All practice questions

An organization is setting up an automated continuous delivery pipeline for a microservice deployed to Cloud Run using Google Cloud Deploy. The architecture team requires progressive traffic shifting to canary instances during release rollout and mandatory container image security attestation before deployment. Which TWO deployment pipeline configurations should you implement to satisfy these requirements?

An enterprise organization is deploying a hub-and-spoke Virtual Private Cloud (VPC) topology on Google Cloud. The central Hub VPC connects to an on-premises data center using Dedicated Interconnect with Cloud Router. Separate spoke VPCs host Production and Staging workloads. The lead architect must enforce the following networking requirements:
1. Spoke VPCs must securely communicate with services in the Hub VPC and access on-premises resources via the Dedicated Interconnect.
2. Spoke VPCs must remain strictly isolated from one another without direct or inter-spoke transit path communication.
3. Workloads in spoke VPCs must reach Google Cloud APIs and private Google Kubernetes Engine (GKE) control planes securely without assigning public IP addresses or exposing master endpoints to the public internet.

Which TWO configuration actions should the Cloud Architect implement to satisfy these architecture requirements? (Select TWO.)

An infrastructure team is automating continuous deployment pipelines for Google Kubernetes Engine (GKE) targets using Terraform and Cloud Deploy. During pipeline executions, team members express concern that local state storage could lead to state corruption and concurrency issues across pipeline runs. Which configuration should the team implement to secure and maintain their Terraform state file?

An enterprise architecture team is implementing an automated Infrastructure as Code workflow to provision a multi-region Cloud Spanner database encrypted with Customer-Managed Encryption Keys (CMEK). Place the operational steps in the mandatory execution sequence required to successfully deploy the database and grant application access without permission or lifecycle failures.

An enterprise Site Reliability Engineering (SRE) team needs to route all data access and administrative audit log entries from multiple production Google Cloud projects into a centralized BigQuery dataset for long-term compliance analysis, while also establishing real-time operational alerts when critical application errors captured in the logs exceed an acceptable threshold. The solution must follow Google Cloud security and operational best practices. Which TWO configuration steps should the team perform to achieve this goal?

A DevOps team wants to automate the deployment of containerized application releases to Google Kubernetes Engine (GKE) while maintaining an automated deployment pipeline and declarative release management using Google Cloud native services. Which service should they use to manage and automate progressive delivery and releases across environments?

A digital gaming enterprise is designing the backend architecture on Google Cloud for a new multiplayer title. The backend consists of two main services:

1. Matchmaking & User Profile Service: A stateless containerized HTTP/2 REST API with highly variable traffic pattern that needs to scale instantly from zero to thousands of concurrent requests while minimizing operational overhead.
2. Real-time Game State Engine: A custom C++ stateful server application that requires persistent low-latency raw TCP sockets, direct access to host network interfaces, and specific Linux kernel tuning parameters (`sysctl` network stack modifications).

Which compute platform combination should the cloud architect select to satisfy these requirements while adhering to Google Cloud best practices?

An enterprise architecture team is designing an operational observability solution for an organization containing over 100 Google Cloud projects. The team needs to set up centralized real-time alerting for system crash events recorded across all Compute Engine virtual machine instances. The solution must minimize administrative overhead, enforce the principle of least privilege, and route matching log entries to a central Cloud Pub/Sub topic located in a dedicated operational monitoring project. Which configuration approach should the architect recommend?

A digital media organization needs to migrate $450\text{ TB}$ of historical raw video footage from an on-premises Network Attached Storage (NAS) array to a Cloud Storage bucket in Google Cloud. The organization has a dedicated $100\text{ Mbps}$ internet connection available for cloud operations. Business stakeholders require all video assets to be fully transferred and validated in Google Cloud within $21\text{ days}$. Which migration strategy best satisfies these operational requirements?

A financial enterprise is architecting an online payment fraud risk evaluation service on Google Cloud. The workload consists of stateless containerized microservices that communicate via HTTP/2 gRPC. The service experiences extreme request volatility, surging to tens of thousands of requests per second during peak retail hours and dropping to near zero overnight. The leadership team requires a compute solution that minimizes operational management overhead, automatically scales down to zero instances during idle periods to optimize costs, and avoids managing underlying server infrastructure or cluster control planes. Which compute architecture should you recommend?

An infrastructure engineering team is establishing an automated deployment pipeline to execute Terraform configurations across multiple Google Cloud production projects. The architecture must enforce secure state management and strictly adhere to identity access management least-privilege guidelines. Which TWO configuration choices should the team implement?

An enterprise organization is building a multi-region hybrid cloud environment on Google Cloud. The architecture consists of a Shared VPC network managed in a central host project with subnets provisioned in both `us-central1` and `europe-west1`. On-premises data centers connect to GCP via Dedicated Interconnect attachments in `us-central1`. The architecture team requires that on-premises workloads dynamically discover and route traffic to resources in both GCP regions over the Interconnect. Additionally, spoke workloads in service projects must access managed GCP services and external SaaS partners strictly through private IP addresses without traversing the public internet, while maintaining network isolation between independent spokes. Which TWO network topology configuration steps must you implement in the Shared VPC to satisfy these requirements? (Select TWO.)

An operational engineering team is configuring Cloud Monitoring alerting policies for a fleet of Compute Engine virtual machines. They require alerts to trigger when memory utilization on any instance exceeds 80% for more than 10 minutes. However, when attempting to build the alert condition in the Cloud Monitoring console, the system memory utilization metric (agent.googleapis.com/memory/percent_used) is unavailable. Which action should the team take to enable this metric and successfully configure the alerting policy?

An e-commerce organization is implementing an automated deployment pipeline to provision Compute Engine virtual machine instances for an order processing backend service. A dedicated custom service account was created to provide runtime permissions for the application on these instances. However, when the automated pipeline executes, instance creation fails with an IAM authorization error when trying to bind the custom service account to the virtual machines. Which configuration change should the cloud architect implement to resolve this provisioning error while adhering to the principle of least privilege?

A healthcare analytics team is standardizing its Google Cloud deployment practices using Google Cloud Deployment Manager and HashiCorp Terraform. The cloud architect needs to enforce schema validation for Deployment Manager resource templates and prevent concurrency issues or race conditions when team members apply Terraform configurations simultaneously. Which TWO actions should the team implement to satisfy these operational requirements?

A digital publishing platform is constructing an automated deployment pipeline using Infrastructure as Code (Terraform) to provision high-throughput compute infrastructure on Google Cloud. The architecture requires deploying a regional Managed Instance Group (MIG) of Compute Engine instances that will autoscale up to 500 N2 vCPUs during traffic bursts. The compute instances must execute using a dedicated workload service account with minimal privileges. Multiple DevOps engineers and automated CI/CD runners will execute Terraform deployments concurrently. Which provisioning design strategy should the Cloud Architect implement to meet these requirements securely and reliably?

A cloud engineer needs to connect an on-premises data center to a Google Cloud Virtual Private Cloud (VPC) using a highly available VPN with dynamic route propagation. Which TWO of the following resources must be configured within Google Cloud to meet this requirement?

A multinational SaaS provider hosts a core analytics engine in a central GCP project's VPC network. Multiple independent enterprise customers need private, low-latency TCP connectivity from their own distinct GCP VPC networks to this central analytics engine. The customer VPC networks frequently have overlapping RFC 1918 internal IP address ranges with each other and with the service provider network. Furthermore, security policies require that customers must only have unidirectional access to initiate connections toward the analytics service, preventing any customer from reaching another customer's network or exposing the provider's internal topology. Which VPC networking design should you implement to satisfy these architecture requirements?

An organization wants to host a stateless HTTP microservice on Google Cloud. The architecture team has established two strict operational constraints:
1. The compute platform must automatically scale down to zero instances during periods of no traffic to minimize idle costs.
2. The infrastructure must be fully serverless, requiring zero management or maintenance of underlying clusters or virtual machines.

Which TWO Google Cloud compute platforms meet these criteria?

An global logistics enterprise is architecting an event-driven supply chain routing service on Google Cloud. The workload handles stateless HTTP webhook payloads containing container tracking events, which scale rapidly from zero during burst peak hours to thousands of requests per second. The application requires standard HTTP/2 transport and zero infrastructure management overhead. Additionally, the development team requires built-in automatic scaling to zero when no events are processing to minimize operational costs. Which two GCP compute platform design choices, when combined, fulfill these requirements with the lowest operational complexity?