All practice questions

1598 questions

All types1,598 Multiple choice815 Multiple select537 Numeric8 Matching64 Ordering174

An enterprise organization is migrating a legacy backend service to Google Cloud. The application requires direct access to specific Linux kernel modules, custom system daemon configurations, and strict operating system level tweaks that cannot be containerized without extensive software modification. Which Google Cloud compute platform should the solution architect select to satisfy these requirements with minimal re-engineering?

Compute Engine virtual machines running custom operating system images

Google Kubernetes Engine (GKE) Autopilot clusters with custom node pools

Cloud Run services deployed from custom container images

App Engine Standard Environment instance groups

Show answer & explanation

Answer: Compute Engine virtual machines running custom operating system images

Answer

Compute Engine virtual machines running custom operating system images is the optimal compute platform choice.

Compute Engine delivers Infrastructure as a Service (IaaS), granting full administrative access to the guest operating system. This allows administrators to install custom kernel modules, run specialized system daemons, and perform OS-level tuning required by legacy software.

Step-by-Step Solution

Analyze workload requirements

Identified essential needs: direct access to custom Linux kernel modules, OS-level configuration, and custom system daemons without re-architecting the legacy code.

Choosing the correct compute platform requires matching workload OS control demands against GCP compute abstraction levels.

Evaluate serverless and container abstraction limitations

Cloud Run, GKE Autopilot, and App Engine Standard abstract away or restrict host operating system kernel access.

Managed application platforms enforce container sandboxes or managed node operating systems that prevent custom kernel module injection.

Select the appropriate compute platform

Compute Engine provides Infrastructure-as-a-Service (IaaS) with full guest OS administrative rights.

Compute Engine custom images allow exact replication of legacy Linux kernel settings and system-level software dependencies.

Key Concept

Matching Compute Platform Abstraction Level to OS Control Requirements

Question 462Question →

A global retail corporation is configuring hybrid connectivity between an on-premises data center and a Google Cloud VPC network. The primary database workload requires a dedicated 10 Gbps connection with sub-10ms latency. Additionally, enterprise compliance rules mandate that all data transferred between the on-premises network and Google Cloud must be encrypted at the network layer using IPsec. Which hybrid connectivity architecture satisfies both requirements according to Google Cloud best practices?

Configure HA Cloud VPN over a Dedicated Interconnect connection using private IP addresses for the VPN gateway interfaces.

Establish a Partner Interconnect connection with Cloud Router dynamic BGP and rely on VPC Service Controls to encrypt traffic in transit.

Deploy two HA Cloud VPN gateways over the public internet with equal-cost multi-path routing across eight active IPsec tunnels.

Configure VPC Network Peering directly between the on-premises core router and the Google Cloud VPC network with IPsec encryption enabled.

Show answer & explanation

Answer: Configure HA Cloud VPN over a Dedicated Interconnect connection using private IP addresses for the VPN gateway interfaces.

Answer

Configure HA Cloud VPN over a Dedicated Interconnect connection using private IP addresses for the VPN gateway interfaces.

Private IP HA Cloud VPN over Dedicated Interconnect is the recommended Google Cloud pattern when both dedicated high-throughput/low-latency physical transport and mandatory IPsec encryption are required. The HA VPN gateway utilizes private IP addresses over the Interconnect VLAN attachment, encrypting traffic before sending it across the physical connection.

Step-by-Step Solution

Analyze performance and encryption requirements

The scenario demands a dedicated 10 Gbps connection with guaranteed low latency while simultaneously enforcing mandatory IPsec encryption.

Standard Dedicated Interconnect satisfies the 10 Gbps low-latency requirement but is unencrypted by default. Standard HA VPN provides IPsec encryption but runs over the public internet without bandwidth SLAs.

Evaluate Google Cloud hybrid connectivity options for combining IPsec encryption with Cloud Interconnect

Deploying Private IP HA VPN over Cloud Interconnect provisions IPsec VPN gateways directly inside the private IP space of a Dedicated Interconnect VLAN attachment.

This combined architecture achieves both the dedicated 10 Gbps performance SLA of Cloud Interconnect and the required IPsec transport encryption.

Key Concept

Private IP HA VPN over Cloud Interconnect

Question 463Question →

A global biomedical research organization plans to migrate its core infrastructure to Google Cloud within a strict 14-day timeline. The workload comprises two main components:

1. An $850\text{ TB}$ uncompressed genomic dataset stored on an on-premises Network Attached Storage (NAS) array. The organization has a $500\text{ Mbps}$ dedicated Internet connection with an average baseline usage of $70\%$ .
2. A $2.5\text{ TB}$ transactional PostgreSQL database supporting active clinical trials that requires continuous replication with zero-downtime cutover.

Which migration strategy meets the operational and time constraints while following Google Cloud architectural best practices?

Order GCP Transfer Appliance devices to perform an offline bulk transfer of the genomic dataset into Cloud Storage, while configuring Database Migration Service (DMS) with continuous Change Data Capture (CDC) over HA VPN for the PostgreSQL database.

Utilize Storage Transfer Service over the existing

500\text{ Mbps}

Internet link to transfer the

850\text{ TB}

genomic dataset directly into Cloud Storage, while deploying Database Migration Service (DMS) for the PostgreSQL database continuous replication.

Deploy GCP Transfer Appliance devices for the genomic dataset migration, while using Storage Transfer Service to continuously replicate the PostgreSQL database into Cloud Spanner.

Configure multiple HA VPN tunnels to aggregate bandwidth across the existing Internet link up to

10\text{ Gbps}

for streaming the genomic dataset via Storage Transfer Service, while using Database Migration Service for the database.

Show answer & explanation

Answer: Order GCP Transfer Appliance devices to perform an offline bulk transfer of the genomic dataset into Cloud Storage, while configuring Database Migration Service (DMS) with continuous Change Data Capture (CDC) over HA VPN for the PostgreSQL database.

Answer

The optimal solution is to order Transfer Appliance devices for the offline migration of the

850\text{ TB}

genomic data, combined with Database Migration Service (DMS) using Change Data Capture (CDC) over HA VPN for the

2.5\text{ TB}

PostgreSQL database cutover.

The correct strategy combines offline physical data transfer (Transfer Appliance) for large static datasets that cannot physically stream over existing network connections within the required timeline, alongside native database continuous replication (Database Migration Service with CDC over HA VPN) to achieve minimal downtime for active transactional workloads.

Step-by-Step Solution

Calculate available network throughput and transfer time for the unstructured genomic dataset.

With a

500\text{ Mbps}

link at

70\%

utilization, net available bandwidth is

150\text{ Mbps}

(

18.75\text{ MB/s}

). Transferring

850\text{ TB}

(

850,000,000\text{ MB}

) requires

\approx 45,333,333\text{ seconds} \approx 524\text{ days}

, exceeding the 14-day limit.

Determines whether an online network transfer or offline physical appliance transfer is necessary.

Select the appropriate transfer mechanism for the

850\text{ TB}

dataset.

Transfer Appliance allows offline bulk ingestion of petabyte-scale data within the 14-day window.

Offline appliance shipping bypasses limited network throughput constraints.

Select the continuous database replication mechanism for the PostgreSQL database.

Database Migration Service (DMS) enables continuous Change Data Capture (CDC) replication over a secure private network connection (HA VPN).

Satisfies the zero-downtime continuous replication requirement for active clinical trial data.

Key Concept

Selecting data migration strategies based on dataset scale, available network bandwidth, and application downtime tolerance.

Estimated Time:2m 30s

Question 464Question →

A global retail enterprise is preparing to migrate its $12\text{ TB}$ on-premises transactional PostgreSQL database to Cloud SQL for PostgreSQL with minimal operational downtime. The architecture team has selected Database Migration Service (DMS) with continuous replication. Arrange the operational phases below into the correct chronological sequence required to complete the migration safely.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) Establish hybrid connectivity and connection profiles, 2) Start initial baseline dump and snapshot restore, 3) Enable continuous CDC streaming, 4) Set source application to read-only and allow replication lag to reach zero, 5) Promote target Cloud SQL instance and redirect application traffic.

Online database migrations require establishing infrastructure connectivity, loading a baseline data snapshot, maintaining real-time CDC synchronization, quiescing source writes to eliminate replication lag, and finally promoting the destination database for production cutover.

Step-by-Step Solution

Configure network connectivity and DMS connection profiles.

Secure communication channel between source PostgreSQL and GCP target environment is verified.

Data transfer cannot start without established network routing and authentication credentials.

Execute the baseline data load.

Initial historical snapshot (

12\text{ TB}

) is transferred to Cloud SQL.

A baseline snapshot provides the starting state for continuous change data replication.

Activate continuous Change Data Capture (CDC).

Ongoing transaction log changes stream automatically to Cloud SQL.

CDC keeps the cloud database synchronized while the on-premises database remains active in production.

Quiesce on-premises writes and monitor replication lag.

Replication lag drops to zero seconds, confirming full parity.

Prevents data loss or data state mismatch during final cutover.

Perform cutover and promote Cloud SQL instance.

Cloud SQL becomes the active primary database and application endpoints are updated.

Completes the migration workflow and finalized switchover to Google Cloud.

Key Concept

Continuous Online Database Migration and Cutover Sequencing with DMS

Estimated Time:2m 0s

Question 465Question →

An enterprise architecture team is translating high-level business requirements for a new cloud solution into formal architectural views. Which statement accurately describes the primary focus of the Logical Architecture layer during this design process?

Defining functional components, data flows, and interface boundaries independently of specific cloud resource choices or hardware infrastructure.

Selecting Cloud Spanner to handle all relational data storage requirements across the application regardless of regional scale or operational complexity.

Deploying Google Kubernetes Engine (GKE) clusters to run simple stateless web services to establish high-level architecture boundaries.

Assigning primitive IAM roles such as Owner and Editor across the GCP resource hierarchy to establish business governance boundaries.

Show answer & explanation

Answer: Defining functional components, data flows, and interface boundaries independently of specific cloud resource choices or hardware infrastructure.

Answer

The primary focus of the Logical Architecture layer is defining functional components, data flows, and interface boundaries independently of specific cloud resource choices or hardware infrastructure.

The logical architecture layer bridges high-level business requirements (conceptual) and concrete cloud implementation details (physical). It defines how systems communicate, how data moves, and what functional boundaries exist without tying the design to specific GCP services or VM instances.

Step-by-Step Solution

Identify the role of Conceptual Architecture

Conceptual architecture captures high-level business requirements, goals, and domain contexts.

Establishes the scope and business purpose of the solution.

Identify the role of Logical Architecture

Logical architecture translates conceptual needs into functional tiers, data flows, and component relationships without specifying concrete cloud resources.

Provides a technology-agnostic structural blueprint for system behavior.

Identify the role of Physical Architecture

Physical architecture maps logical components onto concrete Google Cloud services (such as Cloud Run, Cloud SQL, VPC subnets, and IAM roles).

Implements the logical blueprint into actionable cloud infrastructure.

Key Concept

Conceptual, Logical, and Physical Cloud Architectures

Estimated Time:1m 0s

Question 466Question →

A DevOps team is setting up an automated Continuous Integration/Continuous Deployment (CI/CD) pipeline using HashiCorp Terraform to provision infrastructure in Google Cloud. Multiple automated jobs and team members will execute Terraform deployments concurrently across shared environments. You need to configure a remote backend that prevents state file corruption from concurrent writes, maintains history for disaster recovery, and enforces least-privilege security access. Which solution should you implement?

Store the Terraform state in a Google Cloud Storage bucket with Object Versioning enabled, configure the Terraform `gcs` backend to handle state locking automatically, and authenticate using fine-grained IAM roles via service account impersonation.

Store the Terraform state file in a standard Cloud Storage bucket without versioning, relying on developers to maintain manual local state file backups prior to executing deployment runs.

Configure a Cloud Storage remote backend and assign the primitive Project Owner IAM role to the CI/CD execution service account to eliminate permission errors during backend initialization and state updates.

Configure the Terraform backend to use Cloud Storage and configure automated script retries in the CI/CD pipeline to resolve regional quota availability failures during execution.

Show answer & explanation

Answer: Store the Terraform state in a Google Cloud Storage bucket with Object Versioning enabled, configure the Terraform `gcs` backend to handle state locking automatically, and authenticate using fine-grained IAM roles via service account impersonation.

Answer

The correct architecture uses a Google Cloud Storage remote backend with Object Versioning enabled, Terraform's native `gcs` backend for automatic state locking, and fine-grained IAM permissions using service account impersonation.

Configuring a Cloud Storage bucket with Object Versioning combined with Terraform's native `gcs` backend ensures state locking prevents concurrent modification while enabling historical state recovery. Authenticating using least-privilege predefined IAM roles aligns with Google Cloud security best practices.

Step-by-Step Solution

Configure a dedicated Google Cloud Storage bucket for Terraform remote state with Object Versioning enabled.

Every state modification creates a historical version, enabling point-in-time recovery from accidental state corruption.

Object Versioning protects critical state history in shared enterprise environments.

Set the Terraform backend configuration to `gcs` referencing the versioned bucket.

Terraform automatically leverages GCP object locking mechanisms to lock the state file during operations.

State locking prevents race conditions and state file corruption caused by concurrent pipeline executions.

Grant the CI/CD service account granular IAM roles (predefined storage and resource administration roles) rather than primitive roles.

Terraform runs securely under least-privilege access controls.

Limits exposure and prevents unauthorized administrative actions across the GCP project.

Key Concept

Enterprise Terraform Remote State Management on Google Cloud Storage

Question 467Question →

An enterprise financial institution is planning the migration of its core transaction settlement platform to Google Cloud. As the Principal Cloud Architect, you must lead the architecture design process by translating high-level enterprise business requirements into a fully deployed cloud infrastructure. In what order should you execute the architectural design and translation steps, moving from initial conceptual design down to physical implementation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows a top-down architectural progression: first, construct the vendor-neutral Conceptual Architecture based on business goals and compliance metrics; second, build the Logical Architecture by defining functional components and data flows; third, map logical tiers to abstract cloud service paradigms; fourth, select concrete Google Cloud products matching technical requirements; and fifth, draft physical deployment specifications, network configurations, and IaC scripts.

Enterprise cloud solution design moves systematically from business vision to executable infrastructure. The process begins with a vendor-neutral Conceptual Architecture to capture SLAs, business processes, and compliance requirements. Next, the Logical Architecture defines subsystem components, data interaction flows, and integration interfaces. Then, logical components are mapped to generic cloud architectural paradigms. After that, specific physical Google Cloud products (such as Cloud Spanner, Pub/Sub, GKE Enterprise, and VPC SC) are selected to meet throughput and availability constraints. Finally, detailed physical deployment specifications—including subnet CIDRs, IAM bindings, and IaC Terraform code—are produced to enable automated environment provisioning.

Step-by-Step Solution

Establish the Conceptual Architecture layer.

Vendor-neutral definition of business capabilities, SLA goals, and compliance boundaries.

Architecture design must begin with business intent and governance requirements before evaluating tech stack options.

Construct the Logical Architecture layer.

Decomposition into functional subsystem tiers, data flows, and service contracts.

Logical tiering structures the data flow and system boundaries needed to satisfy conceptual business capabilities.

Map logical tiers to abstract cloud paradigms.

Identification of general category patterns (e.g., transactional storage, event messaging).

Connecting functional requirements to cloud design patterns bridges pure logical design with cloud technology concepts.

Select physical GCP services and topographies.

Specification of Cloud Spanner, Pub/Sub, GKE Enterprise, and VPC Service Controls.

Concrete GCP managed services are chosen based on their ability to fulfill the performance, availability, and security targets of the logical design.

Formulate physical deployment artifacts.

Definition of VPC subnet CIDR blocks, IAM role definitions, and Terraform IaC manifests.

Executable implementation artifacts and explicit network configurations represent the final step prior to automated provisioning.

Key Concept

Top-down Cloud Architecture Lifecycle (Conceptual -> Logical -> Physical)

Question 468Question →

A connected-vehicle enterprise is designing a global telemetry platform to ingest real-time sensor metrics from millions of vehicles worldwide. The architecture must handle over $2 \times 10^6$ write operations per second with single-digit millisecond write latency, store semi-structured time-series data with dynamic schemas, and allow data analysts to execute ad-hoc SQL queries directly through BigQuery without creating periodic ETL pipelines. Which storage and database architecture should you recommend?

Deploy Cloud Bigtable with multi-cluster replication across targeted regions for low-latency time-series ingestion, and query the data directly from BigQuery using external table definitions.

Deploy Cloud Spanner with a multi-region instance configuration, using strongly consistent relational tables to index high-velocity time-series sensor streams.

Collect telemetry logs locally on edge gateway servers and continuously dispatch Transfer Appliance hardware to upload data into Cloud Storage Coldline buckets for analytical querying.

Deploy Cloud SQL for PostgreSQL with horizontal read replicas, relying exclusively on IAM roles without VPC Service Controls to govern database access and prevent data export.

Show answer & explanation

Answer: Deploy Cloud Bigtable with multi-cluster replication across targeted regions for low-latency time-series ingestion, and query the data directly from BigQuery using external table definitions.

Answer

Deploy Cloud Bigtable with multi-cluster replication across targeted regions for low-latency time-series ingestion, and query the data directly from BigQuery using external table definitions.

Cloud Bigtable provides scalable NoSQL key-value storage optimized for massive throughput time-series ingestion with single-digit millisecond latency. Integrating BigQuery via external table definitions enables direct SQL analytics without maintaining complex streaming ETL pipelines.

Step-by-Step Solution

Analyze workload write throughput and data model requirements.

The requirement specifies over

2 \times 10^6

write operations per second with single-digit millisecond latency and semi-structured time-series data. Cloud Bigtable is the optimal NoSQL key-value store designed specifically for high-volume time-series ingestion.

Relational databases like Cloud SQL or Spanner are inefficient and cost-prohibitive for raw high-velocity key-value sensor append streams.

Evaluate analytical query requirements without ETL overhead.

BigQuery supports direct querying of Cloud Bigtable via external table federated queries, allowing analysts to run SQL without needing custom ETL streaming pipelines.

Federated querying preserves operational performance while fulfilling ad-hoc analytical access requirements.

Verify architectural fit against constraints.

Cloud Bigtable multi-cluster replication provides regional resiliency and localized low latency while integrating seamlessly with BigQuery for analytics.

Meets all performance, storage model, cost, and operational requirements.

Key Concept

Selecting Cloud Bigtable for high-throughput time-series ingestion combined with BigQuery federated queries for zero-ETL analytics.

Question 469Question →

An enterprise security team needs to grant an external compliance auditor permission to view BigQuery dataset metadata for all Google Cloud projects contained within a specific department folder. The solution must adhere to the principle of least privilege and minimize administrative overhead. Which action should the Cloud Architect take?

Grant the predefined BigQuery Metadata Viewer role (roles/bigquery.metadataViewer) on the department folder node.

Grant the primitive Viewer role (roles/viewer) at the Organization resource node.

Grant the Service Account User role (roles/iam.serviceAccountUser) on each project within the folder.

Configure a VPC Service Controls security perimeter around the department folder to allow metadata access.

Show answer & explanation

Answer: Grant the predefined BigQuery Metadata Viewer role (roles/bigquery.metadataViewer) on the department folder node.

Answer

Grant the predefined BigQuery Metadata Viewer role (roles/bigquery.metadataViewer) on the department folder node.

Granting the predefined BigQuery Metadata Viewer role at the folder level leverages resource hierarchy inheritance so that all current and future projects within the folder inherit metadata viewing rights without granting access to table data or other GCP services.

Step-by-Step Solution

Identify the required access scope and level of permission.

The auditor requires metadata-only read access for BigQuery datasets scoped exclusively to projects under a specific folder.

The requirement stresses least privilege and administrative efficiency.

Evaluate resource hierarchy inheritance in Google Cloud IAM.

Permissions applied at a folder node are inherited by all child projects and resources inside that folder.

Applying the IAM binding at the folder level eliminates the need to configure each project individually.

Select the minimal role meeting the functional requirement.

The predefined role `roles/bigquery.metadataViewer` grants metadata inspection without exposing underlying dataset contents or granting primitive viewer rights across unrelated services.

Using predefined fine-grained roles aligns with security best practices.

Key Concept

Resource Hierarchy Permission Inheritance and Predefined IAM Roles

Question 470Question →

A global fintech company is migrating its core multi-region banking ledger application to Google Cloud. The workload requires full transactional ACID compliance, relational database semantics across multiple regions, horizontal scale for high-throughput reads and writes, and a high availability SLA of 99.999%. Which database resource should you select to meet these business and technical requirements?

Cloud SQL for PostgreSQL configured with High Availability (HA) in the primary region and cross-region read replicas.

Cloud Spanner provisioned as a multi-region instance configuration across the required geographic regions.

Cloud Storage bucket architecture configured with continuous online streaming via Storage Transfer Service.

Cloud Bigtable clusters configured with multi-cluster routing and Customer-Supplied Encryption Keys (CSEK) managed manually.

Show answer & explanation

Answer: Cloud Spanner provisioned as a multi-region instance configuration across the required geographic regions.

Answer

Cloud Spanner provisioned as a multi-region instance configuration across the required geographic regions.

Provisioning Cloud Spanner as a multi-region instance is the correct choice because Cloud Spanner natively supports global relational tables with strong ACID consistency across multiple regions, horizontal scale for reads and writes, and provides an industry-leading 99.999% availability SLA.

Step-by-Step Solution

Analyze workload requirements

Identified requirements for relational schema enforcement, multi-region horizontal write scale, global ACID consistency, and a 99.999% SLA.

Determines the storage class and database engine required by comparing GCP database capability limits.

Evaluate database candidates against relational multi-region scale

Cloud SQL cannot support multi-region write scaling or 99.999% SLA. Cloud Bigtable lacks relational multi-table ACID guarantees.

Narrowing down service capabilities against stringent availability and transactional constraints.

Select optimal service

Cloud Spanner meets all criteria by providing external consistency, multi-region ACID transactions, high availability (99.999%), and relational SQL capabilities.

Cloud Spanner is specifically designed for enterprise-grade global relational workloads requiring high availability.

Key Concept

Selecting Cloud Spanner for globally distributed relational workloads requiring strong consistency and 99.999% SLA

Question 471Question →

An enterprise requires an encrypted, cost-effective connection over the public internet to link an on-premises location to a Google Cloud Virtual Private Cloud (VPC) for low-throughput data transfers. Which Google Cloud hybrid connectivity solution should be configured?

Cloud HA VPN

Dedicated Interconnect

VPC Network Peering

VPC Service Controls

Show answer & explanation

Answer: Cloud HA VPN

Answer

Cloud HA VPN is the correct solution for encrypted connectivity over the public internet.

Cloud HA VPN establishes secure, IPsec-encrypted VPN tunnels between an on-premises network and a Google Cloud VPC over the public internet, making it the appropriate choice for low-throughput, cost-effective hybrid connectivity.

Step-by-Step Solution

Identify the requirement for internet-based encryption and low throughput.

Connections over the public internet with low throughput requirements point to IPsec VPN solutions.

Dedicated Interconnect bypasses the public internet and targets high bandwidth capacity.

Evaluate Google Cloud hybrid connectivity options against these constraints.

Cloud HA VPN meets all criteria by providing IPsec encrypted tunnels over the public internet.

VPC Network Peering is only for VPC-to-VPC connectivity, and VPC Service Controls is a security perimeter feature.

Key Concept

Configuring Hybrid Connectivity using Cloud VPN for encrypted transit over the public internet.

Estimated Time:45s

Question 472Question →

A financial infrastructure company uses Google Cloud Pub/Sub and Cloud Run to process payment events across multiple Google Cloud projects. During a recent audit, compliance officers discovered that several high-severity payment failure log entries failed to route to the central long-term Cloud Storage sink. An investigation reveals that a developer implemented an aggregate log exclusion filter at the organization level to control ingestion costs, but it accidentally matched critical transaction audit entries. Additionally, an alerting policy monitoring transaction failures using a log-based metric has ceased notifying the incident handling pub/sub topic. How should the principal cloud architect resolve both the missing compliance logs and restore operational alerting while following Google Cloud security best practices?

Modify the organization log exclusion filter using a narrowed boolean evaluation to explicitly match non-compliance log names while allowing payment audit entries, and verify that the custom log-based metric service account holds the Monitoring Notification Channel Editor role.

Remove the exclusion filter entirely across all projects, and grant the primitive Owner role to the Cloud Logging service account associated with the project sink.

Refine the exclusion filter expression to exclude low-severity operational logs while protecting high-severity payment audit logs, and ensure the log-based metric alert condition evaluates non-zero count thresholds properly without relying on elevated administrative service account roles.

Update the exclusion filter to drop all logs matching severity standard INFO, and grant Service Account Admin privileges to the Cloud Monitoring alerting service account.

Show answer & explanation

Answer: Refine the exclusion filter expression to exclude low-severity operational logs while protecting high-severity payment audit logs, and ensure the log-based metric alert condition evaluates non-zero count thresholds properly without relying on elevated administrative service account roles.

Answer

The correct solution explicitly refines the log exclusion filter to avoid dropping critical audit records, maintaining compliance retention while avoiding excessive log ingestion costs. It also ensures proper alert threshold evaluation without abusing IAM administrative roles.

Step-by-Step Solution

Analyze the log exclusion filter logic in Cloud Logging.

Identify that overbroad regex/boolean filters drop high-severity compliance entries.

Exclusion filters prevent matching log entries from being ingested or routed to downstream sinks.

Adjust the exclusion filter regex filter to explicitly target non-critical operational noise while safeguarding audit logs.

Compliance log entries resume routing to the centralized Cloud Storage log sink.

Fine-grained filtering maintains cost control while fulfilling compliance retention policies.

Review the IAM identity and alerting policy configuration for the log-based metric.

Confirm metric calculation and alerting threshold parameters without granting primitive or administrative IAM roles.

Ensures alerting continuity while preserving IAM least-privilege requirements.

Key Concept

Cloud Logging Exclusion Filters and Least-Privilege Operational Alerting

Question 473Question →

An enterprise organization is preparing to migrate 500 high-performance Compute Engine N2 virtual machines across multiple newly created Google Cloud projects in the `us-central1` region using an automated Infrastructure as Code (IaC) pipeline. During early testing in a staging project, automated deployments failed halfway through due to exceeding default regional CPU quotas. Additionally, the finance team requires strict quota usage monitoring and automated alerts before limits are breached, while ensuring infrastructure engineers cannot grant themselves quota increase privileges. Which architectural decision best resolves these quota management and governance requirements?

Submit proactive quota increase requests for the required N2 CPUs in `us-central1` across target projects prior to pipeline execution, assign the Quotas Viewer role to infrastructure engineers, configure Cloud Monitoring quota utilization alerts, and restrict Quota Administrator privileges strictly to a central governance IAM group.

Configure the Terraform pipeline scripts to dynamically request quota increases via the Cloud Quotas API during execution whenever a quota threshold is breached, using exponential backoff retry loops until GCP support grants approval.

Grant the primitive Owner role to the Infrastructure CI/CD Service Account across all migration projects to automatically bypass regional resource limits and empower engineers to adjust quotas dynamically during deployment.

Override quota checks by embedding local provisioner scripts in the Terraform code that store quota configuration parameters inside an unversioned local state file to isolate state management during concurrent resource creation.

Show answer & explanation

Answer: Submit proactive quota increase requests for the required N2 CPUs in `us-central1` across target projects prior to pipeline execution, assign the Quotas Viewer role to infrastructure engineers, configure Cloud Monitoring quota utilization alerts, and restrict Quota Administrator privileges strictly to a central governance IAM group.

Answer

The correct architecture requires requesting N2 CPU quota increases in us-central1 proactively before executing deployment pipelines. Infrastructure engineers should be granted the Quotas Viewer role to view limits without permission to request increases, while central governance handles Quota Administrator roles. Cloud Monitoring alerts track quota utilization thresholds.

Proactively requesting regional quota increases in advance ensures that automated IaC deployments complete successfully without hitting API rate or resource limits. Enforcing fine-grained IAM roles (Quota Administrator for central governance and Quotas Viewer for engineers) aligns with security best practices and least privilege, while Cloud Monitoring alerts provide early warnings before quotas are exhausted.

Step-by-Step Solution

Assess quota requirements prior to deployment

Identify that 500 N2 instances will exceed default regional N2 CPU quota limits in us-central1.

GCP quotas are enforced at the project and regional level, and quota increases require lead time for approval.

Implement proactive quota request workflow

Submit quota increase requests for us-central1 N2 CPUs via Cloud Console or Cloud Quotas API ahead of migration.

Automated pipelines will fail if quotas are insufficient during provisioning.

Enforce principle of least privilege using IAM fine-grained roles

Assign roles/servicemanagement.quotaViewer to engineers and reserve roles/servicemanagement.quotaAdmin for the governance team.

Prevents unauthorized personnel from requesting arbitrary quota modifications while granting required visibility.

Set up operational observability and alerting

Configure Cloud Monitoring metrics (e.g. quota/allocation/usage) and set threshold alert policies for early notification.

Allows proactive response before reaching 100% quota consumption.

Key Concept

Proactive Quota Provisioning and IAM Governance

Estimated Time:3m 0s

Question 474Question →

A DevOps engineer is provisioning a Google Cloud Storage bucket to serve as a centralized remote backend for Infrastructure as Code (IaC) deployment state. The team requires a mechanism to recover previous state file revisions in case an automated pipeline introduces state corruption or accidental overwrites. Which configuration should be enabled on the Cloud Storage bucket to satisfy this requirement?

Enable Object Versioning on the Cloud Storage bucket.

Store the state files in an unversioned local directory on the deployment runner.

Configure Customer-Supplied Encryption Keys (CSEK) on the bucket.

Provision a multi-region Cloud Spanner database instance to store raw state files.

Show answer & explanation

Answer: Enable Object Versioning on the Cloud Storage bucket.

Answer

Enable Object Versioning on the Cloud Storage bucket.

Enabling Object Versioning on a Google Cloud Storage bucket maintains a complete historical record of object modifications. If an automated IaC pipeline applies a breaking change or corrupts the state file, administrators can retrieve and restore prior object versions directly.

Step-by-Step Solution

Identify the operational requirement for managing Infrastructure as Code (IaC) state files.

The requirement calls for preventing data loss and restoring previous file revisions when overwrites occur.

Automated pipeline runs can overwrite remote state files during deployment failures.

Select the appropriate Cloud Storage feature for revision control.

Object Versioning maintains multiple historical variants of objects within the same bucket.

If a state file becomes corrupted, Object Versioning allows instant rollback to the last known good state revision.

Key Concept

Cloud Storage Object Versioning for IaC State Protection

Estimated Time:1m 0s

Question 475Question →

A solutions architect is creating architectural documentation for a new cloud application on Google Cloud. The architecture team needs to clearly distinguish between conceptual, logical, and physical views. Which of the following statements accurately describe the characteristics of conceptual and logical architectural views? (Select TWO.)

Select all that apply

A conceptual architecture defines high-level business capabilities, system boundaries, and user interactions without specifying concrete cloud services.

A conceptual architecture specifies concrete Google Cloud resources such as Cloud Spanner database configurations and VPC subnet IP ranges.

A logical architecture defines functional components, data flows, and interface boundaries independent of specific compute machine types or physical deployment configurations.

A logical architecture requires defining exact GKE node pool machine specs and cluster autoscaling parameters to model service communication.

A physical architecture focuses exclusively on abstract business requirements while ignoring network topology and cloud resource provisioning.

Show answer & explanation

Answer: A conceptual architecture defines high-level business capabilities, system boundaries, and user interactions without specifying concrete cloud services.; A logical architecture defines functional components, data flows, and interface boundaries independent of specific compute machine types or physical deployment configurations.

Answer

The correct statements are that a conceptual architecture defines high-level business capabilities, system boundaries, and user interactions without specifying concrete cloud services, and a logical architecture defines functional components, data flows, and interface boundaries independent of specific compute machine types or physical deployment configurations.

Conceptual architecture models high-level business domain boundaries and objectives without referencing vendor-specific technical components. Logical architecture models functional components, data exchange patterns, and service interactions independently of concrete physical hardware or resource configurations.

Step-by-Step Solution

Identify the purpose of a conceptual architecture.

Recognize that conceptual architecture represents high-level business capabilities and domains without technology binding.

Conceptual views bridge business requirements and solution architecture.

Identify the purpose of a logical architecture.

Recognize that logical architecture defines component boundaries, data pathways, and software abstractions.

Logical views define structural relationships independently of specific physical cloud resource provisioning.

Distinguish physical architecture characteristics from conceptual and logical views.

Identify that specific GCP product choices, node sizes, subnet ranges, and deployment parameters belong strictly to physical architecture.

Physical architecture translates logical models into concrete cloud deployments.

Key Concept

Distinguishing Conceptual, Logical, and Physical Cloud Architecture Views

Question 476Question →

An enterprise operations team is experiencing intermittent database timeout errors across multiple microservices. The team needs to configure automated real-time incident notifications based on log entries generated by these failures. Place the operational configuration steps in the correct chronological order to establish a log-based metric and an associated Cloud Monitoring alerting policy.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins by defining an advanced log filter in Cloud Logging, constructing a log-based counter metric from the filtered query, creating a Cloud Monitoring Alerting Policy with threshold conditions set on that metric, and finalizing the policy by attaching notification channels and runbook documentation.

Establishing automated operational alerting based on log events follows a strict dependency path: identifying target logs via query filters, transforming log event occurrences into metric time-series data, building an alert policy with threshold evaluation rules, and attaching notification channels to complete incident dispatch.

Step-by-Step Solution

Filter target logs in Cloud Logging.

Filtered log stream isolated.

Determines the precise log payload matching database timeout conditions.

Construct a log-based metric.

Custom time-series metric created in Cloud Monitoring.

Converts unstructured log occurrences into continuous quantitative data for evaluation.

Define Alerting Policy condition.

Alert threshold and evaluation window established.

Sets the numeric rules for when log error rates breach operational SLAs.

Bind notification channels and runbook metadata.

Active alert policy configured for automated incident notification.

Ensures on-call engineers receive notifications and standard operating procedures upon policy trigger.

Key Concept

End-to-end configuration sequence for log-based metrics and operational alert policies in GCP

Question 477Question →

An enterprise organization is automating infrastructure provisioning on Google Cloud using Infrastructure as Code. During a major deployment using Cloud Deployment Manager templates, several resource creation calls fail mid-execution because regional API allocation limits are exceeded. Additionally, resource updates fail or execute out of order because implicit creation order is relied upon. Which TWO actions should the Cloud Architect recommend to address these operational and architectural failures? (Select TWO.)

Select all that apply

Explicitly define resource dependencies within Deployment Manager templates using the dependsOn directive.

Audit project resource limits and request required regional quota increases prior to launching large-scale automated deployments.

Configure the deployment pipeline to maintain state files in unversioned local storage on the execution runner to avoid remote state synchronization latency.

Grant the primitive Owner IAM role to the Deployment Manager execution service account to bypass regional resource quota enforcement.

Show answer & explanation

Answer: Explicitly define resource dependencies within Deployment Manager templates using the dependsOn directive.; Audit project resource limits and request required regional quota increases prior to launching large-scale automated deployments.

Answer

The correct actions are to explicitly define resource dependencies within Deployment Manager templates using the dependsOn directive, and to audit project resource limits and request required regional quota increases prior to launching large-scale automated deployments.

Declaring resource dependencies explicitly with dependsOn ensures Deployment Manager builds resources in the required topological sequence. Proactively verifying and requesting regional quota increases prevents deployment pipelines from failing when provisioning large infrastructure footprints.

Step-by-Step Solution

Analyze out-of-order provisioning failures

Determine that Deployment Manager requires explicit dependency declarations using the dependsOn directive when resources depend on non-implicit parent references.

Prevents resources from being provisioned before prerequisites exist.

Analyze mid-execution resource limit failures

Identify that quota limits must be evaluated and increased before provisioning begins.

Prevents automated deployments from failing due to regional quota exhaustion.

Key Concept

Deployment Manager dependency management and proactive quota planning for Infrastructure as Code automation

Question 478Question →

An autonomous mobility platform needs to migrate 40 TB of unstructured sensor logs from an on-premises storage system and a 500 GB relational database to Google Cloud within a 3-week planning window. The organization maintains an active 1 Gbps Dedicated Interconnect with 600 Mbps of consistent available bandwidth allocated for data migration. The operational requirement dictates that the relational database must remain fully operational for online transactions until a planned 2-hour final cutover window.

Which TWO architectural recommendations should be included in the cloud migration strategy to fulfill these business and technical requirements?

Select all that apply

Utilize Storage Transfer Service for agent-based transfers to move the 40 TB unstructured log dataset directly over the Dedicated Interconnect connection.

Deploy Database Migration Service (DMS) to execute initial data loading and continuous Change Data Capture (CDC) replication for the relational database prior to final cutover.

Order a Google Cloud Transfer Appliance to perform an offline bulk migration of the 40 TB unstructured log files.

Establish an IPsec High Availability (HA) VPN connection over the public internet specifically to isolate and transmit the database and file data transfers.

Show answer & explanation

Answer: Utilize Storage Transfer Service for agent-based transfers to move the 40 TB unstructured log dataset directly over the Dedicated Interconnect connection.; Deploy Database Migration Service (DMS) to execute initial data loading and continuous Change Data Capture (CDC) replication for the relational database prior to final cutover.

Answer

The migration strategy should combine using Storage Transfer Service over the existing Dedicated Interconnect for the 40 TB log files and Database Migration Service with continuous replication for the relational database.

Combining Storage Transfer Service for unstructured logs over the Dedicated Interconnect and Database Migration Service with CDC for relational data satisfies both time constraints and low-downtime operational requirements. Online network migration of 40 TB completes well under a week over 600 Mbps available bandwidth, while continuous CDC replication ensures the database stays synchronized until the 2-hour cutover window.

Step-by-Step Solution

Calculate network throughput for the 40 TB file transfer

600\text{ Mbps}

, transferring

40\text{ TB}

(

320,000\text{ Gb}

) requires

\approx 320,000 / 0.6 = 533,333\text{ seconds} \approx 6.17\text{ days}

of continuous transfer (or under 4 days at full line rate without protocol overhead), which comfortably fits inside the 3-week window.

Determining network capacity confirms whether an online transfer tool is viable versus an offline appliance.

Select the appropriate file migration tool

Storage Transfer Service allows automated, scalable, agent-based ingestion of on-premises file data directly into Cloud Storage over private Interconnect connectivity.

Using existing private bandwidth avoids physical device logistics and simplifies orchestration.

Select the database migration pattern

Database Migration Service (DMS) provides minimal-downtime database migration using continuous Change Data Capture (CDC).

Continuous replication keeps target database updated in real-time, allowing cutover to take place within the narrow 2-hour window.

Key Concept

Selecting online file transfer mechanisms versus offline appliances based on bandwidth calculations, alongside minimal-downtime database replication strategies.

Question 479Question →

An administrator is setting up a dedicated management VPC network (VPC-Mgmt) that requires direct, private IP connectivity to two separate application VPC networks (VPC-App1 and VPC-App2) in Google Cloud. The two application VPC networks do not need to communicate with each other. Which TWO configuration actions must be performed to establish this connectivity using VPC Network Peering?

Select all that apply

Establish a VPC Network Peering connection from VPC-Mgmt to VPC-App1 and a matching peering connection from VPC-App1 to VPC-Mgmt.

Establish a VPC Network Peering connection from VPC-Mgmt to VPC-App2 and a matching peering connection from VPC-App2 to VPC-Mgmt.

Create a single peering connection between VPC-App1 and VPC-App2 and rely on VPC-App1 to transitively route traffic to VPC-Mgmt.

Provision a Dedicated Interconnect circuit between VPC-App1 and VPC-App2 to bridge communication back to VPC-Mgmt.

Configure VPC Service Control perimeters around VPC-Mgmt and VPC-App1 to enable internal network routing without creating peering connections.

Show answer & explanation

Answer: Establish a VPC Network Peering connection from VPC-Mgmt to VPC-App1 and a matching peering connection from VPC-App1 to VPC-Mgmt.; Establish a VPC Network Peering connection from VPC-Mgmt to VPC-App2 and a matching peering connection from VPC-App2 to VPC-Mgmt.

Answer

To establish connectivity between VPC-Mgmt and both application VPCs, you must create a bidirectional peering pair between VPC-Mgmt and VPC-App1, and separately create a bidirectional peering pair between VPC-Mgmt and VPC-App2.

VPC Network Peering requires explicit peering configuration from both participating VPC networks. To connect VPC-Mgmt to VPC-App1 and VPC-App2, direct bidirectional peering connections must be created between VPC-Mgmt and VPC-App1, as well as between VPC-Mgmt and VPC-App2.

Step-by-Step Solution

Identify the direct connectivity requirements for each independent VPC pair.

Determine that VPC-Mgmt needs to talk directly to VPC-App1, and VPC-Mgmt needs to talk directly to VPC-App2.

VPC Network Peering is non-transitive, so intermediate networks cannot forward traffic to third-party VPCs.

Configure bilateral VPC Network Peering for VPC-Mgmt and VPC-App1.

Peering state transitions to ACTIVE for the VPC-Mgmt and VPC-App1 pair.

Both network administrators (or both sides of the configuration) must authorize the peering relationship.

Configure bilateral VPC Network Peering for VPC-Mgmt and VPC-App2.

Peering state transitions to ACTIVE for the VPC-Mgmt and VPC-App2 pair.

A separate peering pair is required for each distinct pair of VPC networks.

Key Concept

VPC Network Peering Bidirectionality and Non-Transitivity

Question 480Question →

A company requires long-term retention of system error logs from Google Kubernetes Engine (GKE) clusters in a centralized Cloud Storage bucket located in a separate compliance project. An administrator configures an organization-level log sink with an inclusion filter for error log entries. However, logs are not appearing in the target destination bucket. Which action should be taken to ensure log delivery following the principle of least privilege?

Grant the unique service account (writer identity) generated for the log sink the Storage Object Creator role on the destination Cloud Storage bucket.

Grant the Cloud Logging Service Agent the primitive Owner role on the destination compliance project.

Grant the GKE node pool default service account the Service Account Admin role across the organization.

Submit a Cloud Console support ticket to request a regional quota increase for aggregated log sink throughput.

Show answer & explanation

Answer: Grant the unique service account (writer identity) generated for the log sink the Storage Object Creator role on the destination Cloud Storage bucket.

Answer

Grant the unique service account (writer identity) generated for the log sink the Storage Object Creator role on the destination Cloud Storage bucket.

When configuring a Cloud Logging sink that exports logs to a destination in another project or resource, Cloud Logging generates a unique service account called a writer identity (e.g., `serviceAccount:[email protected]`). To grant log delivery access according to least privilege, you must grant this specific writer identity the `roles/storage.objectCreator` role directly on the destination Cloud Storage bucket.

Step-by-Step Solution

Identify the log sink writer identity

Obtain the unique service account created automatically when the log sink was provisioned.

Cloud Logging log sinks use a dedicated writer identity service account to write log entries to external destinations.

Assign fine-grained destination permissions

Grant `roles/storage.objectCreator` to the sink writer identity specifically on the destination Cloud Storage bucket.

The writer identity requires write access to create log blobs in the destination bucket without granting broad privileges over the destination project.

Key Concept

Log Sink Writer Identity IAM Permissions

PreviousPage 24 / 80Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept