Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 581Question →

An organization is deploying an application on Google Cloud and needs to configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS to protect sensitive data stored in Cloud Storage buckets and Compute Engine persistent disks. Which TWO requirements must be met to properly implement CMEK for these services? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the KMS key to the Google-managed service account for each respective GCP service.; Specify the Cloud KMS key resource ID when creating the Cloud Storage bucket or Compute Engine persistent disk.

Answer

The correct requirements are granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Google-managed service accounts for Cloud Storage and Compute Engine, and referencing the Cloud KMS key resource ID during resource creation.
Implementing CMEK for GCP resources requires providing the Cloud KMS key resource ID to the target service (such as Cloud Storage or Compute Engine) and granting the specific service agent the Cloud KMS CryptoKey Encrypter/Decrypter role so it can perform encryption/decryption operations.

Step-by-Step Solution

1
Identify the key management model being requested.
The scenario specifically asks for Customer-Managed Encryption Keys (CMEK) using Cloud KMS.
CMEK relies on keys hosted inside Google Cloud KMS rather than key material generated and supplied out-of-band by the customer in API requests.
2
Determine IAM permission requirements for GCP service integration.
GCP services use dedicated service agents to interact with Cloud KMS keys.
The service agents require the minimal predefined role 'roles/cloudkms.cryptoKeyEncrypterDecrypter' on the targeted CryptoKey.
3
Determine resource binding requirements.
Resources must be explicitly configured with the Cloud KMS key URI upon creation.
Providing the key resource ID instructs Google Cloud to encrypt new objects or persistent disks using the specified CMEK key.

Key Concept

Customer-Managed Encryption Keys (CMEK) and Service Agent IAM Configuration
Question 582Question →

A healthcare enterprise uses a Google Cloud resource hierarchy consisting of an Organization node, Department Folders, and nested Environment Folders ('Production' and 'Development'). A third-party security compliance system requires read-only access to inspect resource configurations, organizational security settings, and IAM access control lists across all Production projects, but must not be permitted to read underlying customer payload data in Cloud Storage or BigQuery. Which IAM role assignment strategy follows Google-recommended best practices for least privilege and operational efficiency?

Show answer & explanation

Answer: Grant the predefined Security Reviewer role (roles/iam.securityReviewer) to the compliance system service account on the Production Environment Folder.

Answer

Grant the predefined Security Reviewer role (roles/iam.securityReviewer) to the compliance system service account on the Production Environment Folder.
The predefined Security Reviewer role (roles/iam.securityReviewer) is specifically tailored for security auditing and compliance tools. It permits viewing security configurations, IAM policies, and asset metadata across resources. By assigning this role at the Production Environment Folder level, IAM policy inheritance automatically applies the permission to all existing and future projects beneath that folder, avoiding project-level management overhead and preventing exposure to raw stored data.

Step-by-Step Solution

1
Analyze access scope and least-privilege role requirements
The scenario requires inspecting security configurations, organizational IAM policies, and metadata across all production environments without reading actual underlying data payloads.
Granting data-level read roles or primitive roles exposes sensitive customer data stored in Cloud Storage or BigQuery.
2
Evaluate GCP predefined roles vs primitive/administrative roles
The predefined role 'Security Reviewer' (roles/iam.securityReviewer) provides specialized access to security configurations and IAM policies across GCP resources without providing data-payload read rights.
Using predefined security-focused roles ensures minimal required permissions while maintaining operational separation.
3
Leverage Resource Hierarchy for policy inheritance
Assigning the Security Reviewer role at the 'Production' Folder level automatically inherits down to all present and future child projects under that folder.
Inheritance reduces management overhead and eliminates the need to configure permissions on individual projects manually.

Key Concept

Identity and Access Management (IAM) Roles and Resource Hierarchy Inheritance
Question 583Question →

A healthcare technology company is building a stateless microservice to validate and convert patient intake records sent as JSON payloads via webhooks. The workload experiences highly unpredictable traffic, ranging from zero requests overnight to thousands of concurrent requests during peak hours. Each request takes less than two minutes to process. The architecture team requires a solution that minimizes operational management overhead, scales to zero automatically to reduce costs, and runs containerized applications without managing underlying infrastructure. Which Google Cloud compute platform should you recommend?

Show answer & explanation

Answer: Deploy the containerized service on Cloud Run.

Answer

Deploy the containerized microservice on Cloud Run, as it fully manages container execution, scales to zero during idle periods, and minimizes operational overhead for stateless HTTP workloads.
Deploying on Cloud Run is the optimal design choice because Cloud Run is a fully managed serverless compute platform designed specifically for stateless containerized web services. It automatically scales instances up and down responsively based on incoming requests (including scaling to zero when idle) and removes all cluster management, node patching, and infrastructure provisioning responsibilities.

Step-by-Step Solution

1
Analyze workload statefulness and traffic pattern requirements.
The microservice is stateless, processes short-duration HTTP webhooks (under two minutes), and experiences unpredictable traffic including idle periods.
Serverless container platforms are ideal for stateless, request-driven HTTP workloads with bursty traffic profiles.
2
Evaluate operational overhead and scaling constraints.
Cloud Run provides scale-to-zero capabilities and requires zero cluster or virtual machine management.
GKE Standard and Compute Engine MIGs introduce management burden and minimum baseline node charges.
3
Select the optimal compute platform based on GCP architectural best practices.
Cloud Run offers the optimal balance of zero infrastructure management, automatic scaling, and cost efficiency.
It directly satisfies the requirement for containerized deployment with minimal management effort and scale-to-zero functionality.

Key Concept

Compute Platform Selection: Cloud Run vs GKE vs Compute Engine MIG
Question 584Question →

An enterprise security architect is establishing an IAM role binding hierarchy for a newly onboarded analytics team requiring access to BigQuery datasets in a production project. To follow Google Cloud best practices for resource hierarchy organization and least privilege inheritance while minimizing administrative overhead, in what order should the architect structure and apply IAM role assignments from the broadest organizational container down to the resource level?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for structuring IAM role assignments top-down through the resource hierarchy is: 1) Define Organization-level policy bindings for security audit and broad governance, 2) Assign job-function predefined roles at the environment Folder level, 3) Grant project-scoped operational roles at the Project level, and 4) Configure fine-grained dataset IAM access controls at the specific Resource level.
Google Cloud IAM follows a top-down policy inheritance model where permissions granted at parent nodes (Organization -> Folder -> Project -> Resource) are inherited by all child resources. Best practices dictate establishing global audit/governance at the Organization root, assigning job-role predefined roles at environment Folders to minimize maintenance overhead, configuring specific workload and service account boundaries at the Project level, and applying object-level access on individual sensitive Resources.

Step-by-Step Solution

1
Establish root security baseline at the Organization node.
Organization-wide governance and audit capabilities are enforced across all child folders and projects.
Top-level policies inherit down the entire resource tree, so only broad governance roles belong at the organization root.
2
Assign functional environment roles at the Folder node.
All projects nested inside the environment folder inherit uniform job-function access.
Folder-level assignments streamline administration by granting permissions once for a logical group of related projects.
3
Bind project-specific roles and service account permissions at the Project node.
Project operational boundaries and compute/service account identities are constrained to single project scopes.
Project-level IAM prevents administrative leakage across neighboring projects within the same parent folder.
4
Apply granular dataset-level access at the Resource node.
Individual sensitive datasets enforce precise user/group access control.
Resource-level IAM bindings complement inherited policy by restricting or opening access to specific data objects based on least privilege principles.

Key Concept

IAM Policy Inheritance and Resource Hierarchy Scoping
Question 585Question →

An enterprise organization is establishing an automated CI/CD release pipeline using Cloud Build and Cloud Deploy to manage infrastructure and application workloads across GCP environments. The security architecture team requires that the pipeline adheres strictly to the principle of least privilege, specifically ensuring Cloud Build can impersonate dedicated target execution service accounts without gaining administrative control over IAM permissions or using over-privileged roles. Which architectural configuration correctly satisfies these requirements?

Show answer & explanation

Answer: Grant the Cloud Build service account the Service Account User role (roles/iam.serviceAccountUser) on the specific target execution service accounts, and assign appropriate predefined Cloud Deploy roles for release creation.

Answer

Grant the Cloud Build service account the Service Account User role (roles/iam.serviceAccountUser) on the specific target execution service accounts, and assign appropriate predefined Cloud Deploy roles for release creation.
The principle of least privilege requires granting the minimal set of permissions necessary to execute pipeline tasks. To allow Cloud Build to impersonate dedicated deployment execution service accounts, the Cloud Build service account must be granted the Service Account User role (roles/iam.serviceAccountUser) specifically on those target service accounts.

Step-by-Step Solution

1
Identify the minimum required permission for a service account to impersonate or run tasks as another execution service account in GCP.
The necessary IAM role is Service Account User (roles/iam.serviceAccountUser).
Service Account User provides permission to attach or impersonate the target service account without granting permissions to alter IAM policies.
2
Evaluate the pipeline runner security requirements against the principle of least privilege.
Cloud Build requires impersonation privileges restricted to specific target execution service accounts.
Scoping the role grant specifically to the target service account prevents unintended access across unapproved resources.
3
Select the correct IAM configuration option matching these least-privilege standards.
Granting roles/iam.serviceAccountUser on the target service account is the optimal and secure approach.
This avoids primitive roles and administrative over-privileging while maintaining full deployment automation capabilities.

Key Concept

Least-privilege IAM configuration for automated CI/CD pipeline service account impersonation.
Question 586Question →

An e-commerce organization uses Cloud Build and Cloud Deploy to execute automated continuous deployment pipelines for microservices backed by Cloud SQL. The cloud architecture team must secure the release pipeline, prevent state corruption during automated Infrastructure as Code (IaC) updates, and ensure application availability during database-backed release rollouts. Which TWO architectural and operational actions should the team implement?

Select all that apply

Show answer & explanation

Answer: Configure Cloud Build to impersonate fine-grained target service accounts using dedicated IAM roles, and store Terraform state in a Cloud Storage backend with object versioning and state locking enabled.; Ensure database schema updates are backward-compatible with previous application code versions before executing progressive release rollouts.

Answer

The correct recommendations are configuring Cloud Build to use least-privilege service account impersonation with a versioned Cloud Storage backend for Terraform state, and enforcing backward-compatible database schema changes before progressive application deployments.
Automating release pipelines requires balancing infrastructure state safety, security, and application continuity. Impersonating targeted service accounts with fine-grained roles alongside a Cloud Storage backend featuring versioning and locking ensures secure, conflict-free IaC management. Additionally, designing database migrations to be backward-compatible protects active traffic during progressive release rollouts.

Step-by-Step Solution

1
Secure the pipeline execution identity
Cloud Build operates using minimal required permissions via service account impersonation rather than broad administrative privileges.
Adhering to least privilege reduces blast radius in automated continuous deployment environments.
2
Configure remote IaC state management
Terraform state is stored centrally in Cloud Storage with object versioning and state locking.
Prevents state file corruption and race conditions when infrastructure updates are triggered concurrently.
3
Structure release strategies for zero-downtime application rollouts
Database schemas are updated in a backward-compatible manner prior to rolling out new application binaries.
Ensures that running application instances continue functioning while traffic is shifted during canary or progressive deployment phases.

Key Concept

Automating Secure CI/CD Pipelines and Zero-Downtime Release Strategies
Question 587Question →

An organization uses Cloud Build to execute Terraform scripts as part of its automated CI/CD deployment pipeline. Currently, developers run into frequent infrastructure deployment conflicts and state corruption when multiple pipeline jobs execute simultaneously because Terraform state is maintained in the local build workspace. Which strategy should the team implement to resolve this CI/CD pipeline issue following Google Cloud best practices?

Show answer & explanation

Answer: Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking enabled.

Answer

Configure the Terraform backend to store state files in a Google Cloud Storage bucket with object versioning and state locking enabled.
Configuring a Google Cloud Storage bucket with object versioning and state locking enabled acts as a centralized backend for Terraform. This ensures concurrent CI/CD pipeline executions wait for ongoing state operations to finish before modifying infrastructure, preventing state file corruption.

Step-by-Step Solution

1
Identify the root cause of CI/CD deployment conflicts
The pipeline relies on local state within an ephemeral container workspace, preventing state sharing and locking across concurrent executions.
Infrastructure as Code pipelines require a central, synchronized state repository to manage resources reliably.
2
Select the appropriate remote backend storage solution on GCP
Configure Cloud Storage as the remote backend for Terraform.
Cloud Storage provides persistent, central, and secure storage for state files across all CI/CD executions.
3
Enable concurrency controls and history tracking
Enable object versioning on the GCS bucket and leverage native Terraform state locking.
State locking prevents concurrent pipeline runs from corrupting the state file, while versioning provides rollback capabilities.

Key Concept

Centralized IaC state management and concurrency control in CI/CD pipelines
Question 588Question →

A enterprise security team wants to restrict the attach capability of cross-project service accounts across all cloud workloads by applying the `constraints/iam.disableCrossProjectServiceAccountUsage` constraint. However, before strictly enforcing this policy, they need to identify existing pipelines and services that rely on cross-project service accounts to prevent operational disruption. Which configuration strategy should the architecture team implement to evaluate potential impact without interrupting active workloads?

Show answer & explanation

Answer: Configure the organization policy constraint in dry-run mode at the organization level, and monitor Cloud Audit Logs for policy violation log entries.

Answer

Configure the organization policy constraint in dry-run mode at the organization level, and monitor Cloud Audit Logs for policy violation log entries.
Applying Organization Policy constraints in dry-run mode allows organizations to test policy guardrails across the resource hierarchy. In dry-run mode, resource operations that violate the constraint are allowed to proceed, but violation details are emitted to Cloud Audit Logs. This enables security teams to identify non-compliant workloads and update service dependencies before enforcing the policy strictly.

Step-by-Step Solution

1
Identify governance evaluation requirements
Recognize the requirement to test restriction policies without breaking existing production pipelines.
Dry-run policy evaluation allows monitoring violations safely before enforcing constraints.
2
Apply Organization Policy dry-run configuration
Set `constraints/iam.disableCrossProjectServiceAccountUsage` in dry-run configuration mode at the target hierarchy node.
Dry-run mode writes violation events to Cloud Audit Logs while permitting resource requests to complete.
3
Audit violation events
Query Cloud Audit Logs for policy violation entries to remediate dependencies prior to enforcing the policy.
Analyzing log metrics identifies impacted service account usages for remediation.

Key Concept

Organization Policy Dry-Run Mode and Governance Testing
Question 589Question →

A financial analytics company is migrating its historical transaction log archive (120 TB120\text{ TB}) and an operational 500 GB500\text{ GB} MySQL database from an on-premises data center to Google Cloud. The environment has an active 1 Gbps1\text{ Gbps} Cloud Dedicated Interconnect connection to GCP. The migration plan requires completing the archive movement with minimal operational overhead, while minimizing downtime for the operational database during a planned 4-hour maintenance window. Which data transfer and migration strategy should the Cloud Architect recommend?

Show answer & explanation

Answer: Use Storage Transfer Service to transfer the 120 TB120\text{ TB} log archive to Cloud Storage over the Dedicated Interconnect, and use Database Migration Service (DMS) with continuous replication to migrate the MySQL database to Cloud SQL.

Answer

The optimal strategy is to use Storage Transfer Service to move the log archive to Cloud Storage over the Dedicated Interconnect, and use Database Migration Service with continuous replication to migrate the MySQL database to Cloud SQL.
Transferring 120 TB over a 1 Gbps Dedicated Interconnect takes roughly 11.6 days of continuous transfer, which fits standard online migration preparation timelines using Storage Transfer Service. For the 500 GB MySQL database, Database Migration Service (DMS) establishes Change Data Capture (CDC) replication from on-premises to Cloud SQL prior to cutover, allowing a zero-data-loss cutover well within the 4-hour maintenance window.

Step-by-Step Solution

1
Evaluate bandwidth and timeframe for the 120 TB static log archive.
At 1 Gbps dedicated bandwidth, transferring 120 TB online takes approximately 11 to 12 days, making online transfer with Storage Transfer Service ideal without requiring physical device shipping.
Storage Transfer Service handles network bandwidth throttling, retries, and data integrity validation over private Cloud Interconnect connections.
2
Evaluate database cutover downtime requirements for the 500 GB MySQL database.
Continuous replication using Database Migration Service (DMS) keeps the Cloud SQL target instance synchronized with the source database in near real time.
DMS continuous replication minimizes cutover downtime to minutes (promoting the standby target), easily satisfying the strict 4-hour maintenance window requirement.

Key Concept

Selecting Online Data Transfer vs. Physical Appliances and Continuous Database Replication Strategies
Question 590Question →

An online streaming platform uses a 10 Gbps Partner Interconnect connection as its primary link between an on-premises data center and a Google Cloud VPC, with an HA VPN connection configured as a secondary backup link. Both hybrid connections terminate on the same Cloud Router in the us-east1 region using dynamic BGP routing. During high-traffic events, network operations notices that egress traffic from the VPC to the on-premises network is being distributed equally across both paths, causing high latency and packet reordering over the lower-speed VPN link. How should the network architect adjust the Cloud Router BGP configuration to ensure that egress traffic from Google Cloud strictly prefers the Partner Interconnect connection under normal operating conditions?

Show answer & explanation

Answer: Set a lower base advertised route priority value on the Partner Interconnect BGP session relative to the HA VPN BGP session.

Answer

Assigning a lower base advertised route priority (which corresponds to a lower BGP MED value) to the Partner Interconnect BGP session compared to the HA VPN BGP session on the Cloud Router ensures Google Cloud prefers the Partner Interconnect route for outbound traffic.
Google Cloud Router uses the base advertised route priority to advertise MED values for BGP routes. BGP routing decision logic prefers routes with lower MED values. Setting a lower priority value on the Partner Interconnect BGP session relative to the HA VPN BGP session instructs Google Cloud to prioritize the Partner Interconnect path for egress traffic back to the on-premises network.

Step-by-Step Solution

1
Analyze the routing behavior
Equal cost multi-path (ECMP) routing occurs when BGP routes learned or advertised across redundant paths carry identical MED/priority values.
Traffic is being distributed across both high-speed Partner Interconnect and lower-speed HA VPN links because Cloud Router views them as equal priority paths.
2
Identify GCP Cloud Router BGP priority mechanisms
Cloud Router utilizes the 'base advertised route priority' setting to advertise MED values to peer routers and select outbound routes.
In BGP routing policy, lower MED numerical values represent higher route preference.
3
Apply the optimal configuration change
Configure a lower base advertised priority (e.g., 100) on the Partner Interconnect BGP session and a higher priority (e.g., 200) on the HA VPN BGP session.
This guarantees that egress traffic from the VPC defaults to the Partner Interconnect link and only spills over or fails over to HA VPN if the primary link drops.

Key Concept

Cloud Router BGP Route Prioritization and MED
Question 591Question →

A multinational financial institution is configuring automated compliance guardrails across its Google Cloud resource hierarchy. The cloud architecture team must enforce two governance mandates:
1. Prevent the creation of user-managed service account keys across all projects in the organization, while granting an exception for a legacy payment integration project residing in a dedicated folder that requires JSON keys for on-premises authentication.
2. Restrict resource deployment locations to European Union regions (in:eu−locationsin:eu-locations) across the entire hierarchy, while allowing a specialized high-performance analytics project to deploy compute resources in in:us−central1−locationsin:us-central1-locations.

Which TWO architectural configurations should the cloud architect implement to meet these governance requirements?

Select all that apply

Show answer & explanation

Answer: Enforce the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` at the Organization root node, and set an explicit enforcement rule of `enforced: false` on the legacy payment integration project to override inheritance.; Apply the list constraint `constraints/gcp.resourceLocations` with `allowed_values = ["in:eu-locations"]` at the Organization root, and configure a policy rule on the analytics project with `allowed_values = ["in:us-central1-locations"]` while overriding parent rules.

Answer

The architect must enforce the service account key creation boolean constraint at the Organization root with an explicit non-enforced override on the legacy project, and set the resource location list constraint to EU locations globally while overriding the rule on the analytics project to allow US Central locations.
Organization policies allow central security teams to restrict resource configurations hierarchically. Boolean constraints such as service account key creation restriction can be enforced at the root and selectively set to non-enforced on sub-nodes. List constraints such as resource locations allow defining allowed values (e.g., EU regions) at the root while replacing parent rules on sub-projects to permit specific alternative locations.

Step-by-Step Solution

1
Analyze requirement for credential security governance and exception handling.
Identified `constraints/iam.disableServiceAccountKeyCreation` as the appropriate boolean constraint.
Boolean constraints inherit down the resource hierarchy. Applying enforcement at the Organization root secures all child nodes, while setting `enforced: false` on a specific project child node overrides the inherited policy for authorized exceptions.
2
Analyze location restriction governance and project-level exception requirement.
Identified `constraints/gcp.resourceLocations` as the required list constraint.
List constraints support value matching groups such as `in:eu−locationsin:eu-locations`. Configuring allowed values at the root sets the baseline, while child nodes can override parent rules (`inheritFromParent: false`) to define specific allowed values such as `in:us−central1−locationsin:us-central1-locations`.
3
Evaluate invalid governance approaches.
Rejected options relying on primitive IAM roles, VPC Service Controls exfiltration boundaries, or elevated service account permissions.
Organization Policies evaluate resource configuration limits independently of IAM permission grants or network perimeter definitions.

Key Concept

Organization Policy Resource Hierarchy Inheritance & Overrides
Question 592Question →

An enterprise HR platform is migrating its background check system to Google Cloud. The system consists of two distinct components:

1. Candidate Web Portal: A stateless HTTP API receiving candidate form submissions. Traffic is highly unpredictable, spiking during business hours and dropping to near zero overnight. The platform team requires zero infrastructure management overhead and automatic scaling down to zero.
2. Verification Rendering Engine: A continuous batch process that performs document validation and rendering. It requires custom C++ Linux socket tuning at the operating system level and runs continuously 24/7 with steady compute demands.

Which TWO architectural decisions should the Cloud Architect recommend to optimize operational efficiency and cost?

Select all that apply

Show answer & explanation

Answer: Deploy the Candidate Web Portal on Cloud Run.; Deploy the Verification Rendering Engine on Compute Engine Virtual Machines backed by Committed Use Discounts.

Answer

Deploy the Candidate Web Portal on Cloud Run, and deploy the Verification Rendering Engine on Compute Engine Virtual Machines backed by Committed Use Discounts.
Cloud Run provides a fully managed serverless execution environment ideal for bursty, stateless HTTP applications requiring scale-to-zero capability without infrastructure management. Compute Engine virtual machines provide full control over the operating system environment needed for custom kernel tuning, while Committed Use Discounts offer maximum cost savings for sustained 24/7 workloads.

Step-by-Step Solution

1
Analyze the requirements for Component 1 (Candidate Web Portal)
The workload is stateless, HTTP-based, bursty, requires zero infrastructure management, and needs scale-to-zero capabilities.
Cloud Run is the optimal Google Cloud compute platform for stateless containerized web services requiring scale-to-zero and fully managed operations.
2
Analyze the requirements for Component 2 (Verification Rendering Engine)
The workload requires custom Linux OS kernel socket modifications and runs continuously 24/7 with steady demand.
Compute Engine provides complete OS control for kernel-level customizations, while Committed Use Discounts significantly lower costs for steady 24/7 usage.
3
Evaluate and reject misallocated alternatives
GKE adds unnecessary management overhead for simple microservices; Cloud Run does not allow low-level kernel modifications; Committed Use Discounts on bursty scale-to-zero workloads lead to financial waste.
Matching compute options directly to workload statefulness, customization limits, and scaling characteristics ensures architectural alignment with GCP best practices.

Key Concept

Compute platform selection based on scaling behavior, OS-level customization, operational overhead, and cost optimization models.
Question 593Question →

A cloud engineering team is establishing an automated continuous delivery pipeline for a containerized microservice running on Google Kubernetes Engine (GKE). The architecture requires container image building, vulnerability scanning, cryptographic image attestation, progressive canary deployment, and metric-driven production promotion using Cloud Build, Artifact Registry, Binary Authorization, Cloud Deploy, and Cloud Monitoring. In what chronological sequence should these operational pipeline stages execute from source commit to full release verification?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct pipeline execution order is: 1) Triggering Cloud Build to construct and store the container image in Artifact Registry, 2) Scanning the image and creating a signed Binary Authorization attestation with Cloud KMS, 3) Deploying via Cloud Deploy to a GKE canary target with 10% traffic, and 4) Validating metrics via Cloud Monitoring before promoting to 100% production traffic.
The sequence logically progresses through CI build generation, automated vulnerability scanning and policy attestation signing, initial low-risk deployment (canary), and metric-driven full release promotion.

Step-by-Step Solution

1
Build and store artifact
Container image created and pushed to Artifact Registry
Source code must be compiled into an immutable artifact before security scanning or deployment can begin.
2
Vulnerability scanning and cryptographic attestation
Binary Authorization attestation signed using Cloud KMS
Binary Authorization policies require explicit attestation signatures verifying security compliance prior to deployment admittance.
3
Initiate progressive delivery canary deployment
Cloud Deploy deploys release to GKE and routes 10% of traffic
Canary deployment limits blast radius by verifying new software against a small slice of real traffic.
4
Monitor health metrics and promote release
Release promoted to full 100% production traffic
Automated verification against SLOs/SLIs ensures system stability prior to full traffic cutover.

Key Concept

Automated CI/CD Pipeline Sequencing with Cryptographic Attestation and Progressive Delivery
Question 594Question →

An organization is provisioning a multi-region Google Cloud infrastructure spanning `us-central1` and `europe-west1`. The architecture requires a high-throughput hybrid network connection to an on-premises data center supporting 20 Gbps bandwidth with automated cross-region route failover. Additionally, private GKE clusters deployed in the application subnets must access Cloud Storage securely without public internet exposure, and administrative access to the GKE control plane must be limited strictly to an internal administration subnet CIDR. Which TWO network topology configurations and architectural decisions should the Cloud Architect implement? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Provision Dedicated Interconnect circuits with VLAN attachments connected to Cloud Routers in both regions, and set the VPC Dynamic Routing Mode to Global.; Enable Private Google Access on the GKE node subnets and configure Control Plane Authorized Networks on the GKE clusters specifying the internal administration subnet CIDR.

Answer

The correct configurations are provisioning Dedicated Interconnect with Global Dynamic Routing enabled on the VPC network, and enabling Private Google Access on GKE subnets while configuring Control Plane Authorized Networks.
To achieve 20 Gbps hybrid connectivity with cross-region failover, Dedicated Interconnect must be combined with Cloud Routers using Global Dynamic Routing, allowing BGP routes to propagate across all regions in the VPC. For securing GKE infrastructure, Private Google Access allows private VM nodes to communicate with Cloud Storage over internal routes, while GKE Control Plane Authorized Networks restrict master access exclusively to trusted internal subnet ranges.

Step-by-Step Solution

1
Analyze hybrid connectivity throughput and dynamic failover requirements.
Dedicated Interconnect satisfies the 20 Gbps bandwidth requirement (exceeding standard 3 Gbps HA VPN tunnel limits). Setting VPC dynamic routing to Global enables Cloud Routers in `us-central1` and `europe-west1` to exchange BGP routes across regions for automated failover.
Regional dynamic routing limits BGP route propagation strictly to the local region, whereas Global dynamic routing shares learned routes across all regions within the VPC.
2
Evaluate GKE private access and master security endpoint configuration.
Private Google Access allows instances without external IP addresses to reach Google APIs (such as Cloud Storage) internally. Control Plane Authorized Networks block unauthorized IP traffic from accessing the GKE cluster control plane.
These combined settings ensure data paths to storage remain on internal Google infrastructure and cluster administration is restricted strictly to designated internal management subnets.
3
Identify and reject invalid networking assumptions.
Discard non-transitive VPC peering designs, single-tunnel HA VPN for high throughput requirements, and IAM-only data exfiltration controls.
VPC Peering does not support transitive routing, Cloud VPN cannot support 20 Gbps per tunnel, and IAM alone cannot stop network exfiltration without VPC Service Controls.

Key Concept

Configuring Global Dynamic Routing with Dedicated Interconnect and Securing Private VPC Subnet Access
Question 595Question →

An online gaming platform is migrating its operational PostgreSQL database and 80 TB80\text{ TB} of unstructured telemetry logs from an on-premises data center to Google Cloud. To ensure zero data loss and minimal downtime during final cutover, place the migration and data transfer steps in the correct chronological sequence.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of migration steps is: 1) Provision Dedicated Cloud Interconnect connectivity, 2) Execute baseline Storage Transfer Service jobs while configuring Database Migration Service CDC, 3) Perform data integrity validation and verify near-zero replication lag, and 4) Promote the Cloud SQL instance, update application connection endpoints to Google Cloud, and terminate the replication stream.
The correct migration sequence follows standard GCP Cloud Migration Framework phases: Hybrid network connectivity (Dedicated Cloud Interconnect) must be established first. Next, initial bulk historical data transfer (Storage Transfer Service) and continuous database replication (Database Migration Service CDC) run concurrently. Once data replication lag drops to near zero, validation is performed to confirm data parity. Finally, database promotion and application endpoint cutover complete the migration.

Step-by-Step Solution

1
Establish hybrid network connectivity
High-bandwidth Dedicated Cloud Interconnect provisioned between data center and VPC.
Hybrid networking must be operational prior to initiating large-scale data migration to guarantee low latency and bandwidth.
2
Initiate bulk storage backfill and continuous database CDC
$80 TB of historical logs synced to Cloud Storage and live PostgreSQL transactions replicated to Cloud SQL.
Bulk transfer uploads historical data while CDC captures ongoing write activity to prepare for zero-downtime cutover.
3
Validate data integrity and check replication lag
Target Cloud SQL instance verified for data completeness with negligible replication delay.
Ensures no transactional data is lost or corrupted before cutover decisions are executed.
4
Promote target instance and perform final traffic cutover
Application traffic redirected to Cloud SQL and migration job finalized.
Promoting the replica and shifting endpoints finalizes the migration with minimal downtime.

Key Concept

Cloud Data Migration Lifecycle & Zero-Downtime Cutover Strategy
Question 596Question →

A healthcare enterprise is migrating a relational database workload to Cloud SQL for PostgreSQL. Regulatory compliance mandates that the enterprise maintain physical and cryptographic sovereignty over the root encryption key within their on-premises Hardware Security Module (HSM), strictly prohibiting raw root key material from ever being generated or stored within Google Cloud infrastructure. Simultaneously, the security team requires seamless data-at-rest protection for Cloud SQL without modifying application code for client-side encryption. Which encryption and key management architecture satisfies all compliance and operational requirements?

Show answer & explanation

Answer: Configure Cloud SQL to use Customer-Managed Encryption Keys (CMEK) backed by Cloud External Key Manager (Cloud EKM), routing key requests to the on-premises HSM over a dedicated private network connection.

Answer

Configure Cloud SQL to use Customer-Managed Encryption Keys (CMEK) integrated with Cloud External Key Manager (Cloud EKM) connected to the on-premises HSM over a private network.
The solution leveraging Cloud External Key Manager (Cloud EKM) backed by Cloud KMS enables Cloud SQL to encrypt data at rest using CMEK while keeping the master encryption keys stored exclusively within the customer's on-premises HSM. Key requests are securely routed over private connectivity whenever cryptographic operations are required.

Step-by-Step Solution

1
Analyze regulatory constraints regarding key sovereignty and storage locations.
Identified that key material must reside strictly inside the customer's on-premises HSM and cannot be generated or stored directly in Google Cloud (ruling out Google-default encryption, standard Cloud KMS, and Cloud HSM).
Regulatory compliance forbids raw key material inside GCP.
2
Evaluate service compatibility and operational integration requirements for Cloud SQL.
Cloud SQL supports Customer-Managed Encryption Keys (CMEK) for transparent storage encryption without requiring application code changes.
Database encryption must be transparent to application logic.
3
Select the appropriate GCP key management capability that bridges external HSMs with GCP service CMEK.
Cloud External Key Manager (Cloud EKM) allows Cloud KMS to delegate cryptographic operations to an external HSM over a secure connection (Cloud Interconnect/VPN), satisfying both external sovereignty and transparent CMEK integration.
Cloud EKM fulfills the requirement for external key sovereignty while supporting native CMEK integrations.

Key Concept

Cloud External Key Manager (Cloud EKM) and Customer-Managed Encryption Keys (CMEK)
Question 597Question →

A cloud architect is standardizing an organization's infrastructure automation practices. The team needs to safely transition a local Terraform state file to a centralized Google Cloud Storage (GCS) backend to support team collaboration and state locking. In what order should the architect execute the steps for this migration process?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: first provision the GCS bucket with versioning, next define the gcs backend configuration block, then execute terraform init to migrate the state file, and finally delete the local state file while restricting bucket permissions.
Establishing a GCS remote backend requires provisioning the prerequisite Cloud Storage bucket first, declaring the backend gcs block in configuration code second, running terraform init to trigger state migration third, and completing post-migration local cleanup and access restriction fourth.

Step-by-Step Solution

1
Provision GCS Bucket
A secure, version-enabled GCS bucket is created.
Terraform requires an existing GCS bucket endpoint before it can store state remotely.
2
Declare GCS Backend
The Terraform root configuration references the target GCS bucket and path prefix.
Terraform CLI relies on backend configuration code to determine where remote state operations are targeted.
3
Run Initialization and Migrate
Local state is uploaded to GCS and state lock tracking is initialized.
Executing terraform init detects backend changes and prompts to transfer local state to the newly configured GCS backend.
4
Post-Migration Cleanup and Security
Local state file is removed and IAM permissions are configured for state protection.
Prevents state drift or accidental state file exposure, while ensuring team access follows least-privilege security controls.

Key Concept

Remote Infrastructure State Management and Migration in Terraform
Question 598Question →

A financial enterprise operating on Google Cloud requires an automated central compliance solution for security audit logs. The security architect must aggregate Data Access audit logs across all organization folders into a dedicated security project. The solution must satisfy strict regulatory compliance by protecting log destination buckets with enterprise-managed encryption keys, preventing authorized internal identities from exfiltrating stored log files to unauthorized external projects, and granting minimum required identity permissions. Which architecture strategy meets these security and compliance requirements?

Show answer & explanation

Answer: Configure an organization-level aggregated log sink targeting a central Cloud Storage bucket encrypted with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and include the central security logging project within a VPC Service Controls perimeter.

Answer

The correct strategy is to create an organization-level aggregated log sink directing logs to a Cloud Storage bucket encrypted with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, while enforcing a VPC Service Controls perimeter around the central logging project.
The valid architecture combines organization-level aggregated logging for complete visibility, Customer-Managed Encryption Keys (CMEK) via Cloud KMS to fulfill customer-managed key governance, and VPC Service Controls around the central logging project to strictly block data exfiltration to external, non-authorized GCP projects.

Step-by-Step Solution

1
Evaluate key management options for automated log sinks.
Determine that Google Cloud services writing background audit logs automatically support Cloud KMS Customer-Managed Encryption Keys (CMEK), whereas Customer-Supplied Encryption Keys (CSEK) cannot be used because automated service agents cannot supply raw keys per API request.
Regulatory compliance requiring customer control over encryption keys must be satisfied via CMEK when integrating with automated Cloud Logging export sinks.
2
Assess data exfiltration protections for audit logs.
Recognize that IAM policies authenticate and authorize identities but cannot prevent an authorized user or compromised service account from exfiltrating data to an outside storage bucket.
VPC Service Controls must be configured around the security logging project to establish a security perimeter that restricts cross-project data transfers.
3
Verify least privilege identity configuration.
Ensure service accounts writing audit logs are assigned specific resource object roles (such as Storage Object Creator) rather than elevated administrative roles.
Excessive administrative privileges like Service Account Admin increase attack surface and violate GCP security standards.

Key Concept

Organization Log Aggregation, CMEK Integration, and Data Exfiltration Prevention via VPC Service Controls
Question 599Question →

A healthcare provider must store patient records in Cloud Storage. Regulatory requirements mandate that the encryption keys protecting the data must reside exclusively within the company's on-premises Hardware Security Module (HSM) and never be stored inside Google Cloud, while allowing Google Cloud Storage to perform automated encryption and decryption operations. Which key management solution should you select?

Show answer & explanation

Answer: Customer-Managed Encryption Keys (CMEK) integrated with Cloud External Key Manager (Cloud EKM)

Answer

Customer-Managed Encryption Keys (CMEK) integrated with Cloud External Key Manager (Cloud EKM)
Cloud External Key Manager (Cloud EKM) enables GCP services to use Customer-Managed Encryption Keys (CMEK) where the actual key material resides outside Google Cloud in an on-premises or external Key Management Service / HSM.

Step-by-Step Solution

1
Identify key storage constraints
Keys must reside in an on-premises HSM external to Google Cloud.
Regulatory compliance requires physical key control off-cloud.
2
Evaluate key management mechanisms in GCP
Cloud External Key Manager (Cloud EKM) allows Cloud KMS to use keys hosted in third-party or on-premises key managers.
Cloud EKM bridges CMEK integration with external key storage.

Key Concept

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)
Question 600Question →

A healthcare enterprise is deploying a containerized analytics microservice on Google Cloud. The architecture team needs to provision a compute solution that minimizes operational management overhead, ensures compute nodes are strictly isolated from the public internet without public IP addresses, and enables container workloads to securely access Cloud Storage using least-privilege IAM permissions. Which combination of provisioning steps should the cloud architect recommend? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Provision a Google Kubernetes Engine (GKE) Autopilot cluster configured as a private cluster.; Configure Workload Identity on the GKE cluster and map the Kubernetes service account to a dedicated IAM service account with granular permissions.

Answer

The correct recommendations are provisioning a private GKE Autopilot cluster and configuring Workload Identity mapped to a dedicated IAM service account with granular permissions.
Provisioning a private GKE Autopilot cluster satisfies both operational efficiency and network isolation requirements by eliminating manual node management and keeping node IPs internal. Configuring Workload Identity ensures pods obtain short-lived tokens associated with specific IAM service accounts, enforcing least-privilege security for Cloud Storage access.

Step-by-Step Solution

1
Select the appropriate GKE operational mode and network configuration
Provisioning a private GKE Autopilot cluster removes node management overhead while ensuring nodes have internal IP addresses only.
Autopilot automates cluster provisioning, repair, and scaling while private mode guarantees network isolation.
2
Configure application authentication using least-privilege security practices
Enabling Workload Identity binds Kubernetes service accounts to specific IAM service accounts.
This allows pod containers to safely authenticate to Google Cloud services without static service account keys or broad node permissions.

Key Concept

Provisioning GKE Private Autopilot Clusters with Workload Identity
Estimated Time:2m 0s
PreviousPage 30 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin