Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 41Question →

An enterprise financial network requires connecting an on-premises data center to a Google Cloud Virtual Private Cloud (VPC). The solution must meet a 99.99% availability SLA, provide mandatory end-to-end IPsec data encryption, and support dynamic route propagation. Which TWO architectural configurations must be implemented together to satisfy all requirements?

Select all that apply

Show answer & explanation

Answer: Deploy HA VPN over Cloud Interconnect using private IP addressing to satisfy both the 99.99% SLA and IPsec encryption constraints.; Configure Cloud Routers with dynamic BGP peering on both ends of the connection to manage automated route exchange and failover.

Answer

To achieve a 99.99% SLA with mandatory IPsec encryption and dynamic routing, the architecture must deploy HA VPN over Cloud Interconnect (Private IP HA VPN) alongside Cloud Routers configured for BGP dynamic routing.
Combining HA VPN over Cloud Interconnect (Private IP HA VPN) fulfills both the 99.99% availability SLA requirement of Cloud Interconnect and the mandatory IPsec encryption requirement. Pair this with Cloud Routers running dynamic BGP to ensure continuous route exchange and high-availability automated failover.

Step-by-Step Solution

1
Evaluate SLA and encryption requirements for hybrid connectivity.
Standard Cloud Interconnect provides a 99.99% SLA but does not natively encrypt traffic; standard HA VPN provides IPsec encryption but has a lower SLA. Combining HA VPN over Private IP Cloud Interconnect satisfies both constraints.
Private IP HA VPN allows IPsec tunnels to be established over Cloud Interconnect attachments, inheriting the 99.99% SLA while maintaining mandatory data encryption.
2
Configure dynamic routing components.
Cloud Routers are deployed to manage BGP sessions across the hybrid connection.
Dynamic BGP routing via Cloud Router enables automatic route propagation and failover necessary for SLA-backed high availability.

Key Concept

Configuring HA VPN over Cloud Interconnect with Cloud Router BGP for 99.99% SLA and encrypted transit
Question 42Question →

A global financial organization is deploying a multi-tier enterprise application on Google Cloud under strict zero-trust boundary requirements. As the principal cloud architect, match each enterprise architectural security constraint to the corresponding GCP network perimeter control mechanism that fulfills the requirement.

Click a left item, then click its matching right item

Items

Prevent unauthorized API-level exfiltration of sensitive BigQuery datasets, even if identity credentials within an authorized VPC subnet are fully compromised.
Mitigate volumetric application-layer (Layer 7) DDoS attacks and SQL injection attempts at the edge before traffic hits backend services.
Enforce organization-wide restriction of inbound SSH access to private compute instances based on workload identity context rather than IP subnet ranges.
Enable on-premises applications to securely invoke Google Cloud APIs over Dedicated Interconnect while blocking all outbound traffic to non-approved Google Cloud services.

Matches

Show answer & explanation

Answer

Each architectural security constraint maps to its precise GCP perimeter mechanism: BigQuery exfiltration prevention requires VPC Service Controls with restricted VIP routing; Layer 7 DDoS and SQLi mitigation requires Cloud Armor enterprise security policies at the edge; organization-wide identity-based firewall rules require Hierarchical Firewall Policies with Secure Tags; private on-premises API access restricting unapproved services requires Private Service Connect targeting restricted Google APIs over Interconnect.
The correct pairings accurately align each Google Cloud perimeter defense tool with its explicit architectural security boundary. VPC Service Controls isolate API-level communication for data exfiltration defense; Cloud Armor provides edge WAF and DDoS filtering for public endpoints; Hierarchical Firewall Policies with Secure Tags establish non-bypassable centralized access controls across instance identities; and Private Service Connect with the restricted VIP secures hybrid enterprise access exclusively to compliant Google APIs.

Step-by-Step Solution

1
Analyze the data exfiltration constraint for BigQuery under credential compromise.
Identify that IAM alone cannot prevent exfiltration if credentials are stolen; VPC Service Controls perimeter boundaries are mandatory to block unauthorized data movements across API boundaries.
VPC Service Controls mitigate risk from compromised credentials by validating the perimeter boundary regardless of identity permissions.
2
Evaluate perimeter edge protection against Layer 7 attacks.
Match SQL injection and HTTP DDoS protection to Google Cloud Armor attached to Global External Load Balancing.
Cloud Armor inspects HTTP(S) traffic at the Google network edge, preventing malicious payloads from reaching backend instances.
3
Determine organization-wide network policy enforcement based on workload context.
Select Hierarchical Firewall Policies coupled with Secure Tags.
Hierarchical policies enforce consistent rules down the resource tree, and Secure Tags allow dynamic context matching independent of IP address ranges.
4
Formulate private hybrid connectivity to Google APIs with service restriction.
Combine Private Service Connect (PSC) targeting restricted Google APIs (`restricted.googleapis.com`) with Cloud Interconnect BGP advertising.
The restricted VIP endpoint blocks access to non-VPC-SC supported services, preventing exfiltration to unapproved public GCP endpoints.

Key Concept

Perimeter Security Architecture and Defense-in-Depth on GCP
Question 43Question →

An enterprise security team requires security analysts to inspect Security Command Center (SCC) threat findings and view centralized Data Access audit logs in Cloud Logging across an entire Google Cloud organization. The analysts must not be permitted to read underlying customer data stored in Cloud Storage buckets or alter security configuration policies. Furthermore, the architecture must establish boundaries to prevent authorized analysts from copying log data to external Google Cloud projects outside the organization's administrative domain. Which architectural approach satisfies these security and compliance requirements?

Show answer & explanation

Answer: Grant security analysts the Security Center Finder and Logs Viewer predefined roles at the organization level, and enforce VPC Service Controls perimeters around the resources containing audit logs.

Answer

Grant security analysts the predefined roles Security Center Finder and Logs Viewer at the organization level, while establishing VPC Service Controls perimeter boundaries around log storage resources to restrict data movement.
Combining fine-grained predefined roles (Security Center Finder and Logs Viewer) ensures least-privilege access by permitting threat finding inspection and log auditing while restricting access to underlying Cloud Storage object content and security configurations. Coupling these roles with VPC Service Controls creates a security perimeter that prevents authorized users from transferring log data to resources in external, unapproved Google Cloud projects.

Step-by-Step Solution

1
Identify least-privilege IAM roles for viewing Security Command Center findings and audit logs without granting content access or policy modification rights.
Selected Security Center Finder (roles/securitycenter.finder) for viewing findings and Logs Viewer (roles/logging.viewer) for auditing logs.
Predefined roles restrict permissions to necessary read-only operational telemetry without granting data payload access in Cloud Storage.
2
Evaluate data exfiltration protection requirements for authorized identities.
Determined that IAM policies alone do not block authorized users from exfiltrating data to external Google Cloud projects.
VPC Service Controls perimeters define network-level security boundaries that prevent copying or transferring data outside designated organization projects.

Key Concept

Combining Least-Privilege IAM Roles with VPC Service Controls for Log Security
Question 44Question →

An energy utility enterprise needs to securely connect its on-premises operational center to a Google Cloud Virtual Private Cloud (VPC) to stream telemetry data from regional substations. The network connection must support a peak throughput of 800 Mbps, guarantee a 99.99% service availability SLA, enforce mandatory IPsec encryption in transit for regulatory compliance, and be fully provisioned within two days. Which hybrid connectivity solution should you implement?

Show answer & explanation

Answer: Deploy a High Availability (HA) Cloud VPN gateway with dual active-active IPsec tunnels connected to Cloud Router for dynamic BGP routing.

Answer

Deploying an HA Cloud VPN gateway with active-active IPsec tunnels and Cloud Router dynamic BGP routing satisfies the 99.99% SLA, 800 Mbps bandwidth requirement, IPsec encryption mandate, and rapid deployment timeline.
Deploying HA Cloud VPN with dual active-active IPsec tunnels paired with Cloud Router meets all specified enterprise requirements: HA Cloud VPN guarantees a 99.99% availability SLA, natively provides IPsec encryption in transit, easily handles the 800 Mbps throughput requirement (up to 3 Gbps per tunnel), and can be configured immediately without physical infrastructure lead time.

Step-by-Step Solution

1
Analyze bandwidth and deployment timeline requirements
Peak bandwidth is 800 Mbps, which falls well within the capacity of Cloud VPN (up to 3 Gbps per tunnel) and does not necessitate Dedicated or Partner Interconnect (>10 Gbps / long lead times).
Choosing Interconnect for sub-Gbps workloads incurs unnecessary cost and long physical circuit provisioning times.
2
Evaluate availability and encryption mandates
HA Cloud VPN provides a 99.99% availability SLA when configured with dual active-active tunnels across distinct zones and enforces IPsec encryption natively.
Standard Interconnect attachments do not encrypt traffic in transit natively without secondary VPN layers.
3
Select the optimal hybrid connectivity option
HA Cloud VPN with Cloud Router dynamic routing is the solution that meets SLA, bandwidth, encryption, and rapid deployment requirements.
It fulfills all enterprise constraints without unnecessary physical operational overhead.

Key Concept

Configuring HA Cloud VPN for high-availability, encrypted sub-Gbps hybrid connectivity
Question 45Question →

An enterprise organization is establishing a secure continuous integration and continuous delivery (CI/CD) pipeline on Google Cloud to deploy containerized applications to Google Kubernetes Engine (GKE) under strict Binary Authorization compliance policies. Arrange the operational pipeline stages in the correct chronological order from the initial developer code check-in to successful pod scheduling in the cluster.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for a secure GKE CI/CD pipeline starts with the developer code commit triggering Cloud Build, followed by image creation and unit testing, uploading the image to Artifact Registry for automated Container Analysis vulnerability scanning, cryptographically signing the image via Cloud KMS to create a Binary Authorization attestation, and finally evaluating the attestation at the GKE admission controller during pod deployment.
A secure GCP continuous deployment pipeline enforces supply chain security in a strict linear sequence: Source Code Repository Trigger -> Automated Compilation & Unit Testing -> Artifact Storage & Vulnerability Scanning -> Policy Attestation Signature via Cloud KMS -> Runtime Enforcement at GKE Admission.

Step-by-Step Solution

1
Identify the pipeline trigger stage
Developer pushes code to version control, which invokes the Cloud Build webhook trigger.
CI/CD execution begins with source revision control events.
2
Identify artifact construction and local verification
Cloud Build compiles, unit tests, and packages application binaries into a container image.
Code must pass local quality gates prior to repository registration.
3
Identify vulnerability evaluation stage
The container image is pushed to Artifact Registry, triggering Container Analysis scanning.
Artifact Registry integration is necessary for automated vulnerability and metadata extraction.
4
Identify attestation creation stage
Upon successful scan results, Cloud Build requests Cloud KMS signing to generate a Binary Authorization attestation.
Attestations certify that compliance and security standard checks passed.
5
Identify final runtime deployment admission
GKE Binary Authorization admission controller verifies the attestation signature before allowing pod scheduling.
Binary Authorization enforces trust policies at runtime deploy time in the Kubernetes API server.

Key Concept

End-to-End Secure Software Supply Chain Integration with Cloud Build, Artifact Registry, Container Analysis, and Binary Authorization
Question 46Question →

A mid-sized retail enterprise plans to migrate its core inventory management system to Google Cloud. During executive alignment meetings, business stakeholders express concern over potential operational disruption, while the IT operations team reports anxiety regarding their lack of cloud experience. Which TWO strategies should the Lead Cloud Architect recommend to address stakeholder requirements and manage organizational change effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Establish a structured training and technical enablement program for operations staff alongside pilot project migrations.; Conduct stakeholder workshops to define Service Level Objectives (SLOs) aligned with business availability requirements prior to migration.

Answer

The Lead Cloud Architect should recommend establishing a structured training program alongside pilot migrations and conducting stakeholder workshops to define business-aligned Service Level Objectives (SLOs).
Managing organizational change requires addressing human readiness through structured enablement programs during pilot phases. Simultaneously, analyzing stakeholder requirements mandates defining clear, business-aligned SLOs to ensure operational expectations are met without disrupting business continuity.

Step-by-Step Solution

1
Evaluate organizational change management and team readiness requirements.
Identified that hands-on training coupled with pilot migrations reduces team anxiety and builds cloud operational skills.
Technical enablement directly addresses the IT team's skill gaps and resistance to change.
2
Assess business stakeholder alignment on system reliability and performance.
Determined that collaborative SLO definition aligns business expectations with cloud technical architecture.
Stakeholders require clear agreement on availability targets to mitigate concerns about migration disruption.
3
Eliminate inappropriate anti-patterns such as primitive IAM role assignment and reliance on IAM alone for data exfiltration prevention.
Rejected options that breach security best practices or fail to provide proper security perimeters.
Least privilege and VPC Service Controls are mandatory GCP architectural principles.

Key Concept

Organizational Change Management and Stakeholder Requirement Alignment
Question 47Question →

An enterprise software organization is establishing centralized security guardrails across its Google Cloud resource hierarchy. The cloud security architect must enforce two specific governance mandates across all projects within a target folder:

1. Prevent developers from generating exportable service account keys to mitigate credential leakage risks.
2. Restrict the deployment of all Google Cloud location-based resources exclusively to the `us-central1` and `us-east1` regions.

Which TWO Organization Policy constraints should be configured at the target folder level to satisfy these mandates?

Select all that apply

Show answer & explanation

Answer: Enforce the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` by setting its policy state to Enforced.; Configure the list constraint `constraints/gcp.resourceLocations` with an allowed list containing `in:us-central1-locations` and `in:us-east1-locations`.

Answer

The correct configurations are enforcing the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` and setting the list constraint `constraints/gcp.resourceLocations` to allow `in:us-central1-locations` and `in:us-east1-locations`.
The correct configuration combines enforcing `constraints/iam.disableServiceAccountKeyCreation` to disable service account key creation and configuring `constraints/gcp.resourceLocations` to restrict GCP resource deployment to specified regions (`us-central1` and `us-east1`).

Step-by-Step Solution

1
Identify the constraint type for service account key prevention.
The constraint `constraints/iam.disableServiceAccountKeyCreation` is a boolean Organization Policy constraint that prevents creation of service account keys when set to Enforced.
Organization Policies provide centralized governance guardrails across the resource hierarchy that IAM permissions alone cannot enforce.
2
Identify the constraint type for geographic location restrictions.
The constraint `constraints/gcp.resourceLocations` is a list constraint that limits where location-based GCP resources can be provisioned.
Specifying value groups such as `in:us-central1-locations` ensures data sovereignty and regional resource compliance across child projects.

Key Concept

Organization Policies and Constraints
Estimated Time:1m 30s
Question 48Question →

An enterprise logistics company is designing a new HTTP microservice to process real-time package status updates submitted by driver mobile applications. The workload is completely stateless, packaged as a standard container image, and experiences extreme traffic variability ranging from zero requests overnight to tens of thousands of requests per second during peak hours. The lead architect wants to minimize operational management overhead and eliminate baseline infrastructure costs when no requests are being processed. Which Google Cloud compute platform should be selected for this workload?

Show answer & explanation

Answer: Deploy the container container image to Cloud Run.

Answer

Deploying the container image to Cloud Run is the optimal architectural choice because it provides fully managed serverless execution for stateless HTTP workloads, scales automatically from zero to match request volume spikes, and incurs no compute costs during idle periods.
Cloud Run is specifically designed for containerized, stateless HTTP services that require fast automatic scaling. It manages all underlying infrastructure, handles request-based autoscaling dynamically from zero to thousands of instances, and charges only for compute resources consumed while processing requests.

Step-by-Step Solution

1
Analyze workload characteristics
Workload is stateless, packaged as an OCI container, uses HTTP protocol, requires zero operational management, and experiences rapid scaling requirements including scaling to zero.
Matching workload technical constraints against Google Cloud compute capabilities narrows suitable platforms.
2
Evaluate candidate compute platforms against operational and cost constraints
Cloud Run natively supports stateless HTTP container scaling to zero without server management. GKE and Compute Engine MIGs maintain baseline operational overhead and infrastructure costs.
Minimizing cost during idle hours requires true serverless pay-per-use request scaling.
3
Select the optimal platform according to GCP best practices
Cloud Run is selected as the recommended application platform.
It fulfills all requirements for statelessness, HTTP container execution, zero management overhead, and scale-to-zero pricing.

Key Concept

Compute Platform Selection for Stateless Serverless Workloads
Estimated Time:1m 30s
Question 49Question →

A retail enterprise organizes its Google Cloud infrastructure using an Organization node containing top-level folders named Staging and Production. The central Security Operations team requires read-only security visibility across all projects in the Production folder. Additionally, an automated deployment service account must create Compute Engine instances within a specific Production project and attach a pre-configured workload service account to those instances. Which TWO actions should a Cloud Architect recommend to fulfill these security requirements while enforcing least privilege and leveraging resource hierarchy inheritance?

Select all that apply

Show answer & explanation

Answer: Grant the Security Reviewer role (roles/iam.securityReviewer) to the Security Operations group at the Production folder level.; Grant the deployment service account the Compute Instance Admin (v1) role on the project and the Service Account User role (roles/iam.serviceAccountUser) on the specific workload service account.

Answer

Granting the Security Reviewer role to the Security Operations group at the Production folder level leverages resource hierarchy inheritance for broad read-only security visibility. Granting the deployment service account Compute Instance Admin on the project and Service Account User on the specific workload service account ensures instance creation and service account attachment adhere strictly to least privilege.
Inheritance down the resource hierarchy ensures that binding the Security Reviewer role at the Production folder level grants security visibility across all child projects. To attach a pre-configured service account to a Compute Engine instance, the deploying identity needs compute creation privileges on the project and the Service Account User role on the specific service account resource being attached.

Step-by-Step Solution

1
Analyze read-only security visibility requirements across the Production folder hierarchy.
Assigning predefined Security Reviewer role at the Production folder level allows all child projects to inherit read-only security monitoring access automatically.
Resource hierarchy inheritance propagates IAM policy bindings down to child nodes, eliminating operational overhead while avoiding primitive role over-granting.
2
Analyze instance provisioning and service account attachment privileges for the deployment service account.
Grant Compute Instance Admin (v1) on the project and Service Account User on the specific target service account.
Attaching a service account to a compute resource requires roles/iam.serviceAccountUser on the target service account resource, not Service Account Admin.

Key Concept

Resource hierarchy IAM permission inheritance and least-privilege role scoping for compute workloads and service accounts
Question 50Question →

A global healthcare enterprise is implementing a multi-tenant Google Cloud architecture across multiple organization folders. Central security governance requires that all Compute Engine instances bound to sensitive workloads with the tag key-value pair environment=restricted are subjected to mandatory security rules that cannot be overridden or modified by local project administrators. Furthermore, these workloads must access Google Cloud APIs (such as BigQuery) without allowing authorized users or compromised instances to exfiltrate data to unauthorized GCP projects or external buckets. Which architectural approach satisfies these security and perimeter requirements while preventing administrative overrides?

Show answer & explanation

Answer: Define central Hierarchical Firewall Policies at the folder level configured with Secure Tags, and construct a VPC Service Controls perimeter around the restricted project with explicit Egress Rules authorizing restricted API destinations.

Answer

The optimal solution is to define central Hierarchical Firewall Policies at the folder level enforced via Secure Tags, combined with a VPC Service Controls perimeter configured with explicit Egress Rules.
Hierarchical Firewall Policies enforce non-overridable security constraints from the folder level using Secure Tags, while VPC Service Controls isolate Google Cloud APIs inside a security perimeter to prevent data exfiltration.

Step-by-Step Solution

1
Evaluate enforcement mechanism against administrative override.
Hierarchical Firewall Policies applied at the folder or organization level are evaluated before project-level VPC firewall rules and cannot be bypassed or modified by project-level IAM users.
Centralized governance requires immutable rule hierarchy across multi-tenant folders.
2
Select targeting mechanism for compute instances.
Secure Tags provide cryptographically secure, IAM-governed resource tagging linked directly to Resource Manager, avoiding the spoofing risks of legacy network tags.
Network tags can be altered by users with instance modification rights, whereas Secure Tags require specific IAM tag binding roles.
3
Address data exfiltration prevention requirement.
VPC Service Controls form a security perimeter around GCP services (like BigQuery), isolating network communication and blocking unauthorized data egress even from valid IAM identities.
IAM controls WHO can access resources, but VPC Service Controls govern FROM WHERE and TO WHERE data can flow.

Key Concept

Hierarchical Firewall Policies & VPC Service Controls Perimeter Security
Estimated Time:3m 0s
Question 51Question →

An enterprise architecture team is conducting an SDLC audit of a multi-project CI/CD deployment pipeline using Cloud Build and Terraform to provision infrastructure across target Google Cloud projects. The audit reveals two critical security and governance findings: the build pipeline uses the default Cloud Build service account with primitive Owner permissions across target projects, and build steps maintain Terraform state within ephemeral Cloud Build workspace storage committed back to git repositories. Additionally, developers require administrative rights over service accounts to run build triggers. Which set of refactoring steps should the architecture team recommend to remediate these pipeline vulnerabilities while adhering to Google Cloud best practices?

Show answer & explanation

Answer: Create a user-managed service account for Cloud Build configured with fine-grained predefined roles on target projects, configure a Cloud Storage remote backend with object versioning and state locking for Terraform, and grant developers the Service Account User role on the build service account.

Answer

The correct architecture solution requires creating a user-managed service account for Cloud Build configured with minimal predefined roles, migrating Terraform state to a remote Cloud Storage backend with object versioning and state locking, and granting developers the Service Account User role.
The correct recommendation enforces strict SDLC pipeline governance on GCP. Replacing primitive roles with fine-grained predefined roles assigned to a user-managed Cloud Build service account enforces least privilege. Storing Terraform state in a centralized Cloud Storage backend with object versioning and state locking eliminates state corruption and concurrency risks. Granting developers the Service Account User role provides the necessary rights to execute build jobs under the service account without exposing full administrative controls.

Step-by-Step Solution

1
Analyze CI/CD identity and access management requirements
Identify that using primitive Owner or Editor roles violates least privilege, and granting Service Account Admin provides unnecessary administrative control when only build impersonation (Service Account User) is required.
CI/CD service accounts should only possess specific deployment roles (e.g., Kubernetes Engine Developer, Cloud Run Admin) necessary for build targets.
2
Evaluate Infrastructure as Code (IaC) state management security
Recognize that storing Terraform state files in ephemeral workspaces or git repositories leads to state corruption, race conditions, and key leakage.
Terraform state must be stored in a centralized Google Cloud Storage (GCS) backend supporting object versioning for rollback capabilities and object locking to prevent concurrent apply operations.
3
Synthesize optimal secure SDLC configuration for Cloud Build
Combine user-managed Cloud Build service accounts with fine-grained roles, GCS remote backend for Terraform, and Service Account User permissions for developers.
This establishes robust pipeline security, operational reliability, and compliance with Google Cloud enterprise deployment standards.

Key Concept

CI/CD Security Hardening and IaC State Management in GCP
Estimated Time:2m 0s
Question 52Question →

A digital publishing platform is setting up database infrastructure to support a globally distributed application. The architecture requires strong relational consistency across multi-region read/write deployments, horizontal scaling capabilities, and automated provision management through Terraform. In addition, the platform engineering team must ensure that automated CI/CD pipeline executions cannot cause concurrency conflicts or state file corruption. Which provisioning strategy should the cloud architect recommend to fulfill these requirements?

Show answer & explanation

Answer: Provision a Cloud Spanner instance to provide multi-region relational transactional consistency, and configure the Terraform remote backend using a Cloud Storage bucket with object versioning and state locking enabled.

Answer

Provision a Cloud Spanner instance to provide multi-region relational transactional consistency, and configure the Terraform remote backend using a Cloud Storage bucket with object versioning and state locking enabled.
The correct strategy combines Cloud Spanner for globally consistent multi-region relational database operations with a Cloud Storage Terraform remote backend configured with object versioning and state locking. This satisfies both the database consistency demands and the IaC pipeline safety requirements.

Step-by-Step Solution

1
Analyze database requirements
Identified the need for multi-region relational consistency and horizontal scaling, pointing to Cloud Spanner rather than Cloud SQL.
Cloud SQL is limited to single-region write workloads, whereas Cloud Spanner provides globally distributed, strongly consistent relational transactions.
2
Analyze Infrastructure as Code (IaC) provisioning requirements
Determined that automated pipeline runs require remote state management with locking and versioning.
Cloud Storage backends support native state locking and object versioning, ensuring state files are protected against concurrent modifications and accidental corruption.

Key Concept

Provisioning scalable relational databases and secure Terraform state backends
Question 53Question →

A financial services organization is migrating two distinct workloads to Google Cloud. The architecture team requires solution designs that minimize operational maintenance and infrastructure cost.

• Workload 1: A stateless, containerized HTTP REST API servicing unpredictable fraud check queries that must automatically scale to zero instances during idle periods.
• Workload 2: A containerized nightly batch process that executes non-HTTP financial risk simulations for up to 3 hours per run.

Which TWO Google Cloud compute platform configurations should you select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Workload 1 as a Cloud Run service configured with request-based autoscaling.; Deploy Workload 2 as a Cloud Run job scheduled to execute the containerized task to completion.

Answer

Deploy Workload 1 as a Cloud Run service configured with request-based autoscaling, and deploy Workload 2 as a Cloud Run job scheduled to execute the containerized task to completion.
For stateless HTTP APIs that require scaling to zero and zero server management, Cloud Run services provide fully managed container deployment with request-driven autoscaling. For batch containers that run to completion without listening for incoming network requests, Cloud Run Jobs provides a fully managed execution environment supporting long-running tasks.

Step-by-Step Solution

1
Analyze requirements for Workload 1 (stateless HTTP microservice, unpredictable traffic, scale-to-zero, low operational overhead).
Cloud Run service is the optimal choice as it natively handles HTTP traffic, scales down to zero, and eliminates server maintenance.
Selecting a serverless container platform reduces operational complexity and cost for idle periods.
2
Analyze requirements for Workload 2 (non-HTTP batch container, nightly execution up to 3 hours, low operational overhead).
Cloud Run Jobs is the optimal choice for containerized workloads that run to completion without an HTTP endpoint and exceed typical function timeouts.
Cloud Run Jobs supports task execution up to 24 hours without cluster management overhead.

Key Concept

Selecting serverless container services (Cloud Run services vs Cloud Run Jobs) based on traffic patterns, execution duration, and event triggers.
Question 54Question →

An enterprise organization is preparing a quarterly disaster recovery (DR) simulation to test the failover of a critical web application from its primary GCP region to a secondary region. During previous tests, spinning up secondary compute instances failed because the target region lacked sufficient resource capacity allocations. Which procedure should the Cloud Architect incorporate into the disaster recovery validation workflow to ensure the failover drill succeeds?

Show answer & explanation

Answer: Submit and verify regional quota increase requests for required compute resources in the secondary region prior to initiating the failover drill.

Answer

Submit and verify regional quota increase requests for required compute resources in the secondary region prior to initiating the failover drill.
Submitting and verifying regional quota increases before starting a disaster recovery drill ensures that Google Cloud allocates sufficient quota limits for secondary compute resources, allowing automated failover scripts to complete without quota errors.

Step-by-Step Solution

1
Identify the root cause of the previous DR simulation failure.
Determine that instance provisioning failed due to hitting regional Compute Engine resource quota limits in the failover region.
GCP projects enforce regional quotas on CPU, memory, and IP addresses to prevent unintended resource exhaustion.
2
Define the pre-validation procedure for business continuity testing.
Audit required target capacity and submit regional quota increase requests in advance of the test.
Verifying quota headroom prior to execution guarantees that infrastructure automation can provision failover instances successfully during the DR exercise.

Key Concept

Disaster recovery validation procedures must include pre-drill verification of target region resource quotas to guarantee successful failover capacity.
Question 55Question →

A enterprise organization is upgrading its governance posture across its Google Cloud resource hierarchy. The security team mandates that service account key creation must be disabled centrally (`constraints/iam.disableServiceAccountKeyCreation`) to eliminate long-lived credential exposure. However, a legacy workloads folder contains automated deployment scripts that still require key-based authentication while undergoing migration to Workload Identity Federation. The lead cloud architect must enforce the restriction centrally across all existing and future projects while allowing a temporary exception for the legacy workloads folder without compromising the security posture of other departments. Which architectural strategy complies with Google-recommended best practices for Organization Policy management?

Show answer & explanation

Answer: Apply the constraints/iam.disableServiceAccountKeyCreation policy set to Enforce at the Organization root node, and configure an explicit policy override at the legacy workloads Folder node that sets Enforce to False.

Answer

Enforce the constraint at the Organization root node and configure an explicit policy override at the legacy workloads Folder node setting Enforce to False.
Google Cloud Organization Policies follow a top-down inheritance model. Enforcing `constraints/iam.disableServiceAccountKeyCreation` at the Organization root level ensures global security compliance by default. Overriding the policy at the legacy workloads Folder level (setting Enforce to False) selectively allows legacy applications to operate until modernization without granting global exemptions.

Step-by-Step Solution

1
Analyze governance requirements and resource hierarchy mechanics
Organization policies inherit hierarchically from Organization to Folders to Projects.
Setting the policy at the top node ensures all current and future projects inherit the constraint by default.
2
Determine the mechanism for exception management
Child nodes in the GCP resource hierarchy can override parent organization policy rules.
Configuring an override on the legacy workloads folder isolates the exception strictly to projects residing inside that folder.
3
Evaluate alternative security controls
IAM roles and VPC Service Controls serve distinct purposes (identity privileges and network exfiltration boundaries) and cannot replace explicit Organization Policy constraints.
Resource behavior constraints require Organization Policy enforcement rather than permission grants or network perimeters.

Key Concept

Organization Policy Resource Hierarchy Inheritance and Overrides
Estimated Time:2m 0s
Question 56Question →

A biomedical research institute is migrating its data pipeline to Google Cloud. The architecture requires transferring sensitive genomic datasets from an on-premises data center to a Google Cloud VPC with a sustained throughput requirement of 8 Gbps. Regulatory compliance dictates that all traffic in transit must be protected by IPsec encryption. Standard Dedicated Interconnect traffic alone does not meet the encryption mandate, while standard Cloud VPN over the public internet cannot reliably guarantee the required bandwidth. Which hybrid connectivity architecture should the lead Cloud Architect implement to satisfy both the bandwidth and encryption requirements?

Show answer & explanation

Answer: Provision a Dedicated Interconnect connection, configure private interconnect VLAN attachments, and deploy Cloud HA VPN gateways using Private IP addresses over the Dedicated Interconnect circuit.

Answer

Provision a Dedicated Interconnect connection, configure private interconnect VLAN attachments, and deploy Cloud HA VPN gateways using Private IP addresses over the Dedicated Interconnect circuit.
The correct option correctly identifies HA VPN over Dedicated Interconnect (also known as HA VPN over Private IP). This architecture provisions high-bandwidth Dedicated Interconnect circuits and establishes Cloud HA VPN tunnels over the private interconnect VLAN attachments. This combination yields multi-gigabit throughput while guaranteeing full IPsec encryption in transit to satisfy strict compliance requirements.

Step-by-Step Solution

1
Analyze bandwidth and security constraints.
Identified sustained 8 Gbps throughput demand and mandatory IPsec encryption requirement.
Standard HA VPN over the internet is capped per tunnel (3 Gbps) and vulnerable to internet latency fluctuations, while Dedicated Interconnect alone is unencrypted by default.
2
Evaluate GCP hybrid networking capabilities for encrypted high-throughput connections.
Selected HA VPN over Private IP (HA VPN over Dedicated Interconnect).
HA VPN over Dedicated Interconnect allows deploying IPsec VPN tunnels over private 10 Gbps or 100 Gbps Dedicated Interconnect circuits, providing both high throughput and end-to-end IPsec encryption.
3
Verify architecture feasibility and compliance with Google Cloud best practices.
Confirmed HA VPN gateways attached via private VLAN attachments deliver scalable, encrypted, multi-gigabit transport.
Combining Dedicated Interconnect with HA VPN fulfills all compliance, performance, and SLA criteria.

Key Concept

HA VPN over Dedicated Interconnect (Private IP HA VPN)
Question 57Question →

A financial enterprise utilizes a Google Cloud resource hierarchy consisting of an Organization node, a 'Core-Payments' Folder containing multiple production workload projects, and a separate 'SecOps-Central' Project. An automated security auditing tool deployed on a Compute Engine instance in 'SecOps-Central' requires visibility to inspect resource configurations and dataset metadata across all projects in the 'Core-Payments' folder without accessing sensitive underlying records. Additionally, developers assigned to individual projects under 'Core-Payments' must be prevented from attached execution or privilege elevation through this auditing service account. Which IAM role assignment and hierarchy strategy adheres to Google Cloud recommended security practices while minimizing operational complexity?

Show answer & explanation

Answer: Grant the predefined roles roles/browser and roles/bigquery.metadataViewer along with roles/storage.bucketViewer to the auditing service account at the 'Core-Payments' folder level, and refrain from granting project developers the roles/iam.serviceAccountUser role on the service account.

Answer

Grant the predefined metadata viewer roles at the folder level to leverage resource hierarchy inheritance, while withholding service account user permissions from project developers.
The solution leveraging predefined metadata viewer roles at the folder level complies with the principle of least privilege by granting inspection access to configuration and metadata without exposing underlying data records. Assigning roles at the folder level ensures policy inheritance across all existing and future projects within the folder, avoiding project-by-project maintenance. Denying developers the Service Account User role prevents them from attaching the service account to compute instances or impersonating it to escalate privileges.

Step-by-Step Solution

1
Determine appropriate IAM scope and inheritance point.
Assigning permissions at the folder level ensures all nested projects inherit the policies automatically, minimizing operational overhead.
Resource hierarchy inheritance allows folder policy bindings to apply consistently to child projects.
2
Apply the principle of least privilege for metadata inspection.
Predefined roles such as BigQuery Metadata Viewer and Storage Bucket Viewer grant access to resource structures and settings without exposing sensitive data content.
Primitive Viewer roles or Admin roles expose data records or permit management actions beyond read-only metadata scanning.
3
Protect service account execution boundary.
Withholding Service Account User and Service Account Admin roles from developers prevents privilege escalation and unauthorized impersonation of the security auditor.
Only authorized deployment principals should hold Service Account User permissions.

Key Concept

Resource Hierarchy IAM Inheritance & Least Privilege Role Scoping
Estimated Time:2m 0s
Question 58Question →

An enterprise engineering team is configuring an automated infrastructure deployment pipeline using Terraform on Google Cloud. The team must establish a remote state backend that prevents concurrent pipeline executions from causing state corruption, protects historical state revisions against accidental deletion, and eliminates the need to store long-lived service account keys inside the CI/CD environment. Which TWO configuration steps should the team implement to fulfill these security and operational requirements?

Select all that apply

Show answer & explanation

Answer: Configure the Terraform backend using a Google Cloud Storage bucket with Object Versioning enabled.; Configure the Terraform Google provider to use Service Account impersonation with short-lived credentials for execution.

Answer

To securely manage Terraform state and authentication in Google Cloud, the team must use a Cloud Storage backend with Object Versioning enabled and utilize Service Account impersonation with short-lived credentials instead of static keys.
Configuring a Google Cloud Storage backend with Object Versioning enabled satisfies state protection requirements by offering native state locking and history preservation. Additionally, employing Service Account impersonation allows the CI/CD pipeline to request short-lived access tokens dynamically, completely removing the risk associated with static JSON key storage.

Step-by-Step Solution

1
Configure a Cloud Storage remote backend with versioning enabled
State locking is automatically handled by the GCS backend, while versioning preserves state history against accidental deletion.
Cloud Storage backends provide native state locking through generation checks and Object Versioning ensures disaster recovery for state files.
2
Configure service account impersonation for Terraform authentication
The pipeline authenticates dynamically without storing long-lived service account JSON keys in CI/CD secrets store.
Impersonation relies on short-lived OAuth2 access tokens, aligning with Google Cloud security best practices.

Key Concept

Terraform Cloud Storage Backend Security and Impersonation Best Practices
Question 59Question →

A cloud governance team manages a Google Cloud resource hierarchy structured by business units into separate folders. A new security mandate requires that no Compute Engine virtual machine (VM) instances created within the 'FinTech' folder be assigned external IP addresses. However, one specific migration project inside the 'FinTech' folder requires external IP access for legacy integration testing during a 30-day transition period. What is the Google-recommended architectural approach to enforce this policy while supporting the transition project?

Show answer & explanation

Answer: Apply the Organization Policy constraint `constraints/compute.vmExternalIpAccess` at the 'FinTech' folder level to deny external IPs, and configure a project-level organization policy override on the legacy project to allow external IP allocation.

Answer

Enforce the Organization Policy constraint `constraints/compute.vmExternalIpAccess` at the 'FinTech' folder level to deny external IP addresses, and configure an organization policy override at the legacy project level to permit external IP allocation.
Organization Policies enforce centralized resource configuration guardrails across the resource hierarchy. Applying the `constraints/compute.vmExternalIpAccess` constraint at the folder level guarantees inherited enforcement across all member projects. Explicitly setting a policy override at the child project level permits fine-grained compliance exceptions for specific projects without modifying the parent folder policy.

Step-by-Step Solution

1
Identify the proper Google Cloud governance tool for resource configuration guardrails.
Organization Policies (specifically `constraints/compute.vmExternalIpAccess`) regulate resource creation constraints independently of IAM access.
Organization policies act as centralized guardrails governing resource configuration across the hierarchy.
2
Determine the resource hierarchy placement for the baseline security policy.
Enforce the constraint at the 'FinTech' folder level.
Applying the constraint at the folder level ensures that all existing and future child projects inherit the external IP restriction by default.
3
Configure the exception mechanism for the legacy migration project.
Apply a project-level Organization Policy override on the specific legacy project.
Google Cloud Organization Policy hierarchy allows child nodes to override inherited policies, enabling temporary, localized exceptions without compromising the parent folder guardrails.

Key Concept

Organization Policy Resource Hierarchy Inheritance and Project Overrides
Question 60Question →

A logistics enterprise is provisioning a private Google Kubernetes Engine (GKE) cluster to host internal microservices. The cluster nodes are created with private IP addresses only, and the cluster control plane is configured with a private endpoint. The platform operations team needs to administer the cluster using kubectl from an on-premises workstation connected to Google Cloud via Cloud VPN. However, connection attempts to the private control plane endpoint are failing. Which configuration change must be made to grant the on-premises workstation access to the private cluster control plane?

Show answer & explanation

Answer: Enable Control Plane Authorized Networks on the GKE cluster and add the on-premises network CIDR range to the allowed IP ranges.

Answer

Enable Control Plane Authorized Networks on the GKE cluster and add the on-premises network CIDR range to the allowed IP ranges.
Enabling Control Plane Authorized Networks on a private GKE cluster allows administrators to specify exact CIDR blocks—such as on-premises workstation subnets connected via Cloud VPN—that are permitted to reach the private Kubernetes control plane endpoint.

Step-by-Step Solution

1
Identify network requirements for private GKE control plane access.
By default, private GKE control planes only accept connections from internal VPC subnets and approved IP ranges.
Traffic originating from an on-premises network over Cloud VPN originates from an external CIDR block outside the cluster's VPC subnet.
2
Configure control plane network authorization controls.
Enabling Control Plane Authorized Networks and adding the corporate network CIDR block explicitly permits kubectl traffic from the on-premises workstation to the private master endpoint.
Control Plane Authorized Networks restrict endpoint access to specified IP ranges regardless of whether the endpoint is public or private.

Key Concept

GKE Private Cluster Control Plane Authorized Networks
PreviousPage 3 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin