Examkin

All practice questions

64 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 41Question →

Match each enterprise data workload requirement to the most appropriate Google Cloud storage or database service based on its data model, latency constraints, and consistency guarantees.

Click a left item, then click its matching right item

Items

High-throughput time-series metrics from millions of utility smart meters requiring sub-10ms write latency without SQL join support.
Globally distributed relational transactions requiring horizontal write scaling, strong consistency, and multi-region ACID compliance.
Unstructured document compliance archive requiring object lifecycle management and immutable write-once-read-many (WORM) retention policies.
Regional transactional application requiring standard relational SQL compliance, point-in-time recovery, and managed high-availability failover.

Matches

Show answer & explanation

Answer

High-throughput smart meter time-series metrics pair with Cloud Bigtable; globally distributed relational transactions pair with Cloud Spanner; unstructured compliance archives pair with Cloud Storage with Bucket Lock; regional relational applications pair with Cloud SQL.
Each requirement aligns directly with the core strengths of the paired GCP service: Cloud Bigtable is designed for high-scale NoSQL time-series streams; Cloud Spanner provides horizontal scaling for global relational ACID databases; Cloud Storage with Bucket Lock satisfies immutable retention regulatory mandates; Cloud SQL is ideal for standard regional relational databases.

Step-by-Step Solution

1
Analyze the data model and operational scale of each workload requirement.
Workloads demand wide-column time-series ingestion, global relational consistency, immutable object archival, and regional relational transactional operations.
Categorizing data models and access patterns narrows down valid Google Cloud storage categories.
2
Map specific performance, compliance, and scope constraints to native GCP storage service features.
Cloud Bigtable delivers high-throughput low-latency NoSQL ingest; Cloud Spanner handles global multi-region ACID transactions; Cloud Storage with Bucket Lock guarantees immutable WORM storage; Cloud SQL handles standard regional SQL workloads.
Aligning latency thresholds, replication boundaries, and consistency models ensures an architectural fit.

Key Concept

Selecting GCP database and storage services based on access pattern, consistency guarantees, latency, and scalability scope
Question 42Question →

Match each workload storage requirement to the most appropriate Google Cloud database or storage service based on data access patterns, scalability, and consistency models.

Click a left item, then click its matching right item

Items

Low-latency, high-throughput NoSQL key-value store for serving real-time user recommendation features with single-digit millisecond latency.
Fully managed relational database supporting global ACID transactions, horizontal scaling across regions, and high availability for financial trade settlement.
Regional relational database requiring full SQL support, ACID compliance, automatic failover, and read replicas for a regional CRM application.
Unstructured object storage used to store media assets and system log archives with automated lifecycle management for cost tiering.

Matches

Show answer & explanation

Answer

Low-latency key-value feature serving maps to Cloud Bigtable; Global relational trade settlement with strong consistency maps to Cloud Spanner; Regional relational CRM application maps to Cloud SQL; Unstructured media assets and log archives with lifecycle policies map to Cloud Storage.
Each requirement directly matches the core capability of the corresponding GCP service: Cloud Bigtable for high-throughput NoSQL key-value lookups; Cloud Spanner for global multi-region relational ACID workloads; Cloud SQL for standard regional relational databases; and Cloud Storage for unstructured object storage with lifecycle management.

Step-by-Step Solution

1
Analyze access pattern and throughput demands for real-time recommendations.
Identified low-latency NoSQL key-value requirement, which aligns directly with Cloud Bigtable.
Cloud Bigtable provides sub-10ms performance at scale for key-value access patterns.
2
Evaluate transactional and consistency requirements for global financial trade settlement.
Identified global ACID compliance and horizontal scalability, which requires Cloud Spanner.
Cloud Spanner is the only fully managed GCP database delivering global scale combined with strong relational ACID transactions.
3
Evaluate regional relational database needs for a CRM application.
Selected Cloud SQL for standard regional relational engine management.
Cloud SQL offers managed PostgreSQL/MySQL/SQL Server with automated backups, HA, and read replicas within a single region.
4
Determine appropriate service for unstructured media files and log lifecycle management.
Selected Cloud Storage.
Cloud Storage is optimized for unstructured blob data and provides automated lifecycle transitions to lower-cost tiers.

Key Concept

GCP Storage and Database Resource Selection Criteria
Estimated Time:1m 30s
Question 43Question →

Match each enterprise data requirement on the left with the most appropriate Google Cloud storage or database service on the right based on access patterns, scaling, and architectural capabilities.

Click a left item, then click its matching right item

Items

Global OLTP application requiring horizontal scalability, strong consistency across multiple geographic regions, and relational SQL support.
High-throughput IoT sensor data ingestion requiring single-digit millisecond read/write latency and seamless scaling for key-value time-series data.
Regional relational database workload needing full PostgreSQL compatibility, ACID compliance, managed backups, and high-availability failover.
Enterprise analytical data warehouse capable of querying petabyte-scale structured data using SQL without managing underlying infrastructure.

Matches

Show answer & explanation

Answer

Global multi-region strong consistency matches Cloud Spanner; high-throughput IoT time-series data matches Cloud Bigtable; regional PostgreSQL relational OLTP matches Cloud SQL for PostgreSQL; petabyte-scale analytics matches BigQuery.
Each GCP database service is optimized for specific workload profiles: Cloud Spanner handles globally scalable relational OLTP; Cloud Bigtable handles massive throughput NoSQL key-value streams; Cloud SQL handles standard regional relational databases; and BigQuery handles large-scale analytics and data warehousing.

Step-by-Step Solution

1
Analyze workload requirements for transactional scope and geographical distribution.
Identified global multi-region transactional needs versus regional single-instance requirements.
Global relational workloads requiring horizontal scale map directly to Cloud Spanner, whereas single-region relational workloads map to Cloud SQL.
2
Differentiate non-relational high-throughput operational storage from analytical warehousing.
Categorized key-value IoT ingestion as operational NoSQL and large SQL reporting as analytical OLAP.
Cloud Bigtable provides low-latency key-value NoSQL capabilities for high-speed write streams, while BigQuery provides serverless OLAP capabilities for petabyte-scale analysis.
3
Pair each requirement to its optimal Google Cloud database product based on best-practice design patterns.
All four workload patterns are mapped to their corresponding Google Cloud target services.
Matching access patterns and SLAs ensures optimal performance, reliability, and cost-efficiency.

Key Concept

Selecting GCP Database and Storage Resources by Access Pattern and Workload Characteristics
Estimated Time:1m 30s
Question 44Question →

A enterprise networking team is designing its hybrid connectivity architecture between an on-premises data center and Google Cloud. Match each Google Cloud hybrid networking component to its primary design requirement or architectural capability.

Click a left item, then click its matching right item

Items

Cloud Router
Dedicated Interconnect
Partner Interconnect
HA VPN

Matches

Show answer & explanation

Answer

Cloud Router matches dynamic BGP routing updates; Dedicated Interconnect matches direct physical wire connection at a Google facility; Partner Interconnect matches connection through a service provider; HA VPN matches encrypted IPsec connection with 99.99% SLA over the internet.
Each hybrid connectivity technology fulfills a distinct role: Cloud Router handles BGP dynamic routing, Dedicated Interconnect establishes direct physical connections at Google edge facilities, Partner Interconnect leverages service provider networks for indirect connectivity, and HA VPN provides encrypted 99.99% SLA connectivity over the public internet.

Step-by-Step Solution

1
Identify the primary capability of Cloud Router
Cloud Router dynamically exchanges routes using BGP across VPNs or Interconnects.
Cloud Router manages dynamic routing to avoid static route configuration in GCP VPCs.
2
Distinguish between Dedicated Interconnect and Partner Interconnect
Dedicated Interconnect requires a physical fiber link directly to Google edge facilities, whereas Partner Interconnect uses a service provider's network.
Physical proximity to Google colocation dictates whether Dedicated or Partner Interconnect is appropriate.
3
Identify the encryption and availability profile of HA VPN
HA VPN provides encrypted IPsec tunnels over public internet paths with a 99.99% SLA architecture.
HA VPN requires dual active interfaces and BGP routing to deliver high-availability encrypted connectivity.

Key Concept

Designing Hybrid Network Architecture in GCP
Question 45Question →

A healthcare organization is migrating clinical workloads and telemetry systems to Google Cloud. The infrastructure requires a tailored hybrid network topology that satisfies specific throughput, SLA, provider presence, and cross-VPC communication constraints. Match each GCP hybrid networking component to the architectural requirement it satisfies.

Click a left item, then click its matching right item

Items

Dedicated Interconnect with MACsec
HA VPN with Cloud Router
Partner Interconnect
VPC Network Peering

Matches

Show answer & explanation

Answer

Dedicated Interconnect with MACsec connects directly via physical circuits with Layer 2 encryption; HA VPN with Cloud Router provides 99.99% SLA encrypted connectivity using BGP over public internet; Partner Interconnect offers private connectivity through third-party service providers when direct colocation is impossible; VPC Network Peering securely bridges separate VPCs internally without network transitivity.
Each GCP networking product satisfies a distinct architectural need: Dedicated Interconnect provides direct physical links with MACsec hardware encryption; HA VPN delivers an SLA-backed 99.99% IPSec tunnel over public internet with BGP dynamic routing; Partner Interconnect offers private connectivity through service providers where Google colocation is absent; and VPC Network Peering provides direct, non-transitive internal IP connectivity between distinct VPCs.

Step-by-Step Solution

1
Identify direct physical connection requirements with hardware-level encryption
Dedicated Interconnect with MACsec maps to direct physical circuits at a colocation facility offering link-layer encryption.
Dedicated Interconnect requires a physical cross-connect in a Google facility, and MACsec secures traffic between the on-premises router and Google edge router.
2
Identify high-availability internet-based encrypted connectivity requirements
HA VPN with Cloud Router maps to IPSec encrypted connections across public internet with 99.99% SLA via dynamic BGP routing.
HA VPN guarantees 99.99% availability when configured with two tunnels across properly redundant cloud routers using BGP.
3
Identify service provider-backed private connection requirements
Partner Interconnect maps to private connectivity via service providers for locations lacking direct Google colocation presence.
Partner Interconnect extends GCP private networks into data centers using a service provider's physical infrastructure.
4
Identify inter-VPC private communication requirements
VPC Network Peering maps to low-latency internal IP routing between separate GCP VPC networks with non-transitive boundaries.
VPC Network Peering directly links virtual networks within GCP, keeping traffic on Google's private network while enforcing non-transitive route isolation.

Key Concept

Selecting appropriate GCP hybrid connectivity and inter-VPC networking technologies based on physical presence, encryption, SLA, and routing constraints.
Question 46Question →

An enterprise lead architect is evaluating GCP hybrid networking topologies for four distinct enterprise business units. Match each architectural scenario on the left with the single most appropriate GCP network connectivity solution on the right that meets all throughput, security, SLA, and connectivity requirements.

Click a left item, then click its matching right item

Items

Scenario 1: A financial analytics platform requires a dedicated, unencrypted, high-throughput physical pipe (10 Gbps+) extending on-premises data centers directly to GCP with a 99.99% availability SLA across two colocation domains without traversing the public internet.
Scenario 2: A remote branch site requires encrypted IPsec tunnel connectivity to GCP over existing commodity public internet circuits, utilizing Cloud Router with dynamic BGP route propagation and providing a 99.99% availability SLA.
Scenario 3: An enterprise requires sub-10 Gbps private hybrid connectivity from an on-premises facility where direct colocation with a Google edge Point of Presence (PoP) is physically unavailable, requiring SLA guarantees managed by a third-party carrier.
Scenario 4: Two independent GCP VPC networks across separate projects require low-latency, private RFC 1918 internal IP communication without using intermediate VPN gateways or paying for external transit.

Matches

Show answer & explanation

Answer

The correct mapping pairs Scenario 1 with Dedicated Interconnect (high-throughput direct physical connection meeting 99.99% SLA); Scenario 2 with HA Cloud VPN (encrypted IPsec over public internet with dynamic BGP routing); Scenario 3 with Partner Interconnect (service provider connection where Google colocation edge is unavailable); and Scenario 4 with VPC Network Peering (direct private inter-VPC connectivity).
The solution accurately pairs each architectural constraint to its definitive GCP networking component: Dedicated Interconnect for direct physical 10 Gbps+ connections; HA Cloud VPN for encrypted internet-based IPsec tunnels; Partner Interconnect for non-colocated locations using carrier services; and VPC Network Peering for internal inter-VPC traffic.

Step-by-Step Solution

1
Analyze Scenario 1 requirements
Identified direct physical link requirement (>10 Gbps, 99.99% SLA, no public internet).
Dedicated Interconnect is the only GCP product providing direct physical circuit extension with 99.99% SLA.
2
Analyze Scenario 2 requirements
Identified encrypted IPsec tunnel over public internet with 99.99% SLA and dynamic BGP.
HA Cloud VPN mandates dual active-active tunnels with Cloud Router BGP to achieve 99.99% availability over internet circuits.
3
Analyze Scenario 3 requirements
Identified third-party service provider requirement due to lack of direct Google colocation presence.
Partner Interconnect is specifically designed for hybrid connections where customers connect through service providers.
4
Analyze Scenario 4 requirements
Identified inter-VPC private IP communication across projects without intermediate gateways.
VPC Network Peering enables direct, non-transitive, high-speed private RFC 1918 interconnectivity between VPCs.

Key Concept

Designing Enterprise GCP Network Topologies and Hybrid Connectivity Options
Question 47Question →

An enterprise cloud security architect is standardizing the data encryption strategy across Google Cloud workloads to satisfy varying regulatory and security control mandates. Match each organizational key control requirement on the left with its corresponding Google Cloud encryption mechanism on the right.

Click a left item, then click its matching right item

Items

Requirement for full key governance where raw AES-256 keys are supplied directly in API request headers and purged from Google Cloud memory immediately after cryptographic operations.
Mandate to enforce automated encryption at rest across standard resources with zero key lifecycle management overhead, utilizing Google-managed key infrastructure.
Regulatory requirement to retain root cryptographic key material outside of Google Cloud infrastructure in a third-party key management system.
Mandate to control key rotation schedules, key access permissions, and auditing while leveraging key infrastructure hosted natively inside Google Cloud.

Matches

Show answer & explanation

Answer

Supplying raw keys in API headers pairs with Customer-Supplied Encryption Keys (CSEK); zero-overhead automated encryption pairs with Google-default encryption; retaining keys in an external third-party HSM pairs with Cloud External Key Manager (Cloud EKM); native Cloud KMS key administration pairs with Customer-Managed Encryption Keys (CMEK).
Each organizational constraint maps directly to a distinct GCP encryption tier: supplying raw keys transiently in headers matches CSEK; hands-off automatic protection matches Google-default encryption; external off-cloud key storage matches Cloud EKM; and native key control and access policy management matches CMEK via Cloud KMS.

Step-by-Step Solution

1
Analyze key ownership location and API interaction mode for raw key headers
Identified requirement matching CSEK, where raw key material is passed directly per request.
CSEK is specifically designed for scenarios where the customer holds raw keys off-cloud and sends them in ephemeral request headers.
2
Analyze standard default baseline protection without customer key intervention
Identified Google-default encryption.
Google Cloud automatically encrypts all customer data at rest by default without requiring user configuration.
3
Analyze external HSM integration requirements
Identified Cloud External Key Manager (Cloud EKM).
Cloud EKM connects Cloud KMS with an external third-party Key Management System residing outside Google Cloud.
4
Analyze native GCP key management governance
Identified CMEK via Cloud KMS.
CMEK allows management of key lifecycle policies, rotation, and IAM access using Cloud KMS/HSM hosted natively inside GCP.

Key Concept

Classification of Google Cloud Encryption Modes (Google-default, CMEK, CSEK, Cloud EKM)
Question 48Question →

A multinational financial processing enterprise is designing perimeter controls for its multi-tenant workload architecture on Google Cloud. Match each specific network security requirement on the left with the most appropriate Google Cloud perimeter control mechanism on the right.

Click a left item, then click its matching right item

Items

Prevent data exfiltration from managed analytics services like BigQuery and Cloud Storage to unauthorized external resources, even when authenticated with valid IAM credentials.
Inspect incoming HTTPS traffic at the edge of Google Cloud External HTTP(S) Load Balancers to mitigate Layer 7 SQL injection and cross-site scripting (XSS) attacks.
Enforce mandatory baseline egress network firewall rules across all VPC networks across all folders in the GCP organization without allowing project administrators to override them.
Enable private, unidirectionally exposed access to a third-party SaaS partner application hosted in an external VPC without establishing full VPC Network Peering.

Matches

Show answer & explanation

Answer

Data exfiltration prevention matches VPC Service Controls; Layer 7 HTTPS threat protection matches Cloud Armor Security Policies; Organization-level enforced network security rules match Hierarchical Firewall Policies; Private third-party service access without peering matches Private Service Connect.
Each perimeter control satisfies a distinct security layer in Google Cloud: VPC Service Controls protect API and storage service boundaries against data exfiltration; Cloud Armor provides Layer 7 WAF protections at the load balancer edge; Hierarchical Firewall Policies mandate organization-level network restrictions across the resource hierarchy; Private Service Connect provides secure, isolated service access across networks without establishing network peering.

Step-by-Step Solution

1
Analyze data exfiltration prevention requirement for managed GCP services.
Identified that IAM alone cannot prevent unauthorized egress of data to external buckets; VPC Service Controls establish explicit perimeter boundaries.
VPC Service Controls block network-level access to API resources from outside the designated perimeter.
2
Evaluate web application security requirements at the load balancer edge.
Identified Cloud Armor as the WAF filter operating at the HTTP(S) load balancer level for Layer 7 protection.
Cloud Armor evaluates pre-configured WAF rules (SQLi, XSS) before traffic reaches compute backends.
3
Identify resource hierarchy control for enterprise-wide firewall governance.
Selected Hierarchical Firewall Policies attached at the Organization or Folder node.
Hierarchical firewall rules delegate or enforce rules top-down, taking precedence over project-level firewall rules.
4
Evaluate private cross-VPC service access mechanisms.
Selected Private Service Connect for publishing and consuming endpoints privately across administrative boundaries.
Private Service Connect avoids overlapping IP spaces and transitive routing risks inherent in traditional VPC Peering.

Key Concept

Google Cloud Perimeter Security & Network Isolation Controls
Question 49Question →

A cloud architect needs to select the appropriate Google Cloud hybrid connectivity service for four distinct organizational requirements. Match each hybrid connectivity service on the left with its defining operational requirement on the right.

Click a left item, then click its matching right item

Items

Dedicated Interconnect
Partner Interconnect
HA VPN
Cloud Router

Matches

Show answer & explanation

Answer

Dedicated Interconnect matches establishing a direct physical fiber connection at a colocation facility. Partner Interconnect matches connecting through a supported third-party service provider. HA VPN matches providing an IPsec encrypted connection over the public internet with a 99.99% SLA. Cloud Router matches dynamically exchanging routes using BGP.
Dedicated Interconnect physically connects enterprise hardware directly to Google at a colocation site. Partner Interconnect uses third-party service providers to bridge physical network gaps. HA VPN delivers active-active IPsec tunnels over the public internet backed by a 99.99% SLA. Cloud Router uses BGP to dynamically advertise and learn routes between VPCs and on-premises environments.

Step-by-Step Solution

1
Identify the service providing direct physical infrastructure linkage.
Dedicated Interconnect is matched with direct physical fiber cabling at a Google colocation facility.
Dedicated Interconnect bypasses the public internet completely by extending private physical circuits directly into Google's colocation facilities.
2
Identify the service providing connectivity via external network providers.
Partner Interconnect is matched with connecting through a supported third-party service provider.
Partner Interconnect allows organizations to connect to GCP when their physical location does not reach a Google colocation facility directly.
3
Identify the service providing high-availability encrypted tunneling over public internet.
HA VPN is matched with IPsec encrypted connections offering 99.99% SLA.
HA VPN operates over the public internet using IPsec protocol while guaranteeing 99.99% SLA with dual active tunnels.
4
Identify the control plane service managing dynamic dynamic route propagation.
Cloud Router is matched with dynamic route exchange using BGP.
Cloud Router handles dynamic BGP peerings to automatically advertise and learn subnets between GCP VPCs and remote routers.

Key Concept

Differentiating GCP hybrid connectivity mechanisms (Dedicated Interconnect, Partner Interconnect, HA VPN) and dynamic routing mechanisms (Cloud Router).
Estimated Time:1m 0s
Question 50Question →

An enterprise architecture team for a global aerospace manufacturer is selecting Google Cloud networking solutions for various workloads during a multi-region migration. Match each Google Cloud networking service on the left with the architectural scenario requirement on the right that best justifies its implementation.

Click a left item, then click its matching right item

Items

Dedicated Interconnect
High Availability (HA) VPN
Partner Interconnect
VPC Network Peering

Matches

Show answer & explanation

Answer

Dedicated Interconnect matches the requirement for direct 10 Gbps/100 Gbps physical circuits at a Google edge location. HA VPN matches the requirement for 99.99% SLA IPsec encrypted connectivity over the public internet. Partner Interconnect matches the requirement for connecting via a third-party service provider where direct Google PoP access is absent. VPC Network Peering matches internal VPC-to-VPC communication without external gateways.
Each hybrid networking technology addresses distinct architecture criteria: Dedicated Interconnect delivers direct 10/100 Gbps physical circuits; HA VPN delivers SLA-backed 99.99% encrypted IPsec connectivity over the internet; Partner Interconnect connects sites via service provider networks where Google PoPs are unavailable; and VPC Network Peering provides high-bandwidth, private internal routing between VPC networks.

Step-by-Step Solution

1
Analyze high-bandwidth physical connection requirements
Dedicated Interconnect provides physical 10 Gbps or 100 Gbps connections directly to Google edge facilities.
When private throughput requirements exceed standard VPN capabilities and a direct facility connection is available, Dedicated Interconnect is required.
2
Evaluate encrypted internet-based connectivity needs
HA VPN fulfills IPsec encrypted tunnel requirements over public internet while guaranteeing 99.99% availability.
HA VPN uses active-active topologies with Cloud Router dynamic BGP routing to ensure 99.99% uptime for internet-bound hybrid traffic.
3
Determine connectivity options for remote geographical locations without Google PoPs
Partner Interconnect enables connection through supported service providers.
Partner Interconnect extends GCP private interconnect benefits to locations where the enterprise cannot colocate directly with Google.
4
Identify cloud-native intra-GCP networking mechanisms
VPC Network Peering connects separate VPCs internally within Google Cloud.
VPC Peering provides direct internal routing between VPCs without incurring performance bottlenecks or needing virtual gateways.

Key Concept

Selecting GCP Hybrid Connectivity and VPC Topology Solutions based on SLA, Bandwidth, Physical Location, and Routing Constraints
Question 51Question →

A global aerospace engineering firm is designing a multi-tier hybrid network architecture to connect its on-premises data centers and remote manufacturing facilities to Google Cloud. Match each operational connectivity requirement on the left with the appropriate Google Cloud hybrid networking solution on the right.

Click a left item, then click its matching right item

Items

Provisioning 100 Gbps private, unencrypted bandwidth between a primary research data center and a VPC network with a 99.99% availability SLA requiring redundant circuits across two edge availability domains.
Establishing an encrypted IPsec connection over the public internet with a 99.99% availability SLA for a regional distribution facility.
Connecting a remote manufacturing plant requiring 200 Mbps sub-1G capacity where direct physical colocation with a Google edge facility is unavailable, leveraging a supported service provider.
Dynamically exchanging BGP routes to establish automatic topology updates and failover paths between on-premises routers and VPC subnets.

Matches

Show answer & explanation

Answer

Matching pairs: Dedicated Interconnect satisfies 100 Gbps private connectivity with a 99.99% SLA across edge availability domains; HA VPN with dual gateways satisfies encrypted public internet connectivity with a 99.99% SLA; Partner Interconnect satisfies sub-1 Gbps connectivity via a service provider; Cloud Router satisfies dynamic BGP route exchange.
Each operational requirement strictly maps to its corresponding Google Cloud networking component based on bandwidth thresholds, SLA guarantees, encryption needs, and service provider integration.

Step-by-Step Solution

1
Analyze high-bandwidth and physical direct connection requirements.
Requirements of 100 Gbps direct private connection with a 99.99% SLA align specifically with Dedicated Interconnect deployed across two edge availability domains.
Dedicated Interconnect directly links the enterprise facility to Google's edge colocation using 10 Gbps or 100 Gbps physical circuits.
2
Analyze encrypted public IPsec connectivity requirements with a 99.99% availability SLA.
Requires HA VPN featuring dual VPN gateways and active-active tunnels.
Classic VPN does not offer a 99.99% SLA; HA VPN is explicitly engineered to provide 99.99% availability over IPsec.
3
Analyze low-bandwidth service provider connectivity requirements.
Sub-1 Gbps capacity (200 Mbps) through an ISP service provider maps to Partner Interconnect.
Partner Interconnect allows connection through third-party service providers when direct connection facilities are inaccessible or bandwidth needs are under 1 Gbps.
4
Analyze dynamic routing requirements.
BGP dynamic route exchange maps to Cloud Router.
Cloud Router automates route propagation using BGP across hybrid interconnects and VPN tunnels.

Key Concept

Architecting Google Cloud hybrid connectivity options (Dedicated Interconnect, Partner Interconnect, HA VPN, Cloud Router) based on SLA, bandwidth, encryption, and service provider integration.
Question 52Question →

A cloud solution architect is establishing local development guidelines for microservices that interact with Google Cloud managed services. Match each Google Cloud service local emulator with its corresponding operational capability or limitation during local integration testing.

Click a left item, then click its matching right item

Items

Cloud Spanner Emulator
Cloud Pub/Sub Emulator
Cloud Firestore Emulator
Cloud Bigtable Emulator

Matches

Show answer & explanation

Answer

Cloud Spanner Emulator pairs with localized DDL/SQL support lacking production IAM enforcement; Cloud Pub/Sub Emulator pairs with PUBSUB_EMULATOR_HOST redirection for topic and subscription testing; Cloud Firestore Emulator pairs with NoSQL CRUD and security rules validation via Firebase CLI; Cloud Bigtable Emulator pairs with single-node in-memory execution configured via BIGTABLE_EMULATOR_HOST.
Each Google Cloud service emulator provides a specific local interface and set of environment variables (`PUBSUB_EMULATOR_HOST`, `BIGTABLE_EMULATOR_HOST`, Firebase suite tooling, and local Spanner DDL parsing) allowing applications to be functionally tested offline without incurring service costs or needing live GCP access.

Step-by-Step Solution

1
Identify the primary function and environment variable for Cloud Spanner local emulation.
Cloud Spanner emulator executes local DDL and transactions but omits production IAM and multi-region features.
Emulators focus on API contract validation rather than replicating complex cloud control planes.
2
Identify the setup requirement for Cloud Pub/Sub emulation.
Set `PUBSUB_EMULATOR_HOST` so client SDKs publish and pull messages locally.
SDKs check this environment variable to redirect gRPC/HTTP traffic away from production endpoints.
3
Determine the ecosystem tooling for Cloud Firestore local testing.
Use Firebase CLI emulator suite for document database operations and security rule verification.
Firestore local testing is integrated into the Firebase emulator suite.
4
Identify the environment variable and storage model for Cloud Bigtable emulation.
Set `BIGTABLE_EMULATOR_HOST` to route requests to an in-memory single-node emulator instance.
Bigtable emulator allows developers to verify schema definitions and table mutations offline.

Key Concept

Google Cloud Service Emulators and Development Testing
Question 53Question →

Match each Google Cloud hybrid networking service to its primary defining capability or implementation requirement.

Click a left item, then click its matching right item

Items

Dedicated Interconnect
Partner Interconnect
HA VPN
Cloud Router

Matches

Show answer & explanation

Answer

Dedicated Interconnect matches with direct physical connection at Google edge facilities; Partner Interconnect matches with connectivity via a third-party service provider; HA VPN matches with high-availability IPsec VPN providing a 99.99% SLA; Cloud Router matches with the fully managed BGP control plane.
Each hybrid connectivity component serves a specific architectural role: Dedicated Interconnect provides direct physical connections at Google facilities; Partner Interconnect offers provider-assisted connectivity; HA VPN establishes encrypted 99.99% SLA IPsec connections over the internet; and Cloud Router manages dynamic BGP routing across these connections.

Step-by-Step Solution

1
Identify direct physical connection requirement without third-party transit.
Dedicated Interconnect directly bridges on-premises networks at a Google facility.
Dedicated Interconnect offers dedicated physical ports at 10 Gbps or 100 Gbps circuits.
2
Identify service provider path options when colocation is unavailable.
Partner Interconnect uses a service provider network to reach GCP.
Partner Interconnect extends connectivity to locations where Google colocation facilities are not present.
3
Determine the encrypted 99.99% SLA Internet option.
HA VPN uses dual active-active tunnels to guarantee high availability over public IP network infrastructure.
Classic VPN only supported 99.9% SLA, while HA VPN configuration achieves 99.99% SLA.
4
Select the dynamic routing component required across all hybrid interconnects and VPNs.
Cloud Router provides dynamic BGP topology route exchanges.
Cloud Router manages control plane BGP sessions across Interconnect attachments and VPN tunnels.

Key Concept

Designing Network Architecture and Hybrid Connectivity
Question 54Question →

Match each hybrid cloud enterprise networking scenario to the most appropriate Google Cloud connectivity solution.

Click a left item, then click its matching right item

Items

A fintech enterprise requires a dedicated 10 Gbps private connection from its primary data center to GCP with a 99.99% availability SLA, requiring redundant physical circuits terminating across two distinct colocation metros.
A healthcare provider needs an encrypted connection between a small regional clinic and a GCP VPC over the public internet with a 99.99% SLA using dynamic routing.
A retail company requires a private, SLA-backed 500 Mbps connection between its data center and GCP without placing its own equipment in a Google colocation facility.
A global logistics firm needs to establish dynamic BGP route exchange and centralized transit connectivity between multiple geographically dispersed VPCs and on-premises branch sites.

Matches

Show answer & explanation

Answer

The correct pairings match each scenario to its required bandwidth, SLA, and topology model: 1) Fintech high-bandwidth 99.99% SLA requires Dedicated Interconnect across two metros; 2) Healthcare clinic requiring IPsec encryption and 99.99% SLA uses HA VPN with dynamic Cloud Router; 3) Retail sub-10 Gbps connectivity without custom colocation hardware uses Partner Interconnect; 4) Logistics dynamic transit routing across VPCs and sites uses Network Connectivity Center.
Each scenario directly maps to the architectural capabilities of GCP hybrid networking products: Dedicated Interconnect is required for unencrypted 10 Gbps direct connections with 99.99% SLA; HA VPN provides encrypted internet connectivity at 99.99% SLA; Partner Interconnect supports sub-10 Gbps private connection through service providers; Network Connectivity Center enables transit routing across hybrid spokes.

Step-by-Step Solution

1
Analyze bandwidth and colocation requirements for high-capacity hybrid connectivity.
Direct 10 Gbps physical circuits without intermediate provider infrastructure mandate Dedicated Interconnect. Meeting 99.99% availability requires 4 VLAN attachments across 2 metros.
Dedicated Interconnect is designed for 10 Gbps/100 Gbps enterprise requirements direct to Google edge locations.
2
Identify secure, internet-based connectivity options meeting high availability standards.
HA VPN with dual active IPsec interfaces and Cloud Router dynamic routing provides 99.99% SLA over public internet.
Classic VPN only provides 99.9% SLA, whereas HA VPN topology guarantees 99.99% availability.
3
Evaluate options for sub-10 Gbps private connectivity without direct colocation access.
Partner Interconnect enables connection speeds from 50 Mbps up to 10 Gbps through a third-party network provider.
Dedicated Interconnect does not support sub-10 Gbps allocations like 500 Mbps.
4
Select central management architecture for enterprise transit connectivity.
Network Connectivity Center acts as a centralized management hub for global VPC and hybrid transit traffic using BGP spokes.
Standard VPC Peering is non-transitive, so transit routing requires Network Connectivity Center.

Key Concept

Selecting and architecting appropriate Google Cloud hybrid connectivity options (Dedicated Interconnect, Partner Interconnect, HA VPN, and Network Connectivity Center) based on bandwidth, SLA, encryption, and routing requirements.
Question 55Question →

An enterprise architecture team is implementing local developer workstation and CI/CD pipeline integration testing for microservices using Google Cloud Emulators. Match each Google Cloud service emulator on the left with its corresponding configuration environment variable and functional testing behavior on the right.

Click a left item, then click its matching right item

Items

Cloud Pub/Sub Emulator
Cloud Spanner Emulator
Cloud Firestore Emulator
Cloud Bigtable Emulator

Matches

Show answer & explanation

Answer

Each Cloud Emulator maps to its corresponding host environment variable and capability profile: Cloud Pub/Sub uses PUBSUB_EMULATOR_HOST with ephemeral state; Cloud Spanner uses SPANNER_EMULATOR_HOST supporting DDL/DML without CMEK; Cloud Firestore uses FIRESTORE_EMULATOR_HOST supporting security rules testing; Cloud Bigtable uses BIGTABLE_EMULATOR_HOST over gRPC without backup/restore capabilities.
Each service emulator requires setting its distinct host environment variable (e.g., PUBSUB_EMULATOR_HOST, SPANNER_EMULATOR_HOST, FIRESTORE_EMULATOR_HOST, BIGTABLE_EMULATOR_HOST) so that Google Cloud client SDKs redirect traffic to local ports instead of production GCP endpoints. Furthermore, each emulator provides specific local capabilities (such as Firestore Security Rules testing or Spanner local DDL execution) while intentionally omitting cloud-scale production capabilities like CMEK or backup/restore.

Step-by-Step Solution

1
Identify the standard environment variable naming convention used by gcloud emulators for client SDK redirection.
Recognized host environment variables: PUBSUB_EMULATOR_HOST, SPANNER_EMULATOR_HOST, FIRESTORE_EMULATOR_HOST, and BIGTABLE_EMULATOR_HOST.
Google Cloud client SDKs check service-specific environment variables to redirect network calls away from live cloud endpoints toward local localhost ports.
2
Evaluate the functional scope and limitations of each local emulator implementation.
Pub/Sub handles transient topics/subscriptions; Spanner executes DDL/DML without advanced security options; Firestore tests document queries and Security Rules; Bigtable provides basic gRPC key-value table operations without backup features.
Emulators mimic core functional APIs for integration testing but purposefully omit production cloud capabilities like multi-region replication, managed backups, and CMEK integration.

Key Concept

Google Cloud Emulators and Development Testing Frameworks
Estimated Time:1m 30s
Question 56Question →

Match each Google Cloud storage or database service on the left to its primary workload characteristic and access pattern on the right.

Click a left item, then click its matching right item

Items

Cloud Bigtable
Cloud Spanner
Cloud Storage
Cloud SQL

Matches

Show answer & explanation

Answer

Cloud Bigtable matches the high-throughput NoSQL wide-column store for time-series/analytical workloads. Cloud Spanner matches the globally distributed relational database with horizontal scaling and ACID compliance. Cloud Storage matches the unstructured object storage service for media and backups. Cloud SQL matches the managed regional relational database supporting PostgreSQL, MySQL, and SQL Server.
Each service is accurately paired with its primary architecture pattern: Cloud Bigtable for high-throughput NoSQL wide-column data, Cloud Spanner for globally consistent multi-region relational data, Cloud Storage for unstructured object data, and Cloud SQL for regional managed relational databases.

Step-by-Step Solution

1
Identify the data model requirements (structured relational vs. unstructured vs. NoSQL wide-column).
Cloud Storage handles unstructured objects; Cloud Bigtable handles NoSQL wide-column data; Cloud SQL and Cloud Spanner handle structured relational data.
Categorizing services by data model narrows down valid target access patterns.
2
Evaluate scale and regional constraints for relational services.
Cloud SQL represents regional managed relational engines (MySQL/PostgreSQL/SQL Server), whereas Cloud Spanner represents multi-region horizontal scaling with ACID guarantees.
Distinguishing between regional relational engines and enterprise global relational databases separates Cloud SQL from Cloud Spanner.
3
Verify NoSQL and object storage use cases.
Cloud Bigtable aligns with high-throughput key-value/time-series data, and Cloud Storage aligns with unstructured binary file and backup object storage.
Matching specific performance characteristics completes all service definitions.

Key Concept

Selecting GCP storage and database services based on data model, consistency needs, scale requirements, and access patterns.
Question 57Question →

Match each Google Cloud database or storage service on the left with its corresponding workload capability and access pattern on the right.

Click a left item, then click its matching right item

Items

Cloud Bigtable
Firestore
Cloud Storage
Cloud Spanner

Matches

Show answer & explanation

Answer

Cloud Bigtable pairs with high-throughput wide-column NoSQL; Firestore pairs with serverless document database for mobile/web; Cloud Storage pairs with unstructured object storage; Cloud Spanner pairs with globally scalable transactional relational database.
Each service directly maps to its primary design use case: Cloud Bigtable for high-throughput NoSQL time-series and wide-column data, Firestore for document storage with mobile/web real-time sync, Cloud Storage for unstructured object storage, and Cloud Spanner for globally distributed relational SQL workloads requiring strong ACID consistency.

Step-by-Step Solution

1
Identify the data model and storage format required for each service.
Cloud Bigtable is wide-column, Firestore is document-based, Cloud Storage is blob/object-based, and Cloud Spanner is relational.
Determining fundamental storage formats isolates applicable GCP storage categories.
2
Analyze access patterns and scale characteristics across each option.
Bigtable targets massive streaming write throughput, Firestore targets client synchronization, Cloud Storage targets file retrieval, and Spanner targets distributed transactional consistency.
Matching access patterns ensures selecting the optimal database service per workload requirement.

Key Concept

GCP Storage & Database Resource Selection
Question 58Question →

A multinational enterprise is designing a hybrid network architecture to connect its on-premises data centers with Google Cloud VPCs. Match each GCP hybrid networking component on the left with the architectural requirement or design constraint it satisfies on the right.

Click a left item, then click its matching right item

Items

Dedicated Interconnect
HA VPN
Partner Interconnect
Cloud Router

Matches

Show answer & explanation

Answer

Dedicated Interconnect pairs with direct 10/100 Gbps physical colocation connectivity; HA VPN pairs with 99.99% SLA IPsec connections over the public internet; Partner Interconnect pairs with sub-10 Gbps connectivity via service providers; Cloud Router pairs with dynamic BGP route control plane management.
Each GCP hybrid networking component directly matches its functional constraint: Dedicated Interconnect delivers unencrypted 10/100 Gbps direct physical colocation links; HA VPN provides 99.99% available IPsec tunnels over public transit; Partner Interconnect offers sub-10 Gbps service-provider-managed connections; Cloud Router provides dynamic BGP control plane routing.

Step-by-Step Solution

1
Identify direct high-bandwidth physical connection options
Dedicated Interconnect connects directly at a Google colocation facility using 10 Gbps or 100 Gbps physical circuits.
Direct private physical connections at colocation facilities meet strict high-throughput SLA demands.
2
Identify high-availability internet-based encrypted options
HA VPN delivers 99.99% SLA using dual active-active IPsec gateway tunnels over public internet routes.
HA VPN provides encrypted traffic transport with high availability topology requirements.
3
Identify sub-10 Gbps service provider connectivity options
Partner Interconnect bridges on-premises locations to GCP via third-party service provider networks for fractional bandwidth capacities.
Partner Interconnect supports data transport without requiring direct physical colocation infrastructure.
4
Determine the control plane mechanism for dynamic routing
Cloud Router establishes BGP sessions to exchange topology routes dynamically between VPCs and on-premises gateways.
Dynamic BGP route advertisement eliminates static route maintenance across hybrid links.

Key Concept

Designing Hybrid Network Architecture and Connectivity Controls
Estimated Time:1m 30s
Question 59Question →

A global pharmaceutical enterprise is modernizing its network architecture to support high-throughput genomic data transfers, remote lab connectivity, and multi-tenant environment isolation. Match each architectural constraint or requirement to the most appropriate Google Cloud hybrid networking service or deployment pattern.

Click a left item, then click its matching right item

Items

Requires a direct, private physical connection providing 100 Gbps bandwidth, low latency, and a 99.99% availability SLA without routing traffic over the public internet.
Requires SLA-backed 99.99% availability for encrypted hybrid connectivity over public internet lines to remote clinical trial sites, utilizing dynamic BGP routing.
Requires connecting on-premises data centers to GCP where physical presence at a Google colocation facility is unavailable, utilizing a supported service provider.
Requires interconnecting hundreds of isolated spoke VPCs to central hybrid connectivity pipelines without creating a complex, non-transitive mesh of individual VPC network peerings.

Matches

Show answer & explanation

Answer

Direct 100 Gbps private connection with 99.99% SLA matches Dedicated Interconnect with redundant edge availability domains. Encrypted connectivity over public internet with 99.99% SLA matches HA VPN with dual active IPsec tunnels and Cloud Router. Connection via a third-party service provider where direct colocation is absent matches Partner Interconnect. Scalable multi-VPC hub-and-spoke interconnectivity bypassing VPC Peering non-transitivity constraints matches Network Connectivity Center.
Each GCP hybrid networking service fulfills specific technical constraints: Dedicated Interconnect offers high-capacity (10/100 Gbps) direct physical lines; HA VPN supplies encrypted IPsec connections over public lines with 99.99% SLA; Partner Interconnect enables SLA-backed connections through service providers when direct colocation is absent; and Network Connectivity Center simplifies multi-VPC management while accommodating non-transitive VPC network boundaries.

Step-by-Step Solution

1
Analyze high-bandwidth direct physical circuit requirements.
Identify Dedicated Interconnect as the only option supporting 100 Gbps direct circuits with 99.99% SLA using dual Edge Availability Domains (EADs).
Cloud VPN cannot reach 100 Gbps without hundreds of tunnels, and Partner Interconnect relies on third-party provider capacity rather than direct 100 Gbps circuits.
2
Evaluate internet-based encrypted hybrid connection needs.
Match HA VPN to the requirement for 99.99% SLA IPsec encrypted tunnel connectivity over public internet.
Classic VPN does not offer a 99.99% SLA, whereas HA VPN provides high availability through dual active interfaces and Cloud Router BGP integration.
3
Determine connectivity option when lacking physical colocation presence.
Select Partner Interconnect.
Partner Interconnect bridges the customer network and GCP through a certified service provider when direct physical meet-me location presence is unavailable.
4
Resolve multi-VPC routing complexity and VPC Peering transitivity limitations.
Assign Network Connectivity Center (NCC) as the central hub solution for managing spoke VPC networks.
VPC Network Peering is strictly non-transitive, meaning traffic cannot hop across intermediate VPCs without custom VPN or proxy appliances, whereas NCC handles spoke routing centrally.

Key Concept

Selecting and architecting Google Cloud hybrid connectivity options (Dedicated Interconnect, Partner Interconnect, HA VPN, and Network Connectivity Center) based on SLA, bandwidth, encryption, physical colocation capability, and VPC transitivity constraints.
Question 60Question →

A financial analytics firm is architecting a hybrid network topology to connect its on-premises infrastructure with Google Cloud. Match each hybrid connectivity requirement on the left with the most appropriate Google Cloud networking solution on the right.

Click a left item, then click its matching right item

Items

Direct physical connection providing 20 Gbps private bandwidth to Google Cloud without traversing the public internet.
IPsec encrypted connectivity over the public internet supporting a 99.99% availability SLA.
Private connection for an office location where direct Google colocation footprint is unavailable and connection must be routed through a service provider.
Dynamic BGP route propagation and automated failover management across hybrid VPN and Interconnect connections.

Matches

Show answer & explanation

Answer

Direct 20 Gbps private connection matches Dedicated Interconnect; IPsec encrypted 99.99% SLA connection matches HA Cloud VPN; Service provider private link matches Partner Interconnect; Dynamic BGP route propagation matches Cloud Router.
Each hybrid networking requirement maps directly to its intended Google Cloud service component: Dedicated Interconnect handles direct physical high-bandwidth connections; HA Cloud VPN offers encrypted public internet connections backed by an SLA; Partner Interconnect enables private links via third-party service providers; and Cloud Router manages dynamic BGP routing.

Step-by-Step Solution

1
Analyze high-bandwidth direct private link requirements without public internet.
Identifies Dedicated Interconnect as the physical direct connectivity product capable of multi-10 Gbps private throughput.
Dedicated Interconnect connects directly to Google facilities at 10 Gbps or 100 Gbps per link.
2
Analyze IPsec encrypted public internet link with 99.99% SLA.
Identifies HA Cloud VPN.
HA Cloud VPN guarantees 99.99% service availability across dual active IPsec tunnels.
3
Analyze private connectivity needs delivered via a third-party service provider.
Identifies Partner Interconnect.
Partner Interconnect enables private GCP access through service provider networks when direct co-location is unavailable.
4
Analyze dynamic routing and automated failover control requirement.
Identifies Cloud Router.
Cloud Router runs BGP to establish dynamic routing across hybrid GCP connections.

Key Concept

Selecting and matching GCP hybrid connectivity services (Dedicated Interconnect, Partner Interconnect, HA Cloud VPN, Cloud Router) according to SLA, bandwidth, encryption, and physical colocation requirements.
PreviousPage 3 / 4Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin