Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 801Question →

A fintech company is setting up an automated provisioning pipeline using Infrastructure as Code (IaC) to deploy a regional, highly available relational database system on Google Cloud. The system must meet strict compliance standards requiring customer-managed encryption keys for data at rest and continuous protection against state file corruption during automated IaC deployments. Which TWO deployment and provisioning actions should the cloud architect implement to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Configure a Cloud Storage bucket with Object Versioning and state locking enabled to store the Terraform remote state files securely.; Provision a Cloud SQL instance with regional High Availability enabled and configure it to use a Customer-Managed Encryption Key (CMEK) hosted in Cloud KMS.

Answer

The architect must configure a Cloud Storage bucket with Object Versioning and state locking for Terraform remote state storage, and provision a Cloud SQL instance with regional High Availability encrypted using a Customer-Managed Encryption Key (CMEK) from Cloud KMS.
Provisioning a Cloud SQL instance with regional High Availability using Cloud KMS Customer-Managed Encryption Keys (CMEK) meets both the availability and compliance requirements for a regional relational database. Storing the Terraform state file in a remote Cloud Storage bucket with Object Versioning and state locking ensures concurrency protection and resilience against state corruption.

Step-by-Step Solution

1
Identify the proper database provisioning configuration for regional high availability and encryption governance.
Cloud SQL configured with regional availability (primary and standby instances across zones) combined with CMEK via Cloud KMS fulfills both high availability and customer-managed key compliance.
Cloud SQL matches single-region relational database demands without introducing the cost or multi-region overhead of Cloud Spanner.
2
Determine the secure Infrastructure as Code (IaC) state management strategy.
Terraform state must be configured to use a remote Cloud Storage backend with Object Versioning and locking enabled.
This prevents race conditions during concurrent CI/CD pipeline executions and enables state recovery in case of accidental corruption.

Key Concept

Provisioning highly available relational databases with CMEK and securing IaC state management in Google Cloud
Question 802Question →

An international agricultural technology company is defining the architectural components for an enterprise smart-farming telemetry platform on Google Cloud. The conceptual design requires decoupling high-throughput sensor data streams from downstream analytics services while establishing a strict security boundary to protect proprietary farm yield data against unauthorized exfiltration. When translating these conceptual and logical requirements into a physical architecture on Google Cloud, which TWO architectural decisions should the cloud architect implement? (Select TWO options.)

Select all that apply

Show answer & explanation

Answer: Provision Cloud Pub/Sub topics as the physical messaging middleware to asynchronously ingest telemetry streams before triggering Dataflow processing jobs.; Configure VPC Service Controls around BigQuery and Cloud Storage resource boundaries to prevent authorized users from exfiltrating data to external GCP projects.

Answer

The optimal physical architecture requires provisioning Cloud Pub/Sub as the asynchronous messaging ingestion layer and establishing VPC Service Controls around storage and analytics services to enforce security boundaries.
The correct choices properly translate high-level conceptual requirements into concrete physical GCP services. Cloud Pub/Sub satisfies the logical decoupling requirement for high-throughput stream ingestion. VPC Service Controls satisfy the physical security requirement by preventing data exfiltration across resource perimeters.

Step-by-Step Solution

1
Translate the conceptual requirement of decoupling high-volume ingestion streams into a physical GCP compute and messaging design.
Cloud Pub/Sub acts as the scalable physical buffer between ingestion sources and analytical processing pipelines.
Asynchronous messaging ensures system resiliency and temporal decoupling.
2
Translate the security requirement of preventing data exfiltration into a physical network and resource perimeter design.
VPC Service Controls define a security perimeter around sensitive data stores like BigQuery and Cloud Storage.
Identity and Access Management controls authorization, but VPC Service Controls physically block data movement across perimeter boundaries.

Key Concept

Mapping Conceptual and Logical Cloud Architectures to Physical GCP Resources
Question 803Question →

An enterprise digital healthcare platform on Google Cloud ingests real-time patient telemetry streams via Cloud Pub/Sub and processes them using a microservices pipeline backed by Cloud Spanner. The contract specifies a customer SLA of 99.9% availability, defined as telemetry processing latency staying under 1.5 seconds. During peak events, while the frontend HTTP Load Balancer immediately acknowledges incoming requests with HTTP 200, downstream processing queue backpressure causes ingestion processing times to frequently exceed 3 seconds. Consequently, the company incurs contract financial penalties despite internal metrics showing 99.99% HTTP request success rates. Which TWO actions should the Site Reliability Engineering (SRE) and business teams take to align technical service levels with business objectives and prevent SLA breaches?

Select all that apply

Show answer & explanation

Answer: Define the Service Level Indicator (SLI) as the proportion of valid telemetry events whose end-to-end processing latency from ingestion to database write is under 1.5 seconds, and set the internal Service Level Objective (SLO) at 99.95%.; Establish an error budget policy that automatically halts new feature deployments and shifts engineering focus to database throughput optimization whenever the multi-window burn rate indicates the error budget will deplete before the end of the compliance cycle.

Answer

The team should define the SLI based on end-to-end processing latency under 1.5 seconds with an internal SLO of 99.95%, and establish an error budget policy that halts feature deployments when error budget burn rates threaten SLA compliance.
The correct architectural strategy involves capturing true end-to-end processing latency as the SLI, setting an internal SLO tighter than the external SLA to build a safety buffer, and enforcing error budget policies that prioritize reliability over new features when the burn rate indicates an impending breach.

Step-by-Step Solution

1
Analyze the misalignment between technical metrics and business SLAs.
The current technical metric (HTTP 200 success rate at the load balancer) reports 99.99% availability, but downstream queue backpressure causes actual latency (>3 seconds) to breach the business SLA threshold (1.5 seconds).
SLIs must reflect actual user/business experience rather than proxy metrics at ingestion boundaries.
2
Define an accurate SLI and internal SLO safety buffer.
SLI = (Valid events processed under 1.5s) / (Total valid events). Setting an internal SLO of 99.95% creates a 0.05% safety margin relative to the 99.9% customer SLA.
Internal SLOs should always be stricter than external SLAs to allow proactive mitigation before financial penalties occur.
3
Establish governance based on error budget burn rates.
When error budget consumption burns at a rate that threatens the compliance window, product releases are frozen and engineering effort is redirected to reliability and backpressure remediation.
Error budget policies bridge technical metrics and business decision-making by balancing velocity with reliability risk.

Key Concept

Aligning technical SLIs/SLOs with business SLAs and enforcing error budget governance
Question 804Question →

An organization is establishing Site Reliability Engineering (SRE) practices on Google Cloud to ensure technical monitoring aligns with business performance goals. Which TWO of the following statements accurately describe the definitions and strategic roles of Service Level Indicators (SLIs) and Service Level Objectives (SLOs)?

Select all that apply

Show answer & explanation

Answer: A Service Level Indicator (SLI) is a quantifiable metric that measures actual service performance, such as the proportion of successful HTTP requests.; A Service Level Objective (SLO) is an internal target goal for an SLI, set to preserve user experience and protect against Service Level Agreement (SLA) breaches.

Answer

The correct answers are the statements asserting that an SLI is a quantifiable metric measuring real-time performance (e.g., successful request ratio) and that an SLO is an internal target goal for an SLI established to safeguard user experience prior to SLA breaches.
The statements defining an SLI as the quantifiable metric measuring actual performance and an SLO as an internal target goal designed to protect user experience and prevent SLA breaches are both correct. SLIs quantify compliance in real time, while SLOs establish acceptable thresholds that guide engineering reliability priorities and error budget management.

Step-by-Step Solution

1
Differentiate between metric collection (SLI) and target definition (SLO).
Recognize that an SLI represents what is measured (e.g., latency, error rate), whereas an SLO represents the target threshold for that metric (e.g., 99.9%99.9\% success over 30 days).
Clear separation between indicators and objectives prevents metric misconfiguration and ensures operational clarity.
2
Align internal target goals (SLOs) with business contracts (SLAs).
Confirm that internal SLOs must be stricter than external SLAs to create an error budget cushion.
Maintaining tighter internal targets ensures teams can intervene before contractual breaches incur business liabilities.
3
Evaluate availability targets against engineering realities.
Reject 100%100\% availability targets because an error budget is required to innovate and deploy changes safely.
Pursuing 100%100\% uptime is economically unfeasible and stifles feature velocity.

Key Concept

Alignment of SLIs, SLOs, and SLAs with Business Impact
Question 805Question →

A financial operations (FinOps) team is establishing cloud cost governance and visibility across an organization's Google Cloud environment. Which of the following recommendations represent valid GCP cost optimization and billing governance practices? (Select TWO options.)

Select all that apply

Show answer & explanation

Answer: Export Cloud Billing data to BigQuery to enable granular cost analysis and custom visualization dashboards.; Configure Cloud Billing budgets with programmatic Pub/Sub notifications to alert teams when spent thresholds are reached.

Answer

The correct practices are exporting Cloud Billing data to BigQuery for granular cost reporting and configuring Cloud Billing budgets with programmatic notifications to alert teams of spending thresholds.
Exporting Cloud Billing data to BigQuery enables deep custom analytics, trend reporting, and cost allocation visualizations across projects. Combining this with Cloud Billing budgets and Pub/Sub notifications ensures proactive alerting when spending approaches specified financial limits.

Step-by-Step Solution

1
Analyze FinOps governance requirements for cost visibility and proactive budgeting.
Identified BigQuery billing export as the standard tool for detailed cost analysis and custom reporting, and Billing Budgets with alerts as the key mechanism for cost control.
Effective FinOps requires granular data for analysis alongside automated alerting to prevent cost overruns.
2
Evaluate the commitment model for variable workloads.
Rejected long-term Committed Use Discounts for unpredictable short-term workloads.
CUDs require predictable baseline usage to deliver financial savings; applying them to fluctuating workloads creates unutilized commitments.
3
Evaluate resource selection and IAM privileges.
Rejected using Cloud Spanner for simple relational workloads and rejected primitive Owner roles.
Cloud Spanner incurs high baseline costs unsuited for small workloads, and primitive IAM roles violate least privilege governance.

Key Concept

GCP Cloud Billing Export and Budget Governance
Question 806Question →

A global gaming enterprise is preparing to migrate its high-throughput real-time telemetry ingestion platform to Google Cloud ahead of an international game release. Business stakeholders require zero service disruption during the launch window and strict compliance with corporate data exfiltration controls. However, an organizational readiness assessment reveals that the operations team lacks experience with GCP administrative workflows, and the planned architecture requires 50,000 Compute Engine vCPUs in a single GCP region. As the Lead Cloud Architect responsible for stakeholder alignment and change management, which strategy should you implement to satisfy technical requirements while ensuring operational readiness?

Show answer & explanation

Answer: Initiate regional quota increase requests far in advance of the launch date, establish a structured role-based training program for the operations team, and enforce VPC Service Controls around telemetry storage resources.

Answer

The optimal strategy is to initiate regional quota increase requests well in advance of deployment, establish a structured role-based enablement program for the operations team, and enforce VPC Service Controls around perimeter resources.
The correct strategy combines technical provisioning lead-time planning (requesting quota increases in advance), organizational enablement (structured training programs for operational readiness), and security perimeter enforcement (VPC Service Controls to satisfy exfiltration constraints).

Step-by-Step Solution

1
Analyze capacity requirements and quota lead times
Identified that provisioned infrastructure requires 50,000 regional vCPUs, which exceeds default quotas and requires early submission to GCP support.
Large-scale quota requests require validation and allocation lead time prior to go-live.
2
Evaluate organizational change management and team readiness factors
Formulated a role-based enablement roadmap to upskill operations personnel on GCP management.
Lack of team operational experience represents a risk to application stability during launch.
3
Incorporate security compliance policies into the cloud perimeter design
Implemented VPC Service Controls to prevent unauthorized data exfiltration.
IAM permissions alone do not restrict copying data to external GCP projects outside the perimeter.

Key Concept

Organizational Change Management and Stakeholder Capacity Alignment
Question 807Question →

A global enterprise operates a high-throughput financial transactions processing platform on Google Cloud with a primary deployment in region us-east4 and a designated disaster recovery (DR) site in us-west1. The database layer utilizes Cloud SQL cross-region read replicas, while microservices run on Google Kubernetes Engine (GKE). The organization is finalizing standard operating procedures for periodic, non-disruptive DR validation drills designed to verify an RTO of 1 hour and an RPO of 5 minutes. Which TWO procedures must the cloud architect include in the DR validation execution plan to ensure accurate validation without disrupting active production operations or causing drill failures? (Select 2 answers.)

Select all that apply

Show answer & explanation

Answer: Submit regional resource quota increase requests for GKE compute nodes and IP addresses in the secondary region (us-west1) well before executing the validation drill.; Perform validation testing against a isolated clone or point-in-time recovery (PITR) instance derived from the secondary database, preserving continuous cross-region replication from production.

Answer

The correct procedures are to request regional compute/network quota increases in the secondary region prior to the drill and to perform database validation against a cloned or point-in-time recovery copy rather than promoting the live production cross-region replica.
To execute a non-disruptive disaster recovery drill, organizations must ensure the secondary region has adequate quota to host production workloads by requesting quota increases prior to the test. Additionally, to avoid disrupting production database replication streams, testing must occur on isolated database snapshots or cloned instances rather than promoting the active replica.

Step-by-Step Solution

1
Analyze capacity requirements in the target DR region.
Identified potential quota bottlenecks in GKE compute resources and networking in us-west1 during full workload deployment.
Default quotas in secondary regions may not match primary production scale, leading to provisioning errors during failover testing.
2
Evaluate database validation strategies for non-disruptive testing.
Selected creating a database clone or point-in-time recovery copy in us-west1.
Promoting a live cross-region replica disconnects it from the primary instance, severing continuous data replication and violating production RPO requirements.
3
Verify overall DR validation procedure compliance against RTO and RPO goals.
Confirmed that pre-provisioning quota and isolating test data fulfills both seamless failover verification and production stability.
Allows thorough validation of failover automation while keeping production environment fully operational and protected.

Key Concept

Developing non-disruptive Business Continuity and Disaster Recovery (BCP/DR) validation procedures on Google Cloud requires pre-verifying regional capacity/quotas and maintaining continuous production replication by conducting tests on cloned isolated environments.
Estimated Time:2m 30s
Question 808Question →

An enterprise is migrating sensitive operational audit logs to Google Cloud. The compliance framework mandates that data stored at rest in Cloud Storage buckets and BigQuery datasets must be encrypted using Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS. The security team mandates strict separation of duties: storage administrators must not manage encryption keys, and key administrators must not access stored log data. Additionally, key rotation must occur automatically without requiring manual re-encryption of existing historical data. Which TWO architectural configuration steps must you perform to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific KMS key to the Cloud Storage and BigQuery service agents, ensuring key management permissions remain restricted to the security team.; Configure an automated rotation schedule on the Cloud KMS CryptoKey so that new key versions are generated periodically while older key versions remain available for decryption.

Answer

Granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Google-managed service agents enforces separation of duties, and configuring an automated key rotation schedule on the Cloud KMS CryptoKey ensures seamless encryption of new data while preserving access to historical data.
Granting the Cloud KMS CryptoKey Encrypter/Decrypter role directly to service agents ensures strict separation of duties and least privilege compliance. Furthermore, setting up an automated key rotation schedule on the Cloud KMS CryptoKey allows GCP services to use the latest key version for new writes while retaining older versions to read legacy data without manual re-encryption.

Step-by-Step Solution

1
Identify key management and separation of duties requirements for CMEK.
Determine that service agents require cryptographic access via fine-grained roles rather than primitive permissions.
Google Cloud service agents (e.g., BigQuery and Cloud Storage service accounts) perform encryption and decryption on behalf of users when configured with CMEK.
2
Configure IAM permissions using least privilege.
Grant roles/cloudkms.cryptoKeyEncrypterDecrypter on the key to the service agents.
This allows the service agents to encrypt/decrypt data without granting human administrators cross-domain access.
3
Configure key rotation settings in Cloud KMS.
Enable automated rotation schedules on the Cloud KMS CryptoKey.
Cloud KMS automatically uses the new primary key version for encrypting newly written data while maintaining old versions for decrypting existing data.

Key Concept

Customer-Managed Encryption Keys (CMEK) and IAM Separation of Duties in Cloud KMS
Question 809Question →

Match each organizational data security requirement to its corresponding Google Cloud encryption and key management architecture model.

Click a left item, then click its matching right item

Items

Google-default Encryption
Customer-Managed Encryption Keys (CMEK)
Customer-Supplied Encryption Keys (CSEK)
Cloud External Key Manager (Cloud EKM)

Matches

Show answer & explanation

Answer

Google-default Encryption matches automatic AES-256 encryption managed by Google without configuration. CMEK matches keys generated/stored in Cloud KMS with customer-controlled lifecycle and IAM permissions. CSEK matches customer-supplied raw 256-bit keys provided per API call with no GCP key persistence. Cloud EKM matches key material residing outside GCP in a third-party/on-premises HSM accessed via Cloud KMS.
Each key management tier represents a distinct boundary of operational responsibility and key location: Google-default is fully automated; CMEK stores keys in GCP Cloud KMS with customer-managed IAM/rotation policies; CSEK transiently receives raw customer keys per API call; Cloud EKM keeps master key material inside an external non-GCP HSM.

Step-by-Step Solution

1
Analyze the operational control and key location for Google-default Encryption.
Identified that Google manages key generation, rotation, and storage automatically without customer configuration (matches statement describing default AES-256 with zero setup).
Google-default encryption is enabled out-of-the-box for all GCP storage services.
2
Differentiate CMEK from CSEK based on key persistence and KMS involvement.
CMEK utilizes Cloud KMS within GCP to manage key lifecycles, IAM service agent permissions, and rotation schedules. CSEK requires passing raw key material in API headers directly, retaining zero key material in Cloud KMS.
CMEK delegates storage to Cloud KMS, whereas CSEK keeps key management completely external to GCP and passes key headers transiently.
3
Evaluate the architectural pattern for Cloud EKM.
Cloud EKM connects Cloud KMS to an external physical HSM infrastructure outside of GCP, ensuring the master key material never leaves the external HSM.
Regulatory compliance may mandate physical separation of cryptographic key storage from cloud service providers.

Key Concept

GCP Key Management Spectrum (Default, CMEK, CSEK, Cloud EKM)
Estimated Time:1m 30s
Question 810Question →

A smart manufacturing enterprise is translating its functional solution requirements into a Google Cloud physical architecture. The solution requires real-time telemetry ingestion from IoT edge devices, stateless event-driven microservices to validate payload schemas, a regional relational database for transactional maintenance work order tracking, and isolation controls to prevent data exfiltration beyond IAM permissions. Which combination of GCP services and security controls fulfills these physical architecture requirements while minimizing operational overhead?

Show answer & explanation

Answer: Cloud Pub/Sub for ingestion, Cloud Run for event processing, Cloud SQL for PostgreSQL for work orders, and VPC Service Controls for exfiltration prevention.

Answer

The optimal architecture combines Cloud Pub/Sub for real-time telemetry ingestion, Cloud Run for fully managed stateless event processing, Cloud SQL for PostgreSQL for regional relational storage, and VPC Service Controls to prevent data exfiltration.
The combination of Cloud Pub/Sub, Cloud Run, Cloud SQL for PostgreSQL, and VPC Service Controls accurately maps each logical tier to its ideal physical service on GCP. It delivers serverless event processing, efficient regional relational storage, and robust perimeter security against exfiltration with minimal operational burden.

Step-by-Step Solution

1
Evaluate compute service selection for stateless event microservices.
Cloud Run provides fully managed serverless container execution for stateless HTTP/event processing with zero infrastructure management overhead compared to GKE.
Choosing Cloud Run aligns physical resources with the conceptual requirement of minimal operational complexity.
2
Evaluate relational database tier requirements.
Cloud SQL for PostgreSQL satisfies standard regional SQL transactions and ACID compliance without the expense and operational model of Cloud Spanner.
Cloud Spanner is designed for globally distributed multi-region databases and is unnecessary for a regional workload.
3
Evaluate perimeter security for data exfiltration prevention.
VPC Service Controls form a security perimeter around storage resources to block data copies to external projects.
IAM roles manage access identity but cannot enforce network boundaries to prevent authorized users from exfiltrating data.

Key Concept

Mapping functional solution requirements across conceptual, logical, and physical architecture tiers on GCP.
Question 811Question →

A healthcare technology organization is conducting an architecture audit of its continuous integration and continuous delivery (CI/CD) pipelines. The pipelines utilize Google Cloud Build to run automated security scans, build container images stored in Artifact Registry, and execute Terraform templates to provision Google Kubernetes Engine (GKE) clusters. An analysis reveals that the pipeline builds currently execute using the default Compute Engine service account, developers manually update infrastructure configurations via the Google Cloud Console, and build steps encounter state conflicts due to unmanaged local state files. Which TWO architectural and security modifications should the organization implement to remediate these issues while adhering to Google Cloud best practices?

Select all that apply

Show answer & explanation

Answer: Configure Cloud Build triggers to execute using a user-managed service account bound to specific fine-grained IAM roles, and configure a Cloud Storage backend with object versioning for Terraform state storage.; Restrict manual Console modifications by enforcing Organization Policies, and mandate that all infrastructure state modifications be applied exclusively through automated Cloud Build pipeline triggers.

Answer

The organization must configure Cloud Build triggers to run with a least-privilege user-managed service account, utilize Cloud Storage with object versioning for centralized Terraform state management, enforce Organization Policies to block manual Console edits, and restrict infrastructure deployments exclusively to automated CI/CD pipeline triggers.
Securing enterprise CI/CD pipelines requires replacing over-privileged default build service accounts with fine-grained custom service accounts, locking down infrastructure changes to version-controlled automated build triggers, and persisting IaC state in a centralized Cloud Storage backend with object versioning and state locking.

Step-by-Step Solution

1
Analyze pipeline security and service account identity
Identified over-privileged execution running under default accounts. Remediated by replacing default compute identities with custom user-managed service accounts assigned minimal required IAM roles.
Least-privilege service accounts restrict build capabilities so compromised build steps cannot modify unrelated project resources.
2
Analyze Infrastructure as Code (IaC) state management
Transitioned from local workspace state storage to a central Cloud Storage remote backend configured with object versioning and state locking.
Cloud Storage backends preserve state across builds, prevent concurrent state modification, and support recovery via versioning.
3
Remediate manual configuration drift
Enforced governance policies to prohibit out-of-band Console edits and routed all infrastructure changes through version-controlled CI/CD pipelines.
Mandating deployment via automated pipelines ensures full code review traceability and eliminates configuration drift between code and deployed environments.

Key Concept

Analyzing SDLC & CI/CD Pipelines for IAM Least Privilege, IaC Remote State Integrity, and Drift Prevention
Estimated Time:2m 30s
Question 812Question →

A healthcare enterprise is establishing an automated, zero-trust software delivery pipeline on Google Cloud. The architecture must automatically build, scan, certify, and deploy microservice container updates to a production Google Kubernetes Engine (GKE) cluster. In what sequential order should the CI/CD pipeline execute these operational stages from code check-in to production deployment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with Cloud Build constructing the container image, followed by Artifact Analysis performing vulnerability scans, storing the image and signing an attestation in Artifact Registry, enforcing security policies through Binary Authorization, and concluding with Cloud Deploy releasing the image to GKE.
The sequence reflects Google Cloud secure software supply chain best practices: first, Cloud Build packages the application; second, Artifact Analysis performs vulnerability scanning; third, the artifact is stored in Artifact Registry with a signed attestation; fourth, Binary Authorization verifies the attestation signature against organizational policy; and fifth, Cloud Deploy delivers the image to production GKE.

Step-by-Step Solution

1
Trigger continuous integration and build artifact
Cloud Build compiles source code into a runnable container image.
The source code must be packaged into a container artifact before security scanning can begin.
2
Execute automated security vulnerability analysis
Artifact Analysis scans the container layers for known vulnerabilities.
Security scanning must occur before certifying that an image is safe for environment promotion.
3
Persist image artifact and sign cryptographic attestation
Container image is pushed to Artifact Registry alongside a KMS-signed attestation.
Attestations provide tamper-proof proof that security compliance gates were passed.
4
Enforce container deployment policies
Binary Authorization verifies that valid attestations exist before allowing deployment.
Policy enforcement prevents unsigned or non-compliant images from reaching GKE cluster nodes.
5
Execute progressive release pipeline
Cloud Deploy manages the canary rollout to the production GKE cluster.
Actual deployment execution is the final step in the continuous delivery pipeline.

Key Concept

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines
Question 813Question →

A global retail company hosts its core checkout microservice on Google Cloud. Executive leadership wants to ensure that technical operational monitoring directly aligns with the business goal of minimizing lost sales revenue during high-volume promotional events. The Site Reliability Engineering (SRE) team needs to define a metric strategy that accurately reflects this business impact. Which approach should the team adopt?

Show answer & explanation

Answer: Define a Service Level Indicator (SLI) measuring the ratio of successful checkout transactions completed under 500 milliseconds, and set a Service Level Objective (SLO) based on the latency threshold where customer purchase drop-off increases.

Answer

Define a Service Level Indicator (SLI) measuring the ratio of successful checkout transactions completed under 500 milliseconds, and set a Service Level Objective (SLO) based on the latency threshold where customer purchase drop-off increases.
The correct approach ties the technical metric (checkout latency and success rate) directly to user impact and business performance. In SRE practices, SLIs should measure user-centric experiences (such as request latency on key transactions), and SLO targets should be calibrated against business tolerances, such as conversion rate impact.

Step-by-Step Solution

1
Identify the key business goal and user journey
The business goal is preventing lost revenue during sales events, which directly relates to the end-user checkout experience.
Technical service levels must be tied to user experience metrics that drive business outcomes.
2
Distinguish between SLI, SLO, and infrastructure metrics
SLI is the measured quantitative metric (e.g., successful fast requests / total requests). SLO is the target goal set for that SLI (e.g., 99.5% fast requests).
System resource utilization (like CPU/RAM) does not directly reflect whether users are successfully completing purchases.
3
Select the strategy aligning technical SLI/SLO with business impact
Measuring latency on successful checkouts and setting SLO targets tied to user conversion degradation achieves business alignment.
This ensures engineering efforts and error budget management focus directly on user experience and business value.

Key Concept

Aligning SLIs and SLOs with User Experience and Business Outcomes
Question 814Question →

An enterprise operations team is preparing to deploy an automated deployment daemon on Google Compute Engine virtual machine instances to provision cloud infrastructure resources and manage application releases to Google Kubernetes Engine (GKE) clusters across multiple GCP projects. The lead developer suggests using the Compute Engine default service account and granting it the primitive Owner role (`roles/owner`) at the GCP folder level to eliminate permission errors during automated resource provisioning. To align with Google Cloud architectural security best practices and the principle of least privilege while maintaining operational efficiency, which guidance should you provide to the development and operations teams?

Show answer & explanation

Answer: Recommend creating a dedicated user-managed service account for the deployment daemon, attaching it to the Compute Engine instances, configuring Workload Identity for GKE deployments, and granting fine-grained predefined IAM roles scoped to the specific target projects.

Answer

Advise the team to create a dedicated user-managed service account attached to the Compute Engine instances, use Workload Identity for GKE integrations, and grant fine-grained, minimum-required predefined IAM roles scoped strictly to target projects.
The architect should advise creating a dedicated, user-managed service account attached to the Compute Engine deployment instances. Using Workload Identity allows GKE workloads to securely interact with Google Cloud APIs using short-lived tokens without storing credentials. Granting fine-grained predefined roles at the project level strictly satisfies the principle of least privilege while keeping management overhead low.

Step-by-Step Solution

1
Analyze identity requirements for automated workloads on Compute Engine and GKE.
Identified that default service accounts contain excessive default access or primitive roles that breach compliance.
Default service accounts should not be used in enterprise production deployment pipelines.
2
Evaluate authentication and credential management mechanisms.
Determined that service account keys should be avoided in favor of VM metadata tokens and Workload Identity.
Workload Identity and attached service accounts use short-lived, automatically rotated tokens without long-lived key risks.
3
Select least-privilege IAM roles scoped to the appropriate resource boundaries.
Configured fine-grained predefined roles at the project level instead of primitive roles at the folder level.
Predefined roles restrict permissions to only what is strictly necessary for deployment pipelines.

Key Concept

Workload Identity and Least Privilege IAM Architecture for CI/CD Deployment Services
Question 815Question →

An e-commerce platform hosted on Google Cloud calculates the ratio of successful checkout API calls to total checkout API calls over a given billing period to evaluate real-time user experience. Which Site Reliability Engineering (SRE) component is represented by this measured ratio?

Show answer & explanation

Answer: Service Level Indicator (SLI)

Answer

Service Level Indicator (SLI)
A Service Level Indicator (SLI) is a quantifiable measure of service performance delivered to users in real time. Calculating the ratio of successful API calls to total API calls yields a direct SLI measurement.

Step-by-Step Solution

1
Identify the nature of the metric described in the scenario.
The metric represents an empirical calculation of Successful RequestsTotal Requests\frac{\text{Successful Requests}}{\text{Total Requests}} collected from live production traffic.
Determining whether a metric is an empirical measurement, a target boundary, or a legal commitment is necessary to accurately classify SRE components.
2
Map the measurement definition to standard SRE concepts.
The measured ratio of actual good events to total events is defined as a Service Level Indicator (SLI).
SLIs provide the real-time quantitative data required to evaluate compliance against a Service Level Objective (SLO).

Key Concept

Distinguishing Service Level Indicators (SLIs) as empirical operational measurements from Service Level Objectives (SLOs) and Agreements (SLAs).
Question 816Question →

An online media streaming platform hosts its user entitlement system on Google Cloud across a primary region (us-central1) and a secondary failover region (us-east4). The cloud architecture team is updating their quarterly Disaster Recovery (DR) and Business Continuity Plan (BCP) validation procedures to ensure regional failover readiness without causing production disruptions. Which procedures should be included in the DR validation workflow to accurately validate failover preparedness and maintain compliance with recovery objectives? (Select TWO options.)

Select all that apply

Show answer & explanation

Answer: Pre-verify regional Compute Engine resource quotas and request necessary quota increases in the target failover region prior to executing the failover drill.; Perform automated data integrity verification and sequence checks on database replicas immediately after redirecting traffic to validate Recovery Point Objective (RPO) compliance.

Answer

The correct procedures are pre-verifying regional resource quotas in the target failover region prior to the drill and performing automated data integrity checks on database replicas immediately after rerouting traffic.
Comprehensive DR validation requires verifying infrastructure provisioning capacity beforehand and validating data consistency after traffic shift. Requesting regional Compute Engine quota increases prior to the drill ensures that target regions can accommodate incoming workloads. Performing automated data integrity checks right after shifting traffic verifies that database replication met RPO objectives without data loss.

Step-by-Step Solution

1
Assess infrastructure capacity prerequisites in the secondary failover region.
Identified potential compute and storage quota bounds in us-east4.
Requesting quota increases in advance ensures compute instance groups can scale out fully during failover testing.
2
Establish automated data integrity verification procedures following traffic redirection.
Automated validation scripts verify record checksums and sequence IDs across database tables.
Validates that the secondary region's data state matches the primary region at failover time, proving compliance with RPO requirements.

Key Concept

Disaster Recovery Validation and Capacity Preparedness
Question 817Question →

A digital publishing company runs a set of core web server virtual machines on Compute Engine. The workload has stable, predictable 24/7 resource utilization and is planned to run continuously for the next three years. The FinOps lead wants to minimize compute costs for this steady-state workload without modifying the application code or infrastructure architecture. Which cost optimization strategy should be implemented?

Show answer & explanation

Answer: Purchase 3-year Committed Use Discounts (CUDs) for the baseline Compute Engine instances.

Answer

Purchasing 3-year Committed Use Discounts (CUDs) for the baseline Compute Engine instances is the optimal cost optimization strategy.
Purchasing Committed Use Discounts (CUDs) is the recommended FinOps practice for predictable, 24/7 workloads planned for 1 to 3 years. It yields maximum cost savings on Compute Engine without changing application code or architecture.

Step-by-Step Solution

1
Analyze the workload characteristics
The application requires continuous 24/7 execution with predictable resource utilization over a 3-year horizon.
Cost optimization strategies depend on whether a workload is steady-state, bursty, or short-lived.
2
Evaluate Google Cloud cost optimization models
Committed Use Discounts (CUDs) provide deep discounts for committed baseline capacity over 1 or 3 years without application refactoring.
CUDs guarantee discounted pricing for committed resource usage without operational risk of preemption.

Key Concept

Committed Use Discounts (CUDs) for Steady-State Workloads
Question 818Question →

A healthcare startup wants to optimize cloud spending across two specific workloads: a monthly batch log processing task that runs for a few hours and a low-traffic internal web service that sits idle most of the day. Which TWO cost optimization strategies should the team implement to minimize expenses?

Select all that apply

Show answer & explanation

Answer: Configure Cloud Storage Object Lifecycle Management rules to move processed logs to Nearline or Coldline storage after 30 days.; Migrate the low-traffic internal web service from a dedicated virtual machine to Cloud Run to benefit from scale-to-zero pricing.

Answer

Implementing Object Lifecycle Management rules to transition log data to colder storage classes and deploying the low-traffic web service to Cloud Run.
Transitioning logs to Nearline or Coldline storage using lifecycle policies reduces storage unit costs for aging data. Hosting low-traffic web apps on Cloud Run ensures billing only occurs when requests are processed, eliminating idle server cost.

Step-by-Step Solution

1
Analyze storage cost optimization options for batch log data
Identify Object Lifecycle Management as the mechanism to move older logs from Standard storage to Nearline or Coldline storage, lowering cost per gigabyte.
Infrequently accessed historical logs do not require high-frequency retrieval storage classes.
2
Analyze compute cost optimization for low-traffic applications
Select serverless container hosting on Cloud Run.
Cloud Run scales to zero instances when idle, preventing charges for unused VM CPU and memory capacity.

Key Concept

Optimizing GCP resource expenses using Cloud Storage lifecycle policies and serverless compute scale-to-zero capabilities.
Question 819Question →

An enterprise security architect is designing an automated deployment pipeline to provision Cloud SQL database instances encrypted with Customer-Managed Encryption Keys (CMEK). The encryption keys reside in a centralized Cloud KMS key ring within a dedicated security project, while the databases are deployed in separate workload projects. During deployment, the Cloud SQL instance creation fails due to missing access permissions on the encryption key. A DevOps engineer recommends assigning the Editor primitive IAM role on the security project to resolve the access issue. Which solution complies with Google Cloud security best practices while enforcing the principle of least privilege?

Show answer & explanation

Answer: Grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the specific KMS key to the Cloud SQL Service Agent account ([email protected]).

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key to the Cloud SQL Service Agent account for the workload project.
The correct solution grants the predefined Cloud KMS CryptoKey Encrypter/Decrypter role directly on the specific encryption key to the target project's Cloud SQL Service Agent. In Google Cloud, service-managed operations like database disk encryption require the service agent identity to have explicit key usage permissions. Applying this role at the key resource level adheres strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the identity responsible for performing encryption/decryption operations for Cloud SQL.
GCP services use specialized Service Agents (e.g., [email protected]) rather than generic user accounts or custom service accounts to perform CMEK operations.
When configuring CMEK, the service itself must be authorized to interact with Cloud KMS on behalf of the project.
2
Determine the least-privileged IAM role required for Cloud KMS operations.
The predefined role roles/cloudkms.cryptoKeyEncrypterDecrypter provides permission to encrypt and decrypt data using Cloud KMS keys.
Granting fine-grained resource-level roles on the specific key prevents over-privileging the service account with key administration rights or broad project permissions.
3
Evaluate and eliminate non-compliant or misconfigured architectural options.
Primitive Editor roles violate least privilege, CSEK is unnecessary and unsupported for Cloud SQL, and VPC Service Controls do not supersede IAM authorization.
Ensures adherence to GCP security design guidelines for multi-project CMEK topologies.

Key Concept

CMEK Integration with Service Agents and Least-Privilege IAM Roles
Question 820Question →

A software security firm is deploying a sensitive workload on Google Compute Engine that requires customer-managed encryption keys (CMEK) hosted in Cloud KMS for persistent disk encryption. Corporate policy mandates a strict separation of duties: compute infrastructure administrators must manage virtual machine lifecycles, but they must NOT have access to read, decrypt, or manage cryptographic key materials directly. You need to configure IAM access control to meet these requirements. Which TWO actions should you perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the Compute Engine Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the target Cloud KMS key.; Grant compute infrastructure administrators the Compute Admin role while withholding Cloud KMS Admin and Cloud KMS CryptoKey Encrypter/Decrypter roles.

Answer

Grant the Compute Engine Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the target key, and assign compute infrastructure administrators the Compute Admin role without Cloud KMS key management permissions.
To implement CMEK on Compute Engine persistent disks while enforcing separation of duties, the Compute Engine Service Agent must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role so that Google Cloud infrastructure can encrypt and decrypt disk blocks. Simultaneously, human compute administrators should receive only compute-related predefined roles (such as Compute Admin) without Cloud KMS roles, ensuring they can manage virtual machines without gaining access to encryption keys.

Step-by-Step Solution

1
Identify the service principal responsible for encryption operations
Recognize that Compute Engine uses its service agent (e.g., [email protected]) to access Cloud KMS keys for persistent disks.
Google Cloud service agents perform cryptographic disk operations under CMEK architectures.
2
Configure key access permissions for the service agent
Grant the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Compute Engine Service Agent on the specified key.
This allows Google Cloud to handle encryption/decryption transparently on disk attachment without granting human administrators access to key material.
3
Enforce separation of duties for human administrators
Grant human administrators the Compute Admin role while omitting Cloud KMS permissions.
This ensures compute administrators can create and maintain virtual machines while satisfying compliance rules against direct cryptographic key access.

Key Concept

Separation of duties using Cloud KMS Customer-Managed Encryption Keys (CMEK) and IAM service agent roles
PreviousPage 41 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin