Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 61Question →

An enterprise platform engineering team is automating the provisioning of storage buckets and relational database instances using Infrastructure as Code (IaC). Corporate security mandates using key management where key rotation and access permissions are managed via cloud identity and access management policies without developers needing to handle or transmit raw encryption keys. Additionally, the team's automated CI/CD pipeline must prevent concurrent execution state corruption and maintain a history of infrastructure state changes for rollback safety. Which TWO actions should the team include in their provisioning architecture to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Provision Customer-Managed Encryption Keys (CMEK) via Cloud KMS and pass the key resource identifiers to the storage bucket and database instance resource blocks.; Configure a Cloud Storage remote backend for Infrastructure as Code state storage with object versioning and state locking enabled.

Answer

The team must provision Customer-Managed Encryption Keys (CMEK) using Cloud KMS to meet key governance requirements without managing raw keys, and configure a Cloud Storage remote backend with state locking and object versioning to protect Infrastructure as Code state integrity.
Provisioning Customer-Managed Encryption Keys (CMEK) via Cloud KMS satisfies organizational governance by leveraging managed key rotation and IAM-based key delegation without exposing raw key secrets. Configuring a Cloud Storage remote backend with object versioning and state locking secures state integrity against concurrent pipeline writes while preserving state history for operational recovery.

Step-by-Step Solution

1
Analyze encryption management requirements
Selected Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS over Customer-Supplied Encryption Keys (CSEK).
CMEK allows organizational key policies and rotation via IAM without exposing raw keys in IaC code or requiring manual key management.
2
Analyze Infrastructure as Code state requirements
Selected Cloud Storage remote state backend with state locking and object versioning.
Remote state locking prevents concurrent modifications by multiple pipeline execution workers, while object versioning maintains historical snapshots for audit and disaster recovery rollback.

Key Concept

Provisioning Database/Storage with CMEK and IaC Remote State Locking
Question 62Question →

A multinational financial enterprise requires centralized security logging across hundreds of Google Cloud projects structured under an organization hierarchy. The security operations team must continuously stream Data Access audit logs from all projects to an external Security Information and Event Management (SIEM) platform in real time. Project-level administrators must not be able to modify, disable, or delete this logging pipeline within their respective projects. Which architecture best satisfies these security and governance requirements?

Show answer & explanation

Answer: Create an aggregated log sink at the organization root level filtering for Data Access audit logs, direct its destination to a Cloud Pub/Sub topic in a dedicated security project, and grant minimal IAM logging permissions.

Answer

Create an aggregated log sink at the organization root level filtering for Data Access audit logs, direct its destination to a Cloud Pub/Sub topic in a dedicated security project, and grant minimal IAM logging permissions.
Creating an aggregated log sink at the organization root level ensures centralized, immutably managed collection of Data Access audit logs across all projects. Directing the log sink to a Cloud Pub/Sub topic in a central security project enables real-time ingestion by external SIEM platforms while preventing project administrators from modifying the pipeline.

Step-by-Step Solution

1
Identify the organization-wide scope and immutability requirements.
Real-time log collection across all current and future projects requires an organization-level aggregate sink.
Sinks defined at the organization level apply hierarchically and cannot be disabled by project-level administrators.
2
Select the appropriate real-time streaming destination.
Cloud Pub/Sub provides low-latency streaming to third-party SIEM solutions.
Exporting audit logs to a Pub/Sub topic enables continuous real-time ingestion by external platforms.
3
Enforce least privilege and proper key/role management.
Use fine-grained IAM roles rather than primitive roles or overly permissive administrative grants.
Least privilege prevents administrative escalation and unauthorized tampering.

Key Concept

Organization Aggregated Log Sinks and Real-time Audit Log Exporting
Estimated Time:2m 0s
Question 63Question →

An international logistics enterprise is establishing design standards to translate its logical architecture into a physical GCP architecture. The logical design specifies three core requirements: a stateless HTTP API ingestion tier with minimal operational complexity, a relational database tier requiring multi-region synchronous write consistency, and a network security boundary that prevents authorized users from exfiltrating data to external public storage. Which physical architecture mapping correctly aligns GCP services to these logical requirements?

Show answer & explanation

Answer: Deploy the stateless API tier on Cloud Run, use Cloud Spanner for the relational persistence layer across multiple regions, and enclose the cloud resources within a VPC Service Controls security perimeter.

Answer

The physical architecture mapping that uses Cloud Run for the stateless API tier, Cloud Spanner for multi-region relational persistence, and VPC Service Controls for perimeter isolation correctly fulfills the logical requirements.
The solution using Cloud Run, Cloud Spanner, and VPC Service Controls accurately translates all logical requirements into physical GCP architecture. Cloud Run provides serverless compute with zero cluster management; Cloud Spanner supports multi-region synchronous relational transactions; and VPC Service Controls establishes network perimeters to prevent data exfiltration beyond IAM controls.

Step-by-Step Solution

1
Analyze the logical requirements for the compute tier
Stateless HTTP API ingestion requiring minimal operational management maps physically to Cloud Run rather than GKE.
Cloud Run is a fully managed serverless platform that automatically scales to zero and removes container infrastructure management.
2
Analyze the logical requirements for the persistence tier
A relational database requiring multi-region synchronous write consistency maps physically to Cloud Spanner.
Cloud SQL only supports single-region primary instances with asynchronous cross-region replicas, whereas Cloud Spanner provides globally distributed synchronous ACID transactions across regions.
3
Analyze the logical requirements for data security and exfiltration prevention
Preventing data exfiltration by authorized entities requires physical perimeter isolation using VPC Service Controls.
IAM permissions control access identity but cannot restrict data movement across network boundaries to non-sanctioned GCP resources.

Key Concept

Translating Logical Architecture Requirements into Physical GCP Resource Selection
Estimated Time:2m 0s
Question 64Question →

A retail organization is setting up automated deployment pipelines to provision Compute Engine Managed Instance Groups (MIGs) across multiple zones for processing nightly inventory updates. The automation process requires creating virtual machine (VM) instances that run under a dedicated runtime service account with specific data access permissions. The security team insists on strictly adhering to the principle of least privilege for the deployment pipeline identity. Which IAM permission configuration should be applied to allow the deployment pipeline to provision the compute instances attached to the runtime service account?

Show answer & explanation

Answer: Grant the Service Account User role (roles/iam.serviceAccountUser) on the specific runtime service account to the deployment pipeline identity.

Answer

Grant the Service Account User role (roles/iam.serviceAccountUser) on the target runtime service account to the deployment pipeline service account.
To attach a service account to a Compute Engine instance or instance template during resource provisioning, the deploying entity must possess the `iam.serviceAccounts.actAs` permission on that service account. Granting the `roles/iam.serviceAccountUser` role directly on the specific runtime service account enforces the principle of least privilege by allowing the pipeline to attach the identity without administrative or project-wide access.

Step-by-Step Solution

1
Identify the operational requirement
The deployment automation pipeline must attach an existing runtime service account to newly created Compute Engine VMs within a Managed Instance Group.
When a compute resource executes code, it assumes the identity of its assigned service account.
2
Evaluate required IAM permissions for impersonation/attachment
To attach a service account to a VM instance, the provisioning identity needs the `iam.serviceAccounts.actAs` permission contained within the Service Account User role.
This prevents users or automated pipelines from abusing higher-privileged service accounts without explicit authorization.
3
Apply least privilege scoping
Granting `roles/iam.serviceAccountUser` specifically on the target service account resource boundary ensures minimum necessary privilege.
Scoped resource-level binding satisfies enterprise security requirements without exposing administrative capabilities.

Key Concept

Compute Engine Service Account Attachment & IAM Least Privilege
Question 65Question →

A regional health system needs to establish hybrid connectivity between its primary on-premises data center and a Google Cloud VPC to support real-time imaging data transfers. The architecture requires a sustained throughput of 6 Gbps, dynamic BGP routing using Cloud Router, and a 99.99% availability SLA. The organization does not have a physical co-location presence in a Google Cloud Interconnect colocation facility. Which hybrid connectivity solution should the cloud architect recommend?

Show answer & explanation

Answer: Establish a Partner Interconnect connection using redundant VLAN attachments through a supported service provider across two edge availability domains.

Answer

The correct architecture is to establish a Partner Interconnect connection using redundant VLAN attachments through a supported service provider across two edge availability domains.
Partner Interconnect is designed for organizations that require SLA-backed, high-bandwidth (up to 10 Gbps per attachment) private connectivity to GCP but do not have hardware co-located in a Google Cloud peering location. Configuring redundant VLAN attachments across two edge availability domains satisfies both the 6 Gbps bandwidth target and the 99.99% availability SLA.

Step-by-Step Solution

1
Evaluate throughput and colocation requirements
Sustained 6 Gbps throughput exceeds standard HA VPN single-tunnel capabilities (3 Gbps per tunnel), requiring an Interconnect solution. The lack of a physical presence in a Google colocation facility rules out Dedicated Interconnect.
Dedicated Interconnect requires customer equipment in a Google co-location facility, whereas Partner Interconnect bridges customer data centers to GCP via a supported service provider.
2
Verify high availability (99.99% SLA) configuration requirements
A 99.99% SLA requires two Partner Interconnect connections established across two distinct edge availability domains (EADs) connected to Cloud Routers in the target region.
Redundancy across service provider paths and GCP edge availability domains guarantees continuous operation during single-point maintenance or outages.

Key Concept

Selecting and configuring GCP Partner Interconnect for high-throughput, SLA-backed hybrid connectivity without direct colocation footprint.
Question 66Question →

A multinational financial enterprise is designing an automated validation framework to test new infrastructure releases prior to production rollout. The environment incorporates private Google Kubernetes Engine (GKE) clusters, Terraform Infrastructure as Code (IaC) deployment pipelines, and strict security perimeters. The cloud architecture team must establish a robust testing procedure that validates technical capacity, network access security, and operational reliability while preventing deployment failures or security gaps. Which TWO procedures must the cloud architect integrate into the pre-deployment testing strategy to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Audit regional resource quotas in target deployment regions and request necessary quota increases prior to running large-scale automated provisioning validation suites.; Configure master authorized networks and secure private jump hosts or VPN pathways to test private GKE cluster control plane endpoints without exposing administrative interfaces publicly.

Answer

The correct procedures are auditing and requesting regional resource quota increases prior to deployment validation, and configuring master authorized networks with private administrative access paths to validate private GKE control plane readiness.
A comprehensive cloud architecture testing procedure must validate both operational capacity and security access patterns. Requesting regional quota increases in advance prevents deployment validation failures due to missing quotas. Furthermore, testing private GKE cluster readiness requires configuring master authorized networks and private connectivity so test suites can reach the control plane API securely.

Step-by-Step Solution

1
Evaluate infrastructure resource requirements against GCP regional quotas before running validation tests.
Prevents automated provisioning test failures caused by hitting default API or compute quota caps.
Quota increases can take time to process, so validating quota availability is a critical pre-deployment step.
2
Establish secure control plane communication testing for private GKE clusters using authorized networks and private access paths.
Ensures cluster health and API endpoints can be tested securely without exposing administrative endpoints to public networks.
Private GKE control planes block public traffic by default, necessitating explicitly configured authorized networks for CI/CD runners or jump hosts.
3
Reject relying solely on IAM for data security testing and reject unversioned local state storage for IaC.
Ensures defense-in-depth network perimeter validation and maintains IaC state integrity.
VPC Service Controls dry-run mode must be tested to ensure data perimeter boundaries, and centralized versioned remote backends (such as Cloud Storage with versioning) are mandatory for safe IaC execution.

Key Concept

Developing Procedures to Test and Validate Technical Solutions
Question 67Question →

A global media streaming company operates an interactive video-on-demand platform on Google Cloud. The primary architecture runs in us-central1, with a secondary disaster recovery (DR) environment prepared in us-east4. The business defines a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 15 minutes. To comply with regulatory audits, the company must execute monthly disaster recovery validation procedures without disrupting live user streams or risking data corruption in production. Which validation procedure should the Cloud Architect implement to satisfy these business continuity requirements?

Show answer & explanation

Answer: Automate a non-disruptive DR validation workflow using Cloud Workflows that pre-verifies regional Compute Engine quota allocations and capacity reservations in us-east4, checks Cloud SQL cross-region read replica replication lag against the 5-minute RPO threshold, promotes a temporary database clone in an isolated VPC network for integration testing, and tears down test infrastructure upon completion.

Answer

The optimal validation procedure is to automate a non-disruptive DR validation workflow that pre-verifies regional quotas and capacity reservations, monitors replication lag, tests failover in an isolated VPC network using temporary database clones, and cleans up resources without altering production Cloud DNS records.
The correct option outlines a comprehensive, non-disruptive DR testing procedure. Pre-verifying quotas and reservations guarantees resource availability, monitoring replication lag satisfies the 5-minute RPO, and running validation in an isolated VPC subnet ensures production traffic in us-central1 remains completely unaffected.

Step-by-Step Solution

1
Pre-verify capacity and resource quota
Ensures the secondary region (us-east4) has adequate Compute Engine CPU, RAM, and IP quota allocations to host the full production workload during failover.
Prevents failover failure caused by unexpected regional quota limits during an actual disaster.
2
Validate data replication health against RPO constraints
Confirms that cross-region database replication lag remains well below the strict 5-minute RPO threshold.
Ensures minimal data loss before initiating any failover processes.
3
Perform isolated sandbox validation
Promotes a temporary point-in-time database clone in an isolated VPC network in us-east4 and runs automated integration test suites without updating live Cloud DNS records.
Validates application functionality and data integrity end-to-end without affecting active production user sessions in us-central1.
4
Automate tear-down and cleanup
Deletes temporary test resources and resets test state post-validation.
Controls operational infrastructure costs while keeping validation procedures fully automated and repeatable.

Key Concept

Business Continuity and Disaster Recovery Validation Procedures
Question 68Question →

An enterprise logistics platform running on Google Cloud processes high-volume vehicle location updates via Cloud Pub/Sub and Dataflow. The company's customer contracts include a strict Service Level Agreement (SLA) guaranteeing 99.9% monthly availability for location lookup requests, with tier-1 financial penalties incurred if availability drops below this threshold. Executive leadership wants to ensure operational performance directly protects business revenue while preserving engineering release velocity. As a Cloud Architect, how should you define the Service Level Objectives (SLOs) and Service Level Indicators (SLIs) to align technical operational performance with this business objective?

Show answer & explanation

Answer: Define the SLI as the ratio of successful location lookup requests to total requests measured over rolling 30-day windows, set an internal SLO of 99.95% availability, and configure automated alerts on error budget burn rates to intervene before breaching the 99.9% contractual SLA.

Answer

Define the SLI as the ratio of successful location lookup requests to total requests measured over rolling 30-day windows, set an internal SLO of 99.95% availability, and configure automated alerts on error budget burn rates to intervene before breaching the 99.9% contractual SLA.
The correct response properly distinguishes between SLI (the metric calculation of successful requests divided by total requests), SLO (the internal target goal of 99.95%), and SLA (the external contractual agreement of 99.9%). Setting an internal SLO higher than the external SLA creates an error budget buffer that absorbs minor outages without triggering financial penalties. Operational alerting on multi-window error budget burn rates ensures proactive intervention before breaching the contractual threshold.

Step-by-Step Solution

1
Differentiate metrics (SLI vs. SLO vs. SLA)
SLI is the metric measuring actual performance (good requests / total requests). SLO is the internal target (99.95%). SLA is the business contract (99.9%).
Clear separation ensures operational measurements accurately feed target objectives without metric definition confusion.
2
Align internal target to business penalty boundary
Setting an internal SLO (99.95%) tighter than the customer SLA (99.9%) establishes an error budget cushion.
An error budget margin protects the business from financial penalties while allowing planned feature deployments and minor operational anomalies.
3
Implement proactive alerting mechanism
Alerting on error budget burn rate identifies consumption speed before total depletion.
Burn rate alerting enables SRE teams to mitigate issues before the external SLA boundary is violated.

Key Concept

SRE Service Level Alignment & Error Budget Management
Question 69Question →

A multinational telemetry platform hosts over 80 independent GCP projects managed by decentralized product teams. The FinOps governing committee identifies severe cost spikes driven by un-tagged resource deployments and unmonitored compute scaling across transient environments. To establish robust FinOps governance, the architecture must enforce mandatory cost-center tagging without interrupting active deployment pipelines, provide detailed cost attribution by business unit, and dynamically constrain high-cost resource creation. Which architectural strategy best satisfies these cost governance and operational requirements?

Show answer & explanation

Answer: Define Organization Tags bound at the folder level, mandate tag compliance using Organization Policy constraints, export granular Cloud Billing data to BigQuery for cost attribution, and execute automated remediation via Eventarc and Cloud Functions triggered by Cloud Audit Logs upon non-compliant resource creation.

Answer

The correct strategy combines Organization Tags, Organization Policy constraints, BigQuery Cloud Billing export, and event-driven automated remediation using Eventarc and Cloud Functions.
Combining Organization Tags with Organization Policy constraints and BigQuery billing exports provides a scalable, enterprise-grade FinOps framework. It ensures mandatory metadata inheritance for accurate chargeback/showback reports while utilizing event-driven serverless automation (Eventarc and Cloud Functions) to remediate non-compliant resources safely.

Step-by-Step Solution

1
Evaluate tagging and policy governance requirements
Organization Tags bound to resource hierarchies paired with Organization Policies ensure standardized metadata inheritance across decentralized projects without breaking CI/CD pipelines.
FinOps cost allocation requires reliable metadata tracking across all deployed infrastructure.
2
Assess cost breakdown and reporting mechanisms
Standard BigQuery billing export ingests Organization Tags and resource labels, enabling detailed querying and spend reporting by business unit.
Granular cost visibility allows product teams to be accountable for their operational spend.
3
Design automated enforcement and governance safeguards
Audit Log events routed via Eventarc to Cloud Functions detect and shut down un-tagged or unauthorized high-cost resources in near real-time.
Automated event-driven remediation prevents unexpected cost runaways without requiring manual administrative intervention.

Key Concept

FinOps Governance and Automated Cost Controls
Question 70Question →

A financial transaction processing company is connecting its on-premises core infrastructure to a Google Cloud Virtual Private Cloud (VPC) network. The architecture requires a high-bandwidth connection capable of supporting a 99.99% Availability Service Level Agreement (SLA) for Dedicated Interconnect, operating entirely over private infrastructure without traversing the public internet. Which TWO deployment steps are required to meet the 99.99% SLA availability requirements?

Select all that apply

Show answer & explanation

Answer: Provision at least four Dedicated Interconnect connections across two distinct metropolitan areas (metros) and two Edge Availability Domains per metro.; Configure Cloud Routers in two distinct Google Cloud regions and enable Global Dynamic Routing on the target VPC network.

Answer

To achieve a 99.99% availability SLA for Dedicated Interconnect, you must provision four connections total across two distinct metropolitan areas (using two Edge Availability Domains per metro) and deploy Cloud Routers in two distinct GCP regions with Global Dynamic Routing enabled on the VPC.
Achieving a 99.99% SLA for Dedicated Interconnect requires physical and logical redundancy across multiple facilities and regions. Specifically, you must order four Dedicated Interconnect connections divided across two distinct metros and two Edge Availability Domains per metro. At the network level, Cloud Routers must be deployed in two separate GCP regions inside the VPC, and Global Dynamic Routing must be enabled so that BGP routes are advertised and managed globally across the VPC.

Step-by-Step Solution

1
Determine the physical connectivity requirements for 99.99% SLA under GCP Dedicated Interconnect guidelines.
Identify that 99.99% availability requires 4 connections across 2 metros and 2 Edge Availability Domains per metro.
Redundancy across multiple facilities and availability domains ensures resilience against facility-level outages.
2
Determine the Google Cloud network routing configuration for multi-region failover.
Provision Cloud Routers in two distinct Google Cloud regions and turn on Global Dynamic Routing for the VPC.
Global Dynamic Routing enables BGP route propagation across all regions in the VPC, allowing seamless dynamic failover between regions.

Key Concept

Configuring 99.99% High Availability Dedicated Interconnect Topology
Question 71Question →

An enterprise telematics provider completed a rapid lift-and-shift migration of its vehicle tracking platform to Google Cloud. A technical debt assessment revealed two major operational risks: infrastructure configuration changes are frequently made directly in the Google Cloud console by engineers holding project-level Editor roles, and Terraform state files are stored locally on individual developer workstations. Which strategy should the cloud architect recommend to mitigate this technical debt while enforcing least privilege and automated governance?

Show answer & explanation

Answer: Migrate Terraform state to a remote Cloud Storage bucket with object versioning and state locking enabled, restrict console access by replacing project-level Editor roles with fine-grained IAM roles, and automate infrastructure deployments via Cloud Build service accounts.

Answer

Migrate Terraform state to a remote Cloud Storage bucket with object versioning and state locking enabled, restrict console access by replacing project-level Editor roles with fine-grained IAM roles, and automate infrastructure deployments via Cloud Build service accounts.
Centralizing Terraform state management into a Cloud Storage backend with object versioning and locking resolves state drift and prevents concurrent execution corruption. Eliminating broad primitive Editor roles in favor of least-privilege predefined roles and routing changes through Cloud Build pipelines enforces strict infrastructure-as-code governance and eliminates manual console modifications.

Step-by-Step Solution

1
Assess the IaC state management technical debt
Identified local state storage as a high-risk anti-pattern causing concurrency conflicts and potential data loss.
Storing state files locally prevents collaboration, lacks object locking, and exposes infrastructure secrets.
2
Remediate IaC state management
Configure a Google Cloud Storage backend for Terraform with object versioning and state locking.
Cloud Storage backends provide secure, centralized, version-controlled state management with locking via Cloud KMS/GCS native mechanisms.
3
Assess and remediate IAM and configuration drift technical debt
Replace project-level Editor roles with least-privilege predefined or custom roles, and enforce deployment through automated CI/CD pipelines (Cloud Build).
Manual Cloud console modifications by Editor-level accounts cause untracked configuration drift. Automating deployments via dedicated service accounts prevents out-of-band changes.

Key Concept

Mitigating IaC State Drift and IAM Technical Debt
Estimated Time:2m 0s
Question 72Question →

An online retail enterprise operating on Google Cloud experiences direct financial losses whenever customer order placement fails or suffers severe latency during peak promotional periods. The business leadership requires that 99.5% of critical customer transactions succeed within acceptable response times, while secondary background operations like inventory synchronization can tolerate lower availability without impacting user revenue. The Site Reliability Engineering (SRE) team must align technical monitoring and SLO management with these specific business goals. Which TWO architectural and operational strategies should the team implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define distinct Service Level Indicators (SLIs) specifically measuring successful user transaction requests separately from non-critical background data sync operations.; Configure error budget burn-rate alerts evaluated across multiple time windows to trigger operational responses before the business-critical SLO is breached.

Answer

The team should define distinct SLIs for high-impact user transaction requests versus non-critical background operations, and configure multi-window error budget burn-rate alerts for the critical checkout service.
Correct alignment of SLAs, SLOs, and SLIs requires measuring metrics that directly correlate with user experience and business outcomes (such as checkout transaction success rates) rather than system-level metrics. Furthermore, managing availability through error budget burn-rate alerting ensures that engineering efforts focus on protecting business objectives without inducing operational noise.

Step-by-Step Solution

1
Categorize service endpoints based on business revenue impact
Order placement is identified as critical (revenue-impacting) while inventory sync is non-critical.
Technical service objectives must directly reflect distinct business criticality levels.
2
Establish user-centric SLIs measuring successful request rates for critical flows
SLIs track successful HTTP transactions over total requests for the order endpoint.
SLIs must evaluate actual user experience rather than raw infrastructure metrics like CPU utilization.
3
Implement error budget burn-rate alerting
Alerts trigger dynamically when error budget consumption rate threatens the 99.5% SLO target.
Burn-rate alerting prevents alert fatigue while ensuring timely operational intervention during severe incidents.

Key Concept

Aligning user-centric SLIs and multi-window burn-rate SLO alerting with business impact
Question 73Question →

An enterprise architecture team is designing a perimeter security strategy for an internal analytics application processing sensitive records across multiple Google Cloud projects. Authorized analysts execute queries in Project A against BigQuery datasets hosted in Project B. The security compliance team requires that data exfiltration to unauthorized Google Cloud storage resources or non-approved GCP projects be strictly prevented, even if an analyst possesses elevated IAM administrative privileges. The analysts must maintain seamless ability to query BigQuery datasets spanning both Project A and Project B. Which perimeter control architecture should the Cloud Architect recommend?

Show answer & explanation

Answer: Define a VPC Service Controls service perimeter that includes both Project A and Project B, and restrict the BigQuery API within the perimeter.

Answer

Define a VPC Service Controls service perimeter that includes both Project A and Project B, and restrict the BigQuery API within the perimeter.
Defining a VPC Service Controls perimeter around both Project A and Project B with the BigQuery API restricted effectively creates a cryptographic and network boundary. This permits communication between the two enclosed projects while preventing data exfiltration to any project or storage bucket outside the perimeter, even if an identity possesses administrative IAM privileges.

Step-by-Step Solution

1
Analyze the exfiltration threat vector
Identified that IAM permissions control who has authorization to access resources, but cannot restrict authorized users from moving data to external GCP projects or storage buckets outside administrative control.
Security requirements mandate preventing data movement to non-approved GCP projects even when users hold elevated IAM roles.
2
Evaluate perimeter control boundaries
Determine that VPC Service Controls (VPC SC) establishes a security boundary around GCP services and projects.
VPC SC blocks API requests that attempt to cross the defined boundary, preventing exfiltration to resources outside the perimeter.
3
Formulate multi-project perimeter architecture
Enclose both Project A (where queries run) and Project B (where datasets reside) inside a single unified VPC Service Controls perimeter with BigQuery restricted.
Including both projects allows legitimate cross-project query operations while isolating both projects from unauthorized external projects.

Key Concept

VPC Service Controls Perimeter Defense and Data Exfiltration Prevention
Estimated Time:2m 0s
Question 74Question →

A multi-tenant IoT telemetry platform hosts its real-time processing pipeline on Google Cloud with a primary deployment in us-east1 and a secondary disaster recovery (DR) site in us-central1. The business mandates a recovery time objective (RTO) of 2 hours and a recovery point objective (RPO) of 15 minutes. During a recent DR validation drill, attempting to fail over processing nodes to the DR region caused severe service degradation because the secondary region lacked sufficient Compute Engine CPU quota to accommodate the incoming traffic volume. Which procedure should the cloud architect implement to ensure reliable disaster recovery validation?

Show answer & explanation

Answer: Automate pre-validation verification checks of regional resource quotas and capacity reservations in the target region prior to initiating failover drills, while conducting regular non-disruptive DR simulations.

Answer

Automate pre-validation verification checks of regional resource quotas and capacity reservations in the target region prior to initiating failover drills, while conducting regular non-disruptive DR simulations.
Establishing automated pre-validation procedures that verify regional CPU/instance quotas and active capacity reservations ensures that target DR regions have sufficient capacity before failover traffic is routed, satisfying both RTO and RPO objectives.

Step-by-Step Solution

1
Analyze the failure root cause in the DR validation drill.
Identified regional compute quota limits in the secondary region as the primary blocker preventing successful failover execution.
Compute Engine default quotas in secondary regions may not match primary region allocations unless requested in advance.
2
Evaluate validation procedures against RTO/RPO objectives.
Automated pre-checks and reserved capacity ensure target infrastructure readiness without risking SLA breaches during failover.
DR validation procedures must ensure resources exist and can scale before shifting live or simulated traffic.

Key Concept

Disaster Recovery Validation and Quota Management
Question 75Question →

An enterprise logistics company is establishing FinOps governance and cost optimization practices across its Google Cloud environment. Which of the following strategies will effectively lower operational spending while maintaining proper resource governance? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Configure Cloud Storage Lifecycle Management rules to automatically transition historical application log objects to Nearline or Coldline storage classes based on object age.; Apply consistent resource labels across projects and configure GCP Billing budget alerts to track department-level spending against financial targets.

Answer

The effective cost optimization strategies are configuring Cloud Storage Lifecycle Management rules for aged logs and implementing resource labeling with GCP Billing budget alerts.
The correct strategies leverage native Google Cloud functionality to reduce waste and enforce governance: Cloud Storage Lifecycle Management automates moving older data to cheaper storage tiers, while structured resource labels paired with GCP Billing budget alerts provide granular spending visibility and proactive budget management required by FinOps frameworks.

Step-by-Step Solution

1
Evaluate storage tiering automation
Moving aged logs to Nearline or Coldline storage automatically reduces per-gigabyte storage pricing.
Cold storage classes provide lower storage costs for infrequently accessed data.
2
Assess organizational billing visibility and accountability
Combining standardized resource labels with project budget alerts enables accurate cost breakdown and early detection of cost overruns.
FinOps practices rely on clear accountability and automated budget thresholds.
3
Identify suboptimal pricing commitments and architecture selections
Avoid committing to long-term discounts on variable batch workloads, using high-cost multi-region database services for simple SQL, or hosting simple web containers on dedicated GKE clusters.
These approaches introduce unnecessary baseline expense and financial lock-in.

Key Concept

Optimizing Business Processes through FinOps and Cloud Cost Management
Question 76Question →

A logistics enterprise manages its Google Cloud environment using a parent folder named 'Fleet-Operations', which contains separate sub-folders for 'Production', 'Staging', and 'Development' environments. The operational safety engineering team requires read-only visibility into Compute Engine Virtual Machines (VMs) across all workloads under 'Fleet-Operations' to inspect instance configurations and operational metrics without modifying running instances or viewing object storage data. Which administrative action adheres to the principle of least privilege while minimizing operational complexity?

Show answer & explanation

Answer: Grant the predefined Compute Viewer role (roles/compute.viewer) to the safety engineering group on the 'Fleet-Operations' folder node.

Answer

Granting the predefined Compute Viewer role (roles/compute.viewer) to the safety engineering group at the 'Fleet-Operations' folder node.
Assigning the predefined Compute Viewer role at the top parent folder node leverages resource hierarchy inheritance. All current and future projects beneath the 'Fleet-Operations' folder automatically inherit read-only access to Compute Engine resources without giving access to modify resources or inspect object storage payload data.

Step-by-Step Solution

1
Identify the required permissions and resource scope
The team needs read-only access to Compute Engine instances across all sub-folders under 'Fleet-Operations'.
Understanding the required access level prevents granting excessive write or administrative privileges.
2
Select the appropriate role type and policy binding node
Selecting roles/compute.viewer applied at the parent folder 'Fleet-Operations'.
IAM roles applied at parent folders are inherited by child sub-folders and projects, avoiding manual per-project configuration.

Key Concept

Resource Hierarchy IAM Role Inheritance and Predefined Roles
Question 77Question →

A cloud engineering team is automating the provisioning of an enterprise data archive on Google Cloud using Terraform. Regulatory compliance requires that all archived objects remain immutable and unmodifiable for seven years after upload. Additionally, company governance requires data at rest to be encrypted using keys managed in Cloud KMS, with automated infrastructure state tracking to prevent concurrency conflicts. Which TWO actions should the team incorporate into their automated provisioning design?

Select all that apply

Show answer & explanation

Answer: Configure a Object Retention Policy on the Cloud Storage bucket with a seven-year duration and retain the policy in a locked state.; Grant the Cloud Storage Service Agent service account the Cloud KMS CryptoKey Encrypter/Decrypter role on the dedicated Cloud KMS key.

Answer

To meet compliance and security requirements, the team must configure and lock a seven-year retention policy on the Cloud Storage bucket and grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the specified CMEK key.
Locking a Cloud Storage retention policy enforces WORM compliance so objects cannot be deleted or overwritten during the retention period. Granting the Cloud Storage service agent encrypter/decrypter rights on the Cloud KMS key enables seamless server-side CMEK encryption during bucket resource provisioning.

Step-by-Step Solution

1
Identify the immutability requirement mechanism
Cloud Storage Retention Policies with Bucket Lock provide WORM (Write Once, Read Many) compliance.
Locking the policy prevents shortening or removing the retention period even by privileged identity accounts.
2
Determine key management authorization requirements
The Cloud Storage service agent (service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com) requires `roles/cloudkms.cryptoKeyEncrypterDecrypter` permissions.
Cloud Storage uses service-agent impersonation to encrypt and decrypt data using Cloud KMS keys.
3
Evaluate distractor configurations
Reject local state file storage and CSEK raw key configurations.
CSEK introduces raw key exposure risks in IaC code, and local unversioned state fails to provide state locking or durability.

Key Concept

Provisioning Immutable Cloud Storage with CMEK and IaC Best Practices
Question 78Question →

A multinational financial services institution processes high-frequency transactions on Google Kubernetes Engine (GKE). To maintain strict regulatory compliance, the security team mandates a zero-trust container security framework. The system must meet three criteria: (1) prevent deployment of untrusted container images by enforcing cryptographic image verification signed by both CI/CD build pipelines and security reviewers, (2) continuously scan container images stored in Artifact Registry for known CVE vulnerabilities, and (3) detect runtime anomalies such as reverse shells and suspicious process executions without installing custom monitoring agents in the cluster. Which architecture and service configuration best fulfills all requirements?

Show answer & explanation

Answer: Configure Binary Authorization with a policy requiring attestations from both the build pipeline and security reviewer attestors, enable Artifact Registry Vulnerability Scanning for continuous vulnerability analysis, and activate Security Command Center Premium with Event Threat Detection and Container Threat Detection.

Answer

Configure Binary Authorization with a policy requiring multi-attestor signatures (CI/CD build and security reviewers), Artifact Registry Vulnerability Scanning for continuous vulnerability checks, and Security Command Center Premium featuring Container Threat Detection and Event Threat Detection for agentless runtime threat discovery.
The solution requiring Binary Authorization, Artifact Registry Vulnerability Scanning, and Security Command Center Premium (Container Threat Detection) fulfills all three security goals. Binary Authorization enforces image signature validation from multiple attestors prior to deployment; Artifact Registry provides automated vulnerability auditing; SCC Premium Container Threat Detection monitors container runtime operations agentlessly.

Step-by-Step Solution

1
Evaluate container deployment validation requirements
Binary Authorization integrates with GKE to enforce deployment policies that require cryptographic attestations from specified attestors (e.g., CI/CD build system and security review teams) prior to pod execution.
This guarantees that untrusted or unvalidated images cannot be deployed into the production cluster.
2
Evaluate image vulnerability scanning requirements
Artifact Registry Vulnerability Scanning (Container Analysis) automatically scans container images when pushed and continuously updates vulnerability reports when new CVEs are published.
This maintains visibility over known software vulnerabilities across container repositories.
3
Evaluate runtime threat detection requirements without agent overhead
Security Command Center (SCC) Premium includes Container Threat Detection, which analyzes hypervisor and audit logs to identify runtime threats (such as reverse shells or unauthorized binary execution) agentlessly.
This satisfies the requirement for real-time runtime monitoring without injecting third-party daemonsets or agents into cluster nodes.

Key Concept

Container Security Pipeline & Threat Detection in GCP
Question 79Question →

An enterprise organization operates a Private Google Kubernetes Engine (GKE) cluster in Project A that processes sensitive analytics data stored in a Cloud Storage bucket in Project B. Strict compliance mandates require that data cannot traverse the public internet, data exfiltration to external storage locations must be prevented even if an identity possesses broad IAM storage roles, and administrative access to the GKE master endpoint must be restricted exclusively to a management bastion subnet located in Project C. Which network security design should you implement to meet all requirements?

Show answer & explanation

Answer: Enclose Project A and Project B inside a VPC Service Controls perimeter, enable Private Google Access for Cloud Storage connectivity, and configure GKE Control Plane Authorized Networks to limit master endpoint access to the Project C management subnet range.

Answer

Enclose Project A and Project B inside a VPC Service Controls perimeter to prevent data exfiltration, utilize Private Google Access for private API communication, and configure GKE Control Plane Authorized Networks to restrict administration to the Project C management subnet.
VPC Service Controls provides perimeter security that isolates Google API service communications for Project A and Project B, preventing data exfiltration to unauthorized buckets even when identities hold high-level IAM roles. Private Google Access routes storage traffic internally, while GKE Control Plane Authorized Networks specifies the exact authorized subnet range from Project C permitted to reach the GKE master API endpoint.

Step-by-Step Solution

1
Address data exfiltration prevention across projects.
Placing Project A and Project B inside a VPC Service Controls perimeter creates a security boundary that blocks copying or moving data to unauthorized external GCP resources, even if an identity has IAM Storage Admin permissions.
IAM grants access permissions but cannot prevent an authorized user from writing data to an external, untrusted bucket without VPC Service Controls.
2
Ensure private connectivity to Google APIs.
Enabling Private Google Access allows GKE nodes with private IP addresses to communicate securely with Cloud Storage without using public IP addresses or routing over the public internet.
Compliance mandates require all network traffic to Google services to stay off the public internet.
3
Secure GKE cluster control plane administration.
Configuring Control Plane Authorized Networks on the GKE private cluster restricts API server endpoint access strictly to specified IP blocks, such as the management bastion subnet in Project C.
Private GKE control planes require authorized network rules to specify which management subnets can reach the Kubernetes master endpoint.

Key Concept

VPC Service Controls & GKE Perimeter Security
Estimated Time:2m 0s
Question 80Question →

A healthcare analytics application runs on Compute Engine virtual machines inside a dedicated Google Cloud production folder. The application must run automated night jobs that query BigQuery datasets and write log entries to Cloud Logging. The security team mandates strict enforcement of least privilege while keeping administrative overhead minimal. Which IAM role configuration strategy should the Cloud Architect recommend?

Show answer & explanation

Answer: Attach a custom user-managed service account to the virtual machines, granting the service account the BigQuery Data Viewer role at the dataset scope and Logs Writer role at the project scope.

Answer

Attach a dedicated user-managed service account to the virtual machines, granting least-privilege predefined roles (BigQuery Data Viewer on specific datasets and Logs Writer at the project level).
Attaching a user-managed service account with fine-grained predefined roles (BigQuery Data Viewer at dataset scope, Logs Writer at project scope) adheres directly to Google Cloud security best practices for workload identity and least privilege.

Step-by-Step Solution

1
Identify the workload identity requirements
Determine that automated virtual machine workloads require distinct identity representation separate from human users or default service accounts.
Using default compute service accounts with broad scopes introduces operational and security risks.
2
Scope permissions using predefined roles
Select `roles/bigquery.dataViewer` for dataset read access and `roles/logging.logWriter` for ingestion.
Predefined fine-grained roles avoid over-granting administrative capabilities while satisfying operational needs.
3
Apply identity at the appropriate resource hierarchy level
Bind BigQuery permissions at dataset resource scope and Logging permissions at project scope.
Granting roles at the specific resource or project boundary prevents unauthorized access to unrelated resources inherited from parent folders.

Key Concept

Applying least privilege IAM roles to user-managed service accounts across Google Cloud resource hierarchy
PreviousPage 4 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin