Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 741Question →

A healthcare technology company uses Cloud Build to automate infrastructure deployments for Cloud Run services. During an SDLC assessment, the architecture team discovers that the deployment pipeline relies on default service account privileges, state files are stored in ephemeral build environments without locking, and developers frequently execute manual CLI commands on production resources during operational incidents. Which strategy best resolves these SDLC and CI/CD security and operational process risks?

Show answer & explanation

Answer: Configure Cloud Build to run under a dedicated user-managed service account with fine-grained IAM roles, store state files in a versioned Cloud Storage bucket with object locking, and mandate all production changes through the automated pipeline.

Answer

Configure Cloud Build to run under a dedicated user-managed service account with fine-grained IAM roles, store state files in a versioned Cloud Storage bucket with object locking, and mandate all production changes through the automated pipeline.
The strategy requiring a dedicated user-managed service account with fine-grained IAM roles, centralized versioned GCS state backends with locking, and pipeline-only change management adheres to GCP security best practices for CI/CD automation and SDLC governance.

Step-by-Step Solution

1
Analyze pipeline security and service account identity configuration
Default service accounts carry excessive permissions or lack granular tracking; replacing them with dedicated user-managed service accounts bounded by specific predefined or custom IAM roles establishes least privilege.
Reduces blast radius and ensures auditability of actions taken by CI/CD build steps.
2
Evaluate Infrastructure as Code (IaC) state management strategy
Moving state files out of build containers into a Cloud Storage backend with object versioning and state locking ensures concurrency protection and state integrity.
Prevents state corruption when concurrent build steps execute or when build instances terminate.
3
Establish strict change control and prevent manual drift
Disallowing manual CLI updates and enforcing all modifications through version-controlled pipeline triggers maintains alignment between code and production state.
Eliminates configuration drift and enforces automated testing and approval controls.

Key Concept

CI/CD Pipeline Security and Infrastructure as Code State Management
Question 742Question →

A financial technology enterprise uses a Google Cloud resource hierarchy containing a top-level folder named Payments-Service. The security team needs to grant an automated CI/CD deployment service account permission to manage Compute Engine resources across all present and future projects under the Payments-Service folder. Additionally, DevOps engineers must be able to deploy virtual machines running as this service account in specific projects without gaining permission to modify the service account itself. Which two actions should you take to implement this access model following Google-recommended best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the Compute Admin role (`roles/compute.admin`) to the CI/CD service account at the Payments-Service folder level.; Grant the Service Account User role (`roles/iam.serviceAccountUser`) to DevOps engineers on the specific service account resource.

Answer

The correct architecture requires binding the Compute Admin predefined role to the CI/CD service account at the folder level to exploit IAM resource hierarchy inheritance, and granting the Service Account User role to DevOps engineers specifically on the service account identity resource.
Predefined roles bound at folder scope pass down permissions to child projects automatically via IAM resource hierarchy inheritance. Granting the Service Account User role on the identity resource ensures engineers can attach the service account to compute instances without gaining excessive administrative rights over the service account identity.

Step-by-Step Solution

1
Identify the appropriate scoping for Compute Engine administration across multiple projects.
Inheritance from the Payments-Service folder node down to all child project resources.
Applying IAM roles at higher hierarchy nodes avoids manual per-project bindings and ensures automated governance.
2
Select fine-grained predefined roles over primitive roles.
Compute Admin (`roles/compute.admin`) selected for infrastructure deployment tasks.
Predefined roles restrict permissions to specific GCP services rather than granting broad project-wide modification rights.
3
Delegate service account impersonation rights safely.
Service Account User (`roles/iam.serviceAccountUser`) granted on the target service account resource.
Engineers only need permission to attach the identity to instances, not permissions to edit or manage the service account itself.

Key Concept

IAM Resource Hierarchy Inheritance and Service Account Least Privilege
Question 743Question →

A retail banking institution based in Canada is migrating its core ledger and customer analytics platform to Google Cloud. To satisfy strict Canadian data sovereignty mandates and regulatory directives, the architecture must fulfill three core security requirements:
1. All persistent data at rest must be restricted exclusively to Google Cloud regions located within Canada.
2. Exfiltration of sensitive financial records to external Google Cloud resources by compromised credentials must be prevented.
3. Any access to customer data by Google support or engineering personnel must require explicit, just-in-time approval from the bank's security operations team with cryptographic verification.

Which combination of Google Cloud security controls should the Cloud Architect implement to satisfy these requirements?

Show answer & explanation

Answer: Enforce an Organization Policy with the `constraints/gcp.resourceLocations` constraint restricted to Canadian regions, establish a VPC Service Controls perimeter encompassing storage and database services, and enable Access Approval along with Access Transparency.

Answer

The correct architecture enforces an Organization Policy using `constraints/gcp.resourceLocations` set to Canadian regions, establishes a VPC Service Controls perimeter around sensitive storage and database services, and enables Access Approval combined with Access Transparency for Google support access.
Enforcing the `constraints/gcp.resourceLocations` Organization Policy guarantees that resources are provisioned strictly within Canadian regions. VPC Service Controls restrict communication between services, blocking exfiltration to unauthorized storage destinations. Access Approval and Access Transparency fulfill regulatory requirements by ensuring Google support cannot inspect customer data without explicit, logged permission.

Step-by-Step Solution

1
Evaluate data sovereignty requirements
Apply `constraints/gcp.resourceLocations` at the organization or folder level, restricting resource creation strictly to `in:canada-locations` (such as `northamerica-northeast1` and `northamerica-northeast2`).
Organization policies provide declarative enforcement preventing users from creating resources outside specified geographic regions.
2
Address data exfiltration risks
Define a VPC Service Controls perimeter around storage and database services (e.g., Cloud Storage, BigQuery, Cloud Spanner).
VPC Service Controls create an isolated security boundary that prevents authorized identities from copying data into GCP resources located outside the defined perimeter.
3
Enforce administrative access governance
Enable Access Approval and Access Transparency logging across the organization.
Access Transparency provides logs of Google administrator actions, while Access Approval requires explicit authorization from the customer before Google support personnel can view customer data.

Key Concept

Data Sovereignty and Perimeter Security Controls
Question 744Question →

An application running on a Google Compute Engine virtual machine requires read access to an Google Cloud Storage bucket. To adhere to security best practices for service account lifecycle management, the security team prohibits downloading long-lived service account key files. Which approach should you use to securely authenticate the application to Cloud Storage?

Show answer & explanation

Answer: Attach a service account with the required Cloud Storage permissions directly to the Compute Engine instance and authenticate using Application Default Credentials (ADC).

Answer

Attaching a service account directly to the Compute Engine instance and using Application Default Credentials (ADC) is the Google-recommended keyless authentication method.
Attaching a custom service account to a Compute Engine instance enables keyless authentication through the metadata server. Application Default Credentials (ADC) automatically fetch short-lived access tokens, ensuring robust service account lifecycle security without long-lived exported keys.

Step-by-Step Solution

1
Identify the authentication requirement
The application needs access to Cloud Storage without using downloadable long-lived service account keys.
Security governance strictly forbids downloading key files due to leak risks.
2
Apply Google Cloud native identity mechanisms
Assign a dedicated service account to the VM instance metadata.
Compute Engine automatically generates and rotates short-lived credentials accessible via the internal metadata server.
3
Leverage Application Default Credentials in application logic
The application automatically inherits permissions granted to the attached service account.
ADC seamlessly retrieves short-lived OAuth 2.0 access tokens without explicit key management.

Key Concept

Keyless Authentication via Attached Service Accounts and Application Default Credentials
Question 745Question →

A healthcare software provider is designing a cloud-native SaaS platform on Google Cloud to host two distinct application components:

1. A stateless REST API backend that receives sporadic HTTP telemetry data from connected medical devices, experiences long idle periods, and must scale to zero instances to eliminate idle infrastructure costs.
2. An on-demand background data cleaning workflow that runs non-HTTP containerized scripts for up to 4 hours per execution cycle when triggered by batch ingestion events.

The enterprise architecture team mandates a solution that minimizes operational management overhead by avoiding virtual machine management, cluster provisioning, or control plane administration.

Which TWO Google Cloud compute platform configurations should the team select to fulfill these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the stateless REST API backend to Cloud Run services configured with minimum instances set to zero.; Deploy the background data cleaning scripts to Cloud Run jobs configured to execute tasks on demand.

Answer

The optimal architecture combines Cloud Run services for the stateless REST API backend and Cloud Run jobs for the long-running background data cleaning workflow.
Cloud Run services provide fully managed serverless deployment for containerized stateless web applications with request-based scaling down to zero instances. Cloud Run jobs cater specifically to containerized tasks that do not serve HTTP requests and run to completion, supporting execution timeouts up to 24 hours per task. Together, they satisfy both workload requirements with zero server or cluster management.

Step-by-Step Solution

1
Analyze the stateless HTTP REST API requirements.
Identified the need for an HTTP serverless platform with scale-to-zero capabilities and zero server administration.
Cloud Run services automatically handle incoming HTTP requests, auto-scale from zero to thousands of instances based on traffic, and bill strictly for execution time per request.
2
Analyze the background data cleaning workflow requirements.
Identified the need for a serverless container execution model supporting non-HTTP, long-running (4-hour execution duration) batch jobs.
Cloud Run jobs run container images to completion without listening for HTTP requests and support task timeout limits up to 24 hours.
3
Evaluate alternative compute platforms against operational overhead constraints.
Rejected GKE, Compute Engine MIGs, and App Engine Standard Environment.
GKE and MIGs introduce unnecessary cluster/OS operational overhead and baseline infrastructure costs, while App Engine Standard is optimized for web serving rather than long-running containerized batch tasks.

Key Concept

Serverless Compute Selection (Cloud Run Services vs. Cloud Run Jobs)
Estimated Time:2m 0s
Question 746Question →

A enterprise healthcare provider is deploying an application on Google Cloud that processes confidential patient health information stored on Compute Engine persistent disks. Corporate governance requires that the enterprise retain central governance over key lifecycle management—including automated key rotation—while strictly isolating key administrative duties from workload management. Furthermore, application compute infrastructure must be restricted to performing encryption and decryption operations using the principle of least privilege. How should the cloud architect design the key management and IAM architecture to meet these requirements?

Show answer & explanation

Answer: Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS in a centralized security project, set up an automated key rotation schedule, and grant the predefined Cloud KMS CryptoKey Encrypter/Decrypter role on the key to the Compute Engine Service Agent of the workload project.

Answer

The correct architecture uses Customer-Managed Encryption Keys (CMEK) provisioned within Cloud KMS in a dedicated security project. Automated rotation is configured within Cloud KMS, and the specific Cloud KMS CryptoKey Encrypter/Decrypter role is granted to the Compute Engine Service Agent in the workload project.
Using CMEK via Cloud KMS housed in a separate security project satisfies key lifecycle ownership, automated rotation, and strict separation of duties. Granting the predefined `roles/cloudkms.cryptoKeyEncrypterDecrypter` role to the Compute Engine Service Agent follows the principle of least privilege by allowing the compute infrastructure to encrypt/decrypt data without granting key management rights.

Step-by-Step Solution

1
Identify key governance and rotation requirements
Customer-Managed Encryption Keys (CMEK) in Cloud KMS are required because CMEK provides automated key rotation, administrative isolation, and native integration with GCP services.
CSEK does not support automated rotation in GCP, and Google-default encryption does not offer customer control over key lifecycles.
2
Enforce project isolation for separation of duties
Provision Cloud KMS KeyRings and CryptoKeys in a separate, secure Google Cloud project dedicated to security administration.
Isolating security administration from the application workload project prevents workload admins from altering key policies or key states.
3
Assign least privilege IAM roles for disk encryption
Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the key resource to the workload project's Compute Engine Service Agent (`[email protected]`).
Compute Engine persistent disk encryption operations are executed by the service agent using envelope encryption under least privilege.

Key Concept

Customer-Managed Encryption Keys (CMEK) with Cloud KMS and IAM Least Privilege
Question 747Question →

A healthcare provider hosts a critical telemedicine application on Google Cloud using a multi-region deployment across us-central1 (primary) and us-east4 (secondary). The backend relies on Cloud Spanner for transactional patient records and Compute Engine Managed Instance Groups (MIGs) for application servers behind a Global External Application Load Balancer. The business continuity requirement specifies a Recovery Point Objective (RPO) of zero and a Recovery Time Objective (RTO) under 15 minutes. Which validation procedure should the cloud architect implement to periodically verify DR readiness in us-east4 without interrupting live production traffic in us-central1?

Show answer & explanation

Answer: Pre-verify regional compute quotas in us-east4, monitor Cloud Spanner replication latency metrics, and conduct synthetic health checks against isolated test endpoints provisioned on the us-east4 MIG via Cloud DNS weighted routing.

Answer

Pre-verify regional compute quotas in us-east4, monitor Cloud Spanner replication latency metrics, and conduct synthetic health checks against isolated test endpoints provisioned on the us-east4 MIG via Cloud DNS weighted routing.
The procedure that pre-verifies regional quotas, monitors Spanner replication metrics, and executes synthetic testing via isolated routing paths validates DR readiness across compute, storage, and networking layers without causing operational disruption to live users.

Step-by-Step Solution

1
Analyze RPO and RTO validation requirements
Zero RPO requires continuous multi-region synchronous/near-synchronous replication (provided natively by Cloud Spanner), while RTO under 15 minutes requires pre-allocated or rapidly scalable infrastructure in the secondary region.
DR validation procedures must verify that data replication lag remains near zero and that secondary infrastructure can immediately absorb production load.
2
Evaluate prerequisite environment validation checks
Regional resource quotas (e.g., Compute Engine vCPUs, in-use IP addresses) in us-east4 must be verified in advance to avoid capacity throttling during failover.
Quota increases in Google Cloud require administrative processing time and cannot be requested reactively during a DR event or time-bounded drill.
3
Design a non-disruptive traffic validation mechanism
Use Cloud DNS weighted routing or isolated test URLs to route synthetic test transactions to the secondary MIG while primary production traffic continues uninterrupted.
Validating DR capabilities should confirm full stack health in the secondary region without impacting live user sessions.

Key Concept

Disaster Recovery Validation & Quota Governance
Question 748Question →

An e-commerce company wants to monitor its online checkout pipeline to align technical metrics with customer satisfaction goals. The product team establishes a target that 99% of valid checkout requests must complete within 200 milliseconds. The operations team configures Google Cloud Monitoring to record the actual, real-time ratio of successful fast requests divided by total requests. Which component of the Site Reliability Engineering (SRE) framework does this real-time measurement metric represent?

Show answer & explanation

Answer: Service Level Indicator (SLI)

Answer

Service Level Indicator (SLI)
A Service Level Indicator (SLI) is a quantifiable metric that measures the actual performance of a service in real time, such as the ratio of successful requests to total requests. The target of 99% represents the Service Level Objective (SLO), while the metric measuring real-time compliance is the SLI.

Step-by-Step Solution

1
Identify the performance measurement described in the scenario.
The scenario describes computing the real-time ratio of successful requests divided by total requests.
Determining what specific data is being collected is the first step in SRE metric classification.
2
Differentiate between actual measurement and target threshold.
The target threshold is 99% (SLO), whereas the ratio calculation is the metric measuring actual performance (SLI).
SLIs measure actual behavior, while SLOs define the target threshold for that behavior.

Key Concept

Distinguishing Service Level Indicators (SLIs) from Service Level Objectives (SLOs)
Estimated Time:45s
Question 749Question →

A media streaming company is deploying a regional user profile microservice on Google Cloud that requires a relational database with high availability across zones. Company policy mandates that all database data at rest must be encrypted using key management controls in Cloud KMS to meet compliance audit requirements without managing raw encryption keys manually. The operations team uses Terraform to manage cloud resources and must maintain state file integrity during automated deployments. Which provisioning strategy meets these architectural, compliance, and infrastructure management requirements?

Show answer & explanation

Answer: Provision a Cloud SQL PostgreSQL instance configured for High Availability across multiple zones, integrated with a Cloud KMS key for Customer-Managed Encryption Keys (CMEK), and store the Terraform state in a Cloud Storage bucket with object versioning enabled.

Answer

Provision a Cloud SQL PostgreSQL instance configured for High Availability across multiple zones, integrated with a Cloud KMS key for Customer-Managed Encryption Keys (CMEK), and store the Terraform state in a Cloud Storage bucket with object versioning enabled.
The correct response combines appropriate database service sizing (Cloud SQL for regional high-availability relational needs), cloud-native key governance (CMEK with Cloud KMS), and enterprise IaC best practices (remote state storage in Cloud Storage with versioning).

Step-by-Step Solution

1
Select the appropriate database service for regional scope.
Choose Cloud SQL instead of Cloud Spanner because the application is a regional relational microservice that does not require global multi-region scalability.
Cloud SQL provides zonal and regional high availability at a cost-effective scale for standard relational database needs.
2
Select the proper encryption mechanism for Cloud KMS compliance.
Configure Customer-Managed Encryption Keys (CMEK) referencing a Cloud KMS key ring and key.
CMEK allows central governance and audit control over key access in Cloud KMS without taking on the operational burden of raw Customer-Supplied Encryption Keys (CSEK).
3
Configure secure Infrastructure as Code (IaC) state management.
Configure a remote Cloud Storage backend for Terraform with object versioning and state locking enabled.
Centralized, versioned remote state storage prevents concurrent execution conflicts, state corruption, and accidental deletion.

Key Concept

Cloud SQL Provisioning with CMEK and IaC Remote State Management
Question 750Question →

A digital healthcare company processes real-time patient telemetry using an enterprise application hosted in Google Cloud's `us-central1` region. The application relies on Cloud Bigtable for high-throughput sensor ingested data and Compute Engine Managed Instance Groups (MIGs) for stateless processing. The organization's business continuity policy mandates a Disaster Recovery (DR) RPO of 0 and an RTO of under 15 minutes in `us-east4`. The lead cloud architect is establishing automated DR validation procedures to execute non-disruptive quarterly failover drills. Which procedural step must be incorporated into the pre-drill validation protocol to ensure the failover procedure satisfies the RTO requirement without runtime failures?

Show answer & explanation

Answer: Programmatically verify and pre-allocate regional resource quotas and capacity reservations in `us-east4` prior to initiating traffic rerouting.

Answer

Programmatically verifying and pre-allocating regional resource quotas and capacity reservations in the target DR region prior to traffic rerouting is essential to ensure failover succeeds within RTO constraints.
Pre-validating regional quotas and securing capacity reservations in the secondary region ensures that when DR failover occurs, the secondary environment can scale up Compute Engine MIGs and provision resources instantly without hitting quota limits or resource shortages, thereby meeting the strict RTO of under 15 minutes.

Step-by-Step Solution

1
Analyze DR constraints and target metrics
Identified strict requirements of RPO = 0 and RTO < 15 minutes for real-time telemetry processing across regions.
Validation procedures must ensure both zero data loss and rapid service restoration.
2
Evaluate pre-failover validation requirements in target GCP region
Recognized that regional quotas (e.g., vCPU limits, in-use IP addresses) in `us-east4` can block MIG scaling if not requested and validated in advance.
Quota acquisition requests are not instant; failing to verify quotas beforehand breaks RTO guarantees.
3
Select the optimal validation procedure
Automated pre-flight quota checks and capacity reservation verifications prior to DNS and traffic switchover.
Ensures targeted secondary infrastructure can immediately absorb production traffic without provisioning errors.

Key Concept

Disaster Recovery Validation and Regional Resource Quota Management
Estimated Time:2m 0s
Question 751Question →

An organization is designing a credential management policy for microservices running on Google Cloud Compute Engine instances. Which of the following security practices should be implemented to enforce Google Cloud least privilege and service account lifecycle security recommendations? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach dedicated service accounts to the Compute Engine instances to utilize short-lived automatic credentials instead of generating static service account JSON keys.; Store third-party API credentials in Secret Manager and grant the workload's service account the Secret Manager Secret Accessor role.

Answer

The recommended security practices are attaching dedicated service accounts to compute instances to leverage short-lived credentials (avoiding static JSON keys) and storing sensitive credentials in Secret Manager with fine-grained Secret Accessor role permissions.
Attaching service accounts directly to compute instances eliminates static key exposure, while storing sensitive API keys in Secret Manager and binding the Secret Accessor role adheres strictly to least-privilege access principles.

Step-by-Step Solution

1
Evaluate service account key management strategy
Using attached service accounts with short-lived tokens eliminates static key management risks.
Google Cloud strongly advises against generating downloadable service account JSON keys whenever automatic metadata-based authentication can be used.
2
Evaluate application secrets storage method
Secret Manager with Secret Accessor role provides centralized least-privilege secret retrieval.
Secret Manager centralizes secret lifecycle management and fine-grained access control.

Key Concept

Secrets Management and Service Account Lifecycle Security
Question 752Question →

An enterprise Cloud Architect is designing perimeter security controls for a multi-tenant Google Cloud architecture. Match each enterprise security requirement on the left with the most appropriate Google Cloud perimeter control mechanism on the right.

Click a left item, then click its matching right item

Items

Prevent an authorized internal identity in a VPC from copying BigQuery dataset contents to an unapproved, external Google Cloud project storage location.
Mitigate Layer 7 credential-stuffing attacks targeting a public Global External HTTP(S) Load Balancer by dynamically throttling clients exceeding request thresholds.
Enforce organization-wide ingress traffic rules across multiple Shared VPC networks using dynamic, IAM-bound workload identity metadata rather than IP ranges.
Provide on-premises workloads private access to a third-party managed SaaS service hosted in a producer VPC without configuring transitive VPC Peering.

Matches

Show answer & explanation

Answer

Each enterprise security requirement maps directly to its designated perimeter control: Data exfiltration prevention matches VPC Service Controls; Layer 7 rate limiting matches Cloud Armor edge security policies; dynamic organization-wide firewall rule enforcement matches Hierarchical firewall policies with Secure Tags; and non-transitive private SaaS connection matches Private Service Connect.
The correct alignment maps each specific architectural risk to its appropriate defense mechanism: VPC Service Controls for exfiltration boundary defense, Cloud Armor for L7 edge protection, Hierarchical Firewalls with Secure Tags for organization-wide metadata-driven filtering, and Private Service Connect for non-transitive endpoint access.

Step-by-Step Solution

1
Analyze data exfiltration vector
Identify that IAM permissions alone cannot stop authorized users from writing to external resources, requiring a security perimeter control.
VPC Service Controls restrict API communication between managed services and external projects outside the perimeter.
2
Evaluate application-layer threat mitigation
Determine the edge protection mechanism for HTTP(S) Load Balancer traffic.
Cloud Armor inspects incoming web traffic at the global edge and enforces threshold-based rate limiting.
3
Assess dynamic network access policy across organization hierarchy
Select hierarchical policies with IAM-bound identity tags.
Hierarchical firewall rules combined with Secure Tags enforce consistent security postures at the organization level without IP static dependencies.
4
Review multi-tenant private connectivity options
Choose Private Service Connect for service endpoint publishing and consumption across network boundaries.
Private Service Connect bypasses transitive routing restrictions associated with VPC Network Peering and isolates tenant networks.

Key Concept

GCP Network Security & Perimeter Controls
Question 753Question →

An enterprise architecture team is conducting an operational and security audit of their automated deployment pipeline. The current system utilizes Cloud Build to execute Terraform scripts for infrastructure provisioning and deploy microservices to Google Kubernetes Engine (GKE) clusters. The audit revealed that build executions currently rely on broad primitive roles, pipeline state is maintained locally on temporary build agent disks leading to state corruption, and team members use exported long-lived service account JSON keys to authenticate pipeline triggers from external developer environments. Which TWO architectural modifications should be implemented to align the software delivery lifecycle with Google Cloud security and operational best practices?

Select all that apply

Show answer & explanation

Answer: Configure a dedicated user-managed service account for Cloud Build restricted to fine-grained predefined roles, and implement Workload Identity Federation for authenticating external developer triggers.; Migrate the Terraform state storage to a Cloud Storage backend configured with object versioning and state locking enabled.

Answer

The pipeline should be remediated by creating a dedicated user-managed service account for Cloud Build with least-privilege roles alongside Workload Identity Federation for keyless authentication, and storing Terraform state in a Cloud Storage backend with object versioning and state locking.
Secure and resilient CI/CD pipelines in Google Cloud require establishing least-privilege identity access using dedicated user-managed service accounts paired with Workload Identity Federation to eliminate service account keys. Additionally, managing Infrastructure as Code requires remote state storage in Cloud Storage featuring object versioning and state locking to guarantee state integrity and concurrent build execution.

Step-by-Step Solution

1
Analyze pipeline security and authentication mechanisms.
Identified reliance on primitive roles and exported JSON service account keys.
Exporting service account keys poses high exfiltration risk; keyless authentication via Workload Identity Federation coupled with a dedicated user-managed service account enforces security best practices.
2
Evaluate Infrastructure as Code state management requirements.
Identified local ephemeral storage of Terraform state as a single point of corruption and concurrency failure.
Centralizing state in Cloud Storage with versioning and state locking ensures data persistence, concurrency protection, and disaster recovery capability.

Key Concept

Continuous Integration & Delivery Pipeline Security and IaC State Management
Question 754Question →

A digital publishing firm needs to host a newly containerized, stateless HTTP microservice that renders vector graphics on demand. The workload experiences unpredictable traffic spikes throughout the day and stays completely idle overnight. The architectural goal is to minimize operational management overhead and infrastructure cost by automatically scaling down to zero when no traffic is present. Which Google Cloud compute platform should you recommend?

Show answer & explanation

Answer: Cloud Run

Answer

Cloud Run is the optimal compute platform for containerized stateless HTTP microservices that require scaling down to zero and minimal operational overhead.
Cloud Run provides a fully managed serverless compute environment for stateless containers. It automatically scales instances up to handle request traffic bursts and scales down to zero when idle, minimizing both management overhead and resource costs.

Step-by-Step Solution

1
Analyze workload statefulness and network protocols
The application is stateless and communicates over standard HTTP web endpoints.
Cloud Run specifically targets containerized stateless applications listening on web ports.
2
Evaluate scaling characteristics and operational overhead constraints
The workload is bursty, idle at night, and requires zero operational infrastructure management.
Cloud Run automatically handles infrastructure management and scales seamlessly from zero to handle inbound request spikes.

Key Concept

Selecting containerized compute platforms based on statelessness, scaling characteristics, and operational overhead.
Question 755Question →

An organization plans to validate its disaster recovery (DR) failover procedure by spinning up application workloads in a secondary Google Cloud region. What essential step must the cloud architecture team complete prior to executing the failover drill to prevent deployment failures caused by resource limits?

Show answer & explanation

Answer: Pre-verify and request regional Compute Engine resource quota increases in the destination disaster recovery region.

Answer

Pre-verifying and requesting regional Compute Engine resource quota increases in the secondary region prior to initiating the failover test.
Pre-verifying and requesting regional quota increases in the target disaster recovery region ensures that Google Cloud will allow the necessary Compute Engine instances and resources to be provisioned during a failover drill without hitting default quota limits.

Step-by-Step Solution

1
Analyze DR failover requirements for compute resources in the destination region.
Identified that scaling up workload instances in a secondary region requires sufficient available Compute Engine CPU and RAM quotas.
Google Cloud quotas are enforced per region to protect system resources.
2
Check target region quotas against estimated DR resource demands prior to testing.
Discovered that default regional quotas might restrict simultaneous instance creation during full failover.
Quota approval requests take time to process and must be completed before the validation drill starts.
3
Submit quota increase requests in advance for the DR destination region.
Guaranteed capacity availability for seamless instance provisioning during the failover simulation.
Pre-verifying quota limits ensures that the DR validation drill tests actual recovery logic rather than failing due to platform capacity limits.

Key Concept

Disaster Recovery Validation and Resource Quota Planning
Question 756Question →

An organization hosts a public web application behind an External HTTP(S) Load Balancer on Google Cloud and needs to enhance its security posture. The architecture requirements mandate defending the application against Layer 7 web attacks (such as SQL injection) and ensuring that sensitive backend data cannot be exfiltrated to external Google Cloud projects, even by authenticated users. Which TWO Google Cloud security controls should you implement? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Attach Cloud Armor security policies to the External HTTP(S) Load Balancer backend service.; Configure a VPC Service Controls service perimeter around the projects hosting the backend storage resources.

Answer

Attaching Cloud Armor security policies to the External HTTP(S) Load Balancer backend service and configuring a VPC Service Controls service perimeter around backend projects.
Cloud Armor security policies protect web applications against Layer 7 attacks such as SQL injection by filtering HTTP(S) traffic at the edge load balancer. Additionally, VPC Service Controls restricts communication between GCP services across perimeter boundaries, preventing data exfiltration to unauthorized projects.

Step-by-Step Solution

1
Identify the protection mechanism required for Layer 7 web application attacks at the ingress edge.
Google Cloud Armor security policies attach directly to backend services of External HTTP(S) Load Balancers to filter traffic and block threats like SQL injection.
Cloud Armor inspects incoming web traffic at the network edge before it reaches application instances.
2
Identify the perimeter security mechanism required to prevent data exfiltration across project boundaries.
VPC Service Controls defines a perimeter isolating Google Cloud APIs and storage services, blocking data transfers to unauthorized projects outside the perimeter.
IAM permissions alone cannot prevent an authorized user from copying data to an external bucket; VPC Service Controls enforces network-level boundary restrictions.

Key Concept

Combining Cloud Armor for edge WAF protection with VPC Service Controls for data exfiltration prevention.
Question 757Question →

An enterprise operations team is establishing a disaster recovery (DR) validation procedure for a mission-critical service on Google Cloud. Which TWO procedures should be included in the validation plan to ensure successful DR testing without causing production downtime or data corruption?

Select all that apply

Show answer & explanation

Answer: Pre-verify and request necessary Google Cloud compute and storage resource quotas in the target DR region prior to executing the failover drill.; Execute failover verification scripts against isolated database snapshots or non-production replicas rather than mutating primary production data.

Answer

The DR validation plan should include pre-verifying resource quotas in the target failover region and testing against isolated database snapshots.
Verifying resource quotas in the target DR region prior to testing prevents unexpected provisioning failures due to regional limits during failover. Performing DR validation against isolated snapshots or replicas protects production data from accidental modification during testing.

Step-by-Step Solution

1
Check target region quotas before testing.
Ensures capacity is available when spinning up failover instances.
Regional quotas are enforced per region, so insufficient quotas would cause resource provisioning failures during failover.
2
Isolate the validation test environment.
Protects production state from unintended modifications.
Validation testing should run against isolated snapshots or read-replicas to prevent live data corruption.

Key Concept

Developing Procedures for Business Continuity and Disaster Recovery Validation
Question 758Question →

An enterprise organization is designing a hub-and-spoke VPC network architecture in Google Cloud. The central Hub VPC must communicate independently with two separate workload VPCs (Spoke-A and Spoke-B). The topology must satisfy two key requirements: first, Spoke-A and Spoke-B must remain network-isolated from each other such that traffic cannot transit through the Hub VPC between the two spokes; second, the organization requires a dedicated 10 Gbps private connection to an on-premises data center without traversing the public internet. Which TWO architectural decisions should the network team implement? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Establish VPC Network Peering between the Hub VPC and Spoke-A, and separately between the Hub VPC and Spoke-B, relying on the default non-transitive routing of VPC Peering to enforce isolation between Spoke-A and Spoke-B.; Provision a Dedicated Interconnect connection between the on-premises co-location facility and a Google Cloud edge location to support SLA-backed 10 Gbps private traffic.

Answer

The correct decisions are to establish separate VPC Network Peering connections from the Hub VPC to each Spoke VPC to leverage non-transitive routing for network isolation, and to deploy Dedicated Interconnect for 10 Gbps private hybrid connectivity.
Establishing separate VPC Network Peering connections between the Hub VPC and each Spoke VPC correctly leverages Google Cloud's non-transitive peering model, which ensures that traffic between Spoke-A and Spoke-B cannot traverse the Hub VPC. Additionally, provisioning Dedicated Interconnect provides high-capacity, SLA-backed 10 Gbps private hybrid connectivity between the on-premises environment and Google Cloud.

Step-by-Step Solution

1
Evaluate inter-VPC traffic isolation requirements.
VPC Network Peering in Google Cloud is non-transitive by default. Peering Hub to Spoke-A and Hub to Spoke-B allows Hub-to-Spoke communication while automatically preventing Spoke-A from reaching Spoke-B through the Hub.
This natively satisfies the isolation requirement between Spoke-A and Spoke-B.
2
Evaluate hybrid connectivity bandwidth and SLA requirements.
Dedicated Interconnect provides private 10 Gbps (or 100 Gbps) physical links directly to Google's edge network.
VPN solutions route over the public internet and cannot scale to a dedicated 10 Gbps baseline per circuit.

Key Concept

VPC Network Topology, Non-Transitive Peering, and Hybrid Interconnect
Question 759Question →

An enterprise architecture team is designing an automated, secure CI/CD pipeline for a microservices application targeted for Cloud Run. To satisfy security and operational requirements, the pipeline must incorporate automated unit testing, container registry storage, security vulnerability scanning, policy validation, and progressive deployment. What is the correct chronological sequence of pipeline steps from initial source code commit to final production release?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct pipeline sequence begins with committing code to trigger Cloud Build, followed by running unit tests and compiling the container image, pushing the container to Artifact Registry to trigger Container Analysis, evaluating vulnerability scan results as a security gate, and finally deploying the release via Cloud Deploy to Cloud Run using a progressive canary strategy.
A secure, continuous delivery pipeline must follow a strict logical progression: code ingestion triggers the CI runner (Cloud Build), unit tests validate functional code before packaging, artifacts are stored in Artifact Registry to trigger Container Analysis, security scanning policy gates release creation, and finally Cloud Deploy manages progressive deployment to the runtime platform (Cloud Run).

Step-by-Step Solution

1
Initiate automated trigger
Cloud Build pipeline starts execution upon receiving the repository commit event.
CI/CD automation begins at code check-in.
2
Build and test container
Code passes unit tests and is packaged into an OCI-compliant container image.
Testing and container creation are required prior to image publishing.
3
Store artifact and scan
Container image is uploaded to Artifact Registry, initiating automatic Container Analysis scanning.
Container Registry storage enables automated security scanning against known vulnerability databases.
4
Evaluate security gating
Pipeline validates scan results and approves release creation in Cloud Deploy.
Deployment releases must be gated by security analysis checks to prevent vulnerable code from entering target environments.
5
Execute progressive deployment
Cloud Deploy deploys the application to Cloud Run with canary traffic splitting.
Progressive release delivery reduces blast radius and validates production telemetry before full traffic cutover.

Key Concept

CI/CD Pipeline Sequencing and Security Gating in GCP
Estimated Time:1m 30s
Question 760Question →

A multinational enterprise is provisioning a high-security environment on Google Cloud for financial transactions stored in Cloud SQL. Corporate policy mandates strict separation of duties: security teams must manage key lifecycles using Cloud KMS, while database administrators must manage database resources without having access to view key material or grant key permissions. You need to configure Customer-Managed Encryption Keys (CMEK) for the Cloud SQL instances while maintaining minimal required permissions for automated encryption operations. Which TWO configuration steps must the architecture team perform to satisfy these security and operational requirements?

Select all that apply

Show answer & explanation

Answer: Grant the Cloud SQL Service Agent role 'roles/cloudkms.cryptoKeyEncrypterDecrypter' on the target Cloud KMS CryptoKey.; Specify the fully qualified Cloud KMS CryptoKey resource identifier when provisioning or updating the Cloud SQL instance.

Answer

Grant the Cloud SQL Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key, and supply the fully qualified KMS key resource identifier during Cloud SQL instance configuration.
Enabling Customer-Managed Encryption Keys (CMEK) for Cloud SQL requires granting the Cloud SQL Service Agent fine-grained Cloud KMS CryptoKey Encrypter/Decrypter permissions on the designated key, as well as providing the KMS key resource ID during instance creation. This enforces strict separation of duties, ensuring database administrators cannot access or alter key materials while Cloud SQL performs automated cryptographic operations using Cloud KMS.

Step-by-Step Solution

1
Identify the Cloud SQL service agent service account for the project
Obtained the system-generated service agent email format ([email protected]).
Google Cloud service agents execute cryptographic operations on behalf of managed services.
2
Grant fine-grained cryptographic IAM role on Cloud KMS key
Bound the Cloud KMS CryptoKey Encrypter/Decrypter role directly to the Cloud SQL service agent on the specific key.
This enforces least privilege and separation of duties between security key management and database management.
3
Provision Cloud SQL instance with CMEK key reference
Configured the instance specifying the KMS key resource name.
Tells Cloud SQL to utilize Cloud KMS for encrypting at-rest database tables and automated backups.

Key Concept

Customer-Managed Encryption Keys (CMEK) and Service Agent Least Privilege in GCP
PreviousPage 38 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin