All practice questions

1598 questions

All types1,598 Multiple choice815 Multiple select537 Numeric8 Matching64 Ordering174

An enterprise operating a multi-folder Google Cloud organization must centralize security operations and satisfy regulatory audit requirements across all current and future projects. The security team requires real-time detection of high-risk threat activity, such as compromised credentials or anomalous data access. Additionally, Data Access audit logs must be preserved for five years in an immutable state, while preventing project-level administrators from modifying retention policies or disabling audit log collection. Which architectural solution fulfills these compliance and security requirements?

Configure an organization-level aggregated log sink with an inclusion filter for Data Access audit logs routing to a Cloud Storage bucket in a dedicated security project with Bucket Lock enabled, and activate Security Command Center Premium at the organization level with Event Threat Detection exporting to Pub/Sub.

Grant primitive Owner roles to project security leads so they can independently configure local Cloud Logging sinks and Security Command Center notification channels according to each project's compliance needs.

Require each project team to manage Data Access audit log storage using Customer-Supplied Encryption Keys (CSEK) and grant project service accounts the Service Account Admin role to authorize log exports across projects.

Deploy VPC Service Controls perimeters around all production folders to prevent unauthorized data movement, relying on default perimeter logs without establishing aggregated log sinks or enabling Security Command Center Premium.

Show answer & explanation

Answer: Configure an organization-level aggregated log sink with an inclusion filter for Data Access audit logs routing to a Cloud Storage bucket in a dedicated security project with Bucket Lock enabled, and activate Security Command Center Premium at the organization level with Event Threat Detection exporting to Pub/Sub.

Answer

Configure an organization-level aggregated log sink routing Data Access audit logs to a locked Cloud Storage bucket in a central security project, alongside organization-level Security Command Center Premium with Event Threat Detection.

The solution leveraging an organization-level aggregated log sink combined with Security Command Center Premium is correct. Aggregated sinks at the organization root automatically capture Data Access audit logs across all existing and future projects. Routing these logs to a dedicated security project with Bucket Lock ensures five-year immutable retention immune to project-level administrative overrides. Enabling Security Command Center Premium at the organization level enables Event Threat Detection, which continuously analyzes log streams for security threats and exports alerts via Pub/Sub.

Step-by-Step Solution

Evaluate central governance and immutability requirements for audit logging.

Organization-level aggregated log sinks automatically inherit all underlying folders and projects, routing logs to a centralized security project where project-level admins lack permissions.

Prevents project admins from disabling audit logs or tampering with retention policies.

Address the five-year immutable retention mandate.

Exporting audit logs to a Cloud Storage bucket configured with Bucket Lock (WORM policy) enforces retention without possibility of premature deletion.

Meets strict compliance and data preservation requirements.

Evaluate real-time threat detection requirements across the organization.

Security Command Center Premium enabled at the organization level provides Event Threat Detection (ETD) to continuously scan audit logs for credential misuse and anomaly patterns.

Delivers real-time automated threat identification across all projects.

Key Concept

Organization-Level Security Telemetry and Audit Log Centralization

Question 542Question →

A global retail firm is migrating its legacy inventory management system to Google Cloud. The environment consists of a $320\text{ TB}$ archive of unstructured product catalog images and a $750\text{ GB}$ operational PostgreSQL database. The on-premises facility has a shared $100\text{ Mbps}$ internet uplink that must remain available for active business operations. The migration must complete within a target window of 14 days with minimal database downtime during cutover. Which migration strategy should the Cloud Architect recommend?

Order a Google Cloud Transfer Appliance to perform an offline data transfer for the

320\text{ TB}

image archive to Cloud Storage, and use Database Migration Service (DMS) with continuous Change Data Capture (CDC) over a secure VPN for the PostgreSQL database.

Configure Storage Transfer Service to stream the

320\text{ TB}

image archive directly over the existing

100\text{ Mbps}

internet link, and use Database Migration Service (DMS) for the PostgreSQL database.

Order a Google Cloud Transfer Appliance for the

320\text{ TB}

image archive, and migrate the operational PostgreSQL database to a Cloud Spanner instance using automated schema conversion and continuous replication.

Provision a 10 Gbps Dedicated Interconnect connection to stream the

320\text{ TB}

image archive via Storage Transfer Service, and perform a one-time database backup and restore using pg_dump during cutover.

Show answer & explanation

Answer: Order a Google Cloud Transfer Appliance to perform an offline data transfer for the $320\text{ TB}$ image archive to Cloud Storage, and use Database Migration Service (DMS) with continuous Change Data Capture (CDC) over a secure VPN for the PostgreSQL database.

Answer

Order a Google Cloud Transfer Appliance for the

320\text{ TB}

image archive, and use Database Migration Service (DMS) with continuous Change Data Capture (CDC) over a VPN for the PostgreSQL database.

The solution combining a Google Cloud Transfer Appliance with Database Migration Service (DMS) via CDC addresses both data scale and network limitations. Moving

320\text{ TB}

of data over a shared

100\text{ Mbps}

pipe takes several months online; Transfer Appliance circumvents this by physically shipping the data to GCP within days. Meanwhile, DMS continuously replicates the

750\text{ GB}

PostgreSQL database using CDC, enabling a low-downtime cutover without requiring lengthy circuit provisioning.

Step-by-Step Solution

Calculate data transfer time over available bandwidth for the bulk dataset.

Transferring

320\text{ TB}

(

3.2 \times 10^{14}

bytes) over a

100\text{ Mbps}

link requires approximately

\frac{320 \times 10^{12} \times 8}{100 \times 10^6} \approx 25,600,000\text{ seconds} \approx 296\text{ days}

, making online transfer infeasible.

Large multi-hundred-terabyte datasets over limited network connections mandate offline physical transfer appliances to meet tight time constraints.

Evaluate operational database migration and cutover requirements.

Database Migration Service (DMS) continuously replicates PostgreSQL data via Change Data Capture (CDC), keeping the target Cloud SQL database synchronized until final cutover.

CDC minimizes operational downtime during database cutover to minutes rather than hours required by offline dumps.

Select appropriate GCP services matching resource scale and timeline.

Combine Transfer Appliance for bulk unstructured data and Database Migration Service over a VPN for relational data.

This combination respects network limitations, completes within the 14-day target window, and avoids over-engineering compute or storage architectures.

Key Concept

Designing hybrid data transfer strategies based on bandwidth constraints, dataset size, downtime tolerance, and lead-time requirements.

Question 543Question →

An enterprise architecture team needs to prevent developers across all Google Cloud projects from granting IAM permissions to external Google accounts outside the corporate Cloud Identity directory. This governance control must apply automatically across all existing and newly created folders and projects within the organization. Which architectural approach should the team implement to meet this requirement?

Define an Organization Policy at the organization root node enforcing the Domain Restricted Sharing constraint (constraints/iam.allowedPolicyMemberDomains) with your Cloud Identity customer ID.

Assign the primitive Owner IAM role to security administrators at the top-level folder so they can audit and manually remove external policy bindings.

Construct a VPC Service Controls perimeter encompassing all projects to prevent external identities from accessing resource APIs.

Grant developers the Service Account User role across the resource hierarchy so they can delegate identity management exclusively through service accounts.

Show answer & explanation

Answer: Define an Organization Policy at the organization root node enforcing the Domain Restricted Sharing constraint (constraints/iam.allowedPolicyMemberDomains) with your Cloud Identity customer ID.

Answer

Enforce an Organization Policy at the organization root using the Domain Restricted Sharing constraint (`constraints/iam.allowedPolicyMemberDomains`) configured with the enterprise Cloud Identity customer ID.

The Domain Restricted Sharing constraint (`constraints/iam.allowedPolicyMemberDomains`) enforced at the Organization node establishes a strict boundary for IAM member additions. By specifying the corporate Cloud Identity customer ID, Google Cloud prevents any user from binding IAM roles to accounts outside the specified identity domain across all existing and future projects.

Step-by-Step Solution

Identify the governance requirement.

The requirement is to restrict IAM membership across all current and future projects to allowed identity domains.

Central security governance requires declarative guardrails enforced via the resource hierarchy.

Evaluate Google Cloud Organization Policy constraints.

The constraint `constraints/iam.allowedPolicyMemberDomains` limits the set of identities allowed in IAM policy bindings to specified Cloud Identity customer IDs.

Organization policies inherit down the resource hierarchy (Organization → Folders → Projects), ensuring automatic coverage for all projects.

Key Concept

Organization Policies - Domain Restricted Sharing

Estimated Time:1m 30s

Question 544Question →

A multinational financial services company operating on Google Cloud needs to implement automated threat detection and immediate remediation for misconfigured resources (such as publicly exposed storage buckets or anomalous service account key creation) across hundreds of projects. Additionally, compliance requirements mandate that all Admin Activity and Data Access audit logs must be immutable and centralized in a manner that prevents project-level resource administrators from modifying or deleting their own project audit records. Which architecture strategy best satisfies these operational and security compliance requirements?

Enable Security Command Center Premium findings notifications routed to an organization-wide Cloud Pub/Sub topic linked to automated Cloud Functions remediation workflows, and configure an organization-level aggregated log sink exporting audit logs to a Cloud Storage bucket protected by a Locked Retention Policy in a dedicated, isolated log-governance project.

Grant the primitive Owner role (roles/owner) to security administrators across all project folders, and configure project-level Cloud Logging sinks to export audit logs to local Pub/Sub topics monitored manually by operational engineers.

Require Customer-Supplied Encryption Keys (CSEK) to manually encrypt all audit logs and Security Command Center event notifications prior to exporting them via Pub/Sub to external security information and event management (SIEM) systems.

Grant the automated remediation Cloud Function service account the Service Account Admin role (roles/iam.serviceAccountAdmin) across the organization hierarchy so it can reconfigure audit log sink destinations and service account key policies when threats are detected.

Show answer & explanation

Answer: Enable Security Command Center Premium findings notifications routed to an organization-wide Cloud Pub/Sub topic linked to automated Cloud Functions remediation workflows, and configure an organization-level aggregated log sink exporting audit logs to a Cloud Storage bucket protected by a Locked Retention Policy in a dedicated, isolated log-governance project.

Answer

The correct strategy leverages Security Command Center Premium to generate continuous threat findings and exports them via Pub/Sub notifications to trigger automated Cloud Functions remediation. Concurrently, centralization and compliance immutability are guaranteed by configuring an Organization Aggregated Log Sink that routes Admin Activity and Data Access audit logs into a dedicated security project with Cloud Storage Bucket Lock enabled, ensuring project-level administrators cannot modify or delete audit trails.

Step-by-Step Solution

Evaluate real-time threat detection and automated remediation requirements across multi-project environments.

Identify Security Command Center (SCC) Premium notification configs combined with Pub/Sub and Cloud Functions / Cloud Run as the standard pattern for automated security incident response.

SCC provides centralized asset vulnerability and threat detection, and publishing findings to Pub/Sub enables event-driven remediation pipelines.

Evaluate log centralization and immutability requirements.

Implement an Organization Aggregated Sink at the GCP Organization level to capture all project audit logs into a dedicated security project.

Organization-level sinks prevent project-level admins from disabling log sinks or deleting logs in their local projects.

Ensure log storage meets strict immutability and compliance regulations.

Apply a Retention Policy with Bucket Lock (Object Lock) to the target Cloud Storage bucket in the central logging project.

Bucket Lock enforces write-once-read-many (WORM) compliance, preventing deletion or alteration of audit logs even by project owners.

Key Concept

Centralized security auditing and event-driven automated remediation using Organization Aggregated Sinks, Bucket Lock, and Security Command Center notifications.

Question 545Question →

Your enterprise cloud architecture team is establishing an automated, secure progressive delivery pipeline using Cloud Build, Artifact Registry, Binary Authorization, and Google Cloud Deploy. In what chronological sequence should the pipeline execution steps occur to safely roll out a new microservice release from code build to full production traffic?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct release sequence is: (1) Build container image and generate Binary Authorization attestation in Cloud Build -> (2) Register Cloud Deploy release with signed image digest -> (3) Deploy to canary stage and route partial live traffic -> (4) Perform automated SLO canary analysis via Cloud Monitoring -> (5) Promote release in Cloud Deploy to shift 100% traffic to production.

The proper release sequence follows shift-left security and progressive delivery best practices. First, Cloud Build creates the container artifact and signs it with a Cloud KMS key to satisfy Binary Authorization policies. Next, a Cloud Deploy release is declared using the signed image digest. The release is then deployed to a canary phase where a small portion of live traffic is routed. Operational health metrics (latency, error rates) are monitored and verified against SLOs. Once verified, Cloud Deploy promotes the release to receive 100% of production traffic.

Step-by-Step Solution

Container artifact creation and security attestation

Signed container image stored in Artifact Registry with valid Binary Authorization attestation

Binary Authorization policies require images to be attested before deployment can be initiated.

Delivery pipeline release declaration

Cloud Deploy release object created referencing the exact immutable image digest

Cloud Deploy requires an explicit release declaration to bind target configurations with the container digest.

Canary deployment and initial traffic routing

Workload deployed to canary target phase with initial percentage of traffic directed to it

Progressive delivery minimizes blast radius by testing candidate revisions on real-world traffic subsets.

Canary health and telemetry verification

Metrics validated against latency, error rate, and availability SLOs

Automated metric evaluation confirms system stability before expanding deployment scale.

Full production promotion

100% of production traffic routed to the newly promoted revision

Promoting the release finalizes deployment after passing all automated health gates.

Key Concept

Automating progressive delivery release pipelines using Cloud Build, Binary Authorization, Google Cloud Deploy, and Cloud Monitoring canary verification.

Question 546Question →

A security administration team needs to grant a group of compliance auditors read-only access to inspect resource configurations and review IAM policies across all projects grouped under a specific department folder in Google Cloud. Which TWO role assignments at the folder level satisfy these requirements while adhering to the principle of least privilege?

Select all that apply

Assign the Security Reviewer role (roles/iam.securityReviewer) to the auditor group at the folder level.

Assign the Folder Viewer role (roles/resourcemanager.folderViewer) to the auditor group at the folder level.

Assign the primitive Owner role (roles/owner) to the auditor group at the folder level.

Assign the Service Account User role (roles/iam.serviceAccountUser) to the auditor group at the folder level.

Show answer & explanation

Answer: Assign the Security Reviewer role (roles/iam.securityReviewer) to the auditor group at the folder level.; Assign the Folder Viewer role (roles/resourcemanager.folderViewer) to the auditor group at the folder level.

Answer

Assign the Security Reviewer role (roles/iam.securityReviewer) and the Folder Viewer role (roles/resourcemanager.folderViewer) to the auditor group at the folder level.

Granting the Security Reviewer role allows auditors to examine IAM bindings and security posture, while the Folder Viewer role enables them to view the resource hierarchy structure under the specified folder. Both roles follow the principle of least privilege by providing targeted read-only capabilities.

Step-by-Step Solution

Identify the resource scope and inheritance level

The permissions must be applied at the folder level so that all underlying projects automatically inherit them.

Google Cloud IAM policy inheritance automatically applies parent folder permissions down to child projects.

Select least-privilege predefined security roles

Combining roles/iam.securityReviewer and roles/resourcemanager.folderViewer grants read access to security policies and resource structures.

Predefined roles provide narrow, purpose-specific capabilities required for auditing without enabling full resource modification.

Key Concept

IAM Policy Inheritance and Predefined Roles for Compliance Auditing

Estimated Time:1m 0s

Question 547Question →

A retail enterprise is configuring a Cloud Logging sink to route operational logs from multiple Compute Engine projects into a centralized Cloud Storage bucket located in a dedicated security project. The log sink is configured using a sink-specific writer identity service account. According to Google Cloud security best practices and the principle of least privilege, which IAM role assignment should be applied to the destination bucket?

Grant the Storage Object Creator role (roles/storage.objectCreator) on the destination bucket to the log sink's writer service account identity.

Grant the primitive Owner role (roles/owner) on the destination bucket to the log sink's writer service account identity.

Grant the Service Account User role (roles/iam.serviceAccountUser) on the target project to the log sink's writer service account identity.

Exclude all low-severity logs at the source project level by applying an exclusion filter that drops all logs below ERROR severity prior to sink processing.

Show answer & explanation

Answer: Grant the Storage Object Creator role (roles/storage.objectCreator) on the destination bucket to the log sink's writer service account identity.

Answer

Grant the Storage Object Creator role (roles/storage.objectCreator) on the destination bucket to the log sink's writer service account identity.

When configuring a Cloud Logging sink that routes log entries to Cloud Storage, Cloud Logging uses a unique service account (the sink's writer identity). To satisfy least-privilege requirements, this service account must only be granted permission to write objects to the target bucket, which is precisely provided by the predefined Storage Object Creator role (roles/storage.objectCreator).

Step-by-Step Solution

Identify the service account executing the write action.

Cloud Logging exports use a unique writer identity service account generated for the sink.

Log routing across projects requires explicit identity authentication at the export destination.

Determine the minimal IAM permissions needed by Cloud Logging for Cloud Storage destinations.

Cloud Logging only requires permissions to write new objects into the destination Cloud Storage bucket.

Objects written by log sinks do not need to be deleted or overwritten by the sink writer identity.

Select the predefined IAM role that matches these exact permissions.

The Storage Object Creator role (roles/storage.objectCreator) grants write-only access to create objects.

This fulfills least-privilege security requirements.

Key Concept

Least-privilege IAM configuration for Cloud Logging sink export destinations.

Question 548Question →

A high-throughput logistics firm uses Google Cloud Deploy to automate release pipelines for a mission-critical fleet management service running on Google Kubernetes Engine (GKE). The team is configuring a progressive release strategy that deploys candidate releases through a canary phase followed by automated rollout to production GKE targets upon successful validation. The release management team needs to ensure the execution service account used by Cloud Deploy has minimal required permissions to perform render and deploy operations on the GKE targets, while preventing infrastructure state corruption during automated Infrastructure as Code (IaC) pipeline runs. Which combination of IAM roles and pipeline state management configurations should be implemented to satisfy these operational and security requirements?

Grant roles/clouddeploy.jobRunner and roles/container.developer to the Cloud Deploy execution service account, grant roles/iam.serviceAccountUser on the target GKE service account, and store pipeline Terraform state in a remote Cloud Storage bucket with versioning and object locking enabled.

Grant the primitive roles/owner role to the Cloud Deploy execution service account across target projects to streamline pipeline rendering and cluster deployment permissions.

Grant roles/iam.serviceAccountAdmin to the Cloud Deploy execution service account so it can manage runtime service account credentials and attach them to GKE workloads.

Grant roles/clouddeploy.jobRunner to the Cloud Deploy execution service account, but maintain the automated pipeline's Terraform state file in unversioned local directory storage on the build runner to maximize execution speed.

Show answer & explanation

Answer: Grant roles/clouddeploy.jobRunner and roles/container.developer to the Cloud Deploy execution service account, grant roles/iam.serviceAccountUser on the target GKE service account, and store pipeline Terraform state in a remote Cloud Storage bucket with versioning and object locking enabled.

Answer

The optimal configuration grants roles/clouddeploy.jobRunner and roles/container.developer to the Cloud Deploy execution service account, grants roles/iam.serviceAccountUser on the target GKE workload service account, and uses a remote Cloud Storage bucket with versioning and state locking for Terraform state management.

The solution properly configures minimal necessary permissions using fine-grained roles (`roles/clouddeploy.jobRunner`, `roles/container.developer`, and `roles/iam.serviceAccountUser`) while securing automated infrastructure changes via Cloud Storage remote backend versioning and object locking.

Step-by-Step Solution

Analyze IAM least privilege requirements for Google Cloud Deploy execution service accounts.

Identify that Cloud Deploy execution requires roles/clouddeploy.jobRunner for executing render/deploy jobs, roles/container.developer to deploy workloads to GKE, and roles/iam.serviceAccountUser to act as the GKE workload service account.

Fine-grained predefined roles ensure minimal access without exposing administrative control over service account definitions or project resources.

Evaluate Infrastructure as Code (IaC) state management requirements within CI/CD pipelines.

Determine that shared CI/CD pipelines deploying infrastructure changes alongside code releases must store Terraform state centrally.

Using Cloud Storage with object versioning and state locking prevents concurrent apply operations from corrupting infrastructure state.

Synthesize security and release pipeline integrity requirements to select the correct design.

Combine fine-grained Cloud Deploy/GKE IAM permissions with a secure remote Terraform GCS backend.

This guarantees both least-privilege security compliance and reliable pipeline execution for GKE canary releases.

Key Concept

Continuous Deployment Security & State Management

Question 549Question →

A biotechnology enterprise manages its Google Cloud infrastructure using a resource hierarchy where all production applications reside inside a folder named 'Production-Workloads'. The security governance board mandates that service account key creation must be blocked across all projects within this folder to reduce exposure to credential leaks. However, a legacy data ingestion project inside 'Production-Workloads' relies on service account keys and cannot be immediately refactored until a Workload Identity Federation migration completes. Which approach should the cloud architect implement to enforce this governance requirement with minimal operational complexity?

Grant primitive Owner roles at the 'Production-Workloads' folder level and configure IAM Deny rules on the legacy project to restrict service account key management capabilities.

Establish a VPC Service Controls perimeter around the 'Production-Workloads' folder and create an egress rule excluding the legacy data ingestion project from perimeter restrictions.

Apply the Organization Policy constraint 'constraints/iam.disableServiceAccountKeyCreation' at the 'Production-Workloads' folder level, and set an explicit policy override enforcing 'Off' at the legacy project level.

Assign the Service Account User role to developers at the folder level and revoke the Service Account Admin role from all service account identities within the legacy project.

Show answer & explanation

Answer: Apply the Organization Policy constraint 'constraints/iam.disableServiceAccountKeyCreation' at the 'Production-Workloads' folder level, and set an explicit policy override enforcing 'Off' at the legacy project level.

Answer

The correct approach leverages Google Cloud Organization Policies. Applying the boolean constraint 'constraints/iam.disableServiceAccountKeyCreation' at the 'Production-Workloads' folder level enforces key creation restrictions for all current and future child projects. Configuring an explicit project-level policy override with enforcement turned off allows the legacy project to remain exempted without compromising governance across the rest of the folder.

Step-by-Step Solution

Analyze the governance constraint requirements across the resource hierarchy.

Identified the need to restrict service account key creation across all projects in a specific folder while granting an exception to a single child project.

Organization Policies are designed to enforce central constraints on Google Cloud resources across the organization, folder, or project hierarchy.

Evaluate the inheritance mechanism of Google Cloud Organization Policies.

Determined that policies applied at a parent folder propagate to child projects unless an explicit policy override is configured at the project level.

Setting 'constraints/iam.disableServiceAccountKeyCreation' to Enforced at the folder level blocks key creation for all child projects by default.

Configure the project-level exception for the legacy workload.

Overriding the organization policy constraint on the legacy project setting enforcement to 'Off' restores key creation for that specific project only.

Explicit project-level organization policy configurations override inherited folder-level rules, fulfilling the temporary exception requirement with minimal effort.

Key Concept

Organization Policy Resource Hierarchy Inheritance and Localized Overrides

Estimated Time:2m 0s

Question 550Question →

A security architect is configuring an enterprise-wide audit logging solution in Google Cloud Platform to stream Cloud Audit Logs from an entire organization to an external SIEM system via Pub/Sub. In what sequence should these steps be executed to establish the log export pipeline successfully?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, create the target Pub/Sub topic in the central project; second, create the organization-level Cloud Logging sink pointing to the topic; third, grant the sink's unique writer service account the Pub/Sub Publisher role on the topic; and fourth, configure the SIEM to consume messages from the Pub/Sub subscription.

Establishing a Cloud Logging export pipeline requires creating the destination Pub/Sub topic first. Next, creating the organization-level log sink defines the filter rules and automatically creates a unique service account identity (writer identity). Third, this specific service account must be granted the Pub/Sub Publisher role on the topic to authorize writing. Finally, the downstream SIEM consumer connects to the subscription to pull the audit logs.

Step-by-Step Solution

Provision the destination Pub/Sub topic resource.

A target Pub/Sub topic is established to receive streamed log messages.

The destination endpoint must be created before a log sink can reference it as a valid destination.

Configure the aggregated Cloud Logging sink at the organization root.

An organization-level sink is created and Google Cloud automatically assigns a unique writer service account identity.

The log sink configuration establishes the audit log filter and generates the specific service account needed for publishing authorization.

Authorize the logging sink service account on the Pub/Sub topic.

The sink's writer service account gains Pub/Sub Publisher privileges on the destination topic.

Cloud Logging sinks do not have implicit write access to Pub/Sub topics across project boundaries without explicit IAM role grants.

Connect the downstream SIEM integration to the Pub/Sub subscription.

The SIEM begins ingesting real-time audit logs from Google Cloud.

Subscriber consumers can only ingest logs reliably once the underlying publisher pipeline and authorizations are fully configured.

Key Concept

Cloud Audit Logs Aggregated Export & Service Account Authorization Workflow

Question 551Question →

A gaming company is deploying a fleet of GPU-accelerated Compute Engine virtual machines in the us-central1 region using Terraform to host an upcoming real-time gaming event. Pre-deployment testing in a low-scale development environment completed successfully. However, when the automated CI/CD deployment pipeline executes the production Terraform apply job to provision 150 NVIDIA T4 GPUs, the deployment fails instantly before any virtual machines are instantiated. Which action should the Cloud Architect take to resolve this issue?

Submit a request to increase the regional NVIDIA T4 GPU quota in the us-central1 region before re-running the deployment pipeline.

Store the Terraform state file in an unversioned Cloud Storage bucket to eliminate concurrency conflicts during instance creation.

Grant the CI/CD pipeline service account the Service Account Admin role instead of the Service Account User role.

Migrate the workload to a Google Kubernetes Engine (GKE) cluster to automatically bypass regional Compute Engine GPU quota restrictions.

Show answer & explanation

Answer: Submit a request to increase the regional NVIDIA T4 GPU quota in the us-central1 region before re-running the deployment pipeline.

Answer

Submit a request to increase the regional NVIDIA T4 GPU quota in the us-central1 region before re-running the deployment pipeline.

Requesting a regional GPU quota increase in the target region resolves the immediate provisioning failure because Compute Engine GPU allocations are constrained by default project quota limits. Verifying and requesting required quota prior to large-scale infrastructure deployments prevents automated provisioning pipelines from failing.

Step-by-Step Solution

Identify the cause of immediate resource provisioning failure during large-scale GPU deployment.

GCP projects enforce default regional quota limits on specialized hardware resources like GPUs, causing API allocation calls to fail immediately if requested capacity exceeds project limits.

Quota limits prevent unexpected resource consumption and require explicit administrative requests before provisioning large compute workloads.

Evaluate the proposed resolution steps against GCP operational best practices.

Requesting a regional GPU quota increase via the Cloud Console or Service Usage API ensures sufficient allocation exists before launching the deployment.

Pre-requesting quota increases avoids pipeline failures and ensures infrastructure deployment completes cleanly.

Key Concept

Compute Engine Resource Quota Management

Question 552Question →

A global media streaming platform is designing the architecture for a new stateless image processing service on Google Cloud. The service processes incoming HTTP requests containing user uploaded images, converts them into multiple web formats, and returns the result. The workload experiences unpredictable traffic spikes ranging from thousands of requests per second during major events to long periods of complete inactivity overnight. To align with FinOps goals and minimize engineering maintenance, the platform team requires a serverless compute model that automatically scales down to zero instances when idle, charges only during request execution, and requires zero cluster administration or node maintenance. Which compute platform should you recommend?

Deploy the containerized service on Cloud Run with request-based autoscaling enabled.

Deploy the service on a Google Kubernetes Engine (GKE) Autopilot cluster using the Horizontal Pod Autoscaler.

Deploy the application across a Compute Engine Managed Instance Group (MIG) using custom VM images and CPU utilization autoscaling.

Deploy the application on Compute Engine Spot VMs with 3-year Committed Use Discounts (CUDs) to cover baseline processing capacity.

Show answer & explanation

Answer: Deploy the containerized service on Cloud Run with request-based autoscaling enabled.

Answer

Deploying the containerized service on Cloud Run with request-based autoscaling is the optimal platform choice because Cloud Run provides serverless container execution that automatically scales down to zero instances during idle periods, eliminates cluster management overhead, and bills strictly for active request processing time.

Deploying on Cloud Run fulfills all functional and operational requirements: it natively runs containerized stateless HTTP applications, automatically scales pods up during traffic spikes, scales down to zero during idle overnight hours, requires zero infrastructure or cluster maintenance, and charges strictly per millisecond of request execution.

Step-by-Step Solution

Analyze workload characteristics and technical requirements.

Identified stateless HTTP workload, containerized packaging, unpredictable traffic spikes, and requirement for scaling to zero.

Selecting the correct compute option requires evaluating statefulness, invocation triggers, and operational constraints.

Evaluate operational overhead and scaling capabilities of GCP compute services.

Cloud Run offers zero infrastructure administration and native scale-to-zero capabilities, matching the requirements exactly.

GKE and Compute Engine MIGs introduce cluster management, node patching, or baseline running costs that violate the zero-administration and zero-idle-cost constraints.

Verify cost efficiency alignment against FinOps requirements.

Cloud Run request-based billing ensures no charges accumulate overnight during periods of total inactivity.

Committed Use Discounts or fixed VM pools create unutilized infrastructure costs when traffic drops to zero.

Key Concept

Compute Platform Selection for Stateless Serverless Workloads

Estimated Time:2m 0s

Question 553Question →

An enterprise cloud governance architect must enforce baseline security constraints on a newly acquired subsidiary's folder structure within Google Cloud. The governance mandate requires restricting resource deployment exclusively to specified European regions and preventing default service accounts from automatically receiving the Editor primitive role upon API enablement. These policies must apply to all current and future projects under the subsidiary folder without affecting legacy projects outside this folder hierarchy. Which TWO Organization Policy constraints should the architect enforce at the subsidiary folder level to achieve these requirements? (Select TWO)

Select all that apply

Enforce the list constraint constraints/gcp.resourceLocations with an allowed values list containing only the approved European regions.

Enforce the boolean constraint constraints/iam.automaticIamGrantsForDefaultServiceAccounts on the target folder.

Construct a VPC Service Controls perimeter around the subsidiary folder resources and configure ingress rules to restrict compute deployment locations.

Grant the primitive roles/owner IAM role to security administrators at the organization node so they can manually revoke default service account roles.

Show answer & explanation

Answer: Enforce the list constraint constraints/gcp.resourceLocations with an allowed values list containing only the approved European regions.; Enforce the boolean constraint constraints/iam.automaticIamGrantsForDefaultServiceAccounts on the target folder.

Answer

The architect must enforce the list constraint constraints/gcp.resourceLocations with an allowed values list of approved regions, and enforce the boolean constraint constraints/iam.automaticIamGrantsForDefaultServiceAccounts at the subsidiary folder level.

Enforcing the constraints/gcp.resourceLocations list constraint limits physical resource creation to the defined European regions. Enforcing the constraints/iam.automaticIamGrantsForDefaultServiceAccounts boolean constraint prevents GCP from automatically binding the primitive Editor role to default service accounts upon API activation. Applying both policies at the folder level ensures hierarchical inheritance across all subsidiary child projects while isolating existing legacy workloads outside the folder.

Step-by-Step Solution

Identify the constraint required for geographic resource placement restrictions.

Selected constraints/gcp.resourceLocations list constraint.

Organization Policies support location restriction list constraints to limit where GCP resources can physically reside across a folder hierarchy.

Identify the constraint required to prevent default service accounts from receiving broad primitive permissions.

Selected constraints/iam.automaticIamGrantsForDefaultServiceAccounts boolean constraint.

By default, enabling certain GCP APIs grants default service accounts the primitive Editor role; enforcing this boolean constraint disables that automatic role grant.

Determine the resource hierarchy node for policy application.

Apply both policies at the subsidiary folder level.

Organization policies applied at a folder node inherit down to sub-folders and child projects, scoping governance strictly to the subsidiary without affecting external legacy workloads.

Key Concept

Resource hierarchy policy inheritance and Organization Policy constraints for location and IAM defaults.

Question 554Question →

An enterprise Cloud Architecture team is establishing an automated progressive release pipeline for a mission-critical microservice deployed to Google Kubernetes Engine (GKE). The release process must integrate Cloud Build, Artifact Registry, Cloud KMS, Binary Authorization, Google Cloud Deploy, and Cloud Monitoring to enforce zero-trust artifact security and automated metric-driven canary verification. Arrange the continuous deployment operational steps in the correct chronological execution sequence from artifact compilation to 100% production traffic cutover.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order is: 1) Cloud Build compiles the image, pushes to Artifact Registry, and creates a Binary Authorization attestation with Cloud KMS; 2) Cloud Build registers a Cloud Deploy release referencing the Skaffold configuration and attested image digest; 3) Cloud Deploy renders manifests to GKE, passing Binary Authorization admission control to establish initial 10% canary traffic; 4) Cloud Deploy verification jobs evaluate Cloud Monitoring SLIs to approve advancing traffic to 50%; 5) Cloud Deploy completes the rollout, directing 100% of live production traffic to the new release revision.

The automated deployment pipeline requires strict sequential dependency ordering: artifacts must be built and cryptographically signed in Cloud Build via Binary Authorization and Cloud KMS before a release can be registered in Cloud Deploy; manifest rendering and GKE admission control must validate signatures at pod creation before the initial canary phase receives traffic; real-time Cloud Monitoring metric verification must confirm health before Cloud Deploy advances traffic percentages; and finally, complete cutover (100% traffic) occurs after all canary gates pass.

Step-by-Step Solution

Compile container image and produce cryptographic attestation

Attestation signature is verified and linked to the image digest stored in Artifact Registry.

Security governance requires binary provenance and attestation prior to release registration.

Instantiate Cloud Deploy release object

Cloud Deploy registers the release metadata and initiates pipeline rendering.

Cloud Deploy manages progressive delivery targets based on declared Skaffold rendering contexts.

Deploy baseline canary workload to GKE

GKE Binary Authorization admission controller validates attestation and permits pod creation with 10% traffic.

Cluster admission enforcement prevents unverified images from executing while exposing a limited canary population.

Perform automated metric-driven canary verification

Cloud Monitoring telemetric health indicators validate SLO compliance, authorizing phase traffic promotion.

Progressive delivery relies on empirical observability data to advance traffic allocation safely.

Complete production rollout

100% of live production traffic is directed to the fully verified release target.

Successful completion of all verification gates concludes the automated delivery lifecycle.

Key Concept

Continuous Deployment Pipeline Execution and Progressive Delivery Sequence with Cloud Deploy and Binary Authorization

Estimated Time:3m 0s

Question 555Question →

An energy utility corporation is setting up a secure telemetry processing platform on Google Cloud. The architecture requires a private Google Kubernetes Engine (GKE) cluster for microservices and a Managed Instance Group (MIG) of Compute Engine VMs for legacy batch processing. The operations team will administer the private GKE cluster control plane remotely from an on-premises administrative subnet ( $10.150.0.0/24$ ) over Cloud Interconnect. Automated deployment pipelines using a dedicated service account will provision both the compute infrastructure and workloads. Which TWO configuration steps are required to ensure secure provisioning and access according to Google recommended practices?

Select all that apply

Enable Control Plane Authorized Networks on the GKE cluster and include the on-premises subnet CIDR block (

10.150.0.0/24

Grant the deployment pipeline service account the Service Account User role (`roles/iam.serviceAccountUser`) on the runtime service accounts assigned to the compute instances.

Grant the deployment pipeline service account the Service Account Admin role (`roles/iam.serviceAccountAdmin`) at the project level.

Leave Control Plane Authorized Networks disabled to allow default internal VPC routing for master management without IP filtering.

Store the deployment Terraform state file in a local git repository attached to the deployment runner instance without object versioning.

Show answer & explanation

Answer: Enable Control Plane Authorized Networks on the GKE cluster and include the on-premises subnet CIDR block ( $10.150.0.0/24$ ).; Grant the deployment pipeline service account the Service Account User role (`roles/iam.serviceAccountUser`) on the runtime service accounts assigned to the compute instances.

Answer

Enable Control Plane Authorized Networks specifying the on-premises CIDR block (

10.150.0.0/24

), and grant the deployment pipeline service account the Service Account User role (`roles/iam.serviceAccountUser`) on the runtime service accounts.

To securely provision and manage the infrastructure, the private GKE control plane endpoint must restrict administrative access to known management networks via Control Plane Authorized Networks. Additionally, automated pipelines deploying VMs or Kubernetes node pools attached to custom runtime service accounts require the `roles/iam.serviceAccountUser` role to bind those identities without granting full administrative ownership over the service accounts.

Step-by-Step Solution

Configure control plane security for the private GKE cluster

Authorized network entry added for

10.150.0.0/24

Private GKE control plane endpoints require explicit authorized IP ranges to restrict HTTPS access to designated management subnets.

Configure IAM roles for compute resource provisioning

Pipeline service account is granted `roles/iam.serviceAccountUser`

When automated tools launch compute instances or node pools bound to a specific runtime service account, the executing identity must have permission to attach (use) that service account.

Key Concept

GKE Private Cluster Control Plane Protection and IAM Service Account User Delegation

Question 556Question →

An enterprise security architect must establish organization-wide Data Access audit logging for sensitive Cloud Storage resources, store the logs in an immutable archive encrypted with customer-managed keys, and enable Security Command Center (SCC) detection for storage bucket misconfigurations. Arrange the configuration steps in the correct chronological sequence to implement this operational pipeline.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins by enabling Data Access Audit Logs at the organization level, followed by provisioning the destination CMEK-encrypted Cloud Storage bucket with Bucket Lock. Next, the organization-level aggregated log sink is created to obtain its unique writer service account identity. Then, that service account identity is granted the Storage Object Creator role on the destination storage bucket. Finally, Security Command Center Security Health Analytics modules are enabled to provide posture monitoring.

Building an enterprise security logging and monitoring pipeline requires respecting GCP resource dependencies. First, audit log generation must be enabled in IAM audit configuration. Second, the storage target with CMEK and Bucket Lock must be created. Third, the organization-level aggregated sink must be created, which generates a unique writer identity service account. Fourth, this writer identity must be granted Storage Object Creator permissions on the destination bucket. Finally, Security Command Center Security Health Analytics modules are enabled for ongoing posture monitoring.

Step-by-Step Solution

Enable Cloud Storage Data Access Audit Logs in the Organization IAM Audit Config.

Cloud Storage begins generating DATA_READ, DATA_WRITE, and ADMIN_READ log entries across all organizational resources.

Log generation must be configured before telemetry can be captured by logging sinks.

Create the destination Cloud Storage bucket with CMEK encryption and a locked retention policy.

A secure, immutable log storage target is available.

The destination bucket must exist prior to sink creation so that the sink path can be validated.

Create an organization aggregated log sink targeting the centralized storage bucket.

The log sink is established and outputs a unique writer identity service account.

Aggregated sinks automatically generate a service account that requires explicit destination IAM permissions.

Assign the Storage Object Creator role to the sink's writer service account on the destination bucket.

The aggregated sink receives write authorization to write log archives into the storage bucket.

Without explicit IAM permission grants on the destination resource, log ingestion into the bucket will fail.

Configure Security Command Center Security Health Analytics to monitor bucket security posture.

Automated posture scanning flags misconfigured or publicly accessible storage buckets.

Completes the security logging and vulnerability detection framework across the Google Cloud organization.

Key Concept

GCP Organization-level aggregated log sink ordering dependencies and security posture auditing

Estimated Time:2m 30s

Question 557Question →

An organization needs to configure real-time exporting of Google Cloud Security Command Center (SCC) Premium threat findings to an external SIEM solution operating on-premises. Arrange the steps in the correct operational sequence to implement this security log export architecture.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Enable Security Command Center Premium at the organization level. 2) Create a Pub/Sub topic and subscription in a dedicated project. 3) Configure a continuous export rule in Security Command Center targeting the Pub/Sub topic. 4) Deploy a forwarder service to pull messages from Pub/Sub and stream them to the on-premises SIEM.

The sequence follows standard Cloud Architecture dependencies: first enable the finding source (SCC Premium), then establish the transport messaging buffer (Pub/Sub topic), configure the publishing source to stream to that buffer (SCC Continuous Export), and finally implement the consumer process that delivers findings to the external SIEM.

Step-by-Step Solution

Activate Security Command Center Premium.

Threat detection capabilities like Event Threat Detection begin generating organization-level finding events.

Findings cannot be exported until the underlying security detection tier is active and generating events.

Provision the destination Pub/Sub messaging pipeline.

A Pub/Sub topic and subscription are available to ingest streamed findings securely.

Export targets must exist before configuring export rules in GCP.

Establish the SCC Continuous Export feed.

SCC findings stream automatically into Pub/Sub in real time as they are generated.

Continuous export connects SCC event creation directly to the Pub/Sub endpoint.

Connect the on-premises SIEM via a Pub/Sub pull subscriber.

Findings are securely delivered from Google Cloud into the external SIEM pipeline.

An active subscriber service is required to consume messages queued in Pub/Sub and ingest them into external systems.

Key Concept

Security Command Center Continuous Export to Pub/Sub and External SIEM Integration

Question 558Question →

An organization wants to grant a central network administration team permissions to create and manage Virtual Private Cloud (VPC) networks across all Google Cloud projects within a specific department folder. Which IAM role assignment strategy follows Google Cloud best practices for resource hierarchy and least privilege?

Grant the predefined Compute Network Admin role to the network administration group at the department folder level.

Grant the primitive Editor role to the network administration group at the department folder level.

Grant the Service Account Admin role to each individual member of the network administration group on every project.

Grant the Compute Network Admin role to each user account individually on every project within the department folder.

Show answer & explanation

Answer: Grant the predefined Compute Network Admin role to the network administration group at the department folder level.

Answer

Grant the predefined Compute Network Admin role to the network administration group at the department folder level.

Granting the predefined Compute Network Admin role at the folder level leverages resource hierarchy policy inheritance, automatically granting necessary network management permissions across all child projects while adhering strictly to the principle of least privilege.

Step-by-Step Solution

Identify the required scope of permissions across the resource hierarchy.

Permissions must apply to all existing and future projects under the department folder.

IAM roles applied at a parent folder level are automatically inherited by all child resources.

Select the appropriate IAM role using least privilege guidelines.

The predefined Compute Network Admin role provides exact network management capabilities.

Predefined roles limit access specifically to required service resources without granting excessive control over unrelated services.

Key Concept

Resource Hierarchy IAM Role Inheritance and Least Privilege

Estimated Time:1m 0s

Question 559Question →

An enterprise digital publishing company is modernizing its legacy content delivery architecture on Google Cloud. The solution requires hosting two distinct workloads:
1. A stateless REST API microservice that receives variable public HTTP traffic and must scale to zero during off-peak hours while minimizing operational infrastructure management.
2. A batch processing engine for raw media encoding that requires low-level Linux kernel sysctl parameters and custom OS kernel modules.

Which TWO compute platform choices should the Cloud Architect recommend to fulfill these requirements while optimizing operational efficiency and adherence to Google Cloud best practices? (Select TWO.)

Select all that apply

Deploy the stateless REST API microservice to Cloud Run to achieve containerized execution with scale-to-zero capability and zero server management overhead.

Deploy the batch processing engine to Compute Engine Virtual Machines using custom images configured with the required OS kernel modules and sysctl settings.

Deploy the stateless REST API microservice to a multi-zone standard Google Kubernetes Engine (GKE) cluster to handle autoscaling and HTTP traffic routing.

Deploy the batch processing engine to Cloud Run by mounting the host kernel driver directory into the container environment.

Deploy both the REST API and the batch processing engine to App Engine Standard environment to unify serverless deployment.

Show answer & explanation

Answer: Deploy the stateless REST API microservice to Cloud Run to achieve containerized execution with scale-to-zero capability and zero server management overhead.; Deploy the batch processing engine to Compute Engine Virtual Machines using custom images configured with the required OS kernel modules and sysctl settings.

Answer

The Cloud Architect should recommend deploying the stateless REST API microservice to Cloud Run and deploying the batch processing engine to Compute Engine Virtual Machines.

Selecting Cloud Run for the stateless REST API microservice satisfies the requirement for automatic scale-to-zero capability with minimal operational management. Selecting Compute Engine Virtual Machines for the media processing engine provides full administrative access to install custom kernel modules and configure sysctl parameters that managed serverless runtimes do not support.

Step-by-Step Solution

Analyze the requirements of the stateless REST API microservice

Identified requirements: stateless HTTP traffic, variable load, scaling to zero, minimal operational overhead.

Cloud Run is Google Cloud's fully managed serverless container platform designed specifically for stateless HTTP workloads, satisfying all operational and scaling requirements.

Analyze the requirements of the batch media encoding engine

Identified requirements: low-level Linux kernel sysctl modifications and custom kernel modules.

Managed serverless container runtimes (such as Cloud Run or App Engine Standard) run sandboxed environments and prohibit host kernel modifications. Compute Engine provides complete OS administrative access required for custom kernel modules.

Evaluate alternative options for compute misallocations

GKE introduces cluster management overhead for simple stateless APIs, while Cloud Run/App Engine Standard cannot support custom host OS kernel modifications.

Matching each workload to its ideal GCP compute platform balances operational simplicity with OS-level flexibility.

Key Concept

Compute Platform Selection Strategy (Cloud Run vs. Compute Engine vs. GKE)

Question 560Question →

A financial enterprise is expanding its cloud presence by establishing private, low-latency network connectivity between its on-premises data center and resources deployed across two Google Cloud regions (`us-east4` and `europe-west3`) within a single Custom Mode Virtual Private Cloud (VPC) network. The on-premises connection requires a guaranteed bandwidth of 10 Gbps, and resources in both regions must dynamically exchange routes with on-premises routers without creating separate regional peering loops. Which TWO architectural actions should be implemented to fulfill these requirements?

Select all that apply

Configure the VPC network dynamic routing mode to Global so Cloud Routers can advertise and receive dynamic routes across all regions.

Provision Dedicated Interconnect circuits between the on-premises facility and Google Cloud colocation facilities.

Deploy an HA VPN gateway with multiple IPsec tunnels over the public internet to deliver the required 10 Gbps bandwidth and latency SLA.

Establish VPC Network Peering between regional subnets and rely on transit routing through a central spoke to connect regions to on-premises.

Deploy GKE clusters in private mode without setting control plane authorized networks, relying entirely on default firewall rules to block public master endpoints.

Show answer & explanation

Answer: Configure the VPC network dynamic routing mode to Global so Cloud Routers can advertise and receive dynamic routes across all regions.; Provision Dedicated Interconnect circuits between the on-premises facility and Google Cloud colocation facilities.

Answer

To meet high-bandwidth requirements and multi-region dynamic routing, configure Global Dynamic Routing on the VPC network and provision Dedicated Interconnect circuits.

Configuring Global Dynamic Routing on the VPC allows BGP dynamic routes learned by a Cloud Router in one region to be distributed to resources in all other regions automatically. Pairing this with Dedicated Interconnect satisfies the strict 10 Gbps bandwidth and low-latency SLA requirements for hybrid connectivity.

Step-by-Step Solution

Determine the physical connectivity option for high throughput (10 Gbps).

Dedicated Interconnect is required because HA VPN tunnels over the public internet cannot guarantee 10 Gbps sustained throughput or strict latency SLAs.

Dedicated Interconnect provides dedicated 10 Gbps or 100 Gbps ports directly connected to Google's edge network.

Select the appropriate routing mode for multi-region inter-VPC dynamic route exchange.

Set VPC Dynamic Routing to Global mode.

Regional dynamic routing mode limits Cloud Router dynamic route advertising and learning to the local region. Global dynamic routing allows Cloud Routers in `us-east4` and `europe-west3` to advertise and learn routes across all regions.

Key Concept

Global Dynamic Routing and Dedicated Interconnect Configuration

PreviousPage 28 / 80Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept