All practice questions

1598 questions

All types1,598 Multiple choice815 Multiple select537 Numeric8 Matching64 Ordering174

A cloud engineering team is preparing to collaborate on provisioning Google Cloud resources using Terraform. To ensure concurrent state locking and prevent state file corruption during team deployments, which remote backend configuration should they use?

Configure a Google Cloud Storage (GCS) bucket backend with object versioning enabled.

Store the state file in a local git repository directory and rely on git merge operations for concurrency.

Configure a Cloud Storage bucket backend and assign the primitive Owner role to the deployment pipeline service account.

Store the state file in Cloud Storage while granting developers the Service Account Admin role to access the backend.

Show answer & explanation

Answer: Configure a Google Cloud Storage (GCS) bucket backend with object versioning enabled.

Answer

Configure a Google Cloud Storage (GCS) bucket backend with object versioning enabled.

Configuring a Google Cloud Storage bucket backend provides native lock support during plan and apply actions, preventing race conditions. Enabling object versioning ensures state history is maintained for recovery.

Step-by-Step Solution

Identify team collaboration requirements for Terraform state.

Remote state storage with lock capabilities is required to handle concurrent executions safely.

Simultaneous execution on a shared state file without locking can lead to state corruption.

Select the standard GCP-native backend for Terraform.

The GCS backend (`gcs`) leverages Cloud Storage native strong consistency and locking.

Terraform integrates directly with GCS to automatically lock state during operations and unlock upon completion.

Enable Object Versioning on the target Cloud Storage bucket.

Historical state versions are preserved.

Versioning allows rapid rollback and recovery if state becomes corrupted or accidentally overwritten.

Key Concept

Terraform Remote State Management with Google Cloud Storage

Estimated Time:1m 0s

Question 362Question →

A logistics fleet management startup needs to deploy a containerized stateless REST API endpoint to receive location telemetry from delivery vehicles. The traffic volume fluctuates throughout the day with near-zero traffic overnight. The startup has a small operational team with no experience maintaining Kubernetes clusters or underlying virtual machine infrastructure. They require a Google Cloud solution that automatically scales instances to zero during inactive periods while minimizing management overhead. Which compute platform should the startup select?

Cloud Run

Google Kubernetes Engine (GKE) Standard Cluster

Compute Engine Managed Instance Group (MIG) configured with CPU utilization autoscaling

Compute Engine Dedicated Host with manual instance provisioning

Show answer & explanation

Answer: Cloud Run

Answer

Cloud Run is the optimal compute platform because it natively runs containerized stateless workloads, automatically scales down to zero instances when idle, and eliminates cluster administration.

The choice of Cloud Run is correct because it accepts container images directly, automatically scales down to zero when requests stop coming in, charges only for consumed CPU and memory during request processing, and requires no infrastructure management.

Step-by-Step Solution

Analyze workload characteristics

The API is stateless, packaged as a container, experiences variable load, and goes idle overnight.

Identifying statefulness and scaling demands narrows the compatible compute models.

Evaluate operational requirements

The team requires zero cluster management overhead and scale-to-zero capability.

Serverless container platforms satisfy low-overhead constraints better than VM or GKE infrastructure.

Match requirements with Google Cloud compute services

Cloud Run provides serverless container deployment with zero server maintenance and scale-to-zero pricing.

Cloud Run directly fulfills all architectural and operational constraints.

Key Concept

Selecting Serverless Compute vs. Managed Clusters for Stateless Microservices

Question 363Question →

An organization is designing a multi-environment infrastructure deployment strategy on Google Cloud using Terraform. They need to establish environment isolation between staging and production while ensuring state file integrity and maintaining least-privilege administrative access. Which TWO architectural and operational practices should the team implement to satisfy these requirements? (Select TWO)

Select all that apply

Configure isolated Cloud Storage buckets with Object Versioning enabled for each environment's remote Terraform backend.

Grant dedicated pipeline service accounts fine-grained predefined IAM roles specific to each environment rather than primitive roles.

Grant the deployment service account the primitive Owner role (roles/owner) across all projects to streamline access management.

Store state files for all environments in a single local unversioned directory on the CI/CD runner to minimize storage latency.

Show answer & explanation

Answer: Configure isolated Cloud Storage buckets with Object Versioning enabled for each environment's remote Terraform backend.; Grant dedicated pipeline service accounts fine-grained predefined IAM roles specific to each environment rather than primitive roles.

Answer

The team should configure isolated Cloud Storage buckets with Object Versioning enabled for each environment's remote backend and assign fine-grained predefined IAM roles to dedicated pipeline service accounts.

Isolating Terraform remote backends into environment-specific Cloud Storage buckets with Object Versioning guarantees state protection, concurrency locking via Cloud Storage, and environment isolation. Furthermore, assigning fine-grained predefined IAM roles to dedicated environment service accounts enforces least privilege.

Step-by-Step Solution

Evaluate Terraform backend security and isolation requirements.

Identify that separate Cloud Storage buckets per environment with Object Versioning provide state isolation, locking, and recovery capabilities.

Prevent accidental state overwrites between staging and production and allow rollback if state corruption occurs.

Evaluate IAM privileges for automated deployment execution.

Determine that service accounts should use least-privilege predefined or custom IAM roles mapped specifically to target environments.

Avoid security exposure associated with broad primitive roles like Owner.

Key Concept

Infrastructure as Code environment isolation, remote state management with Cloud Storage, and least-privilege IAM configuration.

Estimated Time:1m 30s

Question 364Question →

A financial technology company is designing a new transaction validation pipeline on Google Cloud consisting of two distinct workloads:

1. A stateless HTTP webhook ingestion component that receives payload spikes ranging from 0 to 5,000 requests per second with execution times under 10 seconds per request, requiring minimal operational management.
2. A specialized legacy fraud-analysis service that depends on a custom compiled Linux kernel module for cryptographic hardware acceleration and maintains persistent, long-lived TCP socket connections.

Which TWO compute platform choices align with Google Cloud best practices for operational efficiency and workload compatibility? (Select TWO)

Select all that apply

Deploy the HTTP webhook ingestion component to Cloud Run to leverage automatic container scaling to zero and fully managed infrastructure.

Deploy the legacy fraud-analysis service to Compute Engine Virtual Machines (or Managed Instance Groups) using a custom OS image.

Deploy the HTTP webhook ingestion component to a Google Kubernetes Engine (GKE) Standard cluster with fixed node pools.

Deploy the legacy fraud-analysis service as a Cloud Run Job scheduled to execute continuously.

Deploy the HTTP webhook ingestion component to App Engine Flexible Environment configured with auto-scaling.

Show answer & explanation

Answer: Deploy the HTTP webhook ingestion component to Cloud Run to leverage automatic container scaling to zero and fully managed infrastructure.; Deploy the legacy fraud-analysis service to Compute Engine Virtual Machines (or Managed Instance Groups) using a custom OS image.

Answer

The optimal architecture combines Cloud Run for the stateless HTTP webhook ingestion component and Compute Engine Virtual Machines (with custom OS images) for the legacy fraud-analysis service requiring custom kernel modules.

Cloud Run is the optimal serverless container platform for stateless HTTP services with unpredictable traffic spikes, scaling rapidly to zero with zero cluster management. Compute Engine is required for workloads that depend on custom host Linux kernel modules and persistent network daemons, as virtual machines provide total control over the guest OS environment.

Step-by-Step Solution

Analyze requirements for the HTTP webhook ingestion service

The service is stateless, HTTP-based, handles bursty traffic (0 to 5,000 rps), and requires low operational overhead.

Cloud Run is designed specifically for stateless containerized HTTP workloads, scaling seamlessly to zero and managing infrastructure automatically.

Analyze requirements for the legacy fraud-analysis service

The service requires a custom Linux kernel module and long-lived TCP socket connections.

Fully managed container services (like Cloud Run or App Engine) do not permit host kernel modifications. Compute Engine allows custom OS images and full root/kernel configuration.

Key Concept

Matching Google Cloud compute platforms (Cloud Run vs. Compute Engine vs. GKE) to workload statefulness, protocol, kernel requirements, and operational overhead targets.

Question 365Question →

A financial analytics firm uses Terraform to provision infrastructure across multiple Google Cloud projects. A recent security and operational audit revealed two critical issues: deployment pipelines frequently fail due to concurrent state file collisions when engineers apply changes simultaneously from local environments, and the service accounts executing infrastructure updates hold excessive administrative access across the entire GCP organization. Which two architectural configurations should you implement to resolve these concurrency and security issues in alignment with Google-recommended best practices? (Select TWO.)

Select all that apply

Configure a Cloud Storage (GCS) bucket as the remote backend for Terraform state files with Object Versioning enabled.

Store Terraform state files in a central Git repository committed alongside module source code to track concurrency.

Assign the primitive Owner role at the Organization level to the CI/CD pipeline service accounts to ensure provisioning commands never fail on API authorization.

Bind granular, predefined or custom IAM roles to dedicated service accounts at the target project scope, and grant deployment engineers the Service Account User role.

Show answer & explanation

Answer: Configure a Cloud Storage (GCS) bucket as the remote backend for Terraform state files with Object Versioning enabled.; Bind granular, predefined or custom IAM roles to dedicated service accounts at the target project scope, and grant deployment engineers the Service Account User role.

Answer

To establish secure and reliable Infrastructure as Code workflows, configure a Cloud Storage backend with Object Versioning for Terraform state storage and state locking, and enforce least privilege by assigning granular predefined/custom roles to dedicated service accounts scoped to target projects while delegating access via the Service Account User role.

Configuring a Cloud Storage remote backend ensures automated, native state locking and consistency checks during Terraform executions, preventing concurrent state overwrite issues. Enabling Object Versioning adds durability against state corruption. Combining this backend configuration with fine-grained, project-scoped IAM roles and granting developers the Service Account User role ensures that automated infrastructure provisioning adheres strictly to Google Cloud security best practices.

Step-by-Step Solution

Address concurrent state modification and state corruption issues.

Migrate state management to a centralized Google Cloud Storage (GCS) bucket backend with Object Versioning enabled.

Cloud Storage backends offer built-in state locking and strong consistency, preventing simultaneous state writes and preserving historical state versions for rollback.

Address overly permissive organizational IAM access.

Replace primitive Organization-level roles with fine-grained predefined or custom IAM roles scoped strictly to the target project, and assign the Service Account User role (`roles/iam.serviceAccountUser`) to authorized deployment users.

This enforces the principle of least privilege, restricting CI/CD pipeline service accounts to only the necessary permissions required to provision specific project resources.

Key Concept

Terraform Remote State Management and IAM Least Privilege Delegation in Google Cloud

Question 366Question →

A financial technology firm is automating the provisioning of a private Google Kubernetes Engine (GKE) cluster using Terraform for an isolated transaction processing engine. Operational security guidelines require restricting network access to the GKE control plane strictly to designated internal administrative subnets, protecting infrastructure state from concurrent modification or corruption, and following least-privilege IAM practices when enabling CI/CD pipelines to attach identities to cluster node pools. Which design choices should the cloud architect include in the deployment configuration? (Select TWO.)

Select all that apply

Enable Control Plane Authorized Networks on the cluster and restrict master endpoint access to authorized internal subnet CIDR blocks.

Configure a Cloud Storage bucket with object versioning and state locking enabled as the remote backend for Terraform state.

Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the deployment pipeline service account to permit provisioning node pools with custom identities.

Store the Terraform state file in unversioned local storage on the deployment pipeline runner to optimize execution performance.

Rely on standard IAM primitive roles assigned to administrators rather than enabling Control Plane Authorized Networks on the cluster.

Show answer & explanation

Answer: Enable Control Plane Authorized Networks on the cluster and restrict master endpoint access to authorized internal subnet CIDR blocks.; Configure a Cloud Storage bucket with object versioning and state locking enabled as the remote backend for Terraform state.

Answer

The correct design choices are enabling Control Plane Authorized Networks with specific internal CIDR ranges and configuring a Cloud Storage remote backend with versioning and state locking for Terraform state management.

Enabling Control Plane Authorized Networks restricts administrative traffic to specific CIDR ranges, establishing network perimeter security for the private master endpoint. Storing Terraform state in Cloud Storage with versioning and state locking provides essential concurrency protection and state consistency across deployment pipelines.

Step-by-Step Solution

Analyze control plane access security requirements.

Enabling Control Plane Authorized Networks enforces IP-based perimeter filtering on the GKE master endpoint, permitting connections only from authorized internal subnet CIDR ranges.

IAM permissions govern identity authorization but do not restrict network-level routing to cluster endpoints.

Determine remote state storage practices for Infrastructure as Code automation.

Configuring a Cloud Storage remote backend with versioning and object locking ensures state integrity, auditability, and concurrency control for Terraform state.

Unversioned local storage exposes infrastructure deployments to state drift, loss, and race conditions.

Evaluate IAM role assignments for provisioning service accounts.

Assigning Service Account User (`roles/iam.serviceAccountUser`) allows deployment pipelines to bind service accounts to compute nodes, whereas Service Account Admin grants unnecessary management privileges.

Principle of least privilege dictates granting resource usage permissions rather than full administrative permissions.

Key Concept

Provisioning private GKE clusters securely requires enforcing Control Plane Authorized Networks, applying least-privilege IAM roles (`roles/iam.serviceAccountUser`), and managing Infrastructure as Code state using remote locked backends.

Question 367Question →

An autonomous vehicle engineering company is migrating its real-time telemetry processing platform to Google Cloud. The infrastructure design requires hybrid network connectivity between their primary on-premises processing facility and a central Hub VPC in Google Cloud, which is connected to separate Spoke VPCs for analytics and long-term storage. The architecture must satisfy two core requirements:

1. Sustained throughput of $20\text{ Gbps}$ with direct, low-latency private connectivity between the on-premises data center and Google Cloud.
2. Workloads in the Spoke VPCs must be able to reach on-premises endpoints and communicate with each other through the Hub VPC without establishing direct VPC Network Peering links between individual spokes.

Which TWO architectural decisions must be implemented to fulfill these requirements? (Select TWO)

Select all that apply

Provision a Dedicated Interconnect connection pair with VLAN attachments associated with Cloud Routers in the Hub VPC using BGP for dynamic route propagation.

Deploy a High Availability (HA) VPN gateway cluster with multiple parallel IPsec tunnels using Equal-Cost Multi-Path (ECMP) routing to aggregate bandwidth up to

20\text{ Gbps}

Utilize Network Connectivity Center (NCC) with Cloud Router hybrid spokes to manage transit routing through the Hub VPC, overcoming standard VPC Peering non-transitivity.

Configure standard VPC Network Peering between the Hub VPC and each Spoke VPC to allow Spoke workloads to transitively reach on-premises networks through the Hub VPC's gateway.

Show answer & explanation

Answer: Provision a Dedicated Interconnect connection pair with VLAN attachments associated with Cloud Routers in the Hub VPC using BGP for dynamic route propagation.; Utilize Network Connectivity Center (NCC) with Cloud Router hybrid spokes to manage transit routing through the Hub VPC, overcoming standard VPC Peering non-transitivity.

Answer

The correct architecture requires provisioning Dedicated Interconnect with Cloud Routers for high-throughput (

20\text{ Gbps}

) hybrid connectivity, combined with Network Connectivity Center (NCC) to enable transitive spoke-to-hub-to-on-premises traffic routing.

Provisioning Dedicated Interconnect satisfies the high throughput demand (

20\text{ Gbps}

) via dedicated physical links and Cloud Router dynamic routing. Using Network Connectivity Center (NCC) solves the transit routing challenge by allowing the Hub VPC to route traffic between Spoke VPCs and on-premises networks, overcoming VPC Peering transitivity restrictions.

Step-by-Step Solution

Evaluate hybrid connectivity throughput requirement (

20\text{ Gbps}

Identify that Cloud VPN is limited to

3\text{ Gbps}

per tunnel. Throughput exceeding

10\text{ Gbps}

mandates Dedicated Interconnect (using 10 Gbps or 100 Gbps circuits).

Dedicated Interconnect provides private physical connectivity to Google's network capable of handling multi-gigabit sustained telemetry traffic with SLAs.

Evaluate spoke-to-hub transit routing requirements.

Identify that default VPC Network Peering is non-transitive and cannot route traffic from Spoke VPC to Hub VPC to On-Premises.

Google Cloud VPC Peering does not export routes learned from external BGP/Interconnect to other peered VPCs without transit routing architectures such as Network Connectivity Center (NCC).

Combine solutions to form valid architecture.

Select Dedicated Interconnect with Cloud Router BGP and Network Connectivity Center (NCC) hub-and-spoke transit management.

This combination satisfies both the physical connectivity throughput threshold and the logical transit routing requirements.

Key Concept

Hybrid Connectivity Selection and VPC Transitivity Limitations

Question 368Question →

A global pharmaceutical enterprise plans to migrate its legacy clinical trial platform to Google Cloud. The workload comprises $3.2\text{ PB}$ of static genomic sequence files stored on local Network Attached Storage (NAS) arrays and a live $15\text{ TB}$ PostgreSQL transactional database. The organization maintains a $2\text{ Gbps}$ Partner Interconnect connection, but strict QoS policies limit dedicated migration traffic to a maximum of $500\text{ Mbps}$ . The business mandates that the $3.2\text{ PB}$ genomic dataset must be fully ingested into Cloud Storage within $45\text{ days}$ , the database cutover must incur less than $10\text{ minutes}$ of service downtime, and all ingested data must be shielded against unauthorized egress and exfiltration. Which TWO architectural strategies should the lead cloud architect incorporate into the migration plan to meet these requirements?

Select all that apply

Order multiple Google Cloud Transfer Appliances to execute an offline bulk transfer of the

3.2\text{ PB}

genomic dataset, and establish VPC Service Controls security perimeters around the target Cloud Storage buckets.

Use Database Migration Service (DMS) with continuous Change Data Capture (CDC) over the Partner Interconnect to replicate the on-premises PostgreSQL database to Cloud SQL for PostgreSQL prior to cutover.

Deploy Storage Transfer Service agents on local NAS servers to stream the

3.2\text{ PB}

genomic sequence files online over the

500\text{ Mbps}

Partner Interconnect allocation directly into Cloud Storage.

Migrate the live

15\text{ TB}

PostgreSQL database to Cloud Spanner using Cloud Storage dump files and automated schema translation to guarantee continuous multi-region availability without cutover downtime.

Show answer & explanation

Answer: Order multiple Google Cloud Transfer Appliances to execute an offline bulk transfer of the $3.2\text{ PB}$ genomic dataset, and establish VPC Service Controls security perimeters around the target Cloud Storage buckets.; Use Database Migration Service (DMS) with continuous Change Data Capture (CDC) over the Partner Interconnect to replicate the on-premises PostgreSQL database to Cloud SQL for PostgreSQL prior to cutover.

Answer

The architect must specify ordering Google Cloud Transfer Appliances for the

3.2\text{ PB}

static dataset with VPC Service Controls perimeter defense, alongside deploying Database Migration Service with CDC replication to Cloud SQL for the

15\text{ TB}

database cutover.

The correct strategy combines offline physical ingestion via Transfer Appliance for petabyte-scale data constrained by a 500 Mbps network ceiling with VPC Service Controls for exfiltration protection, and uses Database Migration Service with CDC to achieve continuous replication to Cloud SQL for PostgreSQL within a minimal cutover window.

Step-by-Step Solution

Calculate network throughput limitations for bulk file transfer

Streaming

3.2\text{ PB}

(

25.6 \text{ Pb}

) over

500\text{ Mbps}

takes

\approx 592\text{ days}

, exceeding the

45\text{ day}

SLA.

Determines whether online transfer (Storage Transfer Service) or offline transfer (Transfer Appliance) is required.

Evaluate data transfer mechanism and perimeter security for static storage

Select Transfer Appliance for offline physical transport and wrap destination Cloud Storage buckets in VPC Service Controls.

Satisfies the 45-day transfer timeline and addresses the data exfiltration compliance requirement.

Evaluate continuous database replication strategy for low downtime

Initial seed of

15\text{ TB}

takes

\approx 2.78\text{ days}

over

500\text{ Mbps}

, followed by low-bandwidth CDC sync using Database Migration Service.

Allows transaction catching-up in real time, reducing final cutover downtime to under 10 minutes.

Key Concept

Selecting optimal data transfer pathways based on bandwidth calculation limits and choosing appropriate database replication tools for minimal-downtime cutovers.

Estimated Time:3m 0s

Question 369Question →

A security compliance team requires all Data Access audit logs across an entire Google Cloud Organization to be aggregated and streamed in real time to a centralized Pub/Sub topic residing within a dedicated security management project. The solution must adhere strictly to Google Cloud security best practices and the principle of least privilege. Which TWO actions must a cloud architect perform to configure this organization-level log export?

Select all that apply

Create an aggregated log sink at the GCP Organization level with a filter for Data Access audit logs, setting the destination to the central Pub/Sub topic and enabling the include_children parameter.

Grant the Pub/Sub Publisher role (roles/pubsub.publisher) on the target Pub/Sub topic to the unique writer identity service account generated by the organization log sink.

Grant the Owner primitive role (roles/owner) on the organization resource to the log sink service account so it has full permission to write logs across projects.

Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the log sink service account in the destination project to enable log ingestion impersonation.

Submit a request for a regional quota increase for Cloud Logging ingestion API throughput prior to creating the aggregated organization sink.

Show answer & explanation

Answer: Create an aggregated log sink at the GCP Organization level with a filter for Data Access audit logs, setting the destination to the central Pub/Sub topic and enabling the include_children parameter.; Grant the Pub/Sub Publisher role (roles/pubsub.publisher) on the target Pub/Sub topic to the unique writer identity service account generated by the organization log sink.

Answer

To configure centralized organization-wide audit log streaming securely, you must create an aggregated organization-level log sink with include_children enabled and grant the sink's generated writer identity service account the Pub/Sub Publisher role on the target Pub/Sub topic.

The solution requires aggregated log collection across an entire GCP Organization hierarchy and least-privilege destination authorization. Creating an organization-level sink with `include_children = true` captures logs from all child folders and projects. Granting `roles/pubsub.publisher` to the sink's unique writer identity directly on the target Pub/Sub topic ensures least-privilege access.

Step-by-Step Solution

Define the aggregated sink at the organization root.

Configuring the sink at the organization level with `include_children = true` ensures child folders and projects automatically export their Data Access audit logs.

Organization-level log aggregation requires explicit inclusion of child resources to cover all projects.

Identify the writer identity of the organization sink.

Cloud Logging creates a service account identity specifically assigned to manage data export for that sink.

Log sink exports rely on service account authorization to access external destinations.

Grant minimum permissions on the target Pub/Sub topic.

Assigning `roles/pubsub.publisher` on the specific Pub/Sub topic allows the sink service account to publish log entries while respecting least privilege.

The service account requires pub/sub publishing capabilities limited strictly to the target resource.

Key Concept

Organization Aggregated Log Sinks and Least-Privilege IAM Routing

Estimated Time:2m 0s

Question 370Question →

An e-commerce enterprise is planning to migrate its on-premises relational database to Cloud SQL for MySQL with minimal operational downtime using GCP Database Migration Service (DMS). Place the following database migration steps in the correct chronological execution order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order is: 1) Provision the target Cloud SQL instance and apply database schema definitions, 2) Configure continuous Change Data Capture (CDC) replication job parameters in Database Migration Service, 3) Execute the initial full baseline data snapshot migration from the source database to Cloud SQL, 4) Stop application write traffic to the source database, verify zero CDC replication lag, and switch application endpoints to Cloud SQL.

The correct sequence follows standard database migration best practices: first provision destination resources and schema, then establish CDC replication pipelines, perform the initial baseline bulk load, and finally pause write traffic to verify zero replication lag before switching application connection strings.

Step-by-Step Solution

Prepare target environment

Destination Cloud SQL instance created with appropriate schema structures ready to accept data

Data cannot be streamed into a destination that has not been provisioned with matching target schemas.

Establish continuous replication framework

DMS connection profile and CDC replication pipeline configured

Setting up the CDC pipeline beforehand ensures change logging is tracking transaction logs during data transfer.

Transfer historical baseline data

Full data snapshot copied to Cloud SQL while ongoing changes accumulate in replication stream

A baseline copy of existing data is required before incremental changes can be applied to align the target with the source.

Promote destination and cut over application endpoints

Downtime window minimized and Cloud SQL becomes the active production database

Pausing source write traffic ensures no new transactions occur while verifying zero CDC lag before updating application connection strings.

Key Concept

Minimal-Downtime Database Migration Cutover Sequencing

Question 371Question →

An enterprise DevOps team manages a critical microservice deployed on Google Kubernetes Engine (GKE). The microservice writes structured JSON payload logs containing a custom numerical field, `processing_latency_ms`. The Site Reliability Engineering (SRE) team needs to evaluate latency distributions and set up automated alerts whenever the 99th percentile latency exceeds 500 ms over a rolling 5-minute window across all clusters. How should the team configure Google Cloud Logging and Monitoring to fulfill this operational requirement while strictly adhering to security least-privilege principles?

Create a distribution log-based metric in Cloud Logging extracting `processing_latency_ms` from incoming log entries, and configure a Cloud Monitoring alerting policy targeting the 99th percentile of this metric aggregated over a 5-minute alignment window.

Grant the Editor primitive role to the service account executing log routing so that it can dynamically create log sinks, modify Cloud Monitoring metrics, and update alerting channels across the project without encountering permission errors.

Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the alerting service account so it can impersonate the Logging service account and create metric descriptors on demand.

Create a counter log-based metric for latency occurrences and submit a regional quota increase request for Cloud Logging API read limits to prevent alerting delays during high traffic bursts.

Show answer & explanation

Answer: Create a distribution log-based metric in Cloud Logging extracting `processing_latency_ms` from incoming log entries, and configure a Cloud Monitoring alerting policy targeting the 99th percentile of this metric aggregated over a 5-minute alignment window.

Answer

Create a distribution log-based metric in Cloud Logging extracting processing_latency_ms from incoming log entries, and configure a Cloud Monitoring alerting policy targeting the 99th percentile of this metric aggregated over a 5-minute alignment window.

The correct answer leverages a distribution log-based metric to extract numerical values (`processing_latency_ms`) directly from structured JSON log entries. Cloud Monitoring can then compute distribution statistics, such as the 99th percentile over a 5-minute alignment period, and trigger alerts accordingly without requiring elevated privileges or additional application code.

Step-by-Step Solution

Identify metric type requirements

Determined that measuring 99th percentile latency requires a distribution log-based metric rather than a counter log-based metric.

Counter metrics only track log line counts, whereas distribution metrics extract numerical values to calculate statistical distribution functions like percentiles.

Configure metric extraction in Cloud Logging

Defined a custom distribution metric with a field extractor targeting payload `processing_latency_ms`.

This bridges unstructured/structured log entry values into Cloud Monitoring timeseries data.

Configure Cloud Monitoring Alerting Policy

Created an alerting threshold policy on the 99th percentile alignment calculation over a 5-minute rolling window.

This fulfills the operational alerting criteria using native Cloud Operations suite features under least-privilege IAM configuration.

Key Concept

Configuring distribution log-based metrics and operational alert threshold policies in Google Cloud Operations suite.

Estimated Time:2m 0s

Question 372Question →

An enterprise logistics company is provisioning a private Google Kubernetes Engine (GKE) cluster to process high-throughput batch analytics workloads. Security compliance mandates that worker nodes must only have private IP addresses and that administrative access to the GKE control plane endpoint must be restricted strictly to an internal management subnet accessible via Cloud Interconnect. During deployment testing, engineers notice that while worker nodes lack public IP addresses, the cluster control plane public endpoint remains accessible from unauthorized external networks. Which configuration change must be implemented to fulfill the security compliance requirements?

Enable Control Plane Authorized Networks on the GKE cluster and restrict authorized CIDR blocks exclusively to the internal management subnet range.

Rely on the private cluster configuration alone, assuming that disabling public IPs on worker nodes automatically restricts network access to the GKE control plane.

Assign the primitive Owner IAM role (roles/owner) to the management subnet service account to enforce perimeter network restrictions on the control plane.

Re-architect the workload to run on an unmanaged Compute Engine Managed Instance Group (MIG) because private GKE clusters cannot restrict control plane administrative endpoints.

Show answer & explanation

Answer: Enable Control Plane Authorized Networks on the GKE cluster and restrict authorized CIDR blocks exclusively to the internal management subnet range.

Answer

Enable Control Plane Authorized Networks on the GKE cluster and restrict authorized CIDR blocks exclusively to the internal management subnet range.

Enabling Control Plane Authorized Networks on a private GKE cluster allows organizations to specify explicit CIDR ranges (such as an internal management subnet) permitted to communicate with the cluster's control plane API server. This ensures that unauthorized public or internal networks cannot reach the cluster administration endpoints.

Step-by-Step Solution

Analyze the cluster security requirements

Worker nodes must remain private and administrative access to the GKE control plane must be constrained to specific internal IP ranges.

By default, creating a private cluster prevents public IP assignment on nodes but leaves the control plane endpoint reachable unless restricted.

Evaluate control plane security features in GKE

Control Plane Authorized Networks provide IP-based access control lists (ACLs) for the GKE control plane master endpoint.

Configuring Control Plane Authorized Networks explicitly blocks traffic originating from IP addresses outside the configured CIDR blocks.

Select the correct configuration option

Enable Control Plane Authorized Networks and set the allowed CIDR range to the internal management subnet.

This satisfies security compliance without requiring application re-architecture or granting overly permissive IAM roles.

Key Concept

GKE Private Cluster Control Plane Security & Authorized Networks

Estimated Time:2m 0s

Question 373Question →

Your enterprise cloud architecture team needs to safely migrate an existing production Terraform deployment from local state management to a centralized remote backend on Google Cloud Storage with state locking and version control enabled. What is the correct sequence of operational steps required to complete this migration without data loss?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with provisioning and securing the target Cloud Storage bucket with versioning enabled, adding the backend configuration block to the Terraform code, executing terraform init to detect backend changes, confirming the state transfer prompt, and finally validating the remote state file while removing the local state file.

Migrating Terraform state to Google Cloud Storage requires preparing the destination infrastructure first (creating the versioned GCS bucket), defining the configuration (`backend "gcs"`), executing `terraform init` to register the new backend and transfer local state, confirming the interactive copy prompt, and finally validating remote state presence prior to local file cleanup.

Step-by-Step Solution

Provision the Cloud Storage bucket with versioning and IAM access controls.

A secure, versioned remote location is available for storing state files safely.

Terraform cannot write state to a non-existent or inaccessible backend bucket.

Declare the backend block in the Terraform root module.

The Terraform codebase specifies GCS as its remote backend.

Terraform needs backend definitions in code before it can re-initialize its working state directory.

Run terraform init.

Terraform identifies the change in backend provider and initiates state migration.

Backend changes require explicit re-initialization via the CLI.

Confirm the state copy prompt when requested by terraform init.

Local state entries are securely transferred to the GCS remote state object.

Ensures continuous tracking of infrastructure resources without resetting state.

Validate remote state object creation and remove local terraform.tfstate file.

State management is fully centralized remotely, preventing split-brain or stale state edits.

Leaving stale local state files can cause operational confusion or accidental local applies.

Key Concept

Terraform Remote State Migration to Google Cloud Storage

Estimated Time:1m 30s

Question 374Question →

A healthcare analytics company needs to migrate 500 TB of static medical imaging data from an on-premises storage system to a Cloud Storage bucket in Google Cloud. The company has a dedicated outbound network link of only 20 Mbps and must complete the initial bulk transfer within two weeks. Which Google Cloud solution should the Cloud Architect recommend?

Transfer Appliance

Storage Transfer Service

Dedicated Interconnect

VPC Service Controls

Show answer & explanation

Answer: Transfer Appliance

Answer

Transfer Appliance is the optimal solution because it enables physical, offline data migration of 500 TB without depending on the limited 20 Mbps network connection.

Transfer Appliance is a physical storage appliance provided by Google Cloud for offline data migration. When available network bandwidth is low (e.g., 20 Mbps) and the dataset size is large (500 TB), online transfer methods are unfeasible. Ordering a Transfer Appliance allows data to be copied locally at high speeds and physically shipped to Google Cloud for fast ingestion.

Step-by-Step Solution

Calculate required network transfer time for 500 TB over 20 Mbps

Network transfer time equals approximately

500 \text{ TB} / 20 \text{ Mbps} \approx 200,000,000 \text{ seconds} \approx 2,314 \text{ days}

, which vastly exceeds the 2-week requirement.

Evaluating bandwidth limitations proves that an online network transfer is mathematically unfeasible.

Select an offline data migration strategy

Google Cloud Transfer Appliance provides a physical storage device shipped to the data center to copy data locally and physically ship it to a Google upload facility.

Offline shipping bypasses network bandwidth constraints entirely, enabling completion within days.

Key Concept

Selecting offline vs. online data transfer mechanisms based on dataset size and network bandwidth constraints.

Question 375Question →

An enterprise fintech firm is designing a real-time risk assessment engine on Google Cloud. The system comprises two distinct workloads: a stateless HTTP/REST fraud scoring API that experiences unpredictable traffic spikes ranging from 0 to 50,000 requests per second, and a long-running stateful session manager that maintains continuous bidirectional gRPC streams with partner banking gateways. The infrastructure team has strict operational constraints: operational management overhead must be minimized, baseline compute costs for idle periods must be zero where possible for stateless components, and custom TCP/gRPC connection handling must support fine-grained session persistence without managing underlying virtual machine operating systems. Which TWO compute solutions should the Cloud Architect select to satisfy these requirements optimally?

Select all that apply

Deploy the stateless fraud scoring API on Cloud Run configured with autoscaling concurrency limits.

Deploy the stateful bidirectional session manager on Cloud Run Jobs configured for continuous background execution.

Deploy the stateful bidirectional session manager on GKE Autopilot using StatefulSets and Session Affinity load balancing.

Provision a custom Compute Engine Managed Instance Group (MIG) for the stateless fraud scoring API to eliminate cold-start latencies.

Deploy the stateless fraud scoring API using Cloud Functions (1st gen) behind an HTTP Load Balancer with CPU-based autoscaling rules.

Show answer & explanation

Answer: Deploy the stateless fraud scoring API on Cloud Run configured with autoscaling concurrency limits.; Deploy the stateful bidirectional session manager on GKE Autopilot using StatefulSets and Session Affinity load balancing.

Answer

The optimal architecture combines Cloud Run for the stateless fraud scoring API and GKE Autopilot with Session Affinity for the stateful continuous session manager.

For the stateless fraud scoring API with unpredictable traffic (0 to 50,000 RPS) and a zero baseline cost target, Cloud Run is the optimal platform because it scales container instances dynamically based on incoming HTTP requests down to zero. For the stateful bidirectional gRPC session manager requiring long-lived continuous connections and minimal OS management overhead, GKE Autopilot provides fully managed Kubernetes infrastructure supporting complex network protocols and session persistence without requiring manual cluster node provisioning.

Step-by-Step Solution

Analyze the stateless fraud scoring API requirements.

Identified high concurrency variability (0 to 50,000 RPS), stateless HTTP nature, and requirement for zero-scale baseline cost.

Cloud Run provides serverless container execution that scales to zero when idle and rapidly scales out to handle extreme HTTP request bursts without operational OS overhead.

Analyze the stateful bidirectional gRPC session manager requirements.

Identified long-running execution, stateful session maintenance, and custom connection handling needs while minimizing OS management.

GKE Autopilot abstracts node management while supporting full Kubernetes features like StatefulSets, persistent gRPC streams, and advanced load balancing with session affinity.

Evaluate and reject misallocated compute platforms.

Compute Engine introduces heavy OS maintenance overhead, Cloud Run Jobs are intended for short-lived batch jobs rather than continuous services, and manual CPU-based autoscaling is inappropriate for serverless functions.

Matching workload statefulness, protocol demands, and scaling behavior to appropriate GCP compute abstractions ensures cost efficiency and operational compliance.

Key Concept

Selecting GCP Compute Platforms based on Workload Statefulness, Scaling Profiles, and Operational Overhead Constraints

Question 376Question →

An enterprise organization is deploying an automated infrastructure pipeline using Terraform to provision core compute infrastructure in Google Cloud. The deployment includes private Google Kubernetes Engine (GKE) clusters for microservices and Managed Instance Groups (MIGs) for batch processing workloads. Security compliance policies dictate two strict requirements:
1. Access to the GKE cluster control plane endpoint for management traffic (`kubectl`) must be restricted exclusively to an internal management CIDR range ( $10.200.0.0/24$ ) without exposing management endpoints to unauthorized networks.
2. The continuous deployment service account executing compute resource creation must attach application service accounts to compute instances without gaining privileges to modify service account IAM policies or impersonate high-privilege roles.

Which TWO deployment and security configuration choices must be implemented to fulfill these requirements? (Select TWO)

Select all that apply

Enable Master Authorized Networks on the private GKE cluster and explicitly add the

10.200.0.0/24

IP range to the authorized network configuration.

Grant the deployment pipeline service account the `roles/iam.serviceAccountUser` role on the specific target workload service accounts.

Provision the GKE cluster as a private cluster without Master Authorized Networks enabled, relying on default VPC network firewall rules to block internet access to the control plane.

Grant the deployment pipeline service account the `roles/iam.serviceAccountAdmin` role to ensure it has required permissions to provision and manage Compute Engine instance service accounts.

Store the Terraform infrastructure state file in an ephemeral local directory on the CI/CD runner host to speed up compute resource provisioning operations.

Show answer & explanation

Answer: Enable Master Authorized Networks on the private GKE cluster and explicitly add the $10.200.0.0/24$ IP range to the authorized network configuration.; Grant the deployment pipeline service account the `roles/iam.serviceAccountUser` role on the specific target workload service accounts.

Answer

To satisfy security and infrastructure provisioning requirements, you must enable Master Authorized Networks on the private GKE cluster specifying the authorized CIDR block (

10.200.0.0/24

) and grant the deployment pipeline service account the `roles/iam.serviceAccountUser` role on target workload service accounts.

Enabling Master Authorized Networks ensures that only traffic originating from specified IP ranges (such as the internal management subnet

10.200.0.0/24

) can communicate with the GKE control plane endpoint. Granting the `roles/iam.serviceAccountUser` role provides the exact minimum IAM permission required for the automated deployment pipeline to provision Compute Engine instances and GKE node pools running under targeted service accounts.

Step-by-Step Solution

Analyze GKE Control Plane Security Requirements

Creating a private GKE cluster ensures worker nodes use private IP addresses. However, restricting administrative access (`kubectl`) to the control plane endpoint requires configuring Master Authorized Networks with the specified CIDR block (

10.200.0.0/24

VPC firewall rules cannot filter traffic terminating on Google-managed control plane peering endpoints directly, making Master Authorized Networks the mandatory setting.

Evaluate IAM Role Requirements for Compute Resource Attachment

The identity running the Infrastructure as Code (IaC) deployment needs permission to assign designated service accounts to Compute Engine instances and GKE node pools.

The precise privilege required for attaching a service account to a compute instance is `roles/iam.serviceAccountUser`. Granting administrative roles such as `roles/iam.serviceAccountAdmin` or primitive Owner/Editor roles grants unnecessary security management rights.

Identify Correct Configuration Combination

Selecting Master Authorized Networks configuration and assigning `roles/iam.serviceAccountUser` satisfies both architectural constraints cleanly.

This combination enforces strict network perimeter security for Kubernetes cluster management and adheres to least-privilege IAM standards for automated provisioning.

Key Concept

GKE Private Cluster Control Plane Protection & Service Account User IAM Scoping

Estimated Time:3m 0s

Question 377Question →

An operations team plans to provision 150 Compute Engine virtual machine instances in a single GCP region for an upcoming batch processing job. Which prerequisite step must the team take prior to deployment to prevent execution failures?

Verify regional CPU core limits and request a regional quota increase before launching the instances.

Execute the deployment immediately and allow Google Cloud to dynamically scale the regional project quotas during instance creation.

Grant the CI/CD deployment service account the primitive Owner role to bypass regional resource quota restrictions.

Configure the deployment script to maintain the Terraform state file on the local ephemeral build runner.

Show answer & explanation

Answer: Verify regional CPU core limits and request a regional quota increase before launching the instances.

Answer

Verify regional CPU core limits and request a regional quota increase before launching the instances.

Google Cloud projects have regional quota limits on CPU cores and compute instances. When provisioning a large batch of virtual machines, verifying available capacity and requesting a regional quota increase in advance prevents API errors and deployment failure.

Step-by-Step Solution

Identify the total resource requirement for the compute workload.

Calculate the total CPU and instance count needed across the target region.

Large deployments often exceed default GCP regional quotas.

Check current regional quota usage in the GCP Console or via gcloud CLI.

Determine if available regional quota covers the 150 instances.

GCP enforces regional quota bounds strictly at API request time.

Submit a quota increase request if existing limits are insufficient.

Ensure quota approval prior to starting automated provisioning scripts.

Quota approvals require time to process and cannot be automatically scaled during deployment.

Key Concept

Resource Quotas and Capacity Planning

Estimated Time:45s

Question 378Question →

A global gaming enterprise is preparing to migrate its core infrastructure to Google Cloud within a 3-week target window. The legacy environment consists of two primary datasets located in a single on-premises data center:

1. A $2.4\text{ PB}$ static archive of telemetry and analytics logs stored on an S3-compatible object storage cluster.
2. A $12\text{ TB}$ operational transactional MySQL database supporting live player accounts, which allows a maximum maintenance downtime of 4 hours during final cutover.

The enterprise has a Dedicated Interconnect connection to Google Cloud with an unallocated available bandwidth of $300\text{ Mbps}$ reserved for migration operations. Security governance strictly mandates that data transfer operations must comply with perimeter-based exfiltration controls using VPC Service Controls.

Which migration and data transfer strategy should you recommend to meet the business and technical requirements?

Order and deploy Google Cloud Transfer Appliance devices to physically ingest and transfer the

2.4\text{ PB}

static archive into Cloud Storage, while utilizing Database Migration Service (DMS) with continuous Change Data Capture (CDC) over the Cloud Interconnect connection for the

12\text{ TB}

MySQL database.

Configure Storage Transfer Service on-premises agents to stream both the

2.4\text{ PB}

static archive and the

12\text{ TB}

MySQL database simultaneously over the

300\text{ Mbps}

Dedicated Interconnect connection using maximum parallel transfer threads.

Migrate the

12\text{ TB}

MySQL database directly to Cloud Spanner by backing up to Transfer Appliance devices, while establishing high-bandwidth HA VPN tunnels to stream the

2.4\text{ PB}

archive directly into BigQuery.

Provision an array of HA VPN tunnels over the public internet to transfer the

2.4\text{ PB}

archive using Storage Transfer Service, and perform a manual `mysqldump` export and restore of the

12\text{ TB}

MySQL database during the 4-hour cutover window.

Show answer & explanation

Answer: Order and deploy Google Cloud Transfer Appliance devices to physically ingest and transfer the $2.4\text{ PB}$ static archive into Cloud Storage, while utilizing Database Migration Service (DMS) with continuous Change Data Capture (CDC) over the Cloud Interconnect connection for the $12\text{ TB}$ MySQL database.

Answer

Deploy Google Cloud Transfer Appliance devices for the

2.4\text{ PB}

static storage archive and use Database Migration Service (DMS) with continuous Change Data Capture (CDC) over Cloud Interconnect for the

12\text{ TB}

MySQL database.

Transferring

2.4\text{ PB}

of data over a

300\text{ Mbps}

network link would take over two years, making offline transfer via Transfer Appliance mandatory to meet the 3-week timeframe. For the

12\text{ TB}

MySQL database, continuous replication using Database Migration Service (DMS) with Change Data Capture (CDC) over Cloud Interconnect ensures the database remains synchronized online, enabling final promotion and cutover well within the 4-hour downtime limit.

Step-by-Step Solution

Calculate network throughput limitations for the static archive dataset

At an available bandwidth of

300\text{ Mbps}

(

37.5\text{ MB/s}

), transferring

2.4\text{ PB}

(

2,400,000\text{ GB}

) online would require

\frac{2,400,000\times 10^9\text{ bytes}}{37.5\times 10^6\text{ bytes/s}} \approx 64,000,000\text{ seconds} \approx 740\text{ days}

An online network transfer cannot satisfy the 3-week migration timeline requirement.

Select physical offline transfer mechanism for petabyte-scale storage

Utilizing Google Cloud Transfer Appliance enables offline physical transport of

2.4\text{ PB}

to Cloud Storage within the 3-week window.

Transfer Appliance bypasses bandwidth bottlenecks for multi-petabyte datasets.

Select replication and cutover mechanism for the operational database

Configuring Database Migration Service (DMS) with continuous CDC continuously syncs transactions over the

300\text{ Mbps}

Interconnect link, allowing final cutover to take minutes, well under the 4-hour downtime threshold.

Offline dumps of

12\text{ TB}

would exceed the 4-hour downtime window during transfer and restore.

Key Concept

Selecting hybrid data transfer strategies based on bandwidth constraints, dataset scale, and operational cutover downtime limits.

Estimated Time:3m 0s

Question 379Question →

A global logistics organization is architecting an IoT fleet telemetry platform on Google Cloud. The system consists of two core components:

1. An event ingestion web service that receives containerized HTTPS and gRPC telemetry payloads from 500,000 active vehicles. Traffic fluctuates unpredictably throughout the day, requiring rapid scale-to-zero capabilities and minimal operational infrastructure management.
2. A legacy route optimization service written in C++ that requires fine-grained Linux kernel parameter tuning ( $sysctl$ ) and shared memory ( $shm$ ) IPC configurations, operating at a continuous baseline load.

Which compute platform architecture meets these technical requirements while minimizing operational management overhead?

Deploy the event ingestion service on Cloud Run, and deploy the C++ route optimization service on Compute Engine Managed Instance Groups (MIGs) utilizing custom virtual machine images.

Deploy both the event ingestion web service and the C++ route optimization service on Google Kubernetes Engine (GKE) Autopilot clusters.

Deploy the event ingestion service on GKE Standard clusters with Cluster Autoscaler, and deploy the C++ route optimization service on Cloud Run as a sidecar container deployment.

Deploy the event ingestion service on App Engine Standard, and deploy the C++ route optimization service on Cloud Functions (2nd gen).

Show answer & explanation

Answer: Deploy the event ingestion service on Cloud Run, and deploy the C++ route optimization service on Compute Engine Managed Instance Groups (MIGs) utilizing custom virtual machine images.

Answer

Deploy the event ingestion service on Cloud Run, and deploy the C++ route optimization service on Compute Engine Managed Instance Groups (MIGs) utilizing custom virtual machine images.

Selecting Cloud Run for the event ingestion service satisfies the containerized HTTP/gRPC scale-to-zero requirement with zero server management overhead. Selecting Compute Engine Managed Instance Groups (MIGs) with custom images for the legacy C++ service allows direct configuration of OS-level parameters, system kernel settings (

sysctl

), and shared memory structures that managed container environments restrict.

Step-by-Step Solution

Analyze workload 1 (event ingestion) requirements

Identified HTTP/gRPC protocol needs, containerized packaging, rapid auto-scaling from zero, and low operational overhead requirement.

Cloud Run is the optimal Google Cloud compute platform for stateless containerized workloads requiring HTTP/gRPC support and scale-to-zero operational simplicity.

Analyze workload 2 (legacy C++ optimization service) requirements

Identified low-level OS dependency requirements including custom

sysctl

kernel parameters and

shm

shared memory configuration.

Fully managed compute environments like Cloud Run, App Engine Standard, and GKE Autopilot restrict host kernel modifications. Compute Engine (VMs/MIGs) provides complete OS and kernel control.

Synthesize optimal architecture

Combine Cloud Run for serverless ingestion with Compute Engine MIGs for low-level OS kernel customization.

This hybrid platform selection aligns with Google Cloud architectural best practices by choosing serverless abstractions where possible while utilizing IaaS for low-level system dependencies.

Key Concept

Compute Platform Selection Matrix (Cloud Run vs GKE Autopilot vs Compute Engine based on OS/Kernel dependencies and scaling characteristics)

Question 380Question →

A cloud architecture team is setting up an automated Continuous Delivery pipeline for a web service on Google Cloud using Cloud Build, Artifact Registry, and Cloud Deploy. What is the correct chronological sequence of steps to safely build, validate, and roll out a new software release to production?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with building and scanning the container image in Artifact Registry, followed by creating a Cloud Deploy release, deploying to a staging target for automated validation, and finally promoting the release to the production target for progressive canary rollout.

A standard automated deployment pipeline enforces strict stage dependencies: source code is first compiled into a container image and scanned for vulnerabilities in Artifact Registry; next, a Cloud Deploy release is initialized referencing this immutable artifact; the release is then deployed to staging for automated integration testing; finally, upon successful test completion, the release is promoted to production.

Step-by-Step Solution

Trigger Cloud Build to build the container image and upload it to Artifact Registry.

A secure container image artifact with scan results is available.

Build artifacts and security scans must exist prior to creating deployment manifests.

Execute gcloud deploy releases create to bundle the pipeline configuration and image digest.

An immutable Cloud Deploy release object is created.

Cloud Deploy requires a defined release object to manage target progressions and rollbacks.

Deploy the release to the non-production staging environment and run integration tests.

The release is validated in an isolated staging environment.

Testing in non-production environments catches integration issues before user impact.

Promote the validated Cloud Deploy release to the production target.

The application is deployed to production using the defined canary strategy.

Promotion executes the progressive rollout strategy safely after all prerequisite checks pass.

Key Concept

Automated Deployment Pipeline Order and Progression Gates

PreviousPage 19 / 80Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept