All practice questions

A multinational enterprise wants to implement real-time security threat detection and automated monitoring across its entire Google Cloud resource hierarchy. The security team needs to detect misconfigurations and suspicious activity (such as malware or unauthorized access) at scale without deploying or managing agents on individual virtual machines. Additionally, high-severity findings must trigger immediate notifications to an automated ticketing system. Which native Google Cloud architecture meets these requirements?

Match each enterprise security and compliance requirement on the left with the corresponding Google Cloud key management implementation on the right.

A multinational enterprise structures its Google Cloud environment under an Organization node with top-level folders named Operations and Workloads. The Workloads folder contains two subfolders: Production and Development. The central security compliance team requires continuous visibility to inspect configuration metadata for all Google Cloud resources across the entire company. Meanwhile, an automated deployment system operating from a Virtual Machine in the Operations folder must provision Compute Engine instances and attach pre-existing workload service accounts exclusively within projects in the Development subfolder. You need to design an IAM access control architecture that enforces the principle of least privilege while minimizing operational overhead. Which IAM role assignment strategy should you implement?

An enterprise operating in the European Union must comply with data sovereignty regulations requiring all newly provisioned data storage resources, such as Cloud Storage buckets and BigQuery datasets, to reside strictly within EU regions. Which Google Cloud feature should the cloud architect configure to enforce this policy centrally across all projects in the organization?

A smart logistics enterprise is migrating its central warehouse management system to Google Cloud. The architecture team must establish a highly available, encrypted hybrid network connection between their on-premises data center and a GCP Virtual Private Cloud (VPC). The connection must support automated route exchange via dynamic routing and meet SLA requirements for high availability (99.99% availability). Which TWO configuration steps are required on Google Cloud to achieve this setup?

An enterprise is configuring its Google Cloud network topology to support multi-region workloads with strict security and network connectivity constraints. Workload instances deployed in private subnets must access Google Cloud APIs securely without requiring external IP addresses, and potential data exfiltration to external Cloud Storage buckets must be blocked using perimeter-level security controls rather than user IAM permissions alone. Furthermore, the architecture utilizes a hub-and-spoke topology across multiple VPC networks where direct communication between spoke VPCs is required. Which TWO network topology and configuration choices must the cloud architect implement to satisfy these requirements?

An enterprise cloud security team needs to encrypt data stored in a Cloud Storage bucket. Security compliance mandates that the enterprise must retain complete control over key lifecycle management, including key rotation and revocation using Google Cloud APIs, without the overhead of manually managing and supplying raw cryptographic keys for every data access request. Which encryption approach should the cloud architect recommend?

A media streaming enterprise is provisioning infrastructure on Google Cloud for a new real-time video processing pipeline. The architecture requires deploying a private GKE cluster for processing microservices and a set of Compute Engine virtual machines for legacy media encoding. The security team mandates that the GKE control plane must not be accessible from the public internet and must restrict administrative access strictly to the company's internal management subnet. Additionally, automated deployment pipelines provisioning the virtual machines must use least-privilege identity management without granting administrative control over service accounts.

Which TWO actions should the Cloud Architect implement to satisfy these security and operational requirements?

A global media streaming platform is configuring central security guardrails across its Google Cloud resource hierarchy. The security team has defined two mandatory policy enforcement rules: preventing developers from generating service account keys across all projects within the Media-Services folder, and restricting the creation of resources so that compute and storage services can only be deployed in designated European locations (europe-west1 and europe-west3). Which TWO configuration actions should the cloud architect take using Organization Policies to satisfy these guardrails?

An enterprise organization is preparing to deploy an event-driven telemetry processing engine across multiple Compute Engine managed instance groups in the us-central1 and europe-west1 regions. During an architectural audit 48 hours prior to launch, the lead cloud architect determines that the required target capacity of 640 N2 vCPUs per region exceeds the project's default regional vCPU quota limit of 200 N2 vCPUs. The deployment will be managed automatically via an Infrastructure as Code (IaC) CI/CD pipeline using Terraform. Which proactive strategy should the architect implement to ensure the automated deployment completes successfully without resource allocation failures?

A healthcare enterprise is building a hybrid cloud network to connect its primary on-premises electronic health record (EHR) data centers to a Google Cloud Virtual Private Cloud (VPC). The connection must support a sustained throughput of 20 Gbps, guarantee a 99.99% availability SLA, and provide dynamic failover using BGP across redundant physical paths. Which TWO architecture steps are required to achieve this configuration in accordance with Google Cloud best practices?

An enterprise is building an analytics platform on Google Cloud that ingests sensitive financial records into BigQuery and stores raw log archives on Compute Engine persistent disks. Security governance requires that all data at rest be protected using Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. The security policy mandates strict separation of duties, zero usage of primitive IAM roles, and automated key rotation where legacy data decryptability is preserved without requiring manual re-encryption of historical datasets. Which TWO architectural and IAM configurations must be implemented to fulfill these compliance requirements? (Select TWO)

An organization is deploying an enterprise application requiring a relational database on Google Cloud to handle financial transactions across three continents. The transaction volume requires predictable low latency (<10 ms reads and writes) globally, automatic horizontal scaling without manual sharding, and strong serializable consistency. As a Principal Cloud Architect, which database provisioning strategy should you select to meet these technical requirements while minimizing operational maintenance?

During a technical review of an enterprise CI/CD pipeline, an organization discovers that manual configuration edits made directly in the Google Cloud Console are frequently causing deployment pipeline failures during Terraform runs. Which operational practice should the team integrate into their continuous integration pipeline to detect and analyze configuration drift before applying changes?

A financial analytics organization manages sensitive data across a multi-folder Google Cloud resource hierarchy. The chief information security officer requires aggregating all Data Access and Admin Activity audit logs across all current and future folders into a centralized log repository. Additionally, the security design must prevent insider threats where project administrators with high-privilege project permissions could copy or exfiltrate centralized audit records to an external, unapproved storage location. Which architectural strategy fulfills all security and compliance requirements?

A national electrical utility company is designing a new cloud platform on Google Cloud to collect, analyze, and store smart meter data. The architectural plan defines three logical tiers: an Ingestion Tier for high-throughput time-series telemetry from 5 million meters, a Storage Tier split between high-volume time-series metrics and standard single-region relational customer billing metadata, and a Security Tier enforcing strict perimeter boundaries to prevent authorized internal users from exfiltrating sensitive telemetry to external storage locations. Which physical Google Cloud architecture best maps these logical tiers to meet all operational and security requirements?

A global healthcare SaaS provider processing protected citizen health records for an Asia-Pacific government entity must comply with strict national data sovereignty regulations and audit requirements. The compliance mandate specifies three requirements:
1. All underlying storage data at rest and cryptographic key management boundaries must be restricted to a single specified GCP region.
2. Google support personnel must be explicitly authorized prior to viewing any customer data during administrative operations, with all access attempts fully audited.
3. Authorized service accounts and insider identities within the project must be programmatically blocked from exfiltrating sensitive datasets to unauthorized external Google Cloud Storage buckets.

Which THREE architectural controls must be implemented in Google Cloud to satisfy these compliance and data governance requirements?

A bio-informatics platform processes sensitive clinical datasets across multiple Google Cloud projects contained within a single dedicated folder named Genomics-Prod. To ensure compliance, an external audit identity requires access to review all IAM policy bindings and resource configurations across all projects within Genomics-Prod without being able to read underlying storage object data or modify permissions. Additionally, development teams need permission to attach specific workload service accounts to Compute Engine instances without being allowed to modify service account permissions or create new service accounts. Which IAM role assignment strategy satisfies these requirements while strictly adhering to the principle of least privilege?

A multinational financial institution operating in the European Union is migrating a mission-critical workload to Google Cloud. To satisfy strict regulatory compliance mandates regarding EU data sovereignty and data governance, the lead architect must design a solution that satisfies the following four requirements:
1. All data stored in Cloud Storage and BigQuery must be restricted exclusively to EU multi-regions or EU sub-regions.
2. Cryptographic keys used for encryption at rest must be managed by the customer within an EU location, and Google personnel access to customer data or key material must require explicit prior customer approval and full auditability.
3. Authorized internal service accounts and users must be prevented from exfiltrating data to external Cloud Storage buckets outside the organization's boundary.

Which architectural combination of Google Cloud security and governance controls fulfills all specified regulatory requirements?

A multinational logistics company plans to migrate its legacy logistics infrastructure to Google Cloud within a strict 3-week cutover window. The workload consists of a $500\text{ TB}$ unencrypted historical shipment tracking log archive and a $2\text{ TB}$ operational PostgreSQL database. The on-premises facility connects to the internet via a dedicated $100\text{ Mbps}$ network link. The solution must minimize operational downtime for the transactional workload while meeting the migration deadline. Which TWO migration and data transfer strategies should the cloud architect recommend?