Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 1021Question →

An enterprise DevOps team is setting up an automated CI/CD pipeline on a self-hosted runner outside of Google Cloud. The deployment script needs to programmatically execute gcloud CLI commands and custom Python client library scripts to manage infrastructure across multiple target Google Cloud projects. Enterprise security policy strictly prohibits creating, downloading, or storing long-lived service account JSON keys. Which approach should the Cloud Architect recommend to enable secure, programmatic authentication for the pipeline?

Show answer & explanation

Answer: Authenticate the runner using Workload Identity Federation to obtain short-lived credentials for a baseline service account, and use service account impersonation for target project deployments.

Answer

Authenticate the runner using Workload Identity Federation to obtain short-lived credentials for a baseline service account, and use service account impersonation for target project deployments.
The correct approach leverages Workload Identity Federation (WIF) alongside service account impersonation. WIF enables on-premises or external CI/CD workloads to authenticate with Google Cloud using native identity tokens, exchanging them for short-lived GCP access tokens without service account keys. Using service account impersonation (`--impersonate-service-account` in gcloud or `google.auth.impersonate` in SDKs) allows the runner to dynamically assume fine-grained identities across target projects safely.

Step-by-Step Solution

1
Identify authentication constraints
External self-hosted runner requiring programmatic access to multiple GCP projects without using long-lived service account JSON keys.
Security policy forbids static credential files such as service account JSON key pairs.
2
Establish federated identity for non-GCP environment
Configure Workload Identity Federation between the external CI/CD provider and Google Cloud IAM.
Allows short-lived OAuth2 access tokens to be issued based on trusted external identity tokens.
3
Apply short-lived token escalation across projects
Use gcloud --impersonate-service-account or Google Cloud SDK client library impersonation credentials to target specific project roles.
Enables multi-project access dynamically with minimal permissions and short-lived credentials.

Key Concept

Workload Identity Federation and Service Account Impersonation for Keyless Programmatic Interaction
Question 1022Question →

An enterprise organization operates hybrid workloads across Compute Engine virtual machines and Google Kubernetes Engine (GKE) clusters. The operations team requires a centralized observability architecture that retains application and system logs for seven years to meet regulatory compliance while enabling real-time alerting for operational anomalies. The architecture must ensure that high-severity logs and security audit trails are guaranteed to be ingested without loss. Which TWO architectural actions should the team implement to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an organization-level aggregated Log Router sink to stream all audit and application logs to a Cloud Storage bucket for long-term compliance storage.; Deploy the Google Cloud Ops Agent on Compute Engine instances and enable native GKE system logging to collect operational metrics and telemetry for real-time Cloud Monitoring alerting.

Answer

The recommended actions are to configure an organization-level Log Router sink pointing to Cloud Storage for compliance retention and to deploy the Ops Agent alongside GKE logging for real-time observability.
Centralized observability for hybrid GCP workloads requires capturing operational telemetry via the Ops Agent on Compute Engine and GKE integrated logging, alongside using an organization-level Log Router aggregated sink to route compliance logs into long-term Cloud Storage buckets.

Step-by-Step Solution

1
Evaluate long-term log retention requirements
Aggregated Log Router sink at the organization level routing logs to a Cloud Storage bucket satisfies multi-year regulatory requirements efficiently.
Cloud Storage provides cheap, durable long-term storage suitable for multi-year compliance audits.
2
Evaluate workload observability and real-time incident detection requirements
Ops Agent on VMs and native GKE logging integration feed Cloud Logging and Cloud Monitoring.
Ops Agent standardizes metric and log capture across VM instances, enabling alerting policies in Cloud Monitoring.
3
Verify security and operational anti-patterns in distractors
Excluding error logs, granting primitive roles, or omitting VPC Service Controls compromise reliability and security.
Exclusion filters on severe errors break incident diagnosis, while excessive IAM roles introduce risk.

Key Concept

Centralized Log Aggregation and Observability Integration
Question 1023Question →

Match each Google Cloud security product or feature to its corresponding container vulnerability management or threat detection role within an enterprise architecture.

Click a left item, then click its matching right item

Items

Binary Authorization
Event Threat Detection (ETD)
Artifact Registry Vulnerability Scanning
Container Threat Detection (CTD)

Matches

Show answer & explanation

Answer

Binary Authorization matches deploy-time signature verification policies; Event Threat Detection matches organization-wide log stream threat analysis; Artifact Registry Vulnerability Scanning matches container image CVE monitoring; Container Threat Detection matches kernel-level GKE node runtime monitoring.
Each service addresses a distinct phase in the container lifecycle: Artifact Registry Vulnerability Scanning handles repository inspection, Binary Authorization enforces deployment policy gates, Container Threat Detection monitors live GKE container runtimes, and Event Threat Detection monitors GCP audit and stream logs across the organization.

Step-by-Step Solution

1
Identify the deploy-time prevention control.
Binary Authorization requires attestations before image deployment on GKE.
Prevents unsigned or unauthorized container builds from running in production environments.
2
Distinguish between log analysis and node kernel runtime inspection.
Event Threat Detection analyzes Cloud Logging log events, whereas Container Threat Detection monitors low-level kernel activities inside GKE worker nodes.
Security Command Center separates log-based threat detection (ETD) from active node workload runtime detection (CTD).
3
Identify image repository scanning controls.
Artifact Registry Vulnerability Scanning handles pre-deployment CVE detection directly within the image storage registry.
Ensures container images are evaluated for software vulnerabilities before deployment.

Key Concept

Defense-in-depth container security, vulnerability scanning, and threat detection in GCP
Question 1024Question →

A logistics software platform runs containerized microservices on Google Kubernetes Engine (GKE). The security architect must ensure that container images in Artifact Registry are continuously monitored for newly discovered vulnerabilities, only verified CI/CD container images can be deployed to production GKE clusters, and runtime container threats are detected without installing third-party agent sidecars on the worker nodes. Which combination of Google Cloud services and configurations meets these requirements?

Show answer & explanation

Answer: Enable Continuous Scanning in Artifact Registry, configure Binary Authorization policies on GKE to enforce build attestations, and enable Security Command Center Container Threat Detection.

Answer

Enable Continuous Scanning in Artifact Registry, configure Binary Authorization policies on GKE to enforce build attestations, and enable Security Command Center Container Threat Detection.
Continuous Scanning in Artifact Registry automatically monitors stored images against newly disclosed vulnerabilities. Binary Authorization enforces policy checks requiring cryptographic attestations from the CI/CD pipeline before deploying to GKE. Security Command Center Container Threat Detection offers agentless runtime threat detection at the hypervisor level.

Step-by-Step Solution

1
Evaluate vulnerability scanning requirements for container images.
Artifact Registry Continuous Scanning satisfies automated, continuous vulnerability monitoring as CVE databases update.
Standard scanning only analyzes images at push time, whereas Continuous Scanning continuously evaluates stored container images against newly published vulnerabilities.
2
Evaluate deployment control requirements for image provenance.
Binary Authorization enforces attestations signed by trusted authorities during CI/CD before allowing image execution on GKE.
Binary Authorization natively integrates with GKE to prevent unsigned or unvalidated container images from being deployed.
3
Evaluate runtime threat detection requirements.
Security Command Center Container Threat Detection provides agentless monitoring of container runtime anomalies.
Container Threat Detection operates at the host node and hypervisor levels, detecting suspicious process executions and container escapes without agent sidecars.

Key Concept

Multi-layered container security combining automated vulnerability scanning, binary attestation enforcement, and agentless runtime threat detection.
Question 1025Question →

An online retail enterprise requires an external auditing system to read data from BigQuery datasets residing inside multiple Google Cloud projects under a dedicated 'Analytics-Prod' folder. Additionally, the external system must be able to generate short-lived credentials by impersonating a specific managed service account without using static service account keys. Which two administrative actions should you take to fulfill these security requirements while strictly adhering to the principle of least privilege?

Select all that apply

Show answer & explanation

Answer: Grant the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) to the auditing identity at the 'Analytics-Prod' folder level.; Grant the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) to the auditing identity on the specific target service account resource.

Answer

Granting the BigQuery Data Viewer role at the 'Analytics-Prod' folder level and assigning the Service Account Token Creator role directly on the target service account resource provides minimal, securely scoped access.
Granting the predefined BigQuery Data Viewer role at the folder level leverages Google Cloud resource hierarchy inheritance to provide read-only access to all datasets in member projects. Granting the Service Account Token Creator role on the specific service account enables secure short-lived token generation for impersonation without sharing static key files or granting excessive service account management permissions.

Step-by-Step Solution

1
Analyze resource hierarchy for BigQuery dataset access.
Assigning `roles/bigquery.dataViewer` at the folder level allows read access to inherit down to all current and future projects in that folder.
Resource hierarchy inheritance simplifies access management across multiple projects while remaining restricted to BigQuery read operations.
2
Determine fine-grained permission required for service account impersonation.
Assigning `roles/iam.serviceAccountTokenCreator` on the specific target service account allows short-lived token generation.
Impersonation requires token creation privileges on the target service account resource itself rather than folder-wide administrative access.

Key Concept

IAM Resource Hierarchy Inheritance and Fine-Grained Service Account Impersonation Roles
Estimated Time:2m 0s
Question 1026Question →

A central security auditing application hosted on a Compute Engine instance needs to programmatically scan metadata and security postures across multiple Google Cloud projects in an organization using the official Cloud Client Libraries. Security governance policies strictly prohibit the creation of exportable, long-lived service account key files and mandate minimal role privilege grants across all target projects. Which TWO configuration choices should you implement to establish secure programmatic authentication for the audit application?

Select all that apply

Show answer & explanation

Answer: Configure the application to leverage Application Default Credentials (ADC) to automatically obtain short-lived tokens from the Compute Engine metadata server.; Grant the instance service account the Service Account Token Creator role on target service accounts in each target project to enable short-lived impersonation.

Answer

The application should be configured to use Application Default Credentials (ADC) via the metadata server, paired with Service Account Impersonation using the Service Account Token Creator role on specific target service accounts.
Using Application Default Credentials allows the SDK to automatically query the Compute Engine metadata server for temporary credentials. Combining this with Service Account Impersonation using the Service Account Token Creator role enables short-lived, fine-grained access across target projects without creating exportable key files.

Step-by-Step Solution

1
Establish identity authentication mechanism
Application Default Credentials automatically detects runtime environment credentials from the Compute Engine metadata server without requiring key files.
Eliminates the need for long-lived service account key files.
2
Configure cross-project programmatic access
Granting roles/iam.serviceAccountTokenCreator on target service accounts allows the central service account to impersonate target service accounts and generate short-lived access tokens.
Adheres to zero-trust standards and least privilege access controls across target projects.

Key Concept

Programmatic GCP authentication via Application Default Credentials and Service Account Impersonation
Question 1027Question →

A cloud architect needs to consolidate all Administrative Activity audit logs from all projects within a Google Cloud organization into a centralized BigQuery dataset for compliance auditing. Which approach represents the recommended Google Cloud observability integration pattern while following security best practices?

Show answer & explanation

Answer: Create an aggregated Log Router sink at the organization level targeting the BigQuery dataset, and grant the sink's service account the BigQuery Data Editor role on the destination dataset.

Answer

Create an aggregated Log Router sink at the organization level targeting the BigQuery dataset, and grant the sink's service account the BigQuery Data Editor role on the destination dataset.
Aggregated Log Router sinks created at the Google Cloud organization resource level automatically gather log entries from all projects under the organization and export them to a designated target such as BigQuery. Granting the BigQuery Data Editor role to the sink's service account provides the minimum permissions necessary to write log entries to the destination table.

Step-by-Step Solution

1
Identify the architectural requirement for multi-project audit log centralization.
An aggregated Log Router sink at the organization level is required to capture logs from all child projects.
Organization-level log sinks automatically capture logs across all current and future projects in the resource hierarchy.
2
Select the appropriate destination and access control policy.
Route logs to BigQuery and grant the sink's identity the least-privilege role (BigQuery Data Editor).
Predefined roles avoid granting unnecessary administrative privileges associated with primitive roles.

Key Concept

Aggregated Log Router Sinks and Least-Privilege IAM Integration
Question 1028Question →

An enterprise organization is migrating sensitive customer identity verification files to Cloud Storage. Compliance policy dictates that the key encryption keys (KEKs) must physically reside within the organization's existing on-premises Hardware Security Module (HSM) and that Google Cloud must never store the root key material. Additionally, application developers must not handle raw key material directly in application code or send key bytes within individual HTTP request headers. Which encryption strategy should you recommend?

Show answer & explanation

Answer: Configure Cloud KMS with Cloud External Key Manager (Cloud EKM) to reference the on-premises HSM key, and set the Cloud Storage bucket to use Customer-Managed Encryption Keys (CMEK).

Answer

Configure Cloud KMS with Cloud External Key Manager (Cloud EKM) connected to the on-premises HSM, and use Customer-Managed Encryption Keys (CMEK) on the Cloud Storage bucket.
The correct choice utilizes Cloud External Key Manager (Cloud EKM) paired with Cloud KMS. Cloud EKM enables Google Cloud services like Cloud Storage to encrypt data at rest via Customer-Managed Encryption Keys (CMEK) while keeping the master keys inside an external on-premises HSM, fulfilling both physical key custody and seamless developer experience requirements.

Step-by-Step Solution

1
Analyze key location and key custody constraints.
The requirement states that root keys must reside in an on-premises HSM and Google Cloud must never store the root key material.
This rules out Google-managed keys and standard Cloud KMS/Cloud HSM keys hosted entirely inside Google Cloud.
2
Evaluate application key handling constraints.
Developers must not supply key material in HTTP headers or handle raw key bytes.
This rules out Customer-Supplied Encryption Keys (CSEK), which require explicit key headers on every request.
3
Identify the service that bridges Cloud KMS/CMEK with external HSMs.
Cloud External Key Manager (Cloud EKM) allows Cloud KMS to delegate cryptographic operations to an external key manager/HSM over a secure connection.
By attaching Cloud EKM keys as CMEK on the Cloud Storage bucket, seamless bucket-level encryption is achieved without exposing key bytes to applications.

Key Concept

Cloud EKM with CMEK for external key governance
Question 1029Question →

A global retail company is designing an automated validation procedure for a new microservices-based inventory management platform on Google Cloud. The deployment process must validate infrastructure availability, security compliance, and system performance before pushing releases to production. The environment relies on private Google Kubernetes Engine (GKE) clusters, Terraform for Infrastructure as Code (IaC), and strict VPC Service Controls. Which testing procedure best aligns with Google Cloud recommended best practices for validating this technical solution?

Show answer & explanation

Answer: Implement a pre-deployment pipeline that runs terraform plan against a remote Cloud Storage backend with state locking, verifies regional quota availability via the Cloud Quotas API, and executes automated integration tests against GKE private master endpoints using internal CI/CD runners inside authorized VPC networks.

Answer

The correct validation strategy implements a pre-deployment pipeline that verifies IaC plan validity against a versioned Cloud Storage backend with locking, checks regional resource quotas via the Cloud Quotas API prior to provisioning, and executes end-to-end integration tests using internal runners with access to private GKE control plane authorized networks.
The solution establishing a pre-deployment pipeline with Cloud Storage remote state locking, Cloud Quotas API validation, and internal runner access to private GKE authorized networks adheres strictly to GCP technical validation best practices. It verifies state integrity, guarantees resource availability, and enforces perimeter security.

Step-by-Step Solution

1
Analyze infrastructure state and deployment prerequisites
Ensure Terraform state is centralized in Cloud Storage with object locking to prevent concurrent state corruption during pre-flight checks.
Centralized state validation ensures that infrastructure changes accurately reflect expected environment configurations without drift.
2
Validate Google Cloud resource quotas programmatically
Query the Cloud Quotas API to confirm required compute, network, and IP resources exist prior to initiating deployment testing.
Requesting or verifying quota limits in advance prevents deployment pipeline failures caused by unexpected quota exhaustion.
3
Execute technical validation securely within private network boundaries
Deploy internal CI/CD runners inside authorized VPC networks to run integration and load tests against private GKE control plane endpoints.
Using authorized internal networks preserves private cluster security while enabling automated pre-flight testing suites.

Key Concept

Developing Procedures to Test and Validate Technical Solutions
Estimated Time:2m 0s
Question 1030Question →

An enterprise financial organization is establishing an automated testing and validation procedure for a high-throughput transaction microservice on Google Kubernetes Engine (GKE). The Cloud Architect must define a sequential validation procedure that ensures static configuration integrity, resource quota readiness, synthetic performance compliance, and production canary safety. In what chronological sequence should the cloud team execute these validation steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: static analysis and dry-run plan execution, followed by resource quota and security perimeter verification, then ephemeral cluster provisioning for synthetic SLO load testing, and finally canary deployment with error budget monitoring.
Technical solution validation follows a progressive risk-reduction sequence. First, static IaC analysis verifies configuration correctness without resource cost. Second, environmental prerequisites (GCP quotas and VPC SC perimeters) are verified to ensure execution readiness. Third, ephemeral staging environments are provisioned for synthetic load and SLO testing. Finally, canary deployments validate production behavior under real user traffic.

Step-by-Step Solution

1
Perform static analysis and dry-run checks on IaC configurations.
Identifies syntax errors and security policy non-compliance without instantiating GCP resources.
Static checks are fast, low-cost, and catch syntax or compliance failures before cloud resource allocation.
2
Check regional quotas and VPC Service Controls boundaries.
Ensures the target project environment has sufficient CPU/IP quotas and compliant network perimeters.
Verifying quota availability prevents provisioning failures during downstream automated cluster scaling.
3
Provision temporary staging infrastructure for synthetic load testing.
Validates application performance metrics and system stability against defined SLOs under heavy load.
Synthetic stress testing proves performance compliance in an isolated setting before introducing production traffic.
4
Execute canary deployment in production with phased traffic routing.
Validates real-world behavior and error budget consumption under production conditions.
Canary deployment provides the ultimate validation step with minimal risk exposure prior to full release.

Key Concept

Developing Sequential Infrastructure and Solution Validation Procedures
Question 1031Question →

Your organization is executing a major application update for a mission-critical microservice running on Google Kubernetes Engine (GKE). The release requires a non-backward-compatible database schema change. To meet business requirements of zero downtime and zero data loss, your architecture team chose an Expand-Contract deployment pattern combined with a Blue-Green release traffic shift via GKE Gateway API HTTPRoute resources. Arrange the operational steps below in the correct logical execution sequence from start to finish.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with applying additive, non-breaking database schema changes (Expand phase), followed by deploying the Green workload to GKE with zero traffic, executing data backfill and synchronization scripts, updating the GKE Gateway HTTPRoute to switch production traffic to Green, and finally removing the legacy Blue workload and deleting deprecated database schema elements (Contract phase).
The correct operational sequence follows the Expand-Contract database pattern paired with Blue-Green traffic routing. First, the database schema must be expanded additively so existing Blue instances remain functional. Second, the Green application is deployed with zero traffic to isolate verification. Third, data backfill and dual-writing occur to synchronize historical data. Fourth, traffic is shifted to Green via GKE Gateway HTTPRoute configuration. Finally, after confirming operational stability, legacy Blue deployment resources are removed and deprecated database columns are dropped during the Contract phase.

Step-by-Step Solution

1
Expand Database Schema
Database supports both old and new schema requirements without breaking the active Blue deployment.
Prevents downtime for current Blue pods while preparing the data layer for Green pods.
2
Deploy Green Workload to GKE
Green pods are running and pass health checks, but receive 0% live traffic.
Allows verification of application startup and connectivity without exposing end users to unvalidated code.
3
Perform Data Backfill & Synchronization
Historical and active data are fully synchronized across expanded schema columns.
Guarantees zero data loss or data corruption when users switch to the Green version.
4
Shift Ingress Traffic to Green
GKE Gateway API HTTPRoute directs 100% of user traffic to Green pods.
Executes the zero-downtime cutover to the new application revision.
5
Contract Phase & Legacy Cleanup
Deprecated database fields are dropped and legacy Blue GKE resources are terminated.
Frees cluster resources and finalizes the schema refactoring safely after stability verification.

Key Concept

Expand-Contract Database Migration with Blue-Green Traffic Shifting
Question 1032Question →

Match each Google Cloud data encryption and key management mechanism to its defining operational control and key lifecycle characteristic.

Click a left item, then click its matching right item

Items

Google-default Encryption
Customer-Managed Encryption Keys (CMEK)
Customer-Supplied Encryption Keys (CSEK)
Cloud External Key Manager (Cloud EKM)

Matches

Show answer & explanation

Answer

Google-default Encryption maps to automatic key lifecycle management by Google. Customer-Managed Encryption Keys (CMEK) maps to key control in Cloud KMS/HSM with automated rotation and IAM access configuration. Customer-Supplied Encryption Keys (CSEK) maps to supplying raw AES-256 keys in API calls held only in memory. Cloud External Key Manager (Cloud EKM) maps to holding keys in an external third-party HSM outside of Google Cloud.
Each encryption mechanism corresponds to a distinct tier of key custody: Google-default handles all keys automatically; CMEK grants customers control of keys stored within Cloud KMS/HSM; CSEK requires callers to supply raw keys in each API call; and Cloud EKM anchors key protection to an external HSM residing outside Google Cloud.

Step-by-Step Solution

1
Analyze key ownership and control requirements for each GCP encryption tier.
Differentiate between fully managed (Google-default), cloud-hosted customer control (CMEK/Cloud KMS), ephemeral client-provided keys (CSEK), and off-cloud external keys (Cloud EKM).
Understanding key placement and request mechanisms determines regulatory compliance and operational responsibility.
2
Pair client API header requirements with Customer-Supplied Encryption Keys (CSEK).
Confirm that CSEK requires transmitting raw AES-256 keys per API request without Google storing the key to disk.
CSEK is unique in requiring per-request key transmission without persisting the key within any Google service.
3
Pair third-party external HSM requirements with Cloud EKM.
Confirm that Cloud EKM routes key operation requests outside GCP to external key managers.
Cloud EKM ensures data keys never leave the external HSM boundary while integrating with GCP services.

Key Concept

Selecting data encryption key modes across Google-default, CMEK, CSEK, and EKM based on regulatory governance and operational requirements.
Estimated Time:1m 30s
Question 1033Question →

An enterprise organization is deploying application workloads on Compute Engine virtual machines in Google Cloud. The operations team needs to collect basic system metrics, custom application telemetry, and ensure high-priority error log entries are retained while managing overall logging ingestion volume. Which TWO implementation steps should the Cloud Architect recommend? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Install and configure the Google Cloud Ops Agent on the Compute Engine virtual machines to gather metrics and application logs.; Configure Cloud Logging exclusion filters with specific sample rates while explicitly allowing log entries with a severity level of ERROR or higher.

Answer

The correct recommendations are to deploy the Google Cloud Ops Agent on Compute Engine virtual machines for telemetry collection, and to configure Cloud Logging exclusion filters that preserve log entries with a severity of ERROR or higher.
Deploying the Google Cloud Ops Agent ensures comprehensive metric and log collection from VM instances. Additionally, using Cloud Logging exclusion filters while safeguarding error-level logs allows cost management without losing essential diagnostic data during operational incidents.

Step-by-Step Solution

1
Identify the primary mechanism for collecting logs and metrics on Compute Engine instances.
The Google Cloud Ops Agent is selected as the standard unified agent for telemetry.
The Ops Agent is designed specifically for Compute Engine to collect system metrics, custom metrics, and application logs.
2
Design log ingestion control mechanisms to optimize cost without impacting reliability monitoring.
Exclusion filters with severity thresholds are established in Cloud Logging Log Router.
Filtering out low-priority telemetry while explicitly preserving high-severity error logs protects the error budget and supports rapid incident response.

Key Concept

Monitoring and Logging Integration for Compute Workloads
Question 1034Question →

A digital agriculture enterprise operates a Google Cloud environment to ingest daily IoT sensor data and run seasonal machine learning (ML) crop yield models. The environment features a predictable, 24/7 baseline web and API service alongside bursty, highly variable ML batch processing workloads. Currently, all resources are billed at standard on-demand rates, resulting in high monthly spend. The executive team has mandated a FinOps governance strategy to optimize costs without risking budget lock-in for unpredictable workloads. Which architecture and purchasing strategy should the Cloud Architect recommend?

Show answer & explanation

Answer: Acquire spend-based Flexible Committed Use Discounts (CUDs) to cover the steady-state baseline compute usage, leverage Spot VMs for the transient ML batch workloads, and implement mandatory resource labeling tied to BigQuery Cloud Billing exports for granular cost allocation.

Answer

Acquire spend-based Flexible Committed Use Discounts (CUDs) to cover the steady-state baseline compute usage, leverage Spot VMs for the transient ML batch workloads, and implement mandatory resource labeling tied to BigQuery Cloud Billing exports for granular cost allocation.
Combining Flexible Committed Use Discounts for predictable baseline services with Spot VMs for stateless batch ML jobs provides maximum financial savings while retaining architectural agility. Linking mandatory labels to BigQuery billing exports forms the foundation of cloud financial accountability (FinOps).

Step-by-Step Solution

1
Analyze workload profile and separate baseline capacity from dynamic peak usage.
Identified steady-state 24/7 web/API services and fault-tolerant, highly variable seasonal ML batch processing.
Different workload patterns require distinct cost optimization mechanisms to maximize savings without over-committing.
2
Select appropriate commitment models and compute purchasing tiers.
Applied Flexible CUDs to baseline services for predictable discount coverage across regions/families, and assigned Spot VMs to ML batch processing.
Flexible CUDs secure baseline savings while Spot VMs dramatically lower cost for stateless, fault-tolerant batch workloads.
3
Establish FinOps accountability and governance mechanisms.
Enforced resource labels and enabled detailed billing exports to BigQuery.
Labeling and automated export analytics enable unit-economics tracking and showback/chargeback governance across teams.

Key Concept

FinOps Cloud Cost Optimization and Governance
Question 1035Question →

A logistics company is establishing deployment standards for a new application team that will manage automated GCP infrastructure releases using Cloud Build pipelines. During initial testing, the team encountered failure errors due to insufficient regional VM quotas when deploying large Compute Engine instance groups, and they are unsure of the minimal IAM permissions needed for the build pipeline service account to attach runtime identities to created resources. As a Cloud Architect advising this team, which TWO recommendations should you offer to satisfy operational reliability and least privilege principles?

Select all that apply

Show answer & explanation

Answer: Submit regional Compute Engine quota increase requests in advance of launching large-scale automated deployments.; Grant the deployment service account the Service Account User role (roles/iam.serviceAccountUser) on specific runtime service accounts.

Answer

The Cloud Architect should advise submitting regional quota increase requests proactively prior to large automated deployments and assigning the Service Account User role (roles/iam.serviceAccountUser) on specific service accounts to adhere to least privilege.
To maintain high operational availability and security rigor, development and operations teams should proactively request regional quota adjustments prior to large automated rollouts and restrict CI/CD identities to the Service Account User role rather than full administrative or primitive roles.

Step-by-Step Solution

1
Evaluate deployment scaling and quota requirements.
Identified that GCP quotas are hard regional limits that do not expand dynamically during provisioning runs.
Requesting quota increases prior to deployment prevents pipeline execution failures caused by QuotaExceeded errors.
2
Analyze identity permission requirements for attaching service accounts to compute resources.
Determined that attaching an existing service account to a compute instance requires identity delegation, not full IAM service account administration.
Granting roles/iam.serviceAccountUser fulfills the operational requirement while strictly adhering to the principle of least privilege.

Key Concept

Advising deployment teams on proactive GCP quota management and least-privilege IAM configuration for automation pipelines.
Question 1036Question →

An organization is migrating a legacy monolithic web application to Google Cloud. To manage technical debt effectively without delaying the initial cloud adoption schedule, the enterprise wants to reduce operational overhead for database maintenance while avoiding unnecessary application rewrites during the first phase. Which TWO cloud migration strategies should the team adopt? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Rehost the application virtual machines directly onto Compute Engine using Migrate for Compute Engine to minimize initial migration risk and application code changes.; Replatform the self-hosted single-region relational database to Cloud SQL to reduce operational maintenance debt without modifying the database schema.

Answer

The team should rehost the application virtual machines directly to Compute Engine to minimize initial migration risk, and replatform the self-hosted relational database to managed Cloud SQL to reduce operational maintenance debt.
The combination of rehosting virtual machines to Compute Engine and replatforming relational databases to Cloud SQL strikes an optimal balance between fast migration execution and reducing operational legacy debt. Rehosting minimizes application code changes, while Cloud SQL offloads database backups, patching, and administration to Google Cloud.

Step-by-Step Solution

1
Analyze the migration constraints and technical debt goals.
Identified the need to avoid application rewrites initially while reducing operational database overhead.
Choosing appropriate migration patterns (rehost vs. replatform vs. refactor) directly impacts migration timelines and technical debt management.
2
Evaluate application compute migration options.
Rehosting virtual machines on Compute Engine allows fast lift-and-shift without refactoring code.
Rehosting legacy VMs minimizes upfront risk and avoids introducing complex microservices refactoring during early phases.
3
Evaluate database migration options.
Replatforming to managed Cloud SQL eliminates operational management debt without requiring global multi-region database rewrites.
Cloud SQL provides managed relational features for single-region workloads without the architectural changes required by Cloud Spanner.

Key Concept

Managing Technical Debt with Pragmatic Cloud Migration Strategies (Rehost and Replatform)
Question 1037Question →

An enterprise organization is restructuring its Google Cloud resource hierarchy to support autonomous engineering teams across multiple regional projects. The Cloud Architecture team needs to implement centralized cost tracking and prevent service disruptions caused by regional Compute Engine quota limits. Which TWO solutions should the Cloud Architect implement to satisfy these administrative and governance requirements? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Configure Cloud Billing export to BigQuery at the Billing Account level to track departmental spend, and set up Cloud Monitoring metrics alerts on quota usage to proactively request limit increases.; Grant the Quota Administrator role (roles/servicemanagement.quotaAdmin) on project folders to delegated team administrators rather than primitive IAM roles.

Answer

The architect should configure Cloud Billing export to BigQuery alongside Cloud Monitoring quota alerts, and grant fine-grained predefined roles such as Quota Administrator to project leads.
Centralizing billing data via BigQuery exports enables comprehensive cost reporting across resource hierarchies. Setting up Cloud Monitoring alerts on quota allocation usage ensures teams are notified before hitting limits, while assigning fine-grained roles like Quota Administrator maintains least privilege governance.

Step-by-Step Solution

1
Establish centralized visibility over infrastructure spend across the entire hierarchy
Configure detailed Cloud Billing data export to BigQuery at the Billing Account level.
Exporting billing data to BigQuery provides scalable SQL querying and visualization across all child folders and projects.
2
Implement proactive quota tracking and governance controls
Configure alerts in Cloud Monitoring for quota consumption percentages and delegate quota management using the Quota Administrator predefined role.
Monitoring metrics trigger alerts before quota limits are reached, allowing Quota Administrators to request quota adjustments prior to deployment.

Key Concept

Proactive Quota Alerting, Resource Hierarchy IAM Governance, and Centralized Cloud Billing Export
Question 1038Question →

Your organization is implementing an automated canary release strategy using Google Cloud Deploy and GKE Gateway API for a mission-critical transaction microservice connected to a Cloud SQL relational database. The deployment pipeline must shift traffic incrementally from the active revision to the canary revision while continuously evaluating Cloud Monitoring metrics against a target Service Level Indicator (SLI). The upcoming software release includes a relational database schema update that adds a mandatory field required by the new software version. Which release management approach ensures continuous service availability and automated rollback capabilities during this rollout?

Show answer & explanation

Answer: Implement a multi-phase database migration strategy with backward-compatible schema changes applied prior to triggering the canary rollout, while using Cloud Deploy with Cloud Monitoring verification metrics for automated traffic rollback.

Answer

Implement a multi-phase database migration strategy with backward-compatible schema changes applied prior to triggering the canary rollout, while using Cloud Deploy with Cloud Monitoring verification metrics for automated traffic rollback.
In progressive delivery strategies like canary deployments, both the active release and the canary revision must coexist and process transactions simultaneously. Applying backward-compatible schema changes (such as expanding schema with optional/default columns) prior to shifting traffic guarantees database compatibility across both application revisions. Integrating Cloud Deploy with Cloud Monitoring automated rollback criteria satisfies the requirements for zero downtime and metric-driven automated recovery.

Step-by-Step Solution

1
Analyze concurrent version requirements during progressive traffic shifting.
Identified that during a canary release, both the existing application revision and the new canary application revision serve user traffic simultaneously against the shared Cloud SQL database.
Any breaking schema change applied while old application code is active will corrupt data or cause SQL runtime failures for active users.
2
Formulate a phased schema migration approach.
Apply additive, backward-compatible schema modifications (e.g., adding nullable columns or default values) before launching the application deployment pipeline.
Ensures that older application versions ignore the new database columns while newer versions can write to them.
3
Configure progressive delivery automation with safety gates.
Utilize Cloud Deploy integrated with Cloud Monitoring metrics to automatically roll back traffic if the canary revision breaches defined SLI thresholds.
Provides automated failure detection and zero-downtime rollback capabilities without manual operator intervention.

Key Concept

Backward-Compatible Database Migrations in Canary Deployments
Question 1039Question →

A global EdTech enterprise operates a digital learning platform on Google Cloud across multiple projects under a single organization. Their environment experiences predictable baseline compute usage alongside sharp, seasonal traffic spikes during worldwide examination periods. The analytics pipeline processes multi-terabyte analytical queries in BigQuery with fluctuating on-demand query costs. Additionally, petabytes of historical student assignment media remain stored in Cloud Storage Standard storage classes long after courses complete. The executive team has mandated a comprehensive FinOps initiative to reduce cloud spending and improve cost predictability without impacting platform performance or increasing operational overhead. Which THREE cost-optimization and governance strategies should the Cloud Architect recommend?

Select all that apply

Show answer & explanation

Answer: Purchase Flexible Committed Use Discounts (Flexible CUDs) for Compute Engine to cover baseline spend across regions and machine families while accommodating seasonal workload fluctuations.; Implement Cloud Storage Object Lifecycle Management rules to automatically transition historical media objects from Standard to Coldline or Archive storage after 30 days of inactivity.; Configure BigQuery slot reservations and capacity commitments to transition high-volume analytics from on-demand pricing to predictable flat-rate query execution.

Answer

The Cloud Architect should implement Flexible Committed Use Discounts for Compute Engine baseline spend, Cloud Storage Object Lifecycle Management for archival media, and BigQuery slot reservations for query cost control.
A comprehensive FinOps strategy balances flexibility, storage lifecycle efficiency, and data warehouse cost caps. Flexible CUDs provide spend-based discounts that automatically apply across compute families and regions for baseline workloads. Cloud Storage Object Lifecycle Management automatically shifts cold data to cheaper storage classes (Coldline/Archive), drastically lowering storage unit costs. BigQuery slot reservations replace variable per-TB on-demand pricing with deterministic compute commitments for predictable financial governance.

Step-by-Step Solution

1
Analyze compute spending patterns and commit strategy
Identified that baseline usage should be covered by Flexible CUDs to gain dollar-per-hour spend flexibility across regions while avoiding over-commitment on peak autoscaling capacity.
Resource-based standard CUDs locked to specific zones/machine types create financial waste when workloads auto-scale down during non-exam periods.
2
Evaluate object storage cost reduction mechanisms
Configured Object Lifecycle Management policies to transition unaccessed media objects from Standard to Coldline/Archive after 30 days.
Automating storage lifecycle management aligns storage costs with data access frequency without manual intervention.
3
Establish query cost predictability in BigQuery
Switched high-volume analytics workloads from on-demand billing to slot reservations using BigQuery editions.
Slot reservations prevent unexpected billing spikes caused by unthrottled on-demand queries on large datasets.

Key Concept

Enterprise FinOps Optimization and Cost Governance
Question 1040Question →

A smart grid energy utility completed a rapid migration of its customer metering infrastructure to Google Cloud. A post-migration technical debt assessment identified two key architecture issues: simple stateless HTTP ingestion microservices are currently running on self-managed Compute Engine virtual machines requiring manual OS patching and fixed compute costs, and sensitive meter telemetry stored in Cloud Storage buckets remains vulnerable to data exfiltration by authorized identity credentials operating outside the enterprise network perimeter. Which TWO architectural mitigations should the Cloud Architect recommend to resolve this technical debt?

Select all that apply

Show answer & explanation

Answer: Refactor the stateless HTTP ingestion microservices to deploy on Cloud Run to eliminate server maintenance and enable automatic scaling to zero.; Configure VPC Service Controls around the Cloud Storage resources storing telemetry data to establish a secure perimeter against exfiltration.

Answer

The optimal mitigations are refactoring the stateless HTTP microservices to Cloud Run and establishing a VPC Service Controls perimeter around Cloud Storage.
Migrating simple stateless HTTP ingestion microservices to Cloud Run eliminates server patching and reduces baseline costs by scaling to zero when idle. Establishing VPC Service Controls creates a security perimeter around Cloud Storage to prevent data exfiltration, even if authorized IAM credentials are used outside the perimeter.

Step-by-Step Solution

1
Analyze the operational compute overhead of the ingestion services.
Simple stateless HTTP services hosted on Compute Engine introduce unnecessary operational debt such as OS maintenance, patching, and non-zero baseline compute expenses.
Cloud Run natively handles containerized stateless HTTP microservices with zero cluster management and automatic scaling to zero.
2
Analyze the security boundary for data exfiltration protection.
Cloud IAM authenticates and authorizes identities but does not restrict egress destination networks or prevent copy operations by compromised authorized credentials.
VPC Service Controls form a network perimeter around Google Cloud services like Cloud Storage to block unauthorized data movements outside designated perimeters.

Key Concept

Mitigating operational and security technical debt using Cloud Run and VPC Service Controls
PreviousPage 52 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin