Examkin

All practice questions

64 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 21Question →

A cloud security architect is defining data protection standards across several enterprise applications migrating to Google Cloud. Match each business or regulatory requirement to the appropriate Google Cloud key management or encryption model.

Click a left item, then click its matching right item

Items

The organization must generate and retain key material in an on-premises external key management system outside of GCP, authorizing GCP to request cryptographic operations over an API.
The organization requires key material to be stored in FIPS 140-2 Level 3 validated Hardware Security Modules hosted inside GCP, while maintaining customer control over key rotation schedules and IAM permissions.
Compliance demands that raw 256-bit AES encryption keys are provided directly in API calls for persistent disk encryption and discarded from GCP memory after use, without key persistence in GCP.
The system requires baseline data encryption at rest with zero administrative overhead, where Google automatically manages key generation, storage, and rotation.

Matches

Show answer & explanation

Answer

Matching pairings: External key generation and retention outside GCP maps to Cloud External Key Manager (Cloud EKM); FIPS 140-2 Level 3 HSM hosted in GCP under customer control maps to Customer-Managed Encryption Keys (CMEK) via Cloud HSM; Transient per-request raw key delivery maps to Customer-Supplied Encryption Keys (CSEK); Zero-overhead automatic encryption by Google maps to Google-default Encryption.
Each requirement aligns directly with its underlying GCP cryptographic architecture: external key custody maps to Cloud EKM; Google-hosted FIPS 140-2 Level 3 hardware key management maps to CMEK with Cloud HSM; transient per-request key transmission maps to CSEK; and default automated protection maps to Google-default encryption.

Step-by-Step Solution

1
Identify key location and custody requirements for external systems
Keys residing in on-premises/third-party HSMs outside GCP infrastructure correspond to Cloud External Key Manager (Cloud EKM).
Cloud EKM connects GCP services to external key management infrastructure via HTTPS endpoints.
2
Evaluate hardware security and administrative compliance levels inside GCP
Keys requiring FIPS 140-2 Level 3 hardware validation managed via Cloud KMS policies map to CMEK with Cloud HSM.
Cloud HSM is a Google-managed hardware security module service integrated into Cloud KMS.
3
Determine key handling for raw per-request key supply
Passing raw 256-bit AES keys directly in service API calls without storing keys in Cloud KMS maps to CSEK.
CSEK requires callers to supply the raw cryptographic key in header parameters for each storage or disk API call.
4
Assess baseline default encryption behavior
Default automatic encryption using internal Google key management systems maps to Google-default Encryption.
All GCP data at rest is encrypted by default using AES-256 without customer setup.

Key Concept

Selecting appropriate GCP encryption models (Google-default, CMEK, CSEK, Cloud EKM) based on operational, regulatory, and key custody requirements.
Question 22Question →

Match each data security governance requirement to the appropriate Google Cloud data encryption and key management mechanism.

Click a left item, then click its matching right item

Items

Strict regulatory mandate requiring encryption keys to reside physically in an on-premises Hardware Security Module (HSM) outside of Google Cloud infrastructure while protecting cloud data.
Enterprise requirement for customer control over key lifecycles, access policies, and automated rotation schedules directly within GCP using service account IAM roles.
Workload requirement to supply raw AES-256 keys dynamically in API request headers, ensuring keys exist only in transient memory and are never persisted to Google Cloud key storage.
Standard operational baseline requiring transparent data encryption at rest across all Google Cloud services without manual key configuration or operational maintenance.

Matches

Show answer & explanation

Answer

Cloud EKM corresponds to on-premises key residency mandates; Customer-Managed Encryption Keys (CMEK) corresponds to GCP-managed key control and automated rotation; Customer-Supplied Encryption Keys (CSEK) corresponds to per-request raw key passing without storage; Google-default Encryption corresponds to baseline zero-overhead encryption.
The matching pairs correctly reflect the boundaries of responsibility and control across Google Cloud's data encryption offerings. Cloud EKM satisfies stringent external key control requirements. CMEK balances customer control over key rotation and access policies with native GCP service integration. CSEK ensures raw key material is never stored within GCP key management tools. Google-default Encryption provides invisible, zero-maintenance baseline security for all stored assets.

Step-by-Step Solution

1
Analyze key storage location requirements.
External key control requiring physical on-premises HSM retention maps directly to Cloud EKM.
Cloud EKM ensures cryptographic keys never leave the external key management infrastructure.
2
Evaluate in-cloud key governance and lifecycle capabilities.
Customer control over keys within GCP using IAM policy bindings and rotation policies maps to CMEK via Cloud KMS.
CMEK allows granular IAM permissioning (Encrypter/Decrypter) and automated rotation inside Google Cloud KMS.
3
Identify key delivery methods for transient processing.
Passing raw AES-256 keys directly within API request headers maps to CSEK.
CSEK guarantees Google does not retain or store key material on disk or within Cloud KMS.
4
Determine default platform security baseline.
Automatic platform-wide encryption without user configuration maps to Google-default Encryption.
Google encrypts all customer data at rest by default using Google-managed service keys.

Key Concept

Google Cloud Data Encryption Spectrum and Key Management Responsibilities
Estimated Time:1m 30s
Question 23Question →

An enterprise cloud architect is establishing a defense-in-depth perimeter security baseline for a financial enterprise migrating to Google Cloud. Match each security requirement to its corresponding GCP perimeter control mechanism.

Click a left item, then click its matching right item

Items

Mitigate Layer 7 web application attacks (such as SQL injection and Cross-Site Scripting) and apply rate limiting at the external HTTP(S) Load Balancer edge.
Prevent authorized internal identities from copying sensitive BigQuery datasets to unauthorized external Google Cloud storage locations.
Enforce mandatory, non-overrideable network access rules globally across all projects in the organization hierarchy using fine-grained resource tagging.
Provide secure, private endpoint connectivity to Google APIs and third-party SaaS services from an isolated VPC without exposing public IPs or requiring transitive VPC peering.

Matches

Show answer & explanation

Answer

The correct alignment pairs each specific security requirement with its dedicated Google Cloud perimeter mechanism: Layer 7 WAF edge defense maps to Cloud Armor; API-level data exfiltration prevention maps to VPC Service Controls; mandatory organization-wide rule enforcement with secure tags maps to Hierarchical Firewall Policies; and private service consumption without transitive peering maps to Private Service Connect.
Each requirement targets a distinct security layer in Google Cloud: Cloud Armor inspects HTTP(S) traffic at Layer 7 for WAF and rate limiting; VPC Service Controls prevents exfiltration across Google API boundaries by controlling network context; Hierarchical Firewall Policies enforce global security baselines with secure tags across project hierarchies; and Private Service Connect establishes private, local VPC endpoints for services without public internet or transitive peering.

Step-by-Step Solution

1
Analyze the request for Layer 7 web attack mitigation and rate limiting at the load balancer.
Identify Cloud Armor as the native GCP WAF solution integrated with Google Cloud External HTTP(S) Load Balancing.
Cloud Armor inspects incoming HTTP(S) requests against OWASP preconfigured rules before traffic reaches compute backends.
2
Analyze the requirement to block data exfiltration from managed services like BigQuery.
Identify VPC Service Controls as the security perimeter mechanism governing Google API boundaries.
IAM controls WHO can access data, but VPC Service Controls restricts WHERE data can be read from or written to, neutralizing exfiltration risks.
3
Analyze the need for organization-wide mandatory firewall rules using tag-based control.
Identify Hierarchical Firewall Policies paired with secure tags.
Hierarchical policies are enforced at the organization or folder level and cannot be overridden by project-level firewall rules.
4
Analyze the requirement for private connectivity to managed services without public IPs or transitive VPC peering.
Identify Private Service Connect (PSC).
PSC project endpoints instantiate private IP addresses inside the consumer VPC to access published services or Google APIs.

Key Concept

Multi-layered GCP network perimeter defense integrating WAF, API Service Perimeters, Hierarchical Firewalls, and Private Endpoint Routing.
Question 24Question →

Match each Google Cloud security product or feature to its corresponding container vulnerability management or threat detection role within an enterprise architecture.

Click a left item, then click its matching right item

Items

Binary Authorization
Event Threat Detection (ETD)
Artifact Registry Vulnerability Scanning
Container Threat Detection (CTD)

Matches

Show answer & explanation

Answer

Binary Authorization matches deploy-time signature verification policies; Event Threat Detection matches organization-wide log stream threat analysis; Artifact Registry Vulnerability Scanning matches container image CVE monitoring; Container Threat Detection matches kernel-level GKE node runtime monitoring.
Each service addresses a distinct phase in the container lifecycle: Artifact Registry Vulnerability Scanning handles repository inspection, Binary Authorization enforces deployment policy gates, Container Threat Detection monitors live GKE container runtimes, and Event Threat Detection monitors GCP audit and stream logs across the organization.

Step-by-Step Solution

1
Identify the deploy-time prevention control.
Binary Authorization requires attestations before image deployment on GKE.
Prevents unsigned or unauthorized container builds from running in production environments.
2
Distinguish between log analysis and node kernel runtime inspection.
Event Threat Detection analyzes Cloud Logging log events, whereas Container Threat Detection monitors low-level kernel activities inside GKE worker nodes.
Security Command Center separates log-based threat detection (ETD) from active node workload runtime detection (CTD).
3
Identify image repository scanning controls.
Artifact Registry Vulnerability Scanning handles pre-deployment CVE detection directly within the image storage registry.
Ensures container images are evaluated for software vulnerabilities before deployment.

Key Concept

Defense-in-depth container security, vulnerability scanning, and threat detection in GCP
Question 25Question →

Match each Google Cloud data encryption and key management mechanism to its defining operational control and key lifecycle characteristic.

Click a left item, then click its matching right item

Items

Google-default Encryption
Customer-Managed Encryption Keys (CMEK)
Customer-Supplied Encryption Keys (CSEK)
Cloud External Key Manager (Cloud EKM)

Matches

Show answer & explanation

Answer

Google-default Encryption maps to automatic key lifecycle management by Google. Customer-Managed Encryption Keys (CMEK) maps to key control in Cloud KMS/HSM with automated rotation and IAM access configuration. Customer-Supplied Encryption Keys (CSEK) maps to supplying raw AES-256 keys in API calls held only in memory. Cloud External Key Manager (Cloud EKM) maps to holding keys in an external third-party HSM outside of Google Cloud.
Each encryption mechanism corresponds to a distinct tier of key custody: Google-default handles all keys automatically; CMEK grants customers control of keys stored within Cloud KMS/HSM; CSEK requires callers to supply raw keys in each API call; and Cloud EKM anchors key protection to an external HSM residing outside Google Cloud.

Step-by-Step Solution

1
Analyze key ownership and control requirements for each GCP encryption tier.
Differentiate between fully managed (Google-default), cloud-hosted customer control (CMEK/Cloud KMS), ephemeral client-provided keys (CSEK), and off-cloud external keys (Cloud EKM).
Understanding key placement and request mechanisms determines regulatory compliance and operational responsibility.
2
Pair client API header requirements with Customer-Supplied Encryption Keys (CSEK).
Confirm that CSEK requires transmitting raw AES-256 keys per API request without Google storing the key to disk.
CSEK is unique in requiring per-request key transmission without persisting the key within any Google service.
3
Pair third-party external HSM requirements with Cloud EKM.
Confirm that Cloud EKM routes key operation requests outside GCP to external key managers.
Cloud EKM ensures data keys never leave the external HSM boundary while integrating with GCP services.

Key Concept

Selecting data encryption key modes across Google-default, CMEK, CSEK, and EKM based on regulatory governance and operational requirements.
Estimated Time:1m 30s
Question 26Question →

An aerospace software engineering enterprise is establishing a multi-layered defense architecture on Google Cloud for its flight simulation microservices. The lead cloud security architect must assign dedicated GCP security products to specific vulnerability management, deploy-time governance, and threat detection requirements. Match each Google Cloud security product to its primary security capability within the application lifecycle.

Click a left item, then click its matching right item

Items

Binary Authorization
Container Analysis
Container Threat Detection
Event Threat Detection

Matches

Show answer & explanation

Answer

Binary Authorization matches with deploy-time signature enforcement; Container Analysis matches with Artifact Registry image vulnerability scanning; Container Threat Detection matches with real-time container runtime memory and kernel syscall monitoring; Event Threat Detection matches with log stream analysis for organization-level threat detection.
Each GCP security service provides a distinct layer of security across the container lifecycle: Container Analysis handles image vulnerability scanning during storage, Binary Authorization enforces cryptographically signed deployment policies, Container Threat Detection monitors runtime kernel and memory behavior on GKE nodes, and Event Threat Detection scans organization audit log streams for cloud-wide threat activity.

Step-by-Step Solution

1
Identify deploy-time prevention controls.
Binary Authorization enforces cryptographic attestations before pod creation in GKE.
Prevents untrusted or unvetted images from entering the production runtime environment.
2
Identify build and storage vulnerability management controls.
Container Analysis continuously scans Artifact Registry repositories for OS and package CVEs.
Provides automated vulnerability visibility prior to container deployment.
3
Identify workload runtime node-level threat detection mechanisms.
Container Threat Detection analyzes hypervisor and kernel memory inside GKE nodes.
Detects active runtime compromises such as execution of unauthorized binaries or reverse shells.
4
Identify log-based cloud management threat monitoring controls.
Event Threat Detection processes Cloud Logging audit streams.
Detects broader account compromises, suspicious identity usage, and data exfiltration patterns.

Key Concept

Defense-in-depth container security and threat detection integration in Google Cloud Platform.
Estimated Time:2m 0s
Question 27Question →

A enterprise architecture team is defining data encryption standards across Google Cloud workloads to meet distinct compliance and operational mandates. Match each business encryption requirement to the appropriate Google Cloud key management mechanism.

Click a left item, then click its matching right item

Items

Regulatory mandate requiring physical key storage strictly outside Google Cloud infrastructure while using cloud services.
Compliance mandate requiring keys to be generated and stored inside FIPS 140-2 Level 3 validated hardware modules managed in the cloud.
Operational requirement to supply encryption key material transiently per API request without persisting the key in GCP.
Standard baseline security requirement where platform services automatically encrypt data at rest without additional configuration.

Matches

Show answer & explanation

Answer

Cloud EKM corresponds to physical key storage outside Google Cloud; Cloud KMS with Cloud HSM corresponds to FIPS 140-2 Level 3 cloud-hosted keys; CSEK corresponds to transient key delivery per API call; Google-default encryption corresponds to zero-configuration server-side encryption.
The mapping accurately pairs each encryption deployment model (Cloud EKM, Cloud KMS with Cloud HSM, CSEK, and Google-default encryption) to its specific operational characteristics, key custody boundary, and regulatory compliance features.

Step-by-Step Solution

1
Analyze key custody locations
External key storage mandates require Cloud EKM.
Cloud EKM keeps keys residing on-premises or in an external HSM partner while permitting GCP services to encrypt/decrypt data via API calls.
2
Evaluate hardware security requirements in GCP
Cloud-managed FIPS 140-2 Level 3 requirements map to Cloud HSM.
Cloud HSM provides managed hardware security modules integrated into Cloud KMS.
3
Differentiate transient key models from stored keys
Keys passed per API call without cloud storage map to CSEK.
CSEK requires passing key material in API requests for Cloud Storage or Compute Engine, residing only in transient memory during requests.
4
Identify default baseline encryption
Zero-configuration automated encryption maps to Google-default encryption.
GCP encrypts all customer data at rest by default using Google-managed keys.

Key Concept

Data Encryption & Key Management Options in Google Cloud
Question 28Question →

An airline company is modernizing its flight operations architecture on Google Cloud. Match each enterprise perimeter security requirement on the left with the correct Google Cloud security mechanism on the right that fulfills it.

Click a left item, then click its matching right item

Items

Prevent data exfiltration from BigQuery and Cloud Storage to unauthorized external services by enforcing an API boundary.
Filter incoming HTTP(S) web traffic at the global edge against SQL injection, cross-site scripting, and volumetric rate limits.
Enforce organization-wide network ingress and egress policies across all existing and future VPC networks, overriding project-level firewall rules.
Connect securely and privately to a third-party partner API published in another VPC without exposing internal IP ranges or establishing VPC peering.

Matches

Show answer & explanation

Answer

The enterprise security requirements match as follows: Data exfiltration prevention for GCP APIs maps to VPC Service Controls; Edge HTTP(S) layer 7 protection maps to Google Cloud Armor Security Policy; Mandatory top-down network rule enforcement maps to Hierarchical Firewall Policy; Private non-transitive partner service access maps to Private Service Connect Endpoint.
Each Google Cloud perimeter security mechanism targets a distinct operational boundary: VPC Service Controls secure API-level communication for managed services; Cloud Armor delivers Layer 7 WAF and rate limiting at the load balancer edge; Hierarchical Firewall Policies enforce immutable organization-wide IP/port filtering; Private Service Connect provides targeted, non-transitive endpoint connectivity between separate VPC environments.

Step-by-Step Solution

1
Evaluate requirement 1 regarding GCP API exfiltration prevention
Identify that IAM controls user permissions but does not restrict egress destination for API requests. VPC Service Controls create perimeters that restrict data movement outside authorized boundaries.
VPC Service Controls isolate Google-managed platform service resources within defined perimeters.
2
Evaluate requirement 2 regarding edge application protection
Identify that Google Cloud Armor attaches to Global External HTTP(S) Load Balancers to provide Web Application Firewall (WAF) and DDoS protection.
Cloud Armor inspects L7 request attributes at the Google edge prior to hitting backend instances.
3
Evaluate requirement 3 regarding centralized firewall enforcement
Identify that Hierarchical Firewall Policies attach to Organization or Folder nodes to enforce non-overridable network rules across all underlying projects.
Project-level VPC firewall rules can be modified by local project admins, whereas Hierarchical policies enforce top-down compliance.
4
Evaluate requirement 4 regarding isolated service consumption
Identify that Private Service Connect endpoints allow unidirectional connection to consumer services via internal IP mapping without establishing transitive network routing.
VPC Peering exposes full CIDR ranges and does not scale across independent administrative domains as easily as Private Service Connect.

Key Concept

Designing multi-layered network perimeters using VPC Service Controls, Cloud Armor, Hierarchical Firewalls, and Private Service Connect.
Estimated Time:1m 30s
Question 29Question →

Match each Google Cloud service local development requirement with the appropriate emulator configuration command or environment variable required to bind client SDKs to local testing environments.

Click a left item, then click its matching right item

Items

Configuring local client libraries to direct event message publishing and subscription calls to a locally executing Cloud Pub/Sub emulator process.
Configuring local application code and schema migration tooling to target a local Cloud Spanner emulator instance for SQL DDL and transactional DML execution.
Executing an ephemeral Datastore mode local emulator instance that keeps state entirely in memory without writing data files to disk during automated unit test runs.
Initializing a Cloud Bigtable emulator service on a developer workstation and configuring the application client SDK to bypass production Cloud IAM credentials.

Matches

Show answer & explanation

Answer

Each Google Cloud service emulator requires specific startup flags via gcloud CLI and corresponding environment variables (PUBSUB_EMULATOR_HOST, SPANNER_EMULATOR_HOST, DATASTORE_EMULATOR_HOST, BIGTABLE_EMULATOR_HOST) to redirect client library traffic locally without real cloud credentials.
Google Cloud client SDKs automatically detect emulator environment variables (e.g., `PUBSUB_EMULATOR_HOST`, `SPANNER_EMULATOR_HOST`, `DATASTORE_EMULATOR_HOST`, `BIGTABLE_EMULATOR_HOST`). When set, client calls are automatically redirected to the specified localhost ports without requiring production service account credentials or project authorization.

Step-by-Step Solution

1
Identify the target GCP service being emulated in local development.
Map Pub/Sub, Spanner, Datastore, and Bigtable to their respective emulator commands.
Each service uses a dedicated `gcloud` sub-command component for local emulation.
2
Determine specific emulator runtime parameters such as in-memory state flags.
Match `--no-store-on-disk` to the ephemeral Datastore configuration requirement.
Preventing disk persistence ensures fast, isolated, clean unit test environments.
3
Identify the standard environment variable required by GCP client SDKs for each service emulator.
Pair service name to host variable: PUBSUB_EMULATOR_HOST, SPANNER_EMULATOR_HOST, DATASTORE_EMULATOR_HOST, and BIGTABLE_EMULATOR_HOST.
GCP client SDKs check for these environment variables at instantiation to redirect connection endpoints away from production GCP APIs.

Key Concept

Local GCP Service Emulators and Environment Configuration
Question 30Question →

A software enterprise is designing a comprehensive perimeter defense architecture on Google Cloud. Match each enterprise network security requirement with the most appropriate Google Cloud perimeter security mechanism.

Click a left item, then click its matching right item

Items

Prevent authorized internal users and compromised compute resources from exfiltrating sensitive data in BigQuery datasets to unauthorized external Google Cloud projects.
Inspect incoming HTTPS traffic at the global load balancer edge to mitigate Layer 7 application attacks, block malicious IP ranges, and enforce rate limiting.
Enforce mandatory organization-wide baseline ingress firewall rules that apply across all VPC networks and cannot be overridden by project-level administrators.
Allow private on-premises workloads to securely access Google APIs (such as Cloud Storage) over Cloud Interconnect without exposing traffic to the public internet or utilizing public IP addresses.

Matches

Show answer & explanation

Answer

1 matches VPC Service Controls Service Perimeter; 2 matches Google Cloud Armor Security Policy; 3 matches Hierarchical Firewall Policy; 4 matches Private Service Connect / Private Google Access.
Each requirement directly aligns with its target GCP perimeter control: VPC Service Controls protect against data exfiltration across API boundaries; Cloud Armor protects public endpoints against Layer 7 and DDoS attacks at the edge; Hierarchical Firewall Policies enforce centralized network rules across the organization hierarchy; and Private Service Connect / Private Google Access enable secure, private routing to Google APIs over hybrid connections.

Step-by-Step Solution

1
Analyze requirement 1 (Data exfiltration prevention across project boundaries).
IAM roles control who can access resources, but do not prevent authorized users from copying data out to unapproved external projects. VPC Service Controls create a perimeter boundary around services like BigQuery to prevent data exfiltration.
VPC Service Controls restrict API communication between resources inside a perimeter and unauthorized resources outside.
2
Analyze requirement 2 (Edge WAF and Layer 7 protection).
Cloud Armor integrates directly with Cloud Load Balancing to block OWASP Top 10 vulnerabilities, enforce geo-blocking, and rate-limit HTTP(S) traffic.
Cloud Armor is the primary GCP edge security product for application-level threat mitigation.
3
Analyze requirement 3 (Organization-wide non-overridable network security baselines).
Hierarchical Firewall Policies are evaluated before VPC network-level firewall rules and can delegated or locked at the organization/folder level.
Hierarchical firewalls ensure organizational compliance across multi-tenant project structures.
4
Analyze requirement 4 (Private Google API access from on-premises over hybrid connectivity).
Private Service Connect and Private Google Access allow internal networks to access Google managed services using private endpoint IPs over Cloud Interconnect or Cloud VPN.
Private access mechanisms eliminate the need for public IP addresses when accessing GCP storage and database APIs.

Key Concept

Google Cloud Perimeter Security Architecture and Network Controls
Question 31Question →

A renewable energy utility enterprise is building a smart-grid telemetry platform on Google Cloud. The infrastructure requires a multi-layered perimeter security model to meet strict compliance guidelines. Match each perimeter security requirement on the left with the corresponding Google Cloud security control mechanism on the right that fulfills it.

Click a left item, then click its matching right item

Items

Protect public HTTPS web application endpoints against SQL injection (SQLi), cross-site scripting (XSS), and volumetric Layer 7 denial-of-service attacks.
Prevent unauthorized data exfiltration from BigQuery and Cloud Storage buckets to external Google Cloud locations, even if IAM service account keys are compromised.
Apply organization-wide SSH access rules to VM instances dynamically based on fine-grained resource metadata rather than IP subnet ranges.
Enable workloads in isolated private VPC subnets without external IP addresses to consume Google APIs securely over internal IP endpoints.

Matches

Show answer & explanation

Answer

1 matches Google Cloud Armor security policies; 2 matches VPC Service Controls service perimeter; 3 matches Hierarchical firewall policies using secure tags; 4 matches Private Service Connect (PSC) endpoints.
Each requirement maps to its specific GCP architectural component: Google Cloud Armor inspects edge HTTP(S) traffic for WAF threats; VPC Service Controls prevents perimeter exfiltration of Google API data; Hierarchical firewall policies with secure tags apply centralized policy based on instance metadata; and Private Service Connect endpoints enable internal IP connectivity to Google APIs.

Step-by-Step Solution

1
Identify protection mechanism for Layer 7 web attacks and DDoS
Google Cloud Armor is Google's edge Web Application Firewall (WAF) and anti-DDoS service.
It handles public HTTPS endpoint protection against XSS, SQLi, and rate limiting.
2
Identify perimeter control for exfiltration prevention across Google Cloud services
VPC Service Controls establishes perimeter boundaries around Google APIs and storage resources.
VPC SC prevents data exfiltration by enforcing authorization at the API perimeter level beyond identity-based IAM controls.
3
Determine organization-level management of instance firewalls via metadata
Hierarchical firewall policies combined with secure tags.
Hierarchical policies enforce top-down rules across the resource hierarchy while secure tags allow rules to target specific instances dynamically.
4
Identify private Google API routing mechanism for internal networks
Private Service Connect (PSC) endpoints for Google APIs.
PSC endpoints map Google APIs to internal IP addresses inside the user's VPC network without requiring public IPs or public internet routing.

Key Concept

Perimeter Security and Access Control Mechanisms in GCP
Question 32Question →

An enterprise security architect is designing a defense-in-depth network architecture across a multi-project Google Cloud deployment. Match each Google Cloud network security control on the left to its primary architectural use case on the right.

Click a left item, then click its matching right item

Items

VPC Service Controls Perimeter
Cloud Armor Security Policy
Hierarchical Firewall Policy with Secure Tags
Private Service Connect Endpoint

Matches

Show answer & explanation

Answer

VPC Service Controls Perimeter maps to defining security boundaries to prevent data exfiltration; Cloud Armor Security Policy maps to mitigating Layer 7 web application vulnerabilities at the edge; Hierarchical Firewall Policy with Secure Tags maps to enforcing top-down network rules using resource tagging; Private Service Connect Endpoint maps to consuming services privately without VPC peering.
Each Google Cloud network security tool addresses a distinct operational layer in the defense-in-depth model: VPC Service Controls secures GCP service API boundaries to prevent data exfiltration; Cloud Armor provides edge L7 WAF protection; Hierarchical Firewall Policies enforce centralized organization-wide L3/L4 rules using Secure Tags; and Private Service Connect provides isolated private endpoint access to services without requiring VPC Peering connections.

Step-by-Step Solution

1
Analyze the role of VPC Service Controls
Identified that VPC Service Controls protect GCP service APIs (e.g., Cloud Storage, BigQuery) from exfiltration, which matches restricting API access across boundaries.
VPC SC acts at the API level rather than traditional IP packet filtering.
2
Analyze the role of Cloud Armor
Identified that Cloud Armor evaluates incoming web traffic at Google's edge, protecting against Layer 7 attacks like SQLi/XSS.
Cloud Armor integrates directly with Cloud Load Balancing for edge security.
3
Analyze Hierarchical Firewall Policies with Secure Tags
Identified that hierarchical policies apply at the organization or folder level and leverage Secure Tags bound to IAM to control instance traffic.
Hierarchical firewalls enforce centralized governance across multiple projects.
4
Analyze Private Service Connect
Identified that Private Service Connect exposes endpoints internally using consumer IP addresses, avoiding VPC Peering requirements.
PSC simplifies private access without IP overlap or transitive peering issues.

Key Concept

Google Cloud Perimeter Security & Network Controls Selection
Estimated Time:1m 30s
Question 33Question →

A global energy utility enterprise is designing a hybrid network architecture between its legacy control centers, regional operational offices, and Google Cloud VPC networks. Match each specific architectural requirement to the most appropriate Google Cloud hybrid connectivity or topology solution.

Click a left item, then click its matching right item

Items

Provisioning 50 Gbps dedicated bandwidth from an enterprise colocation facility requiring a guaranteed 99.99% availability SLA.
Connecting a regional operational facility that lacks direct colocation access with a bandwidth requirement of 2 Gbps.
Establishing encrypted IPsec tunnel connectivity over the public internet with automated BGP failover for a 99.99% SLA.
Connecting two distinct Google Cloud VPCs directly for low-latency communications while maintaining strict non-transitive routing boundaries.

Matches

Show answer & explanation

Answer

Each hybrid connectivity requirement matches its corresponding GCP networking solution based on bandwidth capacity, colocation capabilities, availability SLA targets, and routing transitivity constraints.
Matching each requirement accurately aligns GCP connectivity features with operational constraints: Dedicated Interconnect for colocation facilities with high bandwidth requirements (50 Gbps) and dual edge domains for 99.99% SLA; Partner Interconnect for non-colocated facilities with sub-10 Gbps needs (2 Gbps); HA VPN for encrypted internet transport with 99.99% SLA via active-active tunnels; and VPC Network Peering for non-transitive direct VPC communications.

Step-by-Step Solution

1
Evaluate high-bandwidth colocation requirement (50 Gbps, 99.99% SLA)
Select Dual Dedicated Interconnect across edge availability domains.
Dedicated Interconnect supports high-capacity 10/100 Gbps circuits at supported colocation facilities. Redundancy across two edge availability domains is mandatory to fulfill a 99.99% availability SLA.
2
Evaluate non-colocated branch office requirement (2 Gbps capacity)
Select Partner Interconnect.
Partner Interconnect provides hybrid connectivity through supported service providers for locations lacking direct Google colocation facilities and supports sub-10 Gbps capacities.
3
Evaluate encrypted internet connectivity with 99.99% SLA
Select High Availability (HA) Cloud VPN.
HA VPN guarantees 99.99% uptime using dual active-active IPsec tunnels over the public internet paired with BGP dynamic routing.
4
Evaluate direct VPC-to-VPC private connectivity with non-transitive isolation
Select VPC Network Peering.
VPC Network Peering provides low-latency internal IP routing between VPCs without intermediate gateway hops and is strictly non-transitive.

Key Concept

Selecting hybrid connectivity technologies (Dedicated Interconnect, Partner Interconnect, HA VPN) and VPC Peering based on SLA, bandwidth, and location constraints.
Question 34Question →

Match each Google Cloud hybrid connectivity mechanism or network topology pattern to its defining architectural characteristic and deployment requirement.

Click a left item, then click its matching right item

Items

Dedicated Interconnect (Dual-Metro Setup)
HA VPN with Cloud Router
Partner Interconnect (Layer 3)
VPC Network Peering

Matches

Show answer & explanation

Answer

Dedicated Interconnect matches direct physical fiber colocation; HA VPN matches encrypted IPsec over public internet; Partner Interconnect matches service provider connectivity; VPC Network Peering matches non-transitive internal VPC connections.
Each hybrid networking option aligns with specific availability, encryption, bandwidth, and physical location requirements. Dedicated Interconnect provides direct physical connections for high capacity; Partner Interconnect bridges customer environments via service provider partners; HA VPN routes encrypted IPsec traffic dynamically over public internet using BGP; VPC Network Peering enables direct, non-transitive internal VPC connectivity.

Step-by-Step Solution

1
Analyze high-bandwidth and physical colocation requirements.
Dedicated Interconnect pairs with physical fiber links at Google edge facilities.
Dedicated Interconnect is specifically designed for enterprise workloads needing direct physical circuits at 10 Gbps or 100 Gbps capacities.
2
Analyze internet-based encrypted hybrid routing needs.
HA VPN with Cloud Router pairs with IPsec tunnels utilizing BGP dynamic routing.
HA VPN secures traffic over the public internet using IPsec, whereas Interconnect connections are unencrypted by default.
3
Evaluate hybrid connectivity for sites lacking direct Google facility presence.
Partner Interconnect pairs with third-party service provider connections.
Partner Interconnect allows organizations to connect through enterprise ISPs/telecom partners to reach Google Cloud.
4
Evaluate VPC-to-VPC internal routing topology rules.
VPC Network Peering pairs with internal non-transitive VPC interconnectivity.
VPC Network Peering connects distinct VPCs directly on the internal GCP backbone without enabling transitive hops.

Key Concept

Designing hybrid network connectivity using Dedicated Interconnect, Partner Interconnect, HA VPN, and VPC Peering
Question 35Question →

Match each workload data requirement and access pattern on the left with its corresponding optimal managed Google Cloud storage or database service architecture on the right.

Click a left item, then click its matching right item

Items

High-throughput time-series IoT metrics ingestion requiring sustained sub-10ms write latency, seamless scale-out without operational downtime, and native compatibility with the open-source Apache HBase API.
Global financial ledger system requiring multi-region active-active transactional consistency, ANSI SQL support, seamless horizontal read/write scaling, and a 99.999% availability SLA.
Serverless enterprise data warehouse executing ad-hoc analytics over petabytes of structured data, leveraging decoupled compute and columnar storage with automatic query slot management.
Cross-platform mobile collaboration tool requiring document-based hierarchy, real-time client state updates via snapshot listeners, and automatic offline data sync.

Matches

Show answer & explanation

Answer

High-throughput time-series IoT ingestion pairs with Cloud Bigtable. Global financial ledger with ACID consistency and 99.999% SLA pairs with Cloud Spanner. Serverless enterprise analytics over petabytes of data pairs with BigQuery. Cross-platform mobile app with document storage and real-time offline sync pairs with Firestore.
Each Google Cloud database and storage offering is tailored for specific workload characteristics: Cloud Bigtable handles high-throughput NoSQL time-series data with HBase compatibility; Cloud Spanner handles global multi-region relational OLTP with 99.999% SLA; BigQuery handles serverless petabyte-scale analytical querying (OLAP); and Firestore handles NoSQL document data for mobile applications with real-time sync and offline support.

Step-by-Step Solution

1
Analyze latency, API compatibility, and write throughput requirements for IoT telemetry.
Identified Cloud Bigtable due to sub-10ms key-value write latency and native HBase API support.
Cloud Bigtable is optimized for heavy, continuous ingestion of time-series data without relational transactional overhead.
2
Evaluate global consistency, transaction model, and SLA constraints for global financial ledger.
Identified Cloud Spanner due to multi-region global ACID transactions, SQL interface, and five-nines availability SLA.
Cloud Spanner uses TrueTime and distributed consensus to achieve global horizontal scaling with strict ACID compliance.
3
Examine analytical workload pattern, storage format, and query execution scale.
Identified BigQuery for petabyte-scale serverless OLAP execution.
BigQuery separates compute and storage, providing columnar execution and slot-based processing for ad-hoc analytical queries.
4
Assess mobile/web application synchronization and document storage requirements.
Identified Firestore for document hierarchy, live query snapshot listeners, and offline mobile synchronization.
Firestore is specifically architected for client-facing applications requiring document-level real-time updates.

Key Concept

Mapping GCP Storage and Database Services to Application Access Patterns, Consistency Requirements, and SLAs
Estimated Time:2m 0s
Question 36Question →

An energy utility enterprise is designing a hybrid cloud network architecture to connect its primary control centers, remote regional substations, and third-party partner facilities to Google Cloud. Match each hybrid networking requirement to the appropriate Google Cloud service.

Click a left item, then click its matching right item

Items

Direct physical fiber connection delivering 10 Gbps per link to a Google colocation facility, providing high bandwidth and strict 99.99% SLA without using the public internet.
Private, SLA-backed hybrid connectivity for data centers that cannot physically co-locate in a Google facility, established through a supported service provider.
Encrypted IPsec tunnels operating over public internet connections, providing 99.99% availability for remote branch facilities with bandwidth requirements below 3 Gbps.
Fully managed dynamic routing component that uses Border Gateway Protocol (BGP) to automatically exchange routes between on-premises networks and VPCs.

Matches

Show answer & explanation

Answer

The correct pairings are: 1) Direct 10 Gbps physical fiber connection maps to Dedicated Interconnect; 2) Private connectivity via a service provider maps to Partner Interconnect; 3) Encrypted IPsec tunnels over public internet maps to HA VPN; 4) Managed dynamic BGP routing maps to Cloud Router.
Each hybrid networking requirement maps directly to its corresponding GCP network service based on physical transport mechanism, bandwidth capacity, SLA guarantees, and dynamic routing capabilities.

Step-by-Step Solution

1
Identify high-bandwidth direct physical connectivity requirements.
Map direct physical fiber links in Google colocation facilities to Dedicated Interconnect.
Dedicated Interconnect provides direct physical circuits (10 Gbps or 100 Gbps) without relying on third-party service providers or public internet.
2
Evaluate enterprise sites lacking direct Google colocation presence.
Map third-party service provider hybrid connections to Partner Interconnect.
Partner Interconnect extends GCP VPC connectivity to customer locations through supported service provider networks.
3
Analyze encrypted IPsec connectivity needs over public internet links.
Map dual active-active IPsec tunnels for lower bandwidth branch sites to HA VPN.
HA VPN delivers topology redundancy and an enterprise-grade 99.99% SLA over public internet pathways.
4
Determine the service responsible for automated routing propagation.
Map Border Gateway Protocol (BGP) route exchange to Cloud Router.
Cloud Router manages dynamic BGP routing for Cloud VPN and Cloud Interconnect attachments.

Key Concept

Selecting GCP Hybrid Connectivity Solutions Based on Bandwidth, SLA, Transport, and Routing Requirements
Question 37Question →

Match each application workload requirement to the Google Cloud storage or database service that best fulfills its operational and architectural needs.

Click a left item, then click its matching right item

Items

Ingesting high-velocity streaming IoT telematics data requiring low write latency, time-series indexing, and seamless scaling to petabytes of data.
Serving a global e-commerce payment transaction platform requiring multi-region relational ACID compliance, horizontal scaling, and 99.999% availability.
Storing compliance audit documents for long-term cold archive with bucket-level lock policies for Write Once Read Many (WORM) immutability.
Powering a mobile application with semi-structured user profile data that requires real-time document synchronization and offline state caching.

Matches

Show answer & explanation

Answer

High-velocity IoT streaming matches with Cloud Bigtable; Global transactional ACID relational database matches with Cloud Spanner; Immutable compliance document archive matches with Cloud Storage (Archive class); Mobile document sync with offline support matches with Firestore in Native mode.
Each GCP database and storage service is purpose-built for specific access patterns: Cloud Bigtable handles massive throughput key-value and time-series streams; Cloud Spanner provides globally consistent relational transactions; Cloud Storage Archive handles low-cost long-term immutable object storage; and Firestore supports real-time document synchronization with mobile clients.

Step-by-Step Solution

1
Analyze access pattern and throughput needs for time-series IoT ingestion.
High-velocity writes and petabyte-scale key-value capabilities point directly to Cloud Bigtable.
Cloud Bigtable delivers single-digit millisecond latency for massive write-heavy analytical workloads.
2
Analyze global relational and availability requirements for transactional payment processing.
Global ACID transactions and 99.999% availability point to Cloud Spanner.
Cloud Spanner is Google Cloud's globally distributed relational database designed for high availability and strict transactional consistency across regions.
3
Evaluate long-term compliance storage requirements for WORM immutability.
Unstructured document retention with WORM policies maps to Cloud Storage Archive class with Bucket Lock.
Cloud Storage offers specialized storage classes for infrequent access alongside bucket retention policies for regulatory compliance.
4
Identify database model needed for real-time mobile user sync and offline caching.
Flexible document structure with real-time updates maps to Firestore in Native mode.
Firestore native client SDKs feature automatic offline data sync and real-time data push mechanisms.

Key Concept

Selecting and Designing Storage and Database Resources
Estimated Time:2m 0s
Question 38Question →

Match each enterprise workload requirement to the most appropriate Google Cloud storage or database service.

Click a left item, then click its matching right item

Items

Global financial ledger requiring horizontal scaling for relational tables, strong consistency across multiple regions, and full ACID transaction support.
Real-time vehicle telemetry ingest engine requiring sub-10ms latency for massive write throughput of structured key-value time-series records.
Regional human resources portal requiring a managed relational database with full PostgreSQL compatibility, high availability, and routine point-in-time recovery.
Centralized media archive needing store-once-read-many (ORM) immutability rules, multi-region durability, and automatic cost-tiering over time.

Matches

Show answer & explanation

Answer

Global financial ledger pairs with Cloud Spanner; Real-time vehicle telemetry pairs with Cloud Bigtable; Regional HR portal pairs with Cloud SQL; Centralized media archive pairs with Cloud Storage.
Each GCP storage service is matched based on data structure (relational vs NoSQL vs object), transaction guarantees, geographical scope, and throughput characteristics. Cloud Spanner is built for multi-region relational ACID workloads; Cloud Bigtable excels at high-throughput time-series key-value access; Cloud SQL fits regional relational databases; and Cloud Storage is designed for unstructured object data with lifecycle policies.

Step-by-Step Solution

1
Analyze the relational data models and geographical consistency constraints.
Identified that the global financial ledger requires horizontal scaling with ACID transactions across regions (Cloud Spanner), whereas the regional portal requires standard PostgreSQL compatibility in a single region (Cloud SQL).
Cloud Spanner is designed for globally distributed relational scale, while Cloud SQL handles standard regional relational workloads.
2
Evaluate the non-relational access patterns and latency requirements.
Matched high-throughput key-value time-series telemetry to Cloud Bigtable.
Cloud Bigtable provides continuous low-latency write performance for heavy time-series workloads.
3
Evaluate unstructured data object storage requirements.
Matched media archiving with retention rules to Cloud Storage.
Cloud Storage natively supports object lifecycle management, bucket locks, and multi-region availability.

Key Concept

Selecting GCP Storage and Database Services Based on Access Patterns, Latency, and Scalability
Question 39Question →

Match each enterprise application workload requirement to the most appropriate Google Cloud database or storage service based on data model, access pattern, and scalability requirements.

Click a left item, then click its matching right item

Items

Globally distributed relational database requiring ANSI SQL compliance, horizontal write scaling, and multi-region strong consistency.
Massive-scale key-value store optimized for high-throughput, low-latency append-only time-series IoT device telemetry data.
Serverless NoSQL document database designed for modern web and mobile applications with native offline data synchronization.
Single-region operational OLTP relational database supporting standard PostgreSQL or MySQL with automated regional high-availability failover.

Matches

Show answer & explanation

Answer

The workload requirements match as follows: Global relational transactions with strong multi-region consistency map to Cloud Spanner; high-throughput time-series key-value telemetry maps to Cloud Bigtable; mobile document storage with offline sync maps to Firestore; single-region managed relational OLTP maps to Cloud SQL.
Each service aligns precisely with its intended workload: Cloud Spanner handles global relational scale; Cloud Bigtable manages high-throughput time-series key-value data; Firestore supports mobile document sync; Cloud SQL hosts single-region operational databases.

Step-by-Step Solution

1
Identify the storage requirements for global relational transactions needing multi-region strong consistency.
Matched with Cloud Spanner.
Cloud Spanner uniquely provides horizontally scalable ANSI SQL relational storage with multi-region strong consistency.
2
Identify the service for high-throughput time-series telemetry key-value storage.
Matched with Cloud Bigtable.
Cloud Bigtable is designed for massive key-value ingest throughput with single-digit millisecond latency.
3
Identify the database providing NoSQL document hierarchy with client offline synchronization.
Matched with Firestore.
Firestore offers mobile client SDK integration with real-time listeners and offline state persistence.
4
Identify the solution for standard single-region operational SQL workloads.
Matched with Cloud SQL.
Cloud SQL manages standard engines (PostgreSQL/MySQL/SQL Server) with regional HA failover.

Key Concept

Selecting GCP Database Services based on data structure, transaction model, scale, and latency requirements
Question 40Question →

Match each enterprise workload requirement to the most appropriate Google Cloud database or storage service based on its data model, consistency guarantees, and operational access pattern.

Click a left item, then click its matching right item

Items

Globally distributed transactional OLTP database requiring full ANSI SQL support, horizontal scaling, and external consistency across multiple geographic regions.
High-throughput time-series IoT sensor data ingestion requiring sub-10 millisecond write latencies and integration with analytical processing pipelines.
Unstructured document and binary media file storage requiring automated lifecycle policies to move infrequently accessed objects to lower-cost archival classes.
Regional relational database requiring native PostgreSQL compatibility, automated backups, and built-in regional high availability failover.

Matches

Show answer & explanation

Answer

The globally distributed transactional database maps to Cloud Spanner; the high-throughput time-series IoT ingestion maps to Cloud Bigtable; the unstructured media storage with lifecycle policies maps to Cloud Storage; and the regional relational PostgreSQL database maps to Cloud SQL for PostgreSQL.
Each GCP database and storage product is engineered for specific data models and access patterns: Cloud Spanner handles global multi-region relational transactions; Cloud Bigtable excels at high-speed NoSQL time-series writes; Cloud Storage manages unstructured binary objects with lifecycle tiering; and Cloud SQL handles single-region managed relational engines like PostgreSQL.

Step-by-Step Solution

1
Analyze the relational and global scaling constraints of the transactional database requirement.
Identified Cloud Spanner as the unique GCP service offering global scale, ANSI SQL support, and strong external consistency.
Standard regional relational options like Cloud SQL do not scale horizontally across multiple regions with global strong consistency.
2
Evaluate the ingestion rate and write latency requirements for time-series IoT data.
Selected Cloud Bigtable for its high-throughput, low-latency NoSQL key-value/wide-column engine optimized for streaming time-series data.
Relational databases cannot cost-effectively sustain massive continuous IoT write loads with sub-10ms latency.
3
Review object storage requirements for unstructured files and cost-tiering capabilities.
Selected Cloud Storage due to its object storage model and Object Lifecycle Management feature.
Database services are intended for structured or semi-structured data, whereas unstructured media files require object storage.
4
Assess the regional managed database requirement for open-source PostgreSQL compatibility.
Matched with Cloud SQL for PostgreSQL.
Cloud SQL provides managed PostgreSQL with built-in regional high availability.

Key Concept

GCP Storage and Database Resource Selection based on Data Model, Scalability, and Access Patterns
Estimated Time:2m 0s
PreviousPage 2 / 4Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin