All practice questions

1598 questions

All types1,598 Multiple choice815 Multiple select537 Numeric8 Matching64 Ordering174

A telemetry infrastructure team is designing the provisioning of a high-throughput time-series database on Google Cloud to ingest real-time IoT metrics. Additionally, they must migrate 3 petabytes of historical baseline metrics from their on-premises data center within a strict 14-day window. The company's on-premises internet link is limited to an unreserved 1 Gbps connection. Regulatory compliance mandates that all stored data at rest must be encrypted using keys managed in Cloud KMS with automated monthly rotation, while preventing team overhead associated with storing raw key material. Which combination of services and provisioning strategies meets all throughput, migration timeline, and compliance requirements?

Provision Cloud Bigtable configured with Customer-Managed Encryption Keys (CMEK) referencing Cloud KMS for real-time ingestion, and request Google Cloud Transfer Appliance to perform the offline migration of the 3 PB dataset into Cloud Storage.

Provision Cloud Spanner across a multi-region configuration using Customer-Supplied Encryption Keys (CSEK) for real-time ingestion, and deploy Storage Transfer Service over the existing 1 Gbps link to stream the 3 PB historical dataset.

Provision Cloud Bigtable with default Google-managed encryption keys, and set up Storage Transfer Service agents on local servers to upload the 3 PB historical dataset over the internet while maintaining Terraform state files locally without object locking.

Provision Cloud Bigtable configured with Customer-Supplied Encryption Keys (CSEK), and order Google Cloud Transfer Appliance to import the 3 PB offline dataset while maintaining infrastructure provisioning scripts in local unversioned files.

Show answer & explanation

Answer: Provision Cloud Bigtable configured with Customer-Managed Encryption Keys (CMEK) referencing Cloud KMS for real-time ingestion, and request Google Cloud Transfer Appliance to perform the offline migration of the 3 PB dataset into Cloud Storage.

Answer

The correct strategy combines Cloud Bigtable for high-throughput time-series telemetry ingestion, Google Cloud Transfer Appliance for migrating 3 PB of data offline within 14 days, and CMEK via Cloud KMS to comply with encryption and automated rotation policies without raw key management overhead.

Step-by-Step Solution

Analyze data transfer timeline constraints

Calculating network throughput for 3 PB over 1 Gbps yields roughly 277 days under ideal conditions (

3 \times 10^{15} \text{ bytes} \times 8 \text{ bits/byte} / 10^9 \text{ bps} \approx 2.4 \times 10^7 \text{ seconds}

). An offline physical transfer appliance is mathematically required to meet the 14-day migration window.

Online streaming via Storage Transfer Service is unviable due to physical bandwidth bottlenecks.

Select appropriate database system for time-series IoT workload

Cloud Bigtable is the optimal high-throughput, low-latency target for time-series IoT data.

Cloud Bigtable scales linearly for continuous high-rate writes and reads.

Evaluate key management security and compliance requirements

Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow automated key rotation without requiring raw key management overhead (unlike CSEK).

CMEK integrates natively with Cloud Bigtable and Cloud Storage while satisfying regulatory requirements.

Key Concept

Provisioning scalable storage and database resources using physical transfer mechanisms for petabyte-scale data and CMEK via Cloud KMS for security compliance.

Estimated Time:2m 0s

Question 602Question →

A enterprise governance team is updating security guardrails for a dedicated `Production` folder containing multiple Google Cloud projects. The team must enforce two main requirements: prevent any newly created Compute Engine VMs or Cloud SQL instances from receiving public IP addresses, and evaluate potential pipeline disruptions by auditing policy violations before actively blocking non-compliant resource deployments. Which TWO actions should you recommend to fulfill these requirements? (Select TWO.)

Select all that apply

Apply Organization Policy constraints `compute.vmExternalIpAccess` and `sql.restrictPublicIp` at the `Production` folder level.

Assign the primitive `roles/viewer` role to project developers to prevent them from allocating external network interfaces.

Configure the `dryRunPolicy` specification on the Organization Policy constraints to monitor non-compliant resource requests in Cloud Audit Logs prior to active enforcement.

Construct a VPC Service Controls perimeter around the `Production` folder to block public IP assignment on Compute Engine and Cloud SQL instances.

Show answer & explanation

Answer: Apply Organization Policy constraints `compute.vmExternalIpAccess` and `sql.restrictPublicIp` at the `Production` folder level.; Configure the `dryRunPolicy` specification on the Organization Policy constraints to monitor non-compliant resource requests in Cloud Audit Logs prior to active enforcement.

Answer

Enforce the `compute.vmExternalIpAccess` and `sql.restrictPublicIp` Organization Policy constraints on the target folder, and utilize the `dryRunPolicy` specification to audit policy violations in Cloud Audit Logs without blocking active operations.

Applying boolean Organization Policy constraints (`compute.vmExternalIpAccess` and `sql.restrictPublicIp`) at the target folder level ensures programmatic guardrails against public IP assignment across all underlying projects. Configuring the `dryRunPolicy` specification enables auditing violations via Cloud Logging before enforcing blocking actions, satisfying the mandate to assess impact on CI/CD pipelines.

Step-by-Step Solution

Identify the proper Google Cloud mechanism for enforcing infrastructure configuration guardrails across resource hierarchies.

Organization Policy constraints (`compute.vmExternalIpAccess` and `sql.restrictPublicIp`) targeted at the folder level prevent public IP assignments.

Organization Policies enforce programmatic configuration restrictions hierarchically across all projects contained within a folder.

Determine how to test policy enforcement without breaking existing CI/CD automation pipelines.

Use Organization Policy dry-run mode (`dryRunPolicy`).

Dry-run mode evaluates policy compliance against incoming requests and writes log entries to Cloud Audit Logs without rejecting non-compliant requests.

Key Concept

Organization Policy constraints and dry-run evaluation mode

Question 603Question →

A Principal Cloud Architect is establishing design standards for a mission-critical connected vehicle telematics platform on Google Cloud. Place the architectural design activities in the correct sequential order, starting from initial business abstraction down to concrete physical infrastructure implementation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with defining the high-level conceptual architecture, followed by constructing the logical architecture tiering, then mapping logical components to concrete Google Cloud services, and concluding with specifying the physical infrastructure deployment layout and security perimeters.

The correct architectural lifecycle progresses from technology-agnostic business definitions to concrete infrastructure deployment. First, the conceptual architecture establishes overall business capabilities and scope. Second, the logical architecture defines functional tiers, interfaces, and data flows. Third, physical architecture begins by mapping these logical components onto appropriate GCP managed services. Finally, the physical architecture is completed by defining low-level infrastructure deployment parameters, network topologies, encryption, and security perimeters.

Step-by-Step Solution

Identify the conceptual design phase.

Establish business capabilities, domain boundaries, and high-level data flow without technical implementation details.

Architectural translation always begins at the conceptual abstraction layer to align solution boundaries with enterprise business objectives.

Identify the logical design phase.

Decompose conceptual capabilities into logical tiers, functional components, and interface definitions.

Logical architecture defines structural building blocks and technology-agnostic service relationships derived from the conceptual model.

Identify the physical cloud service selection phase.

Map logical tiers to specific Google Cloud managed services (such as Pub/Sub, Dataflow, and Bigtable).

Physical architecture begins by selecting concrete Cloud products that meet the technical requirements defined in the logical design.

Identify the physical network and security specification phase.

Define VPC subnetting, Cloud Interconnect connections, KMS keys, and VPC Service Controls.

The complete physical architecture finalizes environment implementation details, network security perimeters, and operational deployment configurations.

Key Concept

Architectural Abstraction Layers (Conceptual -> Logical -> Physical Mapping)

Question 604Question →

A enterprise media streaming platform utilizes a Google Cloud resource hierarchy structured with an Organization node and dedicated subfolders under a main 'Media-Services' folder for separate business units: 'Content-Delivery', 'User-Analytics', and 'Rights-Management'. A centralized security policy mandates two operational requirements:
1. External compliance auditors must be able to view Cloud Asset Inventory metadata and resource configurations across all current and future projects nested within the 'User-Analytics' folder, without granting access to actual workload data or project resource configurations in other folders.
2. Application developers working inside projects within the 'User-Analytics' folder must be able to deploy Compute Engine instances that run under specific workload service accounts, but must not be granted administrative privileges over service account lifecycles or keys.

Which TWO IAM and resource hierarchy configurations should you implement to satisfy these requirements while adhering to Google-recommended best practices for least privilege and operational simplicity? (Select TWO.)

Select all that apply

Grant the roles/cloudasset.viewer and roles/browser roles to the external compliance auditors group on the 'User-Analytics' folder level.

Grant the roles/iam.serviceAccountUser role to the developer user group on the specific workload service accounts or target project scope.

Assign the primitive Viewer role (roles/viewer) to the external compliance auditors group at the Organization node level.

Assign the roles/iam.serviceAccountAdmin role to the developer user group at the 'User-Analytics' folder level.

Show answer & explanation

Answer: Grant the roles/cloudasset.viewer and roles/browser roles to the external compliance auditors group on the 'User-Analytics' folder level.; Grant the roles/iam.serviceAccountUser role to the developer user group on the specific workload service accounts or target project scope.

Answer

The correct architecture requires binding roles/cloudasset.viewer and roles/browser at the 'User-Analytics' folder level for auditor visibility, and granting roles/iam.serviceAccountUser to developers at the specific service account or project level.

To satisfy both requirements securely, you must leverage Google Cloud resource hierarchy inheritance and fine-grained roles. Granting asset viewing and browser roles at the folder node allows auditors to inspect resources and inventory metadata across all current and future projects in that folder subtree while maintaining strict isolation from other folders. Granting the Service Account User role to developers provides precisely the permission needed to attach service accounts to Compute Engine workloads without providing administrative control over service account management.

Step-by-Step Solution

Evaluate the inheritance requirements for auditing permissions across dynamic sub-projects.

Applying predefined asset viewer and browser roles at the folder node allows permissions to inherit automatically to all child projects within that folder without granting organization-wide access.

IAM roles applied at a folder node propagate down the resource hierarchy to child projects and resources.

Determine the least-privileged IAM role required for developers to attach service accounts to Compute Engine instances.

Developers require roles/iam.serviceAccountUser to impersonate or bind a service account to a compute instance.

The Service Account User role provides execution and attachment rights without exposing administrative lifecycle permissions.

Eliminate flawed choices involving primitive roles or excessive administrative access.

Primitive Viewer at the organization level provides excessive visibility across unrelated folders, and Service Account Admin provides unnecessary security key and policy control.

Google Cloud security best practices mandate fine-grained predefined roles over primitive roles and minimal scoped rights over administrative roles.

Key Concept

Resource Hierarchy IAM Role Inheritance and Least-Privilege Service Account Delegation

Question 605Question →

A platform engineering team is automating the deployment of Google Cloud resources across multiple environments using an automated continuous integration pipeline. The security team mandates strict access controls and high resilience against state loss or concurrent execution conflicts. Which implementation approach satisfies these operational and security requirements?

Maintain state files locally on the persistent storage of the build runner to eliminate external network dependencies and decrease provisioning execution duration.

Configure a Google Cloud Storage remote backend with versioning enabled, and grant the executing service account the primitive Owner role to prevent authorization failures during resource provisioning.

Configure a Google Cloud Storage remote backend with object versioning and state locking enabled, and assign fine-grained predefined IAM roles to the executing service account.

Configure a Google Cloud Storage remote backend, and grant the deployment pipeline identity the Service Account Admin role so compute resources can run under dedicated service account credentials.

Show answer & explanation

Answer: Configure a Google Cloud Storage remote backend with object versioning and state locking enabled, and assign fine-grained predefined IAM roles to the executing service account.

Answer

Configure a Google Cloud Storage remote backend with object versioning and state locking enabled, and assign fine-grained predefined IAM roles to the executing service account.

The option specifying a Google Cloud Storage remote backend with object versioning and state locking combined with fine-grained predefined IAM roles represents the Cloud Architect best practice for infrastructure as code automation. Google Cloud Storage natively supports state locking via state file generation checks, versioning provides a fallback safety net for state recovery, and least-privilege predefined roles maintain enterprise security standards.

Step-by-Step Solution

Establish central remote state storage for Terraform

Configured Google Cloud Storage bucket backend with object versioning enabled to maintain state history and protect against accidental corruption.

Centralized remote state ensures team accessibility and backup history.

Enforce concurrency control

State locking via Google Cloud Storage prevents simultaneous pipeline executions from mutating state files concurrently.

Prevents state file corruption caused by race conditions during parallel updates.

Apply least-privilege IAM permissions

Assigned specific predefined IAM roles required for the target resources instead of broad primitive roles or administrative permissions.

Limits security risks in the automated pipeline environment.

Key Concept

Terraform Remote State Management and IAM Least Privilege on GCP

Question 606Question →

An organization needs to configure a centralized pipeline to stream Google Cloud Audit Logs across all existing and future projects to an external Security Information and Event Management (SIEM) platform in real time. Arrange the required implementation steps in the correct architectural sequence to achieve this workflow.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins by provisioning the central Pub/Sub topic, creating the organization-level aggregated log sink targeting that topic, granting the sink's generated service account permission to publish to the topic, and finally configuring the streaming pipeline consumer to deliver log events to the external SIEM.

Establishing a centralized, real-time audit log streaming architecture requires creating the target Pub/Sub topic first so it exists as a valid sink destination. Creating the organization-level aggregated log sink next creates the log router configuration and automatically generates a unique writer identity service account. Assigning the Pub/Sub Publisher role to this generated service account authorizes cross-project log ingestion. Finally, deploying the downstream consumer on the Pub/Sub subscription initiates telemetry delivery to the SIEM.

Step-by-Step Solution

Provision the central Pub/Sub destination topic

Establishes a valid target resource URI for incoming audit log messages.

Log sinks require an existing destination resource before sink creation or authorization can be configured.

Configure the organization-level aggregated log sink

Generates a dedicated sink writer service account identity and defines inclusion filters for audit logs.

Aggregated sinks at the organization node automatically capture audit logs across all nested hierarchy levels.

Authorize the log sink's writer identity on the destination Pub/Sub topic

Grants Pub/Sub Publisher permissions to the unique sink service account.

Without explicit IAM publisher authorization on the destination topic, log entry delivery will fail.

Establish downstream streaming consumption to the SIEM platform

Streams real-time audit logs from the Pub/Sub subscription into the SIEM system.

Configuring the consumer completes the end-to-end telemetry integration after log routing and permissions are established.

Key Concept

Organization-Aggregated Cloud Audit Log Routing with Pub/Sub

Question 607Question →

In what sequence should a Cloud Security Architect configure an organization-level aggregated log sink to stream Data Access audit logs from all child projects into a centralized BigQuery dataset within a dedicated logging project?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence to set up an organization-level aggregated log sink to a central BigQuery dataset is: First, create the central logging project and target BigQuery dataset. Second, create the organization-level log sink configured with the --include-children flag and audit log filter. Third, retrieve the auto-generated writer identity service account for the log sink. Fourth, grant that writer identity service account the BigQuery Data Editor role on the destination dataset.

The proper administrative workflow begins by establishing the central destination resource (BigQuery dataset) in a dedicated project. Next, the organization log sink is created targeting this dataset with the aggregated option enabled, which provisions a dedicated service account writer identity. The service account name must then be retrieved so that the final step—granting the BigQuery Data Editor IAM role on the destination dataset—can be completed to permit log ingestion.

Step-by-Step Solution

Provision the destination GCP project and the BigQuery dataset.

A valid target destination URI is created for the sink definition.

Creating a log sink requires a valid, pre-existing destination target.

Execute the organization-level sink creation command with the audit log filter and --include-children flag.

The aggregated log sink is established at the organization level and a service account writer identity is generated.

The writer identity service account is created as a direct side effect of provisioning the log sink.

Identify the writer identity output from the created log sink.

The unique service account email for the sink is retrieved.

You must know the exact service account identity before granting permissions.

Assign the BigQuery Data Editor IAM role on the destination dataset to the log sink writer identity.

Data Access audit logs from all existing and future projects start flowing into BigQuery.

Log sinks write data asynchronously using their unique service account identity, requiring write authorization on the destination resource.

Key Concept

Organization-level aggregated log sink provisioning workflow and service account access control

Estimated Time:1m 0s

Question 608Question →

An enterprise healthcare provider structures its Google Cloud resource hierarchy into a parent folder named 'Clinical-Data' containing child folders 'Production' and 'Staging'. The governance committee mandates that no Compute Engine virtual machines in any project under 'Clinical-Data' are permitted to acquire external IP addresses, while ensuring that project owners in 'Staging' cannot override this restriction. Furthermore, the security team wants to audit and log potential violations across new projects without immediately blocking deployment pipelines during an initial 30-day evaluation phase. Which architectural strategy meets these governance and operational requirements?

Apply the boolean constraint `constraints/compute.vmExternalIpAccess` at the 'Clinical-Data' folder level with enforcement mode set to dry-run, and ensure project administrators are not granted the Organization Policy Admin role.

Grant primitive Owner roles to project administrators in the 'Staging' folder while applying explicit IAM deny policy bindings at the project level to restrict public IP allocation.

Configure a VPC Service Controls perimeter encompassing the 'Clinical-Data' folder with egress rules configured to block external IP allocation across all subnets.

Assign the Service Account Admin role to project leads in 'Staging' and configure IAM conditions on compute service accounts to restrict external IP bindings.

Show answer & explanation

Answer: Apply the boolean constraint `constraints/compute.vmExternalIpAccess` at the 'Clinical-Data' folder level with enforcement mode set to dry-run, and ensure project administrators are not granted the Organization Policy Admin role.

Answer

The correct strategy is to enforce the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the parent folder level in dry-run mode while withholding Organization Policy Administrator permissions from project owners.

Applying the `constraints/compute.vmExternalIpAccess` boolean constraint at the parent folder level ensures that all current and future child projects in both Production and Staging inherit the policy guardrail. Configuring the enforcement mode as dry-run enables the security team to log all non-compliant attempts without impacting active deployment pipelines. Restricting Organization Policy Administrator permissions prevents project-level administrators from modifying or overriding the constraint.

Step-by-Step Solution

Determine the resource hierarchy node for policy placement.

Applying the constraint at the 'Clinical-Data' parent folder ensures child folders ('Production' and 'Staging') inherit the policy restriction automatically.

Hierarchical inheritance ensures consistent enforcement without configuring each project individually.

Select the appropriate constraint type and evaluation mode.

Use the boolean constraint `constraints/compute.vmExternalIpAccess` in dry-run mode.

Dry-run mode logs violations to Cloud Audit Logs for inspection during the 30-day trial without breaking existing deployment scripts.

Verify access control permissions to prevent policy overrides.

Restrict the `roles/orgpolicy.policyAdmin` role to central governance administrators only.

Project owners without this role cannot override or disable inherited organization policies.

Key Concept

Organization Policy inheritance, boolean constraints, dry-run evaluation mode, and IAM role separation for central governance.

Question 609Question →

Match each Google Cloud data encryption mechanism on the left with its defining key management characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Google-default Encryption matches automatic key management by Google; CMEK matches storing keys in Cloud KMS with customer rotation and IAM control; CSEK matches supplying raw AES-256 keys in API headers; Cloud EKM matches keeping encryption keys in an external third-party HSM outside Google Cloud.

Each encryption mechanism in Google Cloud provides a distinct balance of operational management and key control. Google-default encryption is fully automated. CMEK grants control over key rotation and IAM policies inside Cloud KMS. CSEK allows customers to supply raw keys per API call. Cloud EKM delegates key protection to external on-premises or third-party HSMs.

Step-by-Step Solution

Identify the key storage location and management responsibility for Google-default encryption.

Recognize that Google handles all encryption key lifecycle operations automatically without user intervention.

Google-default encryption is fully managed by GCP for data at rest.

Analyze Customer-Managed Encryption Keys (CMEK).

Associate CMEK with Cloud KMS where key policies, rotation, and IAM access are customer-configured.

CMEK provides customer control over key lifecycles hosted within Google Cloud infrastructure.

Analyze Customer-Supplied Encryption Keys (CSEK).

Link CSEK to raw AES-256 keys supplied per request header that exist only temporarily in volatile memory.

CSEK guarantees Google does not retain key material after the request finishes.

Analyze Cloud External Key Manager (Cloud EKM).

Connect EKM to keys residing in external HSM systems outside Google Cloud.

Cloud EKM enables cryptographic operations using keys hosted in an off-cloud HSM.

Key Concept

Data Encryption Options and Key Management Models in GCP

Question 610Question →

A software architecture team is analyzing their release management lifecycle for microservices running on Cloud Run. To align their continuous integration and continuous deployment (CI/CD) pipelines with security and governance best practices, they must establish appropriate permission boundaries for automated build processes. Which pipeline identity configuration follows Google Cloud recommended practices?

Attach a dedicated service account to Cloud Build with minimal, predefined roles scoped only to the required deployment actions.

Assign the primitive Owner role to the build service account to guarantee build steps never run into permission errors.

Grant application developers the Service Account Admin role on the build pipeline service account so they can manage credentials during runs.

Persist deployment state tracking files exclusively on local container disk space during pipeline execution.

Show answer & explanation

Answer: Attach a dedicated service account to Cloud Build with minimal, predefined roles scoped only to the required deployment actions.

Answer

Attach a dedicated service account to Cloud Build with minimal, predefined roles scoped only to the required deployment actions.

Configuring dedicated service accounts with fine-grained, predefined roles tailored to specific deployment targets adheres to Google Cloud security best practices by implementing the principle of least privilege.

Step-by-Step Solution

Evaluate identity requirements for CI/CD automation

Automated pipelines require distinct service accounts rather than user identities or default high-privilege credentials.

Isolating pipeline identity ensures traceability and security boundaries.

Apply the principle of least privilege

Grant only specific predefined roles (such as Cloud Run Developer) to the pipeline service account.

Restricting roles prevents unauthorized modifications to non-pipeline resources.

Key Concept

Least Privilege Identity Management in CI/CD Pipelines

Question 611Question →

A healthcare organization manages its Google Cloud environment using a folder hierarchy where all production database workloads reside under a dedicated folder named Database-Prod. To comply with data sovereignty regulations, the security team must mandate that all resources provisioned within this folder can only be located in us-central1 and us-west1. The guardrail must apply automatically to all existing and future projects created within the Database-Prod folder without relying on custom deployment scripts or per-user IAM permissions. Which configuration correctly satisfies this requirement?

Apply an Organization Policy at the Database-Prod folder level for the Resource Locations constraint (constraints/gcp.resourceLocations), specifying an allowed list containing us-central1 and us-west1.

Assign the primitive Owner role (roles/owner) to the security governance team at the Database-Prod folder level, relying on manual resource reviews to block non-compliant deployments.

Create a VPC Service Controls perimeter around the Database-Prod folder and rely exclusively on data exfiltration rules to restrict resource deployment regions.

Grant the Service Account User role (roles/iam.serviceAccountUser) to developers across the Database-Prod folder to restrict where resources can be provisioned.

Show answer & explanation

Answer: Apply an Organization Policy at the Database-Prod folder level for the Resource Locations constraint (constraints/gcp.resourceLocations), specifying an allowed list containing us-central1 and us-west1.

Answer

The Organization Policy service provides centralized governance controls over resource configurations. By binding an Organization Policy containing the constraints/gcp.resourceLocations list constraint to the Database-Prod folder, Google Cloud enforces an explicit allowlist for us-central1 and us-west1. Because Organization Policies inherit down the resource hierarchy, all current and future projects inside that folder inherit this policy automatically.

Step-by-Step Solution

Identify the administrative requirement and scope

The requirement demands continuous, automated enforcement of regional resource limits at the folder level across existing and future child projects.

Governance guardrails operating across resource hierarchies are best enforced via Google Cloud Organization Policies.

Select the appropriate Organization Policy constraint

Identify constraints/gcp.resourceLocations as the designated list constraint for restricting geographic deployment locations.

This policy constraint allows administrators to explicitly define allowed or denied locations for GCP services.

Determine the resource hierarchy binding point

Apply the policy directly to the Database-Prod folder node with allowed values set to us-central1 and us-west1.

Policy inheritance automatically propagates constraints down to all descendant projects and resources within that folder branch.

Key Concept

Organization Policy Resource Location Constraints

Question 612Question →

A enterprise security architect is auditing access control evaluation for a Google Cloud environment structured with an Organization node, nested Department and Environment Folders, Workload Projects, and Cloud Storage resources. A user requests `storage.objects.get` on a specific bucket. To verify permission resolution and troubleshoot unexpected access results, the architect must trace the exact sequence of Google Cloud Identity and Access Management (IAM) policy evaluation logic.

In what exact sequence does Google Cloud IAM process policy rules and resource hierarchy grants to determine if the user is authorized to perform the action?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct evaluation order begins with checking IAM Deny policies across all hierarchy levels, followed by collecting IAM Allow bindings top-down from the Organization node, through parent Folders, at the Project node, and finally on the target Resource, concluding with computing the union of all Allow permissions to authorize the request.

Google Cloud evaluates authorization by first checking IAM Deny policies across all ancestral nodes (Organization, Folders, Project). If no Deny rule applies, IAM collects Allow permissions top-down starting from the Organization root node, continuing through parent Folders, down to the Project node, and ending at the target Cloud Storage Bucket resource. Finally, it calculates the union of all granted Allow permissions; if the required permission is present, access is granted.

Step-by-Step Solution

Check for IAM Deny overrides across the resource hierarchy.

Confirm that no IAM Deny policy defined at the Organization, Folder, or Project level explicitly blocks `storage.objects.get` for the requesting principal.

Google Cloud IAM enforces Deny policies prior to evaluating any Allow rules. An applicable Deny rule short-circuits evaluation and halts execution with an access denied result.

Evaluate top-down inherited IAM Allow permissions from the Organization and Folder nodes.

Collect Allow role bindings inherited from ancestor nodes in the hierarchy tree.

Permissions granted at higher levels in the GCP resource hierarchy automatically propagate down to all child resources due to resource hierarchy inheritance.

Evaluate project-level IAM Allow permissions.

Add role bindings granted at the Project containing the target bucket to the candidate permission set.

Project-level role grants complement higher-level folder and organization policies for all resources inside that specific project.

Evaluate target resource-level IAM Allow permissions.

Add role bindings defined directly on the Cloud Storage Bucket.

Resource-level IAM policies allow fine-grained access control on individual resources at the leaf node of the hierarchy.

Calculate effective authorization by taking the union of all collected Allow permissions.

Authorize the API call if the required permission `storage.objects.get` is contained within the resulting permission set.

IAM permissions in GCP are additive. If any valid Allow binding at any level grants the required permission, and no Deny rule blocks it, access is approved.

Key Concept

Google Cloud IAM Policy Evaluation and Resource Hierarchy Inheritance

Question 613Question →

An enterprise architecture team for a global digital publishing platform is translating high-level business goals into a structured architecture framework on Google Cloud. During this transition, they must map logical system components (such as decoupled messaging, perimeter boundaries, and data persistency) to concrete physical GCP service implementations.

Which TWO architectural mapping decisions correctly translate the logical requirements into physical Google Cloud component selections while avoiding architectural anti-patterns? (Select TWO.)

Select all that apply

Mapping the logical tier for real-time decoupled ingestion and stream analytics to Cloud Pub/Sub combined with Cloud Dataflow.

Mapping the logical security perimeter boundary for cross-service network isolation and data exfiltration defense to VPC Service Controls.

Mapping the logical perimeter boundary for data exfiltration protection to project-level primitive IAM roles (Owner/Editor) without VPC Service Controls boundaries.

Mapping the logical requirement for a regional single-instance relational content management database to a multi-region Cloud Spanner instance to minimize operational cost.

Mapping the logical requirement for a basic, low-traffic stateless HTTP request redirector microservice to a multi-zone GKE cluster to simplify management overhead.

Show answer & explanation

Answer: Mapping the logical tier for real-time decoupled ingestion and stream analytics to Cloud Pub/Sub combined with Cloud Dataflow.; Mapping the logical security perimeter boundary for cross-service network isolation and data exfiltration defense to VPC Service Controls.

Answer

The correct architectural mappings are: 1) Mapping real-time decoupled ingestion and stream analytics to Cloud Pub/Sub and Cloud Dataflow, and 2) Mapping perimeter security boundaries for data exfiltration defense to VPC Service Controls.

Mapping real-time decoupled event ingestion to Cloud Pub/Sub with Cloud Dataflow directly aligns the logical requirement for asynchronous messaging and pipeline analytics to managed physical services. Additionally, defining data exfiltration boundaries using VPC Service Controls correctly translates logical perimeter isolation into a physical security boundary on Google Cloud.

Step-by-Step Solution

Analyze the logical requirements for event processing and perimeter security.

Real-time asynchronous messaging maps logically to Pub/Sub and stream processing to Dataflow. Security isolation across service boundaries maps to VPC Service Controls perimeters.

Conceptual architectures define overall capability goals, logical architectures map functional capabilities and boundaries, and physical architectures implement concrete GCP products.

Evaluate the invalid physical service choices for storage, compute, and security.

Cloud Spanner for regional relational workloads creates cost overruns; GKE for simple stateless microservices adds unwanted cluster management complexity; primitive IAM roles fail to prevent data exfiltration across perimeters.

Selecting physical GCP components requires balancing non-functional requirements like cost, operational complexity, and zero-trust perimeter defense.

Key Concept

Translating Logical Architecture into Physical GCP Service Selections

Question 614Question →

A global retail enterprise is building a lightweight, stateless microservice to handle peak spikes of HTTP inventory availability queries during high-volume promotional events. Traffic to this microservice exhibits extreme variability, surging from zero requests during off-peak hours to tens of thousands of HTTP requests per second during flash sales. The engineering team requires a containerized execution environment that automatically scales down to zero instances to minimize costs, requires zero underlying server or cluster management overhead, and charges strictly per millisecond of request processing time. Which Google Cloud compute platform should the Cloud Architect select?

Deploy the containerized service to Cloud Run.

Deploy the containerized service to a Google Kubernetes Engine (GKE) Autopilot cluster.

Deploy the service on a Compute Engine Managed Instance Group (MIG) configured with CPU-based autoscaling.

Deploy the service using App Engine Flexible Environment.

Show answer & explanation

Answer: Deploy the containerized service to Cloud Run.

Answer

Deploying the microservice to Cloud Run satisfies all requirements for stateless execution, automatic scaling to zero, zero cluster management overhead, and request-based billing.

Cloud Run is designed specifically for stateless containerized workloads. It scales instances automatically up and down (including scaling down to zero when idle), eliminates infrastructure and cluster administration overhead, and charges only for compute resources consumed while processing requests.

Step-by-Step Solution

Analyze workload characteristics and requirements

Workload is a stateless containerized HTTP microservice with bursty, unpredictable traffic scaling from zero to thousands of requests per second.

Determining scaling dynamics and protocol needs narrows down compute options.

Evaluate Google Cloud serverless and container execution platforms

Cloud Run native container deployment provides serverless scaling to zero, zero node management, and per-millisecond request billing.

Matching technical requirements to GCP platform capabilities identifies the most operationally efficient choice.

Eliminate platforms with cluster overhead or baseline infrastructure costs

GKE, Compute Engine MIGs, and App Engine Flex require continuous infrastructure maintenance or minimum baseline costs during idle traffic periods.

Eliminating options that introduce management overhead or idle cost fulfills cost-optimization and operational directives.

Key Concept

Compute Platform Selection for Stateless Bursty Microservices

Question 615Question →

A financial services firm is scaling its algorithmic trading platform across 12 newly provisioned Google Cloud projects contained within a dedicated production folder hierarchy. The solution requires hundreds of C2 compute instances across two distinct target regions. To guarantee that automated Infrastructure as Code (IaC) pipelines deploy without runtime resource allocation failures while maintaining centralized financial control, which TWO solutions should the principal cloud architect implement? (Select TWO.)

Select all that apply

Request proactive regional Compute Engine CPU and instance quota limit increases for both target regions before triggering the IaC deployment pipelines.

Export Organization-level Cloud Billing data into BigQuery and configure programmatic budget alerts using Cloud Pub/Sub topics to monitor cost thresholds.

Assign the Owner primitive IAM role to the deployment pipeline service account at the folder level to override regional quota limits during resource provisioning.

Store Terraform state files in local storage during deployment execution so the pipeline can dynamically adjust regional quota allocations on demand.

Show answer & explanation

Answer: Request proactive regional Compute Engine CPU and instance quota limit increases for both target regions before triggering the IaC deployment pipelines.; Export Organization-level Cloud Billing data into BigQuery and configure programmatic budget alerts using Cloud Pub/Sub topics to monitor cost thresholds.

Answer

The architect must proactively request regional compute quota increases before running IaC pipelines, and set up Organization-level Cloud Billing exports to BigQuery with Pub/Sub budget notifications.

Proactively requesting quota increases for targeted regional C2 capacity prevents pipeline execution failures caused by regional limit breaches. Configuring organization-level BigQuery billing exports combined with Pub/Sub budget notifications ensures automated, centralized cost governance across multi-project environments.

Step-by-Step Solution

Analyze capacity requirements against regional quotas.

Identified that high-spec C2 instances across 12 projects will exceed default regional quota limits.

Default quota limits in new GCP projects will cause IaC provisioning scripts to fail immediately when quota thresholds are breached.

Submit proactive quota increases for target regions via Cloud Console or quota management APIs prior to pipeline execution.

Sufficient regional CPU quota is approved and allocated across the project environments.

Quota increases require manual or automated GCP review and must be secured before automated provisioning begins.

Configure Billing Data Export to BigQuery at the Organization level.

Centralized repository for detailed cost and usage metrics across all 12 projects.

Organization-level export standardizes cost tracking across all child projects and folders.

Attach Pub/Sub notifications to Cloud Billing Budgets.

Automated notification channel for threshold breaches.

Enables programmatic response or alerting when expenditure reaches critical limits.

Key Concept

Proactive Quota Planning and Centralized FinOps Governance

Question 616Question →

An enterprise platform engineering team is setting up an automated Terraform provisioning pipeline for a production Cloud SQL for PostgreSQL database. Security and networking policies require that the database must utilize Customer-Managed Encryption Keys (CMEK), be accessible strictly via private IP over Private Services Access, and enforce IAM database authentication. To ensure an automated execution without resource dependency deadlocks or authorization failures, in what chronological order must these deployment steps be executed?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for provisioning Cloud SQL with CMEK and Private Services Access is: 1) Create the Cloud KMS key and grant the Encrypter/Decrypter role to the Cloud SQL Service Agent; 2) Reserve an IP range and configure Private Services Access in the VPC; 3) Provision the Cloud SQL instance with private IP, CMEK reference, and IAM authentication; 4) Create database schemas and IAM database users.

Provisioning Cloud SQL infrastructure with CMEK and private connectivity requires strict adherence to foundational dependency chains. First, key permissions must be assigned to the Cloud SQL Service Agent (`[email protected]`) so GCP can access the CMEK key. Second, Private Services Access peering must be established in the VPC network so Cloud SQL can allocate internal IP addresses in the producer network. Third, the Cloud SQL instance is provisioned referencing the CMEK key and private network. Finally, database schemas and IAM database users are created inside the initialized database instance.

Step-by-Step Solution

Set up CMEK security permissions

Cloud SQL Service Agent obtains permissions to encrypt/decrypt using the target CryptoKey

Cloud SQL validates disk encryption permissions during initial instance creation. Lacking this permission causes instance creation to fail immediately.

Configure private network infrastructure

VPC peering is established between customer VPC and Google's service producer network

Private IP database instances cannot be attached to a VPC without an established Private Services Access peering connection.

Deploy the Cloud SQL instance

The Cloud SQL instance is provisioned with private IP connectivity and CMEK disk encryption

The database instance depends directly on pre-existing KMS role bindings and Private Services Access peering.

Configure database objects and access

Database schemas and IAM-mapped users are created

Logical database schemas and user roles are internal to the engine and require an operational database instance.

Key Concept

Cloud SQL Provisioning Dependency Sequencing

Question 617Question →

An enterprise organization with hundreds of Google Cloud projects structured under a multi-folder hierarchy needs to establish a centralized security auditing and threat monitoring architecture. The lead cloud security architect must satisfy three strict requirements:
1. Capture all audit logs (including Data Access audit logs) across all current and future projects and streaming export them to a third-party SIEM running outside Google Cloud.
2. Prevent unauthorized exfiltration of aggregated audit log data by compromised internal identities possessing storage read permissions.
3. Enable real-time detection of threat patterns across the organization hierarchy while adhering to the principle of least privilege for security operations teams.

Which TWO architectural configurations must the security team implement to satisfy these requirements? (Select TWO.)

Select all that apply

Create an organization-aggregated log sink with an empty inclusion filter targeting a Pub/Sub topic in a dedicated security project enclosed within a VPC Service Controls security perimeter.

Grant the primitive Owner role (roles/owner) at the organization level to the security operations service account to ensure uninterrupted access across all logging and monitoring endpoints.

Enable Event Threat Detection in Security Command Center at the organization level and grant security operators dedicated fine-grained roles such as Security Center Admin Viewer (roles/securitycenter.adminViewer).

Rely exclusively on Cloud IAM bucket-level permissions and IAM Conditions on the log destination Cloud Storage buckets to restrict log exfiltration to unauthorized accounts.

Show answer & explanation

Answer: Create an organization-aggregated log sink with an empty inclusion filter targeting a Pub/Sub topic in a dedicated security project enclosed within a VPC Service Controls security perimeter.; Enable Event Threat Detection in Security Command Center at the organization level and grant security operators dedicated fine-grained roles such as Security Center Admin Viewer (roles/securitycenter.adminViewer).

Answer

The correct architectural choices are: (1) Creating an organization-aggregated log sink targeting a Pub/Sub topic inside a dedicated logging project protected by a VPC Service Controls perimeter, and (2) Enabling Event Threat Detection within Security Command Center at the organization level while assigning fine-grained security roles.

The correct options combined provide a complete enterprise security solution. Creating an organization-aggregated log sink with an empty inclusion filter routes all log streams (including Data Access logs) from all current and future projects to a Pub/Sub topic. Placing this topic inside a dedicated project enclosed by a VPC Service Controls perimeter guarantees protection against data exfiltration. Furthermore, enabling Event Threat Detection in Security Command Center Premium/Enterprise at the organization level provides automated real-time threat monitoring, while granting fine-grained security roles ensures strict adherence to least-privilege IAM principles.

Step-by-Step Solution

Evaluate centralized audit logging and scope requirements across the organization hierarchy.

An organization-aggregated log sink ensures all present and future projects inherit logging policies and stream audit logs centrally without project-by-project manual setup.

Organization-level aggregation is required to enforce baseline compliance and capture Data Access logs uniformly across child folders and projects.

Analyze threat detection and data exfiltration defense mechanisms.

VPC Service Controls boundaries prevent authorized or compromised identities from transferring centralized audit data out of the organization perimeter to external destinations.

IAM rules dictate identity access control, but VPC Service Controls are strictly required to define network-level perimeter guardrails against data exfiltration.

Configure Security Command Center threat monitoring with fine-grained access control.

Event Threat Detection in Security Command Center analyzes log streams in real time across the organization resource, while assigning specific roles like roles/securitycenter.adminViewer preserves least-privilege security posture.

Using specialized Security Command Center roles avoids assigning dangerous primitive roles while maintaining complete visibility into security findings.

Key Concept

Centralized Organization Log Sinks, Event Threat Detection, VPC Service Controls, and Least-Privilege IAM

Question 618Question →

A financial analytics company organizes its Google Cloud resources using a dedicated folder named 'Production Payments' containing dozens of project workloads. The security team needs to deploy an automated audit worker on a Compute Engine instance in a separate 'Security Operations' project. This audit worker must inspect Cloud Storage bucket IAM policies and list bucket metadata across all projects in the 'Production Payments' folder, without being allowed to read object contents or modify bucket settings. Additionally, application developers must be able to attach this audit service account to virtual machines in the Security Operations project without being granted administrative access over the service account itself or broad access across the folder. Which configuration strategy satisfies least privilege and operational security requirements?

Create a custom IAM role with storage.buckets.getIamPolicy and storage.buckets.list permissions and bind it to the audit service account at the Production Payments folder level; then grant the roles/iam.serviceAccountUser role on the audit service account resource to the developer group.

Assign the primitive roles/viewer role to the audit service account at the Production Payments folder level, and grant the primitive roles/editor role on the Security Operations project to the developer group.

Create a custom IAM role with storage.buckets.getIamPolicy and storage.buckets.list permissions and bind it to the audit service account at the Production Payments folder level, but grant the roles/iam.serviceAccountAdmin role on the Security Operations project to the developer group.

Assign the predefined roles/storage.objectViewer role to the audit service account at the Organization root node, relying on IAM permissions alone to prevent data exfiltration to external storage buckets.

Show answer & explanation

Answer: Create a custom IAM role with storage.buckets.getIamPolicy and storage.buckets.list permissions and bind it to the audit service account at the Production Payments folder level; then grant the roles/iam.serviceAccountUser role on the audit service account resource to the developer group.

Answer

Create a custom IAM role containing only the storage.buckets.getIamPolicy and storage.buckets.list permissions bound to the audit service account at the Production Payments folder level, and grant the roles/iam.serviceAccountUser role on the specific service account resource to the developer group.

The correct solution defines a fine-grained custom role containing only the required bucket metadata permissions (storage.buckets.getIamPolicy and storage.buckets.list) and binds it at the folder node level so that child projects inherit access automatically. Furthermore, assigning roles/iam.serviceAccountUser directly on the service account resource allows developers to attach the account to instances while adhering strictly to the principle of least privilege.

Step-by-Step Solution

Determine the required permission scope for the audit worker.

The worker requires storage.buckets.getIamPolicy and storage.buckets.list permissions across all projects under the Production Payments folder without object payload access.

Creating a fine-grained custom IAM role with only these permissions ensures least privilege compared to predefined object viewer or primitive roles.

Select the appropriate resource hierarchy node for policy binding.

Binding the custom role at the Production Payments folder level allows all current and future child projects to inherit the audit read permissions automatically.

Inheritance down the resource hierarchy reduces operational overhead compared to per-project policy assignments.

Configure developer delegation permissions safely.

Granting roles/iam.serviceAccountUser on the audit service account resource to the developer group allows developers to attach the service account to compute workloads without allowing them to modify service account IAM policies or keys.

Resource-level binding of serviceAccountUser follows recommended delegation practices.

Key Concept

Resource Hierarchy Role Inheritance and Service Account Delegation

Question 619Question →

An energy utility provider is migrating its historical meter telemetry data archive of $450\text{ TB}$ and an operational $2\text{ TB}$ relational database from an on-premises data center to Google Cloud. The facility has a dedicated $100\text{ Mbps}$ internet uplink available for the migration process, and business requirements specify that all data must be transferred within a $30\text{ day}$ window with minimal disruption to ongoing database transactions. Which data transfer strategy best satisfies these technical and operational constraints?

Order a Google Cloud Transfer Appliance to transfer the

450\text{ TB}

telemetry archive offline, and use Database Migration Service (DMS) with continuous replication over a dedicated network connection for the operational database.

Use Storage Transfer Service over the existing

100\text{ Mbps}

internet uplink to move both the

450\text{ TB}

telemetry archive and the

2\text{ TB}

database files directly into Cloud Storage buckets.

Migrate the operational database to Cloud Spanner and use Cloud VPN over the internet link to stream the

450\text{ TB}

archive using parallel gsutil uploads.

Establish a single HA VPN tunnel to stream the

450\text{ TB}

telemetry archive while using VPC Network Peering to directly copy database snapshots to target subnets.

Show answer & explanation

Answer: Order a Google Cloud Transfer Appliance to transfer the $450\text{ TB}$ telemetry archive offline, and use Database Migration Service (DMS) with continuous replication over a dedicated network connection for the operational database.

Answer

Order a Google Cloud Transfer Appliance for the

450\text{ TB}

telemetry archive and use Database Migration Service (DMS) for the

2\text{ TB}

operational database.

The correct strategy combines Transfer Appliance for the static

450\text{ TB}

dataset with Database Migration Service (DMS) for the

2\text{ TB}

database. Transferring

450\text{ TB}

over a

100\text{ Mbps}

network line requires over 400 days, making online transfer impossible within the 30-day requirement. Transfer Appliance bypasses this network bottleneck by physically shipping high-capacity hardware. Meanwhile, DMS supports continuous change data capture for the active operational database to minimize cutover downtime.

Step-by-Step Solution

Calculate the theoretical minimum transfer time for the

450\text{ TB}

dataset over the available network bandwidth.

100\text{ Mbps}

(

12.5\text{ MB/s}

), transferring

450\text{ TB}

(

450,000\text{ GB}

) requires

\frac{450,000 \times 10^9 \text{ bytes}}{12.5 \times 10^6 \text{ bytes/sec}} \approx 36,000,000\text{ seconds} \approx 416\text{ days}

An online transfer exceeds the 30-day window, mandating an offline physical transfer option.

Select the appropriate Google Cloud offline transfer service for the large static dataset.

Transfer Appliance allows shipping high-capacity physical appliances to ingest the

450\text{ TB}

data locally and upload it to Cloud Storage within days.

Offline transfer bypasses network bandwidth bottlenecks completely.

Select the online migration method for the dynamic

2\text{ TB}

database workload.

Database Migration Service (DMS) performs an initial backfill followed by continuous change data capture (CDC) replication over the network.

DMS enables minimal downtime cutover for active relational database workloads.

Key Concept

Selecting data transfer tools based on bandwidth math and workload state (offline physical transfer for petabyte/terabyte-scale static data over limited links vs. continuous replication for databases).

Question 620Question →

A financial analytics company is designing a new cloud architecture on Google Cloud for two distinct backend services within their risk analysis pipeline.

1. Risk Ingestion Service: A high-throughput, stateless HTTP/2 REST API microservice that receives incoming market data webhooks. Traffic fluctuates heavily throughout the day, dropping to zero during market off-hours. It requires zero server maintenance, fast cold-starts, and scaling down to zero instances to minimize idle costs.
2. Monte Carlo Simulation Engine: A high-performance compute workload requiring custom Linux kernel modules, direct hardware access to NVIDIA GPUs, local NVMe SSD scratch storage for fast state caching, and long-running batch job execution lasting up to 14 hours.

Which TWO platform selection decisions should you recommend to fulfill these workload requirements while optimizing cost and operational efficiency? (Select TWO.)

Select all that apply

Deploy the Risk Ingestion Service on Cloud Run to take advantage of automatic scaling to zero, pay-per-use billing, and zero cluster management overhead.

Provision a multi-zone Google Kubernetes Engine (GKE) cluster with Standard mode node pools to host the Risk Ingestion Service to ensure minimal latency during traffic spikes.

Deploy the Monte Carlo Simulation Engine on Compute Engine Managed Instance Groups (MIGs) utilizing custom VM images with required kernel modules, GPU attachments, and local SSDs.

Deploy the Monte Carlo Simulation Engine on App Engine Standard environment using background instances to leverage automated infrastructure scaling.

Purchase 3-year Committed Use Discounts (CUDs) for maximum compute instances on the Risk Ingestion Service to minimize per-request baseline costs.

Show answer & explanation

Answer: Deploy the Risk Ingestion Service on Cloud Run to take advantage of automatic scaling to zero, pay-per-use billing, and zero cluster management overhead.; Deploy the Monte Carlo Simulation Engine on Compute Engine Managed Instance Groups (MIGs) utilizing custom VM images with required kernel modules, GPU attachments, and local SSDs.

Answer

Deploy the stateless HTTP Risk Ingestion Service on Cloud Run for scale-to-zero efficiency and operational simplicity, and host the Monte Carlo Simulation Engine on Compute Engine Managed Instance Groups (MIGs) to support custom kernel modules, attached GPUs, local NVMe SSDs, and 14-hour batch runs.

The solution correctly pairs the stateless HTTP API service with Cloud Run to take advantage of scale-to-zero autoscaling, zero management overhead, and request-based pricing, while assigning the complex compute engine with custom kernel, GPU, local SSD, and extended execution time requirements to Compute Engine MIGs.

Step-by-Step Solution

Analyze requirements for the Risk Ingestion Service

Identified a stateless, HTTP/2 REST API with variable traffic dropping to zero.

Cloud Run provides serverless container execution that automatically scales instances to zero during off-hours and handles container deployment without cluster management overhead.

Analyze requirements for the Monte Carlo Simulation Engine

Identified requirements for custom kernel modules, GPU acceleration, local NVMe SSDs, and long-running execution (14 hours).

Compute Engine VM instances allow full root access to modify kernel drivers, attach local NVMe storage and GPUs directly, and run unbounded compute jobs.

Evaluate invalid compute platform combinations

Eliminated GKE standard clusters for simple stateless ingestion due to idle baseline costs/management overhead, App Engine Standard due to hardware/kernel constraints, and fixed long-term CUD commitments for bursty zero-idle services.

Matching compute workloads strictly to architectural capabilities avoids misallocating infrastructure.

Key Concept

GCP Compute Platform Selection based on statefulness, execution duration, hardware dependencies, and operational overhead limits.

Estimated Time:2m 0s

PreviousPage 31 / 80Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept