring a Cloud Storage backend with Object Versioning provides automatic lock acquisition during execution and state recovery options. Combining this backend with service account impersonation via short-lived tokens ensures enterprise security and operational reliability without exposing static key files.

Step-by-Step Solution

Establish secure remote state management

Configured Google Cloud Storage backend with Object Versioning enabled.

Google Cloud Storage natively supports object locking to prevent concurrent state modifications and object versioning to allow rolling back to previous state snapshots if corruption occurs.

Configure pipeline authentication and authorization

Pipeline uses short-lived credentials via service account impersonation.

Granting the Service Account Token Creator role to the pipeline runner allows short-lived token generation, avoiding exported JSON key management while preserving least privilege.

Key Concept

Terraform Remote State locking, GCS Versioning, and Service Account Impersonation

Estimated Time:1m 30s

Question 297Question →

A financial software firm uses Cloud Build pipelines to execute Terraform configurations across multiple Google Cloud projects. During continuous integration test runs, concurrent pipeline executions intermittently corrupt infrastructure state tracking. Additionally, security audits revealed that the pipeline's service account uses the primitive Editor role. You need to redesign the execution environment to enforce state concurrency locking, state recovery, and least-privilege security controls. Which set of configurations should you implement?

Configure a Cloud Storage backend with object versioning enabled on the bucket, and grant the Cloud Build service account minimal predefined or custom IAM roles required for the target resources.

Store Terraform state files locally inside the Cloud Build ephemeral workspace, and enforce git branch locking to prevent parallel deployment conflicts.

Configure a Cloud Storage backend with object versioning enabled, and assign the primitive Owner role to the Cloud Build service account to prevent permission failures during provisioning.

Grant developer user accounts the Service Account Admin role (roles/iam.serviceAccountAdmin) to let them generate service account keys locally and bypass pipeline permissions.

Show answer & explanation

Answer: Configure a Cloud Storage backend with object versioning enabled on the bucket, and grant the Cloud Build service account minimal predefined or custom IAM roles required for the target resources.

Answer

Configure a Cloud Storage backend with object versioning enabled on the bucket, and grant the Cloud Build service account minimal predefined or custom IAM roles required for the target resources.

The correct configuration uses Google Cloud Storage as a remote backend for Terraform state, enabling automatic state locking and object versioning for state safety and recovery. Additionally, it enforces least-privilege access by assigning minimal predefined or fine-grained custom IAM roles to the Cloud Build service account rather than broad primitive roles.

Step-by-Step Solution

Select a remote state backend supporting state locking and versioning.

Configuring the Google Cloud Storage (`gcs`) backend ensures state files are locked automatically during `terraform apply` operations, preventing race conditions and file corruption.

Local workspace storage in temporary CI runners loses state between runs and cannot lock concurrent executions.

Enable object versioning on the designated Cloud Storage state bucket.

Enables historical state retention and recovery in case of accidental corruption or invalid state updates.

Object versioning safeguards against state file corruption or destructive manual modifications.

Apply principle of least privilege to the Cloud Build service account.

Replace primitive Editor or Owner roles with narrow predefined or custom IAM roles specific to the infrastructure being managed.

Primitive roles grant excessive project-wide privileges, violating security compliance standards.

Key Concept

Terraform Cloud Storage backend state locking, state versioning, and IAM least-privilege automation service account management.

Estimated Time:1m 30s

Question 298Question →

A global media production company is architecting a hybrid connectivity solution to transfer uncompressed 4K video streams between their primary broadcast facilities in Los Angeles and Chicago, and their Google Cloud environment spanning the us-west1 and us-east1 regions. The architectural requirements dictate a sustained throughput of 20 Gbps with zero tolerance for internet jitter, private connectivity to Google APIs (such as Cloud Storage), and a strict 99.99% availability SLA that can survive the total failure of a single colocation facility or GCP region. Which hybrid network architecture should you recommend to meet all technical and availability requirements?

Provision two 10 Gbps Dedicated Interconnect connections across two distinct Edge Availability Domains in a Los Angeles colocation facility, and two 10 Gbps Dedicated Interconnect connections across two distinct Edge Availability Domains in a Chicago colocation facility. Configure Cloud Routers in both us-west1 and us-east1 with Global Dynamic Routing enabled, and configure Private Google Access for on-premises hosts.

Deploy eight High Availability (HA) VPN tunnels using Cloud Routers across us-west1 and us-east1 with multiple public IP addresses to aggregate 24 Gbps of encrypted tunnel bandwidth, utilizing Equal-Cost Multi-Path (ECMP) routing to satisfy the throughput requirement and achieve a 99.99% SLA.

Establish a single 20 Gbps Dedicated Interconnect pair in a Central Hub VPC located in us-west1, and configure VPC Network Peering between the Hub VPC and Spoke VPCs in us-east1 to transitively route on-premises traffic to all regions without deploying separate Cloud Routers in spoke networks.

Provision two 10 Gbps Partner Interconnect connections with a single service provider in Los Angeles, attached to Cloud Routers in us-west1 with Regional Dynamic Routing enabled, and rely on Cloud NAT for private access to Google APIs.

Show answer & explanation

Answer: Provision two 10 Gbps Dedicated Interconnect connections across two distinct Edge Availability Domains in a Los Angeles colocation facility, and two 10 Gbps Dedicated Interconnect connections across two distinct Edge Availability Domains in a Chicago colocation facility. Configure Cloud Routers in both us-west1 and us-east1 with Global Dynamic Routing enabled, and configure Private Google Access for on-premises hosts.

Answer

Provision two 10 Gbps Dedicated Interconnect connections across two distinct Edge Availability Domains in a Los Angeles colocation facility, and two 10 Gbps Dedicated Interconnect connections across two distinct Edge Availability Domains in a Chicago colocation facility, with Global Dynamic Routing enabled on Cloud Routers in both GCP regions and Private Google Access for on-premises hosts.

To achieve a 99.99% availability SLA with Google Cloud Dedicated Interconnect, an organization must deploy four Interconnect connections across two distinct metropolitan areas (colocation facilities), with two connections in each metro placed in separate Edge Availability Domains (EADs). Enabling Global Dynamic Routing on Cloud Routers ensures BGP routes are propagated to and from all regions in the VPC network. Additionally, Private Google Access for on-premises hosts allows internal datacenter servers to securely reach Google APIs like Cloud Storage over the private Interconnect link without traversing the public internet.

Step-by-Step Solution

Analyze throughput and SLA requirements

Sustained 20 Gbps bandwidth without public internet traversal rules out HA VPN. A 99.99% availability SLA requires 4 Dedicated Interconnect circuits across 2 metros (2 circuits per metro in separate Edge Availability Domains).

HA VPN is limited to 3 Gbps per tunnel over the public internet, whereas Dedicated Interconnect provides private 10 Gbps or 100 Gbps pipes with deterministic latency.

Determine dynamic routing configuration across regions

Global Dynamic Routing must be enabled on Cloud Routers in both us-west1 and us-east1.

Global Dynamic Routing allows Cloud Routers to advertise and learn BGP routes across all regions within the VPC, facilitating cross-region failover and high availability.

Identify private API access mechanism for on-premises workloads

Enable Private Google Access for on-premises hosts (using private.googleapis.com or restricted.googleapis.com VIPs).

This allows on-premises broadcast servers to reach Cloud Storage buckets privately over the Interconnect connections rather than over the public internet.

Key Concept

99.99% Availability Architecture for GCP Dedicated Interconnect with Global Dynamic Routing

Question 299Question →

An enterprise organization is deploying workloads in a Shared VPC network on Google Cloud. The infrastructure team must establish secure, private connectivity from compute instances in a service project to a third-party managed database service hosted in another Google Cloud tenant project. The third-party provider uses an internal IP address range that overlaps with the organization's subnet ranges, preventing the use of standard VPC Network Peering. Which network configuration should the Cloud Architect implement to meet these requirements?

Create a Private Service Connect endpoint in the consumer Shared VPC that targets the published Service Attachment of the managed database provider.

Establish a VPC Network Peering connection between the Shared VPC and the third-party provider VPC network while disabling custom route export.

Provision a Dedicated Interconnect connection directly between the consumer project and the third-party provider project.

Configure a VPC Service Controls perimeter around the consumer Shared VPC and grant the third-party service account IAM access.

Show answer & explanation

Answer: Create a Private Service Connect endpoint in the consumer Shared VPC that targets the published Service Attachment of the managed database provider.

Answer

Create a Private Service Connect endpoint in the consumer Shared VPC that targets the published Service Attachment of the managed database provider.

Private Service Connect endpoints allow consumers to access services published in another VPC using a private IP address allocated from the consumer's own local VPC subnet. Because traffic is translated through the endpoint and Service Attachment, overlapping IP ranges between the consumer and producer VPC networks do not block communication.

Step-by-Step Solution

Analyze network isolation and overlapping IP constraints

Identified that traditional VPC Network Peering cannot be established due to overlapping IP CIDR ranges between the enterprise Shared VPC and the third-party provider VPC.

VPC Peering requires strictly non-overlapping IP subnets to construct valid routing tables across peered networks.

Evaluate private service delivery mechanisms in Google Cloud

Selected Private Service Connect (PSC) endpoints as the optimal architecture.

PSC uses NAT-like functionality where the consumer allocates an endpoint IP from its own local subnet, mapping traffic privately to the producer's Service Attachment regardless of IP address collisions in the producer network.

Key Concept

Private Service Connect Endpoint for Cross-Tenant VPC Access

Question 300Question →

An enterprise financial application processes sensitive event streams using Cloud Pub/Sub before storing data in long-term storage. Corporate compliance policies dictate that all data at rest within Cloud Pub/Sub topics must be encrypted using cryptographic keys residing in an external, on-premises Hardware Security Module (HSM), ensuring raw key material is never held or stored within Google Cloud infrastructure. Additionally, access to encryption and decryption operations must strictly adhere to the principle of least privilege. Which architecture and key management configuration meets these requirements?

Configure Cloud EKM (External Key Manager) within Cloud KMS to connect to the on-premises HSM, and grant the Pub/Sub Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the Cloud KMS key.

Generate raw 256-bit AES Customer-Supplied Encryption Keys (CSEK) on the on-premises HSM, and pass the key material directly within the headers of each Pub/Sub API publish call.

Configure Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS Cloud HSM, and grant the primitive Editor role to the default Compute Engine service account to handle key lifecycle operations.

Define a VPC Service Controls perimeter around Cloud Pub/Sub and rely on default Google-managed encryption keys to automatically protect topic data at rest from external access.

Show answer & explanation

Answer: Configure Cloud EKM (External Key Manager) within Cloud KMS to connect to the on-premises HSM, and grant the Pub/Sub Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the Cloud KMS key.

Answer

Configure Cloud EKM (External Key Manager) within Cloud KMS to reference keys hosted on the on-premises HSM, and grant the Pub/Sub Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.

The correct solution uses Cloud EKM (External Key Manager) to keep key material in an external on-premises HSM while enabling Cloud KMS to orchestrate Pub/Sub message encryption. Assigning the specific Cloud KMS CryptoKey Encrypter/Decrypter role (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) to the Pub/Sub Service Agent complies strictly with the principle of least privilege.

Step-by-Step Solution

Identify the key location requirement

Because the keys must reside inside an external, on-premises HSM while performing encryption for GCP services, Cloud EKM (External Key Manager) integrated with Cloud KMS must be selected.

Google Cloud default encryption and standard CMEK/Cloud HSM host key material within Google Cloud infrastructure, whereas Cloud EKM allows key material to remain strictly on-premises.

Determine service integration and identity permissions

Cloud Pub/Sub uses a Google-managed service agent to perform encryption and decryption operations on behalf of the application.

To support CMEK/Cloud EKM with Pub/Sub, the Pub/Sub Service Agent (`serviceAccount:[email protected]`) must be granted permissions.

Apply least privilege access controls

Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Pub/Sub Service Agent specifically on the relevant Cloud KMS key resource.

Using fine-grained, predefined KMS roles prevents granting overbroad administrative or project-wide primitive permissions.

Key Concept

Cloud EKM (External Key Manager) enables GCP services like Pub/Sub to encrypt data using keys stored in an external third-party key management system or on-premises HSM, while granting service agents fine-grained KMS encrypter/decrypter roles enforces least privilege.

PreviousPage 15 / 80Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept