Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 901Question →

An international airline runs two major microservices on Google Cloud: a passenger Flight Seat Reservation API and a post-flight Partner Loyalty Points Reconciliation worker. Interruption of seat reservations directly causes severe financial loss and customer churn, whereas delays in processing loyalty points reconciliation by several hours have minimal business impact. The organization aims to align technical metrics and operational procedures with business risk. Which TWO Site Reliability Engineering (SRE) decisions correctly align technical service level objectives (SLOs/SLIs/SLAs) with business impact? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define a high-availability SLO (99.99%99.99\%) measured over a tight 11-minute SLI evaluation window for the Flight Seat Reservation API, while assigning a lower availability target (99.0%99.0\%) with a multi-hour latency SLI for the Loyalty Points Reconciliation worker.; Implement error budget policy enforcement that automatically freezes new feature deployments on the Flight Seat Reservation API when its budget depletes, while permitting non-critical deployments on the Loyalty Points Reconciliation worker even under low error budgets.

Answer

The two correct decisions are: 1) Defining a high-availability SLO (99.99%99.99\%) for the critical seat reservation API while establishing a lower availability SLO (99.0%99.0\%) for the non-critical loyalty points worker; and 2) Enforcing strict deployment freezes based on error budget depletion for the reservation API while permitting feature deployments on low-impact background services.
Aligning service levels with business impact requires setting higher SLOs and strict error budget enforcement on revenue-impacting user flows (Seat Reservation API) while setting relaxed SLOs on low-risk asynchronous background workers (Loyalty Points Reconciliation).

Step-by-Step Solution

1
Analyze business impact differences between the microservices
The Flight Seat Reservation API is a critical revenue path requiring maximum reliability, whereas the Loyalty Points Reconciliation worker is an asynchronous background process where temporary delay incurs minimal business risk.
Technical objectives (SLOs) must be proportional to the business consequences of failure to optimize engineering spend and maintain velocity.
2
Evaluate SLO targets and SLI window alignment
Assigning a strict 99.99%99.99\% SLO to the reservation API and a 99.0%99.0\% SLO to the reconciliation worker aligns reliability targets with user impact.
Over-engineering availability for non-critical services wastes financial resources and developer productivity.
3
Establish error budget governance policies
Tie release gating to error budget exhaustion specifically on high-impact services.
Freezing deployments on revenue-critical services protects user experience, while allowing background services flexibility preserves development speed.

Key Concept

Business-Aligned Service Level Objectives and Error Budget Governance
Question 902Question →

An enterprise financial organization manages its Google Cloud infrastructure using Terraform within an automated CI/CD pipeline. Multiple autonomous feature teams frequently provision and update resources across shared VPC networks. Recently, a CI/CD deployment failed during a Terraform apply phase because an operational team manually modified firewall rules and updated subnets directly via the Cloud Console to mitigate an active security incident. Furthermore, state locks were intermittently failing during concurrent CI/CD pipeline executions due to misconfigured remote state storage. What architecture and operational strategy should the Lead Cloud Architect implement to secure state management and prevent uncoordinated configuration drift in accordance with Google Cloud best practices?

Show answer & explanation

Answer: Configure a central Cloud Storage backend with object versioning and state locking enabled, enforce IaC updates exclusively through a CI/CD pipeline executing with a dedicated service account assigned fine-grained predefined roles, and run scheduled automated plan workflows to detect configuration drift.

Answer

Configure a central Cloud Storage backend with object versioning and state locking enabled, enforce IaC updates exclusively through a CI/CD pipeline executing with a dedicated service account assigned fine-grained predefined roles, and run scheduled automated plan workflows to detect configuration drift.
The correct strategy establishes a central Cloud Storage backend with object versioning and state locking to ensure concurrency control and recoverability, restricts infrastructure modifications to an automated CI/CD pipeline using least-privilege service accounts, and routinely executes scheduled plan operations to identify drift.

Step-by-Step Solution

1
Establish secure remote state management
Configured a Google Cloud Storage (GCS) backend with object versioning and state locking enabled to guarantee state persistence, concurrency control, and disaster recovery.
Prevents state corruption and race conditions during simultaneous pipeline triggers across feature teams.
2
Restrict deployment permissions to CI/CD automation
Configured the CI/CD deployment pipeline using a dedicated service account with granular predefined IAM roles rather than broad primitive roles.
Enforces least-privilege security and eliminates uncoordinated, manual out-of-band edits from human operators.
3
Implement automated drift detection workflows
Scheduled recurring terraform plan execution runs within the automated pipeline.
Identifies discrepancies between actual infrastructure states and declared IaC configuration early, mitigating configuration drift.

Key Concept

Centralized Remote State Management, Drift Detection, and Least Privilege CI/CD Pipeline Scoping in Infrastructure as Code
Estimated Time:3m 0s
Question 903Question →

An enterprise organization is establishing an automated Continuous Integration and Continuous Delivery (CI/CD) pipeline using Cloud Build to provision and update infrastructure across multiple Google Cloud projects using Terraform. The architecture team requires that concurrent execution of pipeline builds does not result in state file corruption or race conditions. Additionally, access to infrastructure state must adhere to least privilege security practices. Which architecture design meets these requirements?

Show answer & explanation

Answer: Configure a Cloud Storage bucket with Object Versioning as the remote Terraform backend, and grant the Cloud Build service account specific predefined Storage Object Admin and resource-specific IAM roles.

Answer

Configure a Cloud Storage bucket with Object Versioning as the remote Terraform backend, and grant the Cloud Build service account specific predefined Storage Object Admin and resource-specific IAM roles.
Configuring Cloud Storage as the remote backend provides built-in state locking mechanisms that prevent race conditions during parallel CI/CD pipeline executions. Combining this with specific predefined roles satisfies least privilege security standards.

Step-by-Step Solution

1
Identify the state management requirement for concurrent execution safety.
Cloud Storage serves as a remote backend supporting automatic state locking and versioning in Google Cloud.
Remote state locking prevents two concurrent Cloud Build runs from modifying the infrastructure state simultaneously.
2
Evaluate IAM permissions for the CI/CD pipeline service account.
Predefined roles tailored to Cloud Storage and infrastructure provisioning ensure least privilege.
Avoid primitive roles (Owner/Editor) and administrative IAM roles when non-administrative user roles suffice.

Key Concept

Terraform Remote State Management and CI/CD Security Best Practices in Cloud Build
Question 904Question →

A digital media company is planning the live streaming infrastructure for a high-profile global event on Google Cloud. Baseline estimates show that Compute Engine VM instance requirements during peak stream demand will exceed the project's current regional resource limits. What action must the Lead Cloud Architect take during capacity planning to ensure compute resources scale without interruption?

Show answer & explanation

Answer: Request a regional Compute Engine quota increase in advance for the target deployment regions.

Answer

Request a regional Compute Engine quota increase in advance for the target deployment regions.
Requesting a regional quota increase before the planned workload spike ensures Google Cloud reserves sufficient hardware quota for Compute Engine instance autoscaling.

Step-by-Step Solution

1
Analyze capacity requirements against project limits.
Identified that projected VM instance consumption exceeds existing regional quotas.
Compute Engine enforces regional limits to prevent unexpected resource exhaustion.
2
Identify the proper process to adjust capacity ceilings.
Determine that quota limit increases must be requested via the GCP Console prior to peak workload events.
Quota approvals require time for review and allocation by Google Cloud.

Key Concept

Regional Resource Quota Allocation & Planning
Question 905Question →

A global energy enterprise is modernizing its grid telemetry analytics platform from an on-premises data center to Google Cloud. The executive steering committee demands a rapid 3-month rollout to satisfy regulatory sustainability reporting mandates. However, the operations team expresses significant change resistance due to unfamiliarity with cloud governance, and the technical architecture requires compute resources exceeding default quota allocations. Which TWO actions should the Lead Cloud Architect recommend to address both stakeholder alignment and technical readiness? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Establish a structured enablement program featuring role-based Google Cloud training to build operational confidence and address team change resistance.; Submit regional resource quota increase requests well in advance of deployment to ensure infrastructure capacity is available when workloads scale.

Answer

Establishing a structured role-based training program to manage change resistance, and submitting regional resource quota increase requests in advance of project deployment.
Successful cloud migrations require balancing technical readiness with organizational enablement. Delivering structured, role-based training addresses change resistance by empowering operational teams with confidence and governance alignment. Simultaneously, identifying quota bottlenecks and requesting regional quota increases in advance ensures infrastructure can scale without encountering operational execution blocks.

Step-by-Step Solution

1
Analyze organizational change management requirements
Identify that operational team resistance stems from skills gaps in cloud governance, requiring structured, role-based enablement.
Technical migrations often fail without deliberate stakeholder alignment and operational readiness planning.
2
Analyze technical deployment readiness constraints
Identify that anticipated compute demand exceeds default regional quota limits, requiring early lead-time requests.
Quota increases require lead time for approval, representing a critical path risk for tight timelines.
3
Evaluate proposed recommendations against GCP architecture best practices
Select proactive quota management and structured role-based training while rejecting security anti-patterns like primitive IAM role assignments.
Security best practices must be maintained even when striving to accelerate onboarding timelines.

Key Concept

Organizational change management and proactive capacity planning in GCP migrations
Question 906Question →

A software enterprise is refining its perimeter defense architecture across multiple Google Cloud projects to satisfy stringent compliance mandates. Match each specific security requirement on the left with the corresponding Google Cloud perimeter control mechanism on the right that best satisfies the architectural goal.

Click a left item, then click its matching right item

Items

Prevent unauthorized data exfiltration from Cloud Storage and BigQuery to external storage locations, even when requests stem from compromised high-privilege IAM credentials.
Inspect incoming HTTP(S) traffic at the global edge to block Layer 7 SQL injection threats and apply rate-limiting rules prior to reaching workload endpoints.
Enforce consistent organizational network ingress rules across multiple VPCs by binding firewall policies to resource hierarchy nodes and dynamically targeting workloads using IAM-governed tags.
Enable workloads in an isolated private VPC network to securely access managed third-party services over private IP addresses without established VPC Network Peering.

Matches

Show answer & explanation

Answer

1. Data exfiltration prevention against compromised IAM credentials matches VPC Service Controls Service Perimeters.
2. Layer 7 SQL injection and rate-limiting at the edge matches Cloud Armor Security Policies.
3. Organization-wide ingress rules bound to hierarchy nodes with dynamic tagging matches Hierarchical Firewall Policies with Secure Tags.
4. Private IP access to third-party services without VPC peering matches Private Service Connect (PSC) Endpoints.
Each perimeter control fulfills a distinct security layer: VPC Service Controls protect API data boundaries against exfiltration; Cloud Armor provides edge L7 protective filtering; Hierarchical Firewall Policies with Secure Tags enforce top-down network access rules; and Private Service Connect enables private consumer-to-producer service endpoints without establishing VPC peering.

Step-by-Step Solution

1
Analyze the requirement for exfiltration prevention under credential compromise.
Identify that IAM permissions control WHO has access, whereas VPC Service Controls restrict FROM WHERE and TO WHERE APIs can transfer data. Thus, VPC Service Controls Service Perimeters fulfill this requirement.
IAM alone cannot prevent a compromised identity from copying data to an external bucket; a perimeter around APIs is required.
2
Analyze the requirement for edge Layer 7 filtering and rate-limiting.
Recognize that edge WAF capability attached to Global Load Balancers is provided by Cloud Armor Security Policies.
Cloud Armor provides web application firewall rulesets and edge DDoS/rate-limiting features.
3
Analyze the requirement for hierarchy-wide firewall enforcement using secure tags.
Identify Hierarchical Firewall Policies configured at the organization/folder level combined with Secure Tags.
Hierarchical firewalls enforce top-down rules across multiple VPCs without relying on network-level IP definitions.
4
Analyze the requirement for accessing external or third-party services privately without VPC peering.
Match with Private Service Connect (PSC) Endpoints.
PSC routes traffic via endpoint IP addresses in the consumer VPC to target service attachments without IP overlapping or transitive peering constraints.

Key Concept

Google Cloud Perimeter Security Architecture
Question 907Question →

An enterprise e-commerce company is preparing for an upcoming promotional event that will require temporarily provisioning 400 Compute Engine N2 Virtual Machines in the `us-central1` region within a newly created Google Cloud project. The current regional quota for N2 CPUs in this project is set to default limits, which is far below the capacity required for the event. Which proactive measure should the Cloud Architect recommend to ensure the deployment succeeds without operational disruption?

Show answer & explanation

Answer: Submit a regional N2 CPU quota increase request via the Google Cloud Console or Quotas API in advance of the event.

Answer

Submit a regional N2 CPU quota increase request via the Google Cloud Console or Quotas API in advance of the event.
Resource quotas in Google Cloud are per-project and per-region limits enforced by the cloud platform regardless of identity permissions. To provision capacity above the default quota limits, an explicit quota request must be submitted and approved prior to resource allocation.

Step-by-Step Solution

1
Assess current project quota limits against expected peak workload resource demands.
Identified that required N2 CPU count exceeds default regional quotas in us-central1.
Default quota limits exist to prevent unexpected spend and protect cloud capacity, requiring explicit quota requests for large resource deployments.
2
Submit a quota increase request for N2 CPUs in us-central1 well ahead of the scheduled deployment.
GCP quota evaluation team or automated evaluation approves the increased regional ceiling.
Proactively requesting quota increases ensures capacity availability and prevents runtime provisioning errors during automated deployments.

Key Concept

Managing Resource Quotas and Provisioning Governance
Question 908Question →

A global logistics firm is storing confidential shipment documentation in Google Cloud Storage. The firm's compliance team mandates that encryption keys must be managed in Cloud KMS by an isolated security team, support automated key rotation every 90 days, and enforce separation of duties so developers cannot directly access raw key material or administrative key controls. Which architectural configuration should you recommend to fulfill these requirements?

Show answer & explanation

Answer: Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS, grant key administration roles exclusively to the security team, and grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.

Answer

Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS, grant key administration roles exclusively to the security team, and grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.
Customer-Managed Encryption Keys (CMEK) allow enterprise security teams to retain full control over key lifecycle, rotation, and IAM permissions in Cloud KMS. Granting the specific `roles/cloudkms.cryptoKeyEncrypterDecrypter` role to the Cloud Storage Service Agent adheres to least privilege and maintains separation of duties.

Step-by-Step Solution

1
Identify key management requirements
Requirements specify key management in Cloud KMS with automated rotation and separation of duties, ruling out Google-default encryption and CSEK.
CSEK requires managing key material outside of Google Cloud and passing raw keys per API call, which prevents Cloud KMS automated rotation.
2
Determine IAM permissions required for service integration
The Cloud Storage Service Agent needs permission to encrypt and decrypt data using the specified Cloud KMS key.
Using predefined fine-grained roles (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) enforces least privilege, whereas primitive roles (`roles/owner`) grant excessive administrative privileges.
3
Synthesize the optimal architecture
CMEK with Cloud KMS key rotation paired with least-privilege IAM grants for the Cloud Storage Service Agent meets all compliance standards.
This setup establishes strict separation of duties between key management admins and service usage.

Key Concept

Customer-Managed Encryption Keys (CMEK) and KMS IAM Least Privilege
Question 909Question →

A pharmaceutical enterprise hosts two core workloads on Google Cloud: a synchronous Clinical Trial Adverse Event Notification Service that directly impacts regulatory compliance and patient safety, and an asynchronous Batch Genomic Sequence Alignment Pipeline used for long-term discovery research. Executive leadership demands a reliability engineering framework that aligns Service Level Objectives (SLOs) and error budgets with real business impact. How should a Cloud Architect structure the Service Level Indicators (SLIs) and SLOs for these distinct workloads?

Show answer & explanation

Answer: Define an availability and latency SLI measured at the application load balancer endpoint for the Adverse Event Notification Service with a stringent 99.95% SLO tied to an error budget policy that freezes non-critical releases upon budget exhaustion; define a pipeline completion time SLI over a multi-hour window for the Genomic Pipeline with a relaxed SLO to preserve developer velocity.

Answer

Define an availability and latency SLI measured at the application load balancer endpoint for the Adverse Event Notification Service with a stringent 99.95% SLO tied to an error budget policy that freezes non-critical releases upon budget exhaustion; define a pipeline completion time SLI over a multi-hour window for the Genomic Pipeline with a relaxed SLO to preserve developer velocity.
Aligning service levels with business impact requires tailoring SLIs and SLOs to workload characteristics. High-priority synchronous APIs that directly affect regulatory compliance need user-facing endpoint SLIs (latency/error rates), strict SLO targets, and enforced error budget policies (such as deployment freezes). Conversely, asynchronous batch workloads should be measured by completion timeliness with lower SLO targets, avoiding unnecessary operational overhead.

Step-by-Step Solution

1
Analyze business impact and workload characteristics
The Adverse Event Notification Service is synchronous and safety-critical, requiring high availability. The Genomic Pipeline is batch-oriented and latency-tolerant.
SLOs must reflect user-perceived reliability and business consequences of downtime.
2
Differentiate metrics (SLIs) from targets (SLOs)
SLIs measure specific user-facing capabilities (e.g., successful HTTP responses or batch execution duration). SLOs represent the target thresholds for those SLIs.
Correct metrics ensure operational monitoring aligns with customer experience rather than internal machine capacity.
3
Establish error budget policies aligned with operational risk
Exhausting the error budget on the critical notification service restricts deployment risk via release freezes, while the batch pipeline maintains lower target goals to maximize feature delivery speed.
Error budgets serve as the decision tool balancing reliability against feature velocity.

Key Concept

Business-Aligned SLO/SLI and Error Budget Strategy
Estimated Time:2m 0s
Question 910Question →

A software engineering company structures its Google Cloud resource hierarchy using environment-specific folders. The security team needs to grant a group of data engineers the ability to manage BigQuery datasets and view Cloud Storage object contents across all current and future projects located under the 'Analytics-Staging' folder. The solution must adhere to the principle of least privilege, avoid primitive roles, and minimize administrative overhead. Which TWO actions should the security team perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Grant the BigQuery Admin (`roles/bigquery.admin`) role to the data engineers Google Group at the 'Analytics-Staging' folder level.; Grant the Storage Object Viewer (`roles/storage.objectViewer`) role to the data engineers Google Group at the 'Analytics-Staging' folder level.

Answer

Grant the BigQuery Admin role (`roles/bigquery.admin`) and the Storage Object Viewer role (`roles/storage.objectViewer`) to the data engineers Google Group at the 'Analytics-Staging' folder level.
Granting predefined fine-grained roles (`roles/bigquery.admin` and `roles/storage.objectViewer`) at the folder level leverages GCP resource hierarchy inheritance. This ensures that permissions propagate automatically to all current and future projects in the folder while strictly adhering to least privilege.

Step-by-Step Solution

1
Determine the optimal resource hierarchy scope to minimize operational overhead.
Applying IAM roles at the 'Analytics-Staging' folder level ensures that all existing and future child projects automatically inherit the permissions.
Folder-level permission bindings eliminate the need to manually configure permissions on individual projects.
2
Select predefined IAM roles that fulfill the specific job duties without over-granting access.
Assigning `roles/bigquery.admin` grants dataset administrative rights, while `roles/storage.objectViewer` permits reading Cloud Storage objects.
Predefined roles enforce least privilege compared to broad primitive roles like Editor or Owner.

Key Concept

Resource Hierarchy IAM Role Inheritance and Least Privilege
Question 911Question →

A cloud architect is establishing a standard operating procedure for validating disaster recovery (DR) failover from a primary GCP region (us-central1) to a secondary region (us-east4) for an enterprise application. In what sequence should the architect execute the following steps to perform a safe and successful DR failover test?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for DR failover validation is: 1) Verify quota availability in the secondary region, 2) Validate data replication and promote the secondary database replica, 3) Reconfigure load balancing and DNS to route traffic to the secondary region, and 4) Run synthetic end-to-end integration tests to confirm operational readiness.
The proper disaster recovery validation sequence follows a dependency-driven path: first, pre-flight capacity and quota checks ensure the target environment can host the workload. Next, data integrity is verified and storage replicas are promoted to primary read-write status. Once the application backend and database are fully operational, network load balancing and DNS routing are updated to shift live traffic. Finally, synthetic end-to-end tests validate system health and compliance with RTO/RPO objectives.

Step-by-Step Solution

1
Pre-verify Compute Engine quota limits and resource reservations in the DR region (us-east4).
Confirms that target region capacity is guaranteed before initiating failover procedures.
Attempting failover without verified quota risks instance spin-up failures during critical migration steps.
2
Check database replication lag and promote the us-east4 replica to a standalone read-write primary instance.
Establishes an active, writable persistence layer in the secondary region.
Application services cannot process stateful transactions until the underlying database is promoted and ready.
3
Modify Cloud DNS routing records and update Cloud Load Balancing backend services to target us-east4 instance groups.
Inbound user traffic is successfully redirected to the secondary region.
Traffic cutover must only occur after compute and data layers in the target region are fully operational.
4
Run synthetic user workflows and automated integration test suites to measure application performance against established RTO and RPO targets.
Validates business continuity objectives and confirms system stability under live workload.
Post-cutover verification is essential to verify that the DR environment meets business SLAs.

Key Concept

Disaster Recovery Validation Procedures and Operational Execution Order
Question 912Question →

A multinational enterprise is designing a hub-and-spoke VPC architecture in Google Cloud. The central hub VPC is connected to an on-premises data center via a 10 Gbps Cloud Interconnect. Two spoke VPCs (Analytics VPC and Production VPC) are connected to the central hub VPC using VPC Network Peering. On-premises workloads require direct connectivity to resources inside the spoke VPCs, and workloads in the spoke VPCs must privately reach Google Cloud APIs (such as Cloud Storage and BigQuery) without routing traffic through the public internet. Which TWO network topology configurations must be implemented to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Configure custom route export and import flags on the VPC Network Peering connections between the hub and spoke VPCs, and set up custom BGP route advertisements on the hub Cloud Router to announce spoke subnets to on-premises.; Enable Private Google Access on the subnets inside the spoke VPCs and deploy Private Service Connect (PSC) endpoints inside the VPCs to allow private access to Google APIs from both GCP workloads and on-premises systems.

Answer

The correct configurations are exporting/importing custom routes on VPC Peering connections along with custom BGP route advertisements on the hub Cloud Router, and enabling Private Google Access on spoke subnets with Private Service Connect endpoints.
To establish end-to-end connectivity between on-premises networks and spoke VPCs in a hub-and-spoke model, custom route export and import must be enabled on VPC Peering links, and the hub Cloud Router must use custom BGP announcements to advertise spoke CIDRs to on-premises. Additionally, Private Google Access and Private Service Connect endpoints grant private internal access to Google APIs without traversing public IP space.

Step-by-Step Solution

1
Address hybrid reachability across non-transitive VPC Peering boundaries.
Enable custom route exchange on VPC Peering and configure BGP custom route advertisements on the hub VPC Cloud Router.
VPC Network Peering is non-transitive. On-premises routers connected via Cloud Interconnect will not automatically learn spoke VPC routes unless custom routes are exported/imported across peering and advertised via BGP on the Cloud Router.
2
Configure private Google API access for spoke VPC workloads and on-premises hosts.
Enable Private Google Access on spoke subnets and set up Private Service Connect (PSC) endpoints.
Private Google Access provides internal routing to Google API endpoints for subnet VMs without external IPs. Private Service Connect endpoints assign internal IP addresses to Google services, enabling both VPC workloads and on-premises networks to reach APIs securely.

Key Concept

Hub-and-spoke VPC topology design, custom BGP route propagation across VPC Peering, and Private Service Connect deployment.
Question 913Question →

Your team is releasing an updated revision of a microservice hosted on Cloud Run. To minimize the impact of potential software bugs, you want to route only 5% of production traffic to the new revision while keeping 95% of traffic on the existing stable revision. After verifying metrics such as latency and error rates, you plan to shift the remaining traffic. Which release management strategy is being implemented in this scenario?

Show answer & explanation

Answer: Canary deployment

Answer

Canary deployment
Canary deployment is a release management strategy where a small fraction of live traffic is directed to a newly deployed revision to monitor performance and error metrics in production before completing a full rollout.

Step-by-Step Solution

1
Identify the release requirement from the scenario
The scenario describes routing a small subset (5%) of live user traffic to a new release version while observing telemetry.
Gradually routing a small proportion of user traffic isolates potential defects to a minority of users.
2
Map the requirement to deployment strategies
Exposing a minor percentage of live traffic to validate a new revision before full promotion is the defining characteristic of a canary deployment.
Cloud Run traffic splitting directly supports canary deployment patterns by assigning percentage weights to target revisions.

Key Concept

Canary deployment strategy using Cloud Run traffic splitting
Estimated Time:1m 0s
Question 914Question →

A global automotive manufacturer is modernizing its connected vehicle telemetry and dealership diagnostic platform by migrating infrastructure to Google Cloud. The executive steering committee requires zero operational disruption during regional rollouts, strict adherence to enterprise security governance, and structured enablement for engineering teams transitioning from legacy on-premises workflows. During stakeholder requirement analysis, the Cloud Architect identifies two critical risks: regional testing teams plan to initiate high-concurrency load tests without reviewing regional default limits, and development leads intend to grant primitive Editor roles across all projects to bypass permission configuration delays. Which two architectural and organizational change management strategies should the Cloud Architect implement to address these risks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Submit regional quota increase requests to Google Cloud well in advance of testing milestones, and institute a quota monitoring workflow with regional technical leads.; Define custom and predefined IAM roles aligned with specific job responsibilities, and provide role-based training to enable engineering teams on least-privilege access management.

Answer

The Cloud Architect should proactively submit regional quota increase requests prior to load testing while instituting quota governance, and implement granular predefined or custom IAM roles accompanied by structured role-based training for regional engineering teams.
Addressing stakeholder operational readiness requires both technical preparation and organizational enablement. Submitting quota increase requests in advance prevents infrastructure provisioning blocks during testing phases. Concurrently, replacing proposed primitive IAM roles with targeted predefined or custom roles combined with structured training ensures compliance with security governance without impeding team productivity.

Step-by-Step Solution

1
Analyze capacity requirements and quota limitations
Identify that default Google Cloud regional quotas will block large-scale concurrency testing if not requested in advance.
Quota approvals require lead time, and unmanaged testing against default limits causes service failure during rollout.
2
Evaluate security and change management requirements
Replace planned primitive IAM role assignments with fine-grained custom or predefined roles, and train regional leads on GCP IAM principles.
Enforces enterprise least-privilege security policy while overcoming team skills gaps through structured enablement.

Key Concept

Analyzing stakeholder requirements and managing organizational change through proactive resource quota governance and structured IAM enablement.
Question 915Question →

An organization maintains a central shared services VPC network (shared-svc-vpc) connected to their on-premises environment using an HA VPN gateway with Cloud Router dynamic routing. To host a new line-of-business workload, the infrastructure team provisions a dedicated application VPC (app-vpc) and establishes a VPC Network Peering connection between app-vpc and shared-svc-vpc. Workloads in app-vpc successfully communicate with internal services residing directly in shared-svc-vpc, but they are unable to reach any on-premises servers over the HA VPN link. What is the root cause of this connectivity behavior, and how should the network topology be configured to allow app-vpc to reach on-premises?

Show answer & explanation

Answer: VPC Network Peering does not support transitive routing across third-party networks or VPN gateways; configure a separate VPN connection or Network Connectivity Center hub to establish direct hybrid routing for app-vpc.

Answer

VPC Network Peering is non-transitive by design in Google Cloud. Dynamic routes learned from on-premises via Cloud Router and HA VPN in one VPC network cannot be transitively routed to a peered VPC network. To enable hybrid connectivity for the application VPC, direct hybrid connectivity (such as a separate VPN tunnel/Interconnect) or a supported routing architecture (such as Network Connectivity Center) must be deployed.
The correct option correctly identifies that Google Cloud VPC Network Peering is non-transitive. Virtual machines in a peered VPC network cannot access external networks (such as on-premises data centers) through a hybrid gateway located in another VPC. Direct hybrid connectivity or Network Connectivity Center must be used.

Step-by-Step Solution

1
Analyze the reported connectivity behavior
Communication succeeds between app-vpc and shared-svc-vpc, but fails between app-vpc and on-premises via the HA VPN in shared-svc-vpc.
This indicates that intra-peering connectivity is functional, but multi-hop path forwarding across the VPN gateway is blocked.
2
Evaluate Google Cloud networking constraints regarding VPC Network Peering
Google Cloud VPC Network Peering does not support transitive routing (i.e., Network A peered with Network B cannot use Network B's gateways or peering connections to reach Network C or on-premises).
VPC Peering only exchanges local subnet routes and explicitly configured custom routes between the two directly peered networks.
3
Identify the required architectural solution
Establish a direct hybrid connectivity gateway (HA VPN or Interconnect) attached directly to app-vpc, or use Network Connectivity Center.
This satisfies GCP networking constraints and ensures scalable hybrid reachability.

Key Concept

VPC Network Peering Non-Transitivity
Estimated Time:2m 0s
Question 916Question →

A global pharmaceutical firm is designing a clinical trial telemetry platform on Google Cloud. The conceptual architecture defines three functional tiers: a message buffer for regional event ingestion from medical devices, a managed compute layer for stateless transformation that scales to zero during off-peak hours, and a network security boundary preventing data exfiltration to unauthorized external cloud locations. Which combination of Google Cloud physical services correctly maps to these conceptual architectural layers while satisfying all operational and security constraints?

Show answer & explanation

Answer: Cloud Pub/Sub for regional event ingestion, Cloud Run for stateless serverless transformation, and VPC Service Controls to define a security perimeter around storage and compute resources.

Answer

The architectural requirements are best met by pairing Cloud Pub/Sub for regional event ingestion, Cloud Run for stateless scale-to-zero compute, and VPC Service Controls to establish a perimeter preventing data exfiltration.
The correct architecture translates conceptual messaging, compute, and security requirements into Cloud Pub/Sub for event ingestion, Cloud Run for scale-to-zero stateless processing, and VPC Service Controls for strict perimeter security against data exfiltration.

Step-by-Step Solution

1
Map conceptual ingestion buffer requirements to physical GCP messaging resources.
Cloud Pub/Sub provides managed, low-latency, regional event buffering with guaranteed delivery.
Pub/Sub handles asynchronous event ingestion efficiently without requiring relational database provisioning.
2
Map conceptual stateless transformation requirements to physical compute resources.
Cloud Run allows containerized stateless execution that automatically scales down to zero instances when idle.
Cloud Run minimizes cost and management overhead compared to managing GKE cluster infrastructure for simple workloads.
3
Map conceptual security isolation requirements to physical network security boundaries.
VPC Service Controls establishes a security perimeter restricting data movement across GCP service boundaries.
IAM policies alone control identities and permissions but do not prevent data egress outside perimeter boundaries.

Key Concept

Mapping conceptual business requirements (buffering, scale-to-zero compute, exfiltration prevention) to concrete logical and physical GCP services (Pub/Sub, Cloud Run, VPC Service Controls).
Estimated Time:1m 30s
Question 917Question →

An energy utility enterprise based in Australia is deploying its smart meter telemetry processing platform to Google Cloud. National regulatory mandates require that all customer consumption records remain strictly within Australia. Additionally, the security policy dictates that all data at rest must be encrypted using keys controlled by the enterprise within the designated Australian region, exfiltration to unauthorized external cloud environments must be prevented, and Google support personnel access to underlying infrastructure must require explicit customer authorization. Which architectural strategy meets all regulatory compliance, data sovereignty, and security requirements?

Show answer & explanation

Answer: Enforce an Organization Policy with the Resource Locations constraint set to australia-southeast1, encrypt Cloud Storage and BigQuery datasets with Customer-Managed Encryption Keys (CMEK) located in australia-southeast1, establish a VPC Service Controls perimeter around the project resources, and configure Access Approval.

Answer

The optimal solution enforces an Organization Policy with the Resource Locations constraint set to australia-southeast1, encrypts data using regional Customer-Managed Encryption Keys (CMEK), isolates resources using VPC Service Controls, and enables Access Approval.
Combining an Organization Policy for resource location restriction (`australia-southeast1`), regional Customer-Managed Encryption Keys (CMEK), VPC Service Controls perimeters, and Access Approval provides a complete regulatory compliance framework. It enforces data sovereignty, key control, exfiltration prevention, and administrative access approval.

Step-by-Step Solution

1
Enforce strict geographical data residency boundaries.
Applying the `constraints/gcp.resourceLocations` Organization Policy restricted to `australia-southeast1` prevents resources from being created outside Australia.
Regulatory compliance mandates that data must physically reside in the specified jurisdiction.
2
Implement enterprise key management and access controls.
Using Cloud KMS CMEK in `australia-southeast1` satisfies key ownership demands, while VPC Service Controls creates a security perimeter preventing data egress.
CMEK ensures compliance with customer key control policies without taking on manual raw key management, and VPC Service Controls mitigates exfiltration risks.
3
Establish access transparency and administrative oversight.
Enabling Access Approval ensures any access request by Google cloud operations personnel requires explicit authorization.
Regulatory frameworks for sensitive data often require formal customer sign-off before cloud provider engineers can inspect underlying systems.

Key Concept

Data Sovereignty and Security Governance Frameworks in GCP
Question 918Question →

A cloud engineering team is designing a secure, automated Continuous Integration and Continuous Delivery (CI/CD) pipeline on Google Cloud to deploy containerized microservices to Google Kubernetes Engine (GKE) using Cloud Build, Artifact Registry, Binary Authorization, and Cloud Deploy. Arrange the operational pipeline stages in the correct chronological execution order from initial code commit to production rollout.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence of pipeline stages is: (1) Source code commit triggers Cloud Build to compile code and push the container image to Artifact Registry, (2) Container Analysis scans the image and Cloud KMS signs the digest for Binary Authorization, (3) Cloud Deploy creates a release and deploys the attested image to the staging GKE cluster, (4) Integration tests pass in staging and Cloud Deploy requests explicit manual approval, and (5) Cloud Deploy executes a progressive canary rollout to the production GKE cluster upon approval.
The proper sequence aligns with Google Cloud CI/CD best practice architecture: artifact compilation (Cloud Build to Artifact Registry) -> security vulnerability scanning and attestation (Container Analysis and Binary Authorization) -> non-production deployment (Cloud Deploy to staging GKE) -> automated qualification testing and approval gating -> production rollout (Cloud Deploy progressive canary deployment).

Step-by-Step Solution

1
Identify the build phase (Continuous Integration)
Developers push code, which triggers Cloud Build to build the container image and upload it to Artifact Registry.
Building and publishing the container artifact must take place before security attestation scanning or deployment can begin.
2
Identify image security verification and attestation
Container Analysis performs vulnerability scanning and a KMS key signs the image digest for Binary Authorization.
GKE clusters configured with Binary Authorization require cryptographic attestations created from image digests prior to cluster admission.
3
Identify non-production release creation and deployment
Cloud Deploy creates a release specifying the signed digest and deploys to the staging GKE cluster.
Cloud Deploy manages continuous delivery across target environments, deploying first to pre-production targets.
4
Identify environment qualification and approval gating
Staging integration tests succeed and Cloud Deploy triggers a manual approval requirement for production rollout.
Enterprise governance requires automated staging validation followed by human authorization before production changes occur.
5
Identify final production deployment execution
Cloud Deploy carries out a progressive canary deployment to the production GKE cluster.
Canary rollouts safely update production workloads incrementally while monitoring for metrics regressions.

Key Concept

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design
Estimated Time:1m 30s
Question 919Question →

An enterprise operations team is scaling its Google Cloud footprint and managing infrastructure deployments across multiple Google Kubernetes Engine (GKE) private clusters. Currently, operators execute Terraform from local workstations without remote state locking, utilize primitive Editor permissions, and access GKE control planes over public endpoints without restriction. As a Cloud Architect advising the operations team, which TWO architectural actions should you recommend to establish least privilege, secure cluster access, and prevent state corruption?

Select all that apply

Show answer & explanation

Answer: Migrate Terraform state management to a Google Cloud Storage bucket with object versioning and state locking enabled via Cloud KMS CMEK.; Restrict private GKE cluster control plane access using Authorized Networks to designated internal CIDR ranges and grant operators fine-grained roles such as Kubernetes Engine Developer alongside Service Account User permissions.

Answer

The correct recommendations are to migrate Terraform state to a Cloud Storage bucket with state locking enabled, restrict GKE control plane access via Authorized Networks, and assign fine-grained IAM roles (Kubernetes Engine Developer and Service Account User) instead of primitive or administrative roles.
Establishing Cloud Storage as a remote Terraform backend ensures state locking and automated concurrency control during pipeline execution. Restricting private GKE control plane endpoints via Authorized Networks prevents unauthorized network traffic, and applying fine-grained roles (Kubernetes Engine Developer paired with Service Account User) satisfies the principle of least privilege without granting dangerous administrative permissions.

Step-by-Step Solution

1
Evaluate IaC state management security and reliability requirements.
Local state files or version control storage lead to state corruption during concurrent updates and leak unencrypted secrets. Utilizing a Google Cloud Storage backend with state locking ensures atomic updates and security.
Cloud Storage backends support native file locking via GCP APIs to guarantee single-writer concurrency control for Terraform state.
2
Analyze perimeter security and API access controls for GKE clusters.
Publicly exposed control plane endpoints allow network reachability from untrusted networks. Configuring Control Plane Authorized Networks limits master endpoint access exclusively to designated management VPC subnets or VPN endpoints.
Authorized Networks enforce layer-3 filtering on the GKE control plane endpoint.
3
Apply Google Cloud Identity and Access Management (IAM) least privilege guidelines.
Replace primitive Owner/Editor roles and excessive Service Account Admin roles with fine-grained predefined roles such as Kubernetes Engine Developer and Service Account User.
Service Account User permits deploying workloads under a service account without permitting service account management or key creation.

Key Concept

Advising DevOps on Secure Infrastructure Management (IaC State Backend & GKE Control Plane Security)
Question 920Question →

An energy utility company operates two primary workloads on Google Cloud: a real-time Smart Grid Telemetry Ingestion microservice and an asynchronous Monthly Customer Billing Report Generator. Failure of real-time telemetry ingestion immediately threatens power grid stability, whereas delayed billing reports can be re-processed asynchronously within a 24-hour window without business loss. Which strategy correctly aligns technical operational metrics with business impact for these workloads?

Show answer & explanation

Answer: Define a stringent availability SLO (such as 99.99%) evaluated over short windows with burn-rate alerts for grid telemetry, and a lower SLO (such as 99.0%) based on job completion freshness over a monthly window for billing reports.

Answer

Define a stringent availability SLO (such as 99.99%) evaluated over short windows with burn-rate alerts for grid telemetry, and a lower SLO (such as 99.0%) based on job completion freshness over a monthly window for billing reports.
The correct strategy differentiates the Service Level Objectives based on business impact: high-frequency real-time grid telemetry requires tight availability goals and rapid error-budget alert monitoring, while batch report generation only requires periodic freshness targets within a 24-hour window.

Step-by-Step Solution

1
Analyze business impact for each service.
Grid telemetry has critical, immediate business impact (grid stability), whereas billing reports are asynchronous with a 24-hour tolerance.
SLOs and error budgets must directly map to user tolerance and business impact of downtime.
2
Select appropriate SLIs and SLO targets.
Assign high availability (e.g., 99.99%) with real-time latency/success SLIs for telemetry, and freshness/completion time SLOs (e.g., 99.0%) for batch billing.
Differentiating targets avoids over-engineering non-critical components and protects critical systems.
3
Differentiate SLI measurements from SLO target goals.
Ensure SLIs measure actual operational events (successful telemetry requests / total requests) while SLOs set the target threshold over a specific time window.
Confusing SLIs with SLOs undermines error budget tracking and operational alert design.

Key Concept

Aligning SLAs, SLOs, and SLIs with Business Impact
PreviousPage 46 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin