All practice questions

1598 questions

All types1,598 Multiple choice815 Multiple select537 Numeric8 Matching64 Ordering174

An automotive telematics enterprise needs to migrate 1.8 Petabytes of static binary log files and an active 4 TB MySQL transactional database from an on-premises data center to Google Cloud. The company has a 1 Gbps Dedicated Interconnect link available, but network policy caps migration bandwidth usage at 500 Mbps. The business mandates that the overall data transfer must complete within 30 days, and the transactional database cutover must incur minimal downtime. Which data transfer and migration strategy should a Cloud Architect recommend to meet these requirements?

Order multiple Google Cloud Transfer Appliance devices to perform an offline bulk migration of the 1.8 PB binary logs, and use Database Migration Service with continuous replication over the Dedicated Interconnect for the 4 TB MySQL database.

Configure Storage Transfer Service to stream both the 1.8 PB binary log files and database backups directly into Cloud Storage over the Dedicated Interconnect link.

Establish a high-throughput HA VPN tunnel over the public internet to migrate the 1.8 PB log files via gsutil parallel composite uploads while using Database Migration Service for the database.

Export both the 1.8 PB binary logs and a full mysqldump of the transactional database onto Transfer Appliance devices, then migrate the database to Cloud Spanner upon arrival to eliminate continuous online replication needs.

Show answer & explanation

Answer: Order multiple Google Cloud Transfer Appliance devices to perform an offline bulk migration of the 1.8 PB binary logs, and use Database Migration Service with continuous replication over the Dedicated Interconnect for the 4 TB MySQL database.

Answer

The correct solution accurately separates the migration path based on data characteristics and constraints. Transferring 1.8 PB over a 500 Mbps network cap requires over 300 days. Using Transfer Appliance for offline transfer allows the 1.8 PB of binary logs to be securely ingested within the 30-day window. Meanwhile, the 4 TB active MySQL database can easily be transferred online over the Dedicated Interconnect link using Database Migration Service with continuous replication to achieve a near-zero downtime cutover.

Step-by-Step Solution

Calculate network throughput capacity for the static dataset

Maximum network transfer rate =

500 \text{ Mbps} = 62.5 \text{ MB/s} \approx 5.4 \text{ TB/day}

. Transferring 1,800 TB over this link takes

\frac{1,800}{5.4} \approx 333 \text{ days}

, exceeding the 30-day limit.

Determines whether an online network transfer or offline physical appliance is required for the petabyte-scale static data.

Select the offline migration mechanism for unstructured binary logs

Deploy multiple Google Cloud Transfer Appliance units (e.g., 300 TB or 40 TB models) to ingest and physically ship the 1.8 PB dataset.

Transfer Appliance enables petabyte-scale data ingestion within days, adhering to the 30-day deadline without saturating network connections.

Select the online migration mechanism for the active MySQL transactional database

Use Database Migration Service (DMS) with continuous Change Data Capture (CDC) replication over the private Dedicated Interconnect.

A 4 TB database can easily sync over the 500 Mbps connection (

4 \text{ TB} \div 5.4 \text{ TB/day} \approx 18 \text{ hours}

initial load), and continuous replication ensures near-zero downtime cutover.

Key Concept

Selecting optimal Google Cloud migration tools based on dataset scale, available network throughput, and cutover downtime constraints.

Estimated Time:2m 30s

Question 342Question →

A genomics research institute is architecting a cloud-native pipeline on Google Cloud to process high-throughput DNA sequencing data. The architecture comprises two distinct workload requirements:

1. A high-performance computing (HPC) sequence alignment engine requiring custom Linux kernel drivers, message passing interface (MPI) inter-node communications with sub-millisecond network latency, and maximum I/O performance on local NVMe storage.
2. An edge-facing containerized API layer that receives large binary sequence data via continuous gRPC streams with individual session durations lasting up to 45 minutes, experiences unpredictable bursts, and must scale to zero instances during idle periods with zero infrastructure management overhead.

Which TWO compute platform choices and configurations should you implement to satisfy both workload requirements while maintaining architectural best practices? (Select TWO.)

Select all that apply

Provision Compute Engine virtual machines equipped with local NVMe SSDs, Tier 1 networking, gNIC interfaces, and configured within a compact placement policy for the sequence alignment engine.

Deploy the containerized web API layer on Cloud Run configured with HTTP/2 enabled, session affinity, and an extended request execution timeout of up to 60 minutes.

Deploy the sequence alignment engine on Cloud Run using Serverless VPC Access and mounting Cloud Storage FUSE buckets for shared file storage.

Deploy the containerized gRPC streaming API on Google Kubernetes Engine (GKE) Autopilot using a custom DaemonSet to orchestrate node scale-to-zero operations.

Deploy both the sequence alignment engine and the gRPC API layer onto App Engine Flexible environment using custom Docker runtime images.

Show answer & explanation

Answer: Provision Compute Engine virtual machines equipped with local NVMe SSDs, Tier 1 networking, gNIC interfaces, and configured within a compact placement policy for the sequence alignment engine.; Deploy the containerized web API layer on Cloud Run configured with HTTP/2 enabled, session affinity, and an extended request execution timeout of up to 60 minutes.

Answer

The optimal architecture combines Compute Engine virtual machines configured with compact placement policies and local NVMe SSDs for the HPC alignment engine, alongside Cloud Run with HTTP/2 and extended timeouts for the containerized gRPC streaming API.

For specialized HPC workloads requiring custom Linux kernel modules, sub-millisecond MPI latency, and high-performance disk access, Compute Engine with compact placement policies, gNIC, and local NVMe SSDs is the only GCP compute platform that satisfies hardware and OS control constraints. For stateless or streaming containerized APIs requiring long timeouts (up to 60 minutes) and scale-to-zero functionality, Cloud Run provides full gRPC streaming support with zero server management overhead.

Step-by-Step Solution

Analyze the HPC sequence alignment workload requirements

Identified requirements for custom OS kernel modules, low-latency inter-node MPI communication, and raw local I/O throughput.

Serverless and managed container platforms restrict host kernel access and do not support compact placement policies. Compute Engine VMs with compact placement policies and gNIC are required.

Analyze the containerized gRPC API workload requirements

Identified requirements for long-running gRPC streaming (up to 45 minutes), scale-to-zero capability, and minimal operational overhead.

Cloud Run supports containerized workloads, native HTTP/2 gRPC streaming, request timeouts up to 60 minutes, and automatic scale-to-zero without cluster management overhead.

Evaluate and reject misallocated compute platforms

Rejected GKE, App Engine Flexible, and Cloud Run for the HPC engine due to missing kernel/placement capabilities; rejected GKE for the API to avoid management overhead.

Matching workload operational profiles to the appropriate GCP compute abstraction optimizes performance while reducing baseline costs and operational complexity.

Key Concept

Compute Platform Selection for Specialized HPC vs. Serverless Container Workloads

Question 343Question →

An enterprise data analytics platform is building an automated Infrastructure as Code (IaC) deployment pipeline using Terraform to provision Compute Engine instance groups and Kubernetes Engine (GKE) node pools across multiple projects. The pipeline is executed by an automated CI/CD service account. The solution must ensure state file integrity, prevent race conditions during parallel team deployments, prevent operational failures during sudden cluster scale-outs, and strictly follow the principle of least privilege for service account impersonation. Which TWO architectural practices should the cloud architect mandate?

Select all that apply

Configure the Terraform remote backend using a Google Cloud Storage bucket with Object Versioning enabled for state persistence and native locking.

Submit regional quota increase requests for Compute Engine CPU cores and node pool resources prior to initiating automated large-scale provisioning.

Store the Terraform state file locally within the CI/CD runner container storage layer to minimize remote storage API latency.

Assign the primitive Owner role (`roles/owner`) to the compute instance service account to guarantee API access across all project resources.

Grant the CI/CD pipeline service account the Service Account Admin role (`roles/iam.serviceAccountAdmin`) on the target project to allow resource attachment.

Show answer & explanation

Answer: Configure the Terraform remote backend using a Google Cloud Storage bucket with Object Versioning enabled for state persistence and native locking.; Submit regional quota increase requests for Compute Engine CPU cores and node pool resources prior to initiating automated large-scale provisioning.

Answer

The correct practices are configuring a Cloud Storage remote backend with Object Versioning for Terraform state locking and requesting regional quota increases in advance before large-scale compute provisioning.

Centralizing Terraform state in a Cloud Storage bucket with Object Versioning and native locking prevents state corruption and concurrent state modifications. Additionally, requesting regional CPU and compute resource quota increases in advance ensures automated deployment scripts do not fail due to GCP quota limits during rapid cluster scale-outs.

Step-by-Step Solution

Evaluate IaC state safety requirements.

Local state storage in ephemeral CI/CD environments causes state corruption and concurrency locks. Utilizing a GCS remote backend with Object Versioning provides central state persistence and state locking.

Safe team-based infrastructure provisioning requires centralized, versioned, and locked state management.

Evaluate resource capacity and quota constraints.

Automated deployments of large Compute Engine and GKE clusters frequently breach default regional quotas if not anticipated.

Requesting regional quota increases in advance guarantees that automated provisioning jobs complete cleanly without resource exhaustion errors.

Review security options against least privilege guidelines.

Primitive roles (`roles/owner`) and administrative permissions (`roles/iam.serviceAccountAdmin`) exceed required permissions for provisioning and operating compute workloads.

Workload service accounts should use granular predefined roles, and deployment service accounts require `roles/iam.serviceAccountUser` to attach service accounts to instances.

Key Concept

Provisioning automated compute infrastructure requires safe state backend management, proactive quota planning, and strict IAM least-privilege scoping.

Question 344Question →

A financial analytics organization needs to transfer a 600 TB dataset from their on-premises storage array to a Google Cloud Storage bucket within a strict 14-day execution window. The organization already has an operational 10 Gbps Dedicated Interconnect connection to GCP, with 6 Gbps of unutilized bandwidth dedicated specifically for this data movement. High availability, automated retry handling, and minimal operational complexity are mandatory requirements. Which data transfer strategy should you recommend?

Use Storage Transfer Service to transfer the dataset online directly over the existing Dedicated Interconnect connection.

Order a GCP Transfer Appliance to perform an offline data copy on-premises and ship the appliance to Google for ingestion.

Provision a new Cloud VPN gateway with HA VPN tunnels over the public internet to stream the dataset into Cloud Storage.

Migrate the raw dataset into Cloud Spanner instances using Cloud Dataflow pipelines to enforce default data security policies.

Show answer & explanation

Answer: Use Storage Transfer Service to transfer the dataset online directly over the existing Dedicated Interconnect connection.

Answer

Use Storage Transfer Service to perform an online data transfer directly over the existing Dedicated Interconnect connection.

Transferring 600 TB over an available 6 Gbps Dedicated Interconnect pipeline takes approximately 9.25 days, comfortably meeting the 14-day requirement. Storage Transfer Service automates object validation, retries, and lifecycle management without physical shipping overhead.

Step-by-Step Solution

Calculate required transfer throughput and time for the 600 TB dataset

600 TB equals

4,800,000

Gb. At an available network speed of

6\text{ Gbps}

, total transfer time is

\frac{4,800,000}{6} = 800,000\text{ seconds} \approx 9.26\text{ days}

, well within the 14-day deadline.

Determining network transfer feasibility confirms whether online transfer meets the time constraint without physical media.

Select the appropriate managed data transfer service for existing hybrid network infrastructure

Storage Transfer Service provides scalable, managed data ingestion into Cloud Storage over Private Google Access via Dedicated Interconnect.

Storage Transfer Service offers enterprise features including bandwidth throttling, error logging, object validation, and automatic retries.

Key Concept

Selecting Online Data Transfer vs. Offline Transfer Appliance based on network bandwidth calculations

Question 345Question →

An enterprise organization is designing an automated IaC pipeline to manage multi-tenant infrastructure across hundreds of Google Cloud projects. The architecture team wants to allow feature teams to validate resource changes during continuous integration without permitting them to apply modifications directly or expose infrastructure state sensitive data. Additionally, deployment pipeline execution must strictly follow least-privilege access when creating and updating Google Cloud resources across target projects. Which IaC architecture and IAM configuration should you implement?

Configure Cloud Storage remote backends with object versioning and state locking in a central management project. Grant feature team CI roles read-only access to plan outputs while executing Terraform runs using short-lived credentials via service account impersonation (`roles/iam.serviceAccountTokenCreator`) mapped to targeted predefined roles in workload projects.

Store Terraform state files in local git repositories for local pipeline validation, and grant the CI pipeline service account the primitive Owner role (`roles/owner`) on all target GCP projects to eliminate permission errors during resource provisioning.

Grant feature team members the Service Account Admin role (`roles/iam.serviceAccountAdmin`) across target projects so the CI pipeline can create dedicated keys on demand for plan and apply stages.

Use unversioned Cloud Storage buckets for state files without object locking to maximize pipeline throughput, and submit regional quota increase requests only after plan validation failures occur.

Show answer & explanation

Answer: Configure Cloud Storage remote backends with object versioning and state locking in a central management project. Grant feature team CI roles read-only access to plan outputs while executing Terraform runs using short-lived credentials via service account impersonation (`roles/iam.serviceAccountTokenCreator`) mapped to targeted predefined roles in workload projects.

Answer

The optimal architecture uses centralized Google Cloud Storage remote backends with versioning and object locking, combined with short-lived service account impersonation (`roles/iam.serviceAccountTokenCreator`) and least-privilege predefined roles in target projects.

Centralizing Terraform remote state in Google Cloud Storage with object versioning and state locking protects infrastructure state integrity. Implementing short-lived service account token creation allows automated pipelines to provision resources across target projects with least-privilege fine-grained roles without storing persistent service account keys.

Step-by-Step Solution

Centralize and secure Terraform remote state storage.

Configured Google Cloud Storage remote backends with object versioning and state locking enabled in a managed governance project.

Prevents state file corruption from concurrent pipeline operations and allows point-in-time recovery.

Configure short-lived credential delegation for multi-project provisioning.

Configured CI/CD pipeline workers to impersonate target project execution service accounts using `roles/iam.serviceAccountTokenCreator`.

Eliminates hardcoded long-lived service account keys and limits potential privilege escalation pathways.

Enforce least-privilege IAM permissions in workload projects.

Assigned specific, fine-grained predefined roles (e.g., Compute Network Admin, Storage Admin) to execution service accounts rather than primitive roles.

Ensures pipeline actions comply strictly with organizational enterprise security policy.

Key Concept

Infrastructure as Code Multi-Project Governance and Least-Privilege IAM Provisioning

Question 346Question →

A digital publishing firm is architecting a new public-facing event notification backend on Google Cloud. The system processes incoming HTTPS webhooks triggered by third-party content providers. The workload is strictly stateless, experiences extreme traffic variance ranging from extended periods of zero traffic to sudden bursts of thousands of requests per second, and requires container-level custom runtime dependencies. The architecture mandate prioritizes minimizing operational overhead, eliminating baseline infrastructure idle costs, and avoiding container cluster management. Which compute platform selection best fulfills these technical and business requirements?

Deploy the containerized application on Cloud Run.

Deploy the containerized application on a GKE Autopilot cluster using Horizontal Pod Autoscaler (HPA).

Deploy the application across a Managed Instance Group (MIG) of Compute Engine Virtual Machines configured with CPU-based autoscaling.

Deploy the application on App Engine Flexible Environment with automatic scaling.

Show answer & explanation

Answer: Deploy the containerized application on Cloud Run.

Answer

Deploying the containerized application on Cloud Run is the optimal architecture choice.

Cloud Run allows executing stateless containerized workloads over HTTP/HTTPS with automatic scaling down to zero when idle. This fulfills all constraints by eliminating baseline idle costs, accommodating unpredictable traffic spikes rapidly, and completely removing cluster and infrastructure management overhead.

Step-by-Step Solution

Analyze workload state and protocol requirements.

The application is containerized, stateless, and handles incoming HTTPS webhooks.

Containerized HTTP workloads are well-suited for serverless container platforms or Kubernetes.

Evaluate operational overhead and scaling constraints.

Requirements mandate zero cluster management, rapid response to high traffic variance, and scale-to-zero capability.

Scale-to-zero eliminates idle billing during zero-traffic periods, while managed serverless eliminates node/cluster lifecycle maintenance.

Select the matching GCP compute platform.

Cloud Run provides serverless container execution with automatic scaling to zero, minimal operational overhead, and per-request billing.

GKE introduces unnecessary cluster abstraction (overkill), Compute Engine MIGs incur VM boot times and baseline VM costs, and App Engine Flexible cannot scale to zero instances.

Key Concept

Compute Platform Selection for Serverless Containers

Question 347Question →

A Cloud Architect is deploying an application on Compute Engine instances that requires writing custom application logs to Cloud Logging and pushing custom operational metrics to Cloud Monitoring. Following the principle of least privilege, which TWO IAM roles should be assigned to the service account used by the Compute Engine instances?

Select all that apply

Logs Writer (roles/logging.logWriter)

Monitoring Metric Writer (roles/monitoring.metricWriter)

Owner (roles/owner)

Service Account User (roles/iam.serviceAccountUser)

Monitoring Admin (roles/monitoring.admin)

Show answer & explanation

Answer: Logs Writer (roles/logging.logWriter); Monitoring Metric Writer (roles/monitoring.metricWriter)

Answer

The correct roles are Logs Writer (roles/logging.logWriter) and Monitoring Metric Writer (roles/monitoring.metricWriter).

To allow a Compute Engine service account to write custom logs and operational metrics under the principle of least privilege, grant Logs Writer (roles/logging.logWriter) for Cloud Logging ingestion and Monitoring Metric Writer (roles/monitoring.metricWriter) for Cloud Monitoring ingestion.

Step-by-Step Solution

Determine the minimal permissions required for logging and metric ingestion.

The application service account requires access to write logs into Cloud Logging and push custom metrics to Cloud Monitoring.

Enterprise security governance requires minimal fine-grained IAM roles for compute service accounts.

Identify the fine-grained predefined IAM roles for these actions.

Logs Writer (roles/logging.logWriter) provides write-only log capabilities, and Monitoring Metric Writer (roles/monitoring.metricWriter) allows writing metric data.

Predefined roles satisfy functional requirements while strictly adhering to least privilege.

Key Concept

Configuring Cloud Logging and Monitoring permissions using least-privilege predefined IAM roles

Question 348Question →

An infrastructure administrator needs to allow the operations team to create and manage Cloud Monitoring alerting policies within a Google Cloud project. Following the principle of least privilege, which IAM role should be granted to the operations team?

Monitoring Editor (roles/monitoring.editor)

Owner (roles/owner)

Service Account User (roles/iam.serviceAccountUser)

Request a regional compute quota increase prior to creating the notification channels

Show answer & explanation

Answer: Monitoring Editor (roles/monitoring.editor)

Answer

Granting the Monitoring Editor (roles/monitoring.editor) role is the correct approach because it provides the necessary permissions to manage operational alerts while following least-privilege principles.

The Monitoring Editor role (roles/monitoring.editor) grants full access to Cloud Monitoring configuration, including creating, updating, and deleting alerting policies and notification channels, while remaining strictly limited to monitoring capabilities in accordance with least-privilege practices.

Step-by-Step Solution

Identify the required operational capability

The operations team requires access to configure and manage Cloud Monitoring alerting policies.

Alerting policy management is part of the operational monitoring domain in Google Cloud.

Evaluate IAM roles according to least privilege

The predefined Monitoring Editor role provides complete access to Monitoring resources (dashboards, alert policies, uptime checks) without granting administrative access to other service components or broad project permissions.

Predefined role assignment avoids over-granting privileges like primitive roles or non-relevant IAM permissions.

Key Concept

Configuring least-privilege IAM access for Cloud Monitoring and operational alerting

Question 349Question →

An organization wants to perform an online transfer of $4\text{ TB}$ of unstructured media files from an on-premises Network Attached Storage (NAS) file system to a Google Cloud Storage bucket over their existing internet connection. Which Google Cloud service is best suited for this transfer?

Storage Transfer Service

Transfer Appliance

Dedicated Interconnect

Cloud Spanner

Show answer & explanation

Answer: Storage Transfer Service

Answer

Storage Transfer Service is the recommended solution for online data transfers from on-premises POSIX/NAS storage to Cloud Storage.

Storage Transfer Service is designed specifically to transfer data online from on-premises POSIX and NAS sources to Cloud Storage buckets quickly, securely, and automatically.

Step-by-Step Solution

Analyze data size and transfer mechanism

Dataset is

4\text{ TB}

, which can easily be migrated online over existing internet connectivity without physical appliance shipping.

Physical appliances introduce unnecessary logistical delay for modest dataset sizes.

Select the appropriate native GCP service for object storage ingestion

Storage Transfer Service provides automated, scalable online data movement from on-premises file systems directly to Cloud Storage.

It handles file discovery, parallel upload, checksum verification, and error retry natively.

Key Concept

Online File Transfer to Cloud Storage

Question 350Question →

An enterprise architecture team is configuring an automated CI/CD pipeline using Cloud Build and Terraform to provision resources across target Google Cloud projects. The team must adhere to Google Cloud security best practices by applying the principle of least privilege to the pipeline service account while ensuring concurrency safety and state integrity during automated deployments. Which provisioning strategy should the team implement?

Assign fine-grained predefined IAM roles for target services and the Service Account User role to the Cloud Build service account, while configuring a remote Cloud Storage backend with object versioning and state locking enabled.

Assign the primitive Owner role at the organization level to the Cloud Build service account to prevent permission failures during provisioning, while storing state locally within the ephemeral build execution environment.

Assign the Service Account Admin role to the Cloud Build service account to allow attached compute resources to execute tasks, while configuring a remote Cloud Storage backend without object versioning.

Generate static service account JSON keys and embed them within the Terraform provider configuration, while disabling state locking to increase parallel execution speed.

Show answer & explanation

Answer: Assign fine-grained predefined IAM roles for target services and the Service Account User role to the Cloud Build service account, while configuring a remote Cloud Storage backend with object versioning and state locking enabled.

Answer

The correct strategy enforces the principle of least privilege by combining fine-grained predefined target roles with the Service Account User role for service account impersonation. Additionally, configuring a Google Cloud Storage remote backend with versioning and object locking guarantees state file resilience and prevents concurrent pipelines from corrupting infrastructure state.

Step-by-Step Solution

Evaluate the IAM permission requirements for the deployment pipeline service account.

Identified that least privilege requires granting specific predefined roles for managed resources and roles/iam.serviceAccountUser to attach service accounts to compute resources, rather than broad administrative or primitive roles.

Prevents over-privileging the CI/CD pipeline while granting necessary execution rights.

Evaluate the state management architecture for automated Terraform executions.

Selected Cloud Storage as a remote backend with object versioning and state locking enabled via Cloud Storage object locking.

Ensures state consistency, enables concurrency controls during pipeline execution, and provides rollback capabilities via bucket object versioning.

Key Concept

Secure IaC automation using least-privilege service accounts and centralized Cloud Storage backend with state locking.

Estimated Time:1m 30s

Question 351Question →

An enterprise architecture team is configuring a centralized log sink in Google Cloud to route operational application logs from a workload project to a Cloud Storage bucket for compliance archiving. The team needs to prevent verbose debug logs from being exported to minimize storage costs, while ensuring the log sink's writer identity adheres strictly to the principle of least privilege on the destination storage bucket. Which approach correctly achieves this configuration?

Define a log sink with a filter matching application logs with severity INFO or higher, and grant the sink's writer identity service account the Storage Object Creator role on the target Cloud Storage bucket.

Define a log sink without filters and grant the sink's writer identity service account the Editor primitive role on the project containing the target Cloud Storage bucket.

Define a log sink with an exclusion filter set to severity >= INFO, and grant the sink's writer identity service account the Storage Object Admin role on the target bucket.

Define a log sink with a filter selecting all logs, and grant the operations team's service account the Service Account Admin role to dynamically manage bucket permissions.

Show answer & explanation

Answer: Define a log sink with a filter matching application logs with severity INFO or higher, and grant the sink's writer identity service account the Storage Object Creator role on the target Cloud Storage bucket.

Answer

Configure a log sink filter that includes logs with severity INFO or higher to exclude debug entries, and assign the Storage Object Creator role (`roles/storage.objectCreator`) directly to the log sink's unique writer identity service account on the destination Cloud Storage bucket.

The correct approach configures an inclusion filter (`severity >= INFO`) on the log sink so that low-priority DEBUG logs are filtered out prior to export, reducing storage costs. It then grants the minimal required IAM role (`roles/storage.objectCreator`) specifically to the log sink's unique writer identity service account on the destination bucket, satisfying least-privilege security mandates.

Step-by-Step Solution

Determine log filtering requirements.

Construct a log sink filter (e.g., `severity >= INFO`) to select operational logs while excluding DEBUG entries.

Filtering at the log sink prevents unnecessary log ingestion and storage overhead in the target sink destination.

Identify the writer identity of the log sink.

Obtain the unique service account email generated by Cloud Logging for the created sink (writerIdentity).

Cloud Logging exports logs using a dedicated service account identity per sink.

Apply least-privilege IAM permissions on the destination bucket.

Grant `roles/storage.objectCreator` to the writerIdentity on the target Cloud Storage bucket.

The Storage Object Creator role provides the exact permissions required to write log objects into the destination bucket without granting read, list, or administrative privileges.

Key Concept

Log sink filtering and least-privilege IAM configuration for Cloud Logging export destinations.

Question 352Question →

A software development team needs to deploy a simple, stateless HTTP web microservice packaged as a standard Docker container. The microservice experiences highly variable traffic patterns and must automatically scale down to zero instances during idle periods to minimize operational costs. The team wants to avoid managing Kubernetes clusters, node pools, or underlying operating system maintenance. Which Google Cloud compute platform best fulfills these requirements with the lowest operational overhead?

Cloud Run

Google Kubernetes Engine (GKE)

Compute Engine Managed Instance Group (MIG)

Cloud Storage hosted container runtime

Show answer & explanation

Answer: Cloud Run

Answer

Cloud Run is the optimal solution because it executes stateless containerized workloads serverlessly, scales automatically down to zero when idle, and eliminates cluster infrastructure management overhead.

Cloud Run is Google Cloud's managed serverless platform for deploying containerized applications. It automatically handles request-based scaling, scales down to zero when no traffic is present, and requires no cluster or node administration.

Step-by-Step Solution

Identify workload characteristics and operational constraints

Workload is a stateless HTTP container requiring automatic scale-to-zero capabilities with minimal operational maintenance.

Establishing workload parameters allows narrowing down compute choices based on GCP platform capabilities.

Evaluate GCP compute platforms against operational overhead limits

Cloud Run fulfills the serverless container requirement directly without requiring virtual machines or Kubernetes cluster administration.

Choosing full Kubernetes orchestration or IaaS virtual machines for basic stateless containerized services introduces unnecessary cost and management complexity.

Key Concept

Selecting Cloud Run for stateless containerized web applications to achieve serverless execution, scale-to-zero capabilities, and minimal operational overhead.

Question 353Question →

An infrastructure engineer needs to provision compute resources for an enterprise application that requires custom operating system kernel modifications and direct access to underlying virtual machine settings. The application must automatically scale out identical instances based on metric thresholds. Which compute provisioning strategy should the engineer select on Google Cloud Platform?

Create an instance template specifying the custom VM configuration and deploy a Managed Instance Group (MIG) configured with autoscaling.

Provision a Google Kubernetes Engine (GKE) cluster to run the application containers with custom node kernel parameters.

Deploy unmanaged Compute Engine instances using a service account assigned the primitive Owner role.

Provision individual Compute Engine instances on demand without verifying or requesting regional vCPU quota increases prior to deployment.

Show answer & explanation

Answer: Create an instance template specifying the custom VM configuration and deploy a Managed Instance Group (MIG) configured with autoscaling.

Answer

Create an instance template specifying the custom VM configuration and deploy a Managed Instance Group (MIG) configured with autoscaling.

Creating an instance template with the required custom virtual machine configuration and provisioning a Managed Instance Group (MIG) enables automated, policy-based scaling of identical Compute Engine instances.

Step-by-Step Solution

Identify workload infrastructure requirements

The application requires custom kernel modifications and automatic scaling of identical virtual machine instances.

Compute Engine virtual machines support low-level guest OS and kernel modifications, whereas standard container platforms restrict direct host kernel modification.

Select the optimal compute provisioning and scaling method

Define an instance template and launch a Managed Instance Group (MIG) with autoscaling.

Instance templates encapsulate custom instance configuration, and MIGs automate scaling out identical Compute Engine instances based on metrics.

Key Concept

Provisioning Compute Engine Managed Instance Groups (MIGs) with Instance Templates

Question 354Question →

A retail platform is migrating its core ordering microservices to Google Cloud. Security policies mandate that cluster worker nodes must not have public IP addresses and that administrative access to the cluster control plane must be restricted exclusively to the enterprise's corporate management subnet ( $10.50.0.0/24$ ) connected via Cloud VPN. Which deployment strategy should a cloud architect select when provisioning the Google Kubernetes Engine (GKE) cluster to meet these requirements?

Provision a GKE private cluster with master authorized networks enabled, adding the 10.50.0.0/24 CIDR block to the allowed authorized ranges.

Provision a GKE private cluster with a private control plane endpoint only, without configuring control plane authorized networks.

Provision a standard GKE cluster with public node pools across multiple zones and assign the IAM Owner role to the cluster's default service account.

Deploy the workload to a Compute Engine Managed Instance Group (MIG) across regions without requesting regional compute quota increases prior to deployment.

Show answer & explanation

Answer: Provision a GKE private cluster with master authorized networks enabled, adding the 10.50.0.0/24 CIDR block to the allowed authorized ranges.

Answer

Provision a GKE private cluster with master authorized networks enabled, adding the 10.50.0.0/24 CIDR block to the allowed authorized ranges.

The correct strategy is to provision a GKE private cluster and enable master authorized networks with the management CIDR range (10.50.0.0/24). A private cluster ensures worker nodes only have private IP addresses, preventing public internet exposure. Master authorized networks restrict HTTPS access to the Kubernetes control plane strictly to specified CIDR blocks, fulfilling both compliance constraints.

Step-by-Step Solution

Identify the network security requirement for worker nodes.

Worker nodes must use private IP addresses only, requiring a GKE private cluster configuration.

Private clusters prevent node instances from receiving public IP addresses.

Identify the access restriction requirement for the cluster control plane.

Access to the GKE control plane must be locked down to the management subnet CIDR block (10.50.0.0/24).

Master authorized networks enforce network perimeter security at the GKE control plane endpoint.

Key Concept

Provisioning GKE Private Clusters with Master Authorized Networks

Question 355Question →

An organization is building an automated CI/CD pipeline using Terraform to provision core infrastructure in Google Cloud. Which TWO deployment and operational practices should the Cloud Architect mandate for this pipeline? (Select TWO.)

Select all that apply

Configure a remote Google Cloud Storage (GCS) backend with object versioning and state locking enabled.

Assign specific, minimal predefined IAM roles to the pipeline execution service account following the principle of least privilege.

Grant the primitive Owner (roles/owner) role to the deployment service account to ensure unhindered resource creation.

Store the state file (terraform.tfstate) on the local disk of the ephemeral CI/CD runner to increase execution speed.

Show answer & explanation

Answer: Configure a remote Google Cloud Storage (GCS) backend with object versioning and state locking enabled.; Assign specific, minimal predefined IAM roles to the pipeline execution service account following the principle of least privilege.

Answer

The deployment pipeline should utilize a remote Google Cloud Storage backend configured with state locking and object versioning, and run under a service account provisioned with least-privilege predefined IAM roles.

Configuring a remote Google Cloud Storage (GCS) backend with state locking and object versioning ensures concurrent operations do not collide and allows rolling back state in case of corruption. Furthermore, restricting the pipeline service account to specific, fine-grained predefined IAM roles adheres to security best practices by limiting access to only what is necessary.

Step-by-Step Solution

Configure remote state storage in Terraform.

Terraform state is maintained in a centralized Google Cloud Storage bucket with object locking and versioning.

Prevents state file corruption caused by concurrent workflow executions and provides audit history for state file changes.

Configure service account access control.

The automated deployment runner authenticates using a service account assigned fine-grained predefined roles.

Enforces least-privilege security controls and prevents unauthorized administrative operations outside the intended scope.

Key Concept

Terraform Remote Backend Management and Least-Privilege IAM Integration in GCP

Question 356Question →

An enterprise development team is deploying a stateless REST microservice packaged as a Docker container to Google Cloud. The workload experiences unpredictable traffic spikes followed by extended idle periods. The team requires zero infrastructure management overhead and rapid auto-scaling to zero instances when idle. Which TWO options represent the recommended design choices for this application?

Select all that apply

Deploy the containerized service to fully managed Cloud Run to handle request-based scaling and zero-instance idle scale-down.

Configure concurrency settings on Cloud Run so each container instance processes multiple simultaneous requests.

Deploy the microservice onto a dedicated Google Kubernetes Engine (GKE) Standard cluster with a multi-zone node pool.

Deploy the microservice on Compute Engine Managed Instance Groups (MIGs) with scaling policy based strictly on host CPU utilization.

Purchase 3-year Committed Use Discounts (CUDs) for baseline compute capacity to lower costs for the microservice.

Show answer & explanation

Answer: Deploy the containerized service to fully managed Cloud Run to handle request-based scaling and zero-instance idle scale-down.; Configure concurrency settings on Cloud Run so each container instance processes multiple simultaneous requests.

Answer

Deploying the microservice to fully managed Cloud Run and configuring container concurrency settings.

Deploying the application to fully managed Cloud Run provides a serverless environment that automatically scales up with HTTP traffic and down to zero instances when idle. Configuring container concurrency allows each instance to handle multiple simultaneous requests efficiently, lowering overall operational costs and management overhead.

Step-by-Step Solution

Analyze the workload characteristics and operational constraints.

Identified a stateless, containerized HTTP microservice with bursty, unpredictable traffic, requiring zero-scaling and no infrastructure management.

Serverless platforms like Cloud Run are tailored specifically for stateless web services that need automatic scaling to zero.

Select the appropriate serverless compute platform.

Selected Cloud Run because it handles containerized HTTP workloads without requiring server provisioning or GKE cluster maintenance.

Cloud Run abstracts cluster management while automatically scaling based on incoming requests.

Configure platform scaling settings for efficiency.

Configured request concurrency per container instance to maximize throughput and resource utilization.

Concurrency allows a single container instance to process multiple requests simultaneously, reducing the total instance count needed during spikes.

Key Concept

Selecting serverless container platforms (Cloud Run) and optimizing scaling configuration for stateless HTTP microservices.

Question 357Question →

A financial company is designing an operational observability strategy for a web application running on Compute Engine instances. To optimize Cloud Logging costs, the operations team must minimize the ingestion of high-volume verbose debug logs into the log bucket while ensuring that administrative security events trigger automated operational alerts in real time. Which TWO architectural and configuration actions should the team implement to meet these requirements? (Select TWO.)

Select all that apply

Configure an exclusion filter on the _Default log bucket to drop low-severity debug log entries prior to log ingestion.

Create a counter log-based metric filtered for administrative log events and attach a Cloud Monitoring alerting policy to that metric.

Assign the primitive Editor (roles/editor) role to the custom service account attached to the Compute Engine instances to allow metric writing.

Grant the Service Account Admin (roles/iam.serviceAccountAdmin) role to operations engineers so they can run Compute Engine instances under the application service account.

Add a log exclusion filter that drops all log entries with a severity of ERROR or higher to prevent log storage spikes.

Show answer & explanation

Answer: Configure an exclusion filter on the _Default log bucket to drop low-severity debug log entries prior to log ingestion.; Create a counter log-based metric filtered for administrative log events and attach a Cloud Monitoring alerting policy to that metric.

Answer

The team should configure an exclusion filter on the _Default log bucket to drop low-severity debug logs and create a counter log-based metric for administrative events attached to a Cloud Monitoring alerting policy.

Configuring exclusion filters on the default log bucket prevents unwanted high-volume debug logs from being ingested into storage, effectively reducing costs. Additionally, creating a counter log-based metric for targeted administrative log events allows Cloud Monitoring to track log occurrences as time-series metrics and trigger automated alerts when thresholds are reached.

Step-by-Step Solution

Configure log ingestion control to reduce Cloud Logging storage costs.

Applying an exclusion filter on the _Default log bucket drops high-volume debug logs before ingestion.

Exclusion filters prevent unneeded log entries from incurring storage and ingestion charges.

Set up real-time alerting based on specific log entry events.

Creating a counter log-based metric counts matching administrative entries, which Cloud Monitoring uses to trigger alerting policies.

Log-based metrics convert log data into time-series data suitable for standard operational alerting thresholds.

Key Concept

Log Ingestion Control and Log-Based Metric Alerting

Question 358Question →

A cloud architect is preparing to provision a private Google Kubernetes Engine (GKE) cluster in GCP to host an internal microservice. Security governance mandates that node instances must not be publicly exposed and that principles of least privilege must be applied to node identity. Which of the following actions should be taken during cluster provisioning to satisfy these requirements? (Select TWO answers.)

Select all that apply

Provision the cluster with private nodes and enable Control Plane Authorized Networks to restrict access to management endpoints.

Assign a dedicated custom service account with minimal required roles to the cluster worker nodes instead of using the default Compute Engine service account.

Assign the primitive Editor role to the cluster node service account to ensure worker nodes can provision any needed GCP resource automatically.

Disable Control Plane Authorized Networks so that cluster administrators can access the master endpoint from any public IP without network restrictions.

Grant the Service Account Admin role to developers on the node service account so they can attach it when launching new node pools.

Show answer & explanation

Answer: Provision the cluster with private nodes and enable Control Plane Authorized Networks to restrict access to management endpoints.; Assign a dedicated custom service account with minimal required roles to the cluster worker nodes instead of using the default Compute Engine service account.

Answer

Provisioning private cluster nodes combined with Control Plane Authorized Networks ensures network isolation, while assigning a dedicated custom service account with minimal IAM permissions guarantees identity isolation.

Provisioning private nodes alongside Control Plane Authorized Networks ensures node instances have no public IPs and control plane access is restricted. Configuring a custom service account with minimal roles enforces least privilege for workload credentials on cluster nodes.

Step-by-Step Solution

Identify network isolation requirements for the GKE cluster.

Creating a private cluster ensures worker nodes receive only internal IP addresses, while enabling Control Plane Authorized Networks limits master endpoint access to authorized source CIDRs.

Prevents unauthorized internet access to cluster nodes and master endpoints.

Identify least-privilege IAM identity requirements for cluster nodes.

Worker nodes should run under a dedicated custom service account configured with minimal required IAM roles.

Avoids using the default Compute Engine service account which has broad access rights.

Key Concept

GKE Private Cluster Provisioning & Node Service Account Security

Estimated Time:1m 0s

Question 359Question →

A financial services organization needs to migrate 10 TB of historical transaction archives from an on-premises object storage environment to Cloud Storage over a 1 Gbps dedicated network connection. The organization requires a solution that minimizes operational management overhead and automatically handles retries for dropped connections during data transfer. Which TWO GCP services or features should the architecture team select to satisfy these requirements?

Select all that apply

Storage Transfer Service

Transfer Appliance

Cloud Storage Transfer Service agent pool installed on-premises

Dedicated Interconnect with manual gsutil rsync cron jobs

Show answer & explanation

Answer: Storage Transfer Service; Cloud Storage Transfer Service agent pool installed on-premises

Answer

The team should use Storage Transfer Service configured with an on-premises agent pool.

Storage Transfer Service combined with on-premises agent pools provides a fully managed solution designed specifically for moving data from on-premises locations to Cloud Storage. It automatically handles scaling, monitoring, checksum verification, and retries without requiring custom maintenance scripts.

Step-by-Step Solution

Assess network transfer feasibility for 10 TB over 1 Gbps connection.

10 TB over 1 Gbps takes approximately 22 to 24 hours, making online managed transfer appropriate.

Determines whether an online or offline transfer strategy is required based on data volume and bandwidth.

Select managed online transfer tooling to minimize operational burden.

Storage Transfer Service handles orchestration, failure retries, and data integrity verification automatically.

Avoids custom scripts and manual operational overhead.

Configure local connectivity into the private on-premises storage.

Installing Storage Transfer Service agent pools locally enables secure access to on-premises data sources.

Allows the managed service to read local files securely.

Key Concept

Selecting online data migration tools for terabyte-scale transfers

Question 360Question →

An operations team needs to export audit and application logs from a Google Cloud project into a Cloud Storage bucket for long-term compliance storage. They require a continuous, automated routing mechanism built directly into Google Cloud's operational suite. Which feature should they configure to meet this requirement?

A Cloud Logging Log Sink configured with the Cloud Storage bucket as the destination target.

A continuous Storage Transfer Service job configured using the primitive Owner role to ingest logs from Cloud Logging.

A Cloud IAM policy granting the Service Account User role to the default Compute Engine service account to export log archives.

A Quotas page quota increase request to expand the retention window of _Default log buckets beyond standard limits.

Show answer & explanation

Answer: A Cloud Logging Log Sink configured with the Cloud Storage bucket as the destination target.

Answer

The operations team should configure a Cloud Logging Log Sink pointing to the Cloud Storage bucket as its destination target.

Configuring a Log Sink with a Cloud Storage destination is the native, fully managed Google Cloud method to continuously route ingested log entries into Cloud Storage for long-term retention and compliance.

Step-by-Step Solution

Identify the primary requirement

Automated and continuous export of Cloud Logging entries into Cloud Storage for long-term retention.

Cloud Logging ingestion includes log routing mechanisms designed specifically to stream incoming log data to external storage sinks.

Evaluate Google Cloud Logging features for continuous export

Log Sinks in Cloud Logging allow defining inclusion filters and selecting supported destinations such as Cloud Storage, BigQuery, and Pub/Sub.

Creating a Log Sink automatically routes matching log entries to the specified Cloud Storage bucket asynchronously as logs are ingested.

Key Concept

Cloud Logging Sinks and Export Routing

PreviousPage 18 / 80Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept