All practice questions

A company wants to deploy a simple, stateless HTTP web API on Google Cloud. The service experiences unpredictable, low-volume traffic and requires scale-to-zero capabilities with zero server management overhead. Which Google Cloud compute platform is the most suitable choice for this requirement?

A multinational financial technology institution is migrating its core transaction history and customer records from an on-premises data center to Google Cloud. The dataset consists of $1.8\text{ PB}$ of static compliance audit logs stored on a local NAS and an active $3\text{ TB}$ transactional database running on MySQL. The enterprise has a single dedicated $1\text{ Gbps}$ Cloud Interconnect connection to GCP. The migration schedule dictates that all static data must be transferred within 30 days without impacting daily business traffic, while the database migration allows a maximum downtime cutover window of $4\text{ hours}$. Which TWO migration strategies should the Lead Cloud Architect recommend to satisfy these operational constraints? (Select two.)

An enterprise IoT platform processes irregular spikes of incoming telemetry messages delivered via Cloud Pub/Sub. Each message requires a lightweight, stateless data validation step that takes approximately 200 milliseconds to execute. The system experiences long periods of zero traffic during maintenance windows, and the operations team wants to minimize both administrative overhead and baseline infrastructure cost. Which compute platform should you select to host the data validation service?

An enterprise is implementing a automated cloud infrastructure deployment pipeline on Google Cloud for a global transactional database and operational storage architecture. The technical requirements specify a relational database engine capable of handling multi-region transactions with external consistency across continents. Furthermore, the Infrastructure as Code (IaC) deployment pipeline using Terraform must guarantee concurrency safety and state recovery against corrupted or conflicting parallel executions. Which TWO architecture and provisioning strategies should be implemented to satisfy these requirements?

A multinational financial services institution is building a hybrid cloud infrastructure to connect its primary on-premises data center with Google Cloud. The architecture must satisfy three mandatory requirements: (1) achieve a 99.99% availability SLA for the underlying physical connection, (2) enforce IPsec encryption for all data in transit across the hybrid connection, and (3) enable on-premises workloads to securely communicate with a secondary backend VPC network (`vpc-partner`) through an established landing VPC network (`vpc-hub`). Which TWO architectural configurations must the cloud network architect implement to satisfy these requirements? (Select TWO.)

An enterprise organization is configuring a global Shared VPC network on Google Cloud spanning the us-central1 and europe-west1 regions. On-premises data centers are connected to us-central1 via a pair of Dedicated Interconnect attachments with BGP sessions established on regional Cloud Routers. Workloads deployed in europe-west1 require low-latency connectivity to on-premises databases, and workloads in both regions must seamlessly reach internal load balancers deployed in either region. The network administration team must ensure optimal route propagation across all regions without introducing unnecessary VPN overlays or invalid routing assumptions. Which VPC network topology configuration meets these requirements?

An enterprise operations team is configuring log routing from a production Google Cloud project to a centralized security project containing a BigQuery dataset for audit compliance. After creating the project-level Cloud Logging sink with a BigQuery dataset target, log entries are not appearing in the target dataset due to permission errors. You need to resolve the ingestion failure while adhering to Google Cloud security best practices and the principle of least privilege. Which action should you take?

A network administrator needs to connect an on-premises location to a Google Cloud Virtual Private Cloud (VPC) using an HA Cloud VPN gateway with dynamic routing over the public internet. Which TWO configuration steps or requirements are necessary to implement this solution? (Select TWO answers)

An enterprise fintech organization is designing an automated continuous deployment pipeline using Cloud Build and Google Cloud Deploy to release microservices across multiple Google Kubernetes Engine (GKE) clusters. To comply with regulatory security auditing and zero-trust policies, the organization mandates that deployment pipelines must eliminate long-lived service account keys and adhere strictly to the principle of least privilege. The build runner service account requires authorization to execute deployment actions on behalf of a dedicated deployment service account without gaining overall administrative privileges. Which IAM configuration strategy should the cloud architect implement to fulfill these requirements securely?

An operations engineering team needs to configure automated incident notifications based on specific error logs emitted by a workload running on Google Cloud. Order the steps required to establish a complete log-based alerting pipeline following Google Cloud observability best practices, starting from raw log evaluation to operational notification.

A retail enterprise is standardizing its cloud deployment framework on Google Cloud. The infrastructure architecture requires deploying new GKE clusters alongside Compute Engine Managed Instance Groups (MIGs) via an automated Infrastructure as Code (IaC) CI/CD pipeline. The security and operations policy dictates strict access controls to cluster control planes, least-privilege identity delegation for deployment workers, and prevention of concurrent deployment state corruption across $15$ distinct feature teams. Which THREE configuration standards should the architecture team enforce in their provisioning blueprint? (Select 3 choices)

In Google Cloud Platform (GCP), IAM permissions are inherited downward through the resource hierarchy structure. How should an architect sequence the GCP resource hierarchy levels in order of policy inheritance, starting from the highest level (broadest policy scope) down to the lowest level (most narrow policy scope)?

A cloud operations team needs to deploy a new PostgreSQL database on Google Cloud using Cloud SQL and populate it using a local database dump file. What is the correct sequence of steps to provision the storage staging environment, transfer the dump, and populate the database?

Your organization is establishing standardized Google Cloud Deployment Manager practices for provisioning cloud infrastructure across development environments. You need to create a reusable configuration and safely deploy it. In what order should you execute the steps to construct, validate, preview, and commit the deployment?

A global healthcare provider is translating its enterprise conceptual architecture into logical and physical cloud designs on Google Cloud. The architecture requires streaming ingestion of high-frequency IoT patient telemetry data, a globally consistent database supporting multi-region ACID transactions for clinical trial records, private service consumption between isolated line-of-business Virtual Private Clouds (VPCs) without exposing underlying network subnets or relying on transitive routing, and strict controls to prevent authorized internal users from exfiltrating data to external locations. Which physical architecture design correctly satisfies all conceptual and logical requirements while adhering to Google Cloud best practices?

An enterprise architecture team is transitioning a critical Google Cloud infrastructure codebase from local execution to a centralized, collaborative Terraform model. To meet corporate security and operational standards, the team must migrate the local state file to a secure Google Cloud Storage (GCS) remote backend featuring state locking and least-privilege service account impersonation. Sequence the steps required to execute this state backend migration safely and correctly.

A global financial analytics firm plans to launch nightly batch processing jobs in Google Cloud to process high-frequency market telemetry data. The batch workload requires automated provisioning of 250 GPU-accelerated Compute Engine instances in a single region (us-central1) using Infrastructure as Code pipelines. During initial test runs, the pipeline execution fails during instance creation due to insufficient GPU resource limits, despite the project having an active billing account with high credit limits. Furthermore, organizational security policy strictly dictates that automated deployment pipelines must adhere to least privilege and cannot hold security administration roles. Which combination of architectural and operational steps should the Cloud Architect execute to resolve the deployment failures while maintaining security compliance?

A software company needs to deploy a stateless HTTP microservice packaged as a container image on Google Cloud. The solution must require zero cluster infrastructure management overhead and automatically scale down to zero instances when no traffic is received. Which TWO options represent the optimal design choices for this requirement?

An organization needs to establish direct, low-latency private IP connectivity between two VPC networks (vpc-a and vpc-b) in Google Cloud without traversing the public internet or deploying hybrid VPN gateways. Which GCP networking configuration should be implemented to enable internal communication between resources in both VPCs?

An enterprise healthcare platform is provisioning a mission-critical Cloud SQL PostgreSQL database instance to store sensitive patient telemetry data. Corporate security policy mandates that data at rest must be encrypted using encryption keys that support automated 90-day key rotation, provide complete centralized key access auditing in Cloud Audit Logs, and require zero raw cryptographic key material handling by the application layer. Which configuration should the cloud architect specify during initial database provisioning to satisfy all requirements?