Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 1081Question →

A global multiplayer game studio runs its backend infrastructure on Google Cloud across multiple projects bound to a central Cloud Billing account. The infrastructure features two main workloads: a stateless, containerized matchmaking service that experiences unpredictable traffic bursts during special in-game events, and a centralized BigQuery telemetry warehouse used for real-time player analytics. The studio wants to establish FinOps governance and cost optimization without compromising service performance or increasing management overhead. Which TWO recommendations should the lead Cloud Architect make?

Select all that apply

Show answer & explanation

Answer: Run the stateless matchmaking service on Cloud Run and leverage Flexible Committed Use Discounts (CUDs) at the billing account level to cover baseline compute spending across projects.; Configure BigQuery edition reservations with baseline slot capacity for predictable analytics and enable slot autoscaling to handle intermittent query spikes.

Answer

The studio should deploy the stateless matchmaking service on Cloud Run using Flexible Committed Use Discounts for baseline spending, and implement BigQuery edition reservations with autoscaling slots for telemetry analytics.
Combining serverless execution via Cloud Run with Flexible Committed Use Discounts guarantees that baseline spend is discounted while burst traffic scales dynamically without idle cluster costs. Meanwhile, BigQuery edition reservations paired with autoscaling slots optimize analytics expenses by providing dedicated slots for base queries and dynamic capacity for peak analysis.

Step-by-Step Solution

1
Analyze compute workload requirements and select an optimal cost-effective platform.
Cloud Run efficiently handles containerized stateless workloads with zero-to-N autoscaling, avoiding baseline cluster maintenance costs.
Serverless container execution fits unpredictable traffic spikes while eliminating idle compute infrastructure overhead.
2
Apply appropriate FinOps commitment models for compute expenditure.
Flexible CUDs apply hourly spend commitments across Cloud Run and Compute Engine across all projects, offering flexibility without locking into specific machine types.
Bursty workloads require spending-based flexibility rather than rigid 3-year static node reservations scaled for peak usage.
3
Optimize analytical database queries and slot capacity governance.
Combining BigQuery edition reservations for predictable queries with slot autoscaling handles peak analytics demands cost-efficiently.
Autoscaling slots ensure performance during heavy analytical bursts without paying for idle capacity continuously.

Key Concept

FinOps Cost Optimization and Compute Governance
Question 1082Question →

An enterprise organization operates a multi-project Google Cloud environment hosting business-critical microservices. The central operations team needs to aggregate high-severity application logs and system audit logs across all projects into a centralized observability project for analysis and compliance. Concurrently, the team must optimize Cloud Logging ingestion costs by suppressing high-volume, routine container runtime logs without risking the loss of critical failure events or audit records. Which TWO actions should the Cloud Architect recommend to satisfy these observability and cost optimization requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Configure an aggregated log sink at the GCP Organization level with an inclusion filter targeting log severity WARNING and above, routing the log entries to a designated Log Bucket or BigQuery dataset in the central observability project.; Configure log exclusion filters on workload projects specifically targeting low-severity INFO and DEBUG messages, while explicitly preserving ERROR, CRITICAL, and audit log entries.

Answer

The correct recommendations are to configure an aggregated log sink at the GCP Organization level targeting severity WARNING and above to route logs centrally, and to apply fine-grained exclusion filters targeting routine low-severity logs (INFO/DEBUG) while preserving critical error and audit logs.
The correct strategy combines organization-level aggregated sinks with targeted log exclusions. Organization-level aggregated sinks allow automatic aggregation of matching telemetry across all current and future projects into a centralized observability project. Paired with precise log exclusion filters that drop only high-volume, low-severity streams (like INFO and DEBUG), the architecture optimizes Cloud Logging ingestion costs while maintaining full visibility into system errors, warnings, and security audit trails.

Step-by-Step Solution

1
Evaluate central log collection across multiple GCP projects.
Identify that an Organization-level aggregated log sink is the GCP recommended pattern for centralized ingestion.
Creating log sinks at the Organization root avoids fragmented per-project configuration and ensures uniform audit/log capture.
2
Evaluate log cost optimization strategies without dropping operational signals.
Identify that log exclusion filters must target high-volume, low-severity log levels (such as INFO and DEBUG).
Excluding routine informational logs reduces ingestion volume while ensuring error and critical severity logs pass through to monitoring and alerting pipelines.
3
Analyze security and compliance requirements for the log sink service account.
Reject primitive IAM role assignments in favor of granular writer roles, and ensure perimeter security controls protect log destinations.
Following security best practices prevents over-privileged service accounts and guards against data exfiltration.

Key Concept

Centralized Log Aggregation and Log Exclusion Filters
Question 1083Question →

An online automotive auction enterprise operates a transaction backend on Google Cloud with a steady baseline compute footprint running 24/7 on Compute Engine instances, alongside highly variable, fault-tolerant batch workloads for image rendering and valuation reports. The cloud architecture team needs to implement a FinOps strategy to maximize cost optimization without compromising workload performance or flexibility. Which approach should the Cloud Architect recommend?

Show answer & explanation

Answer: Purchase Flexible Committed Use Discounts (CUDs) to cover the predictable baseline compute footprint, and leverage Spot VMs for the fault-tolerant batch processing workloads.

Answer

Combining Flexible Committed Use Discounts (CUDs) for baseline compute capacity with Spot VMs for fault-tolerant, variable batch workloads optimizes cost while maintaining operational flexibility.
The correct strategy combines Flexible Committed Use Discounts (CUDs) for predictable 24/7 baseline compute needs with Spot VMs for stateless, fault-tolerant batch processing. This minimizes spending on steady infrastructure while capitalizing on deep discounts for interruptible workloads without incurring financial waste from over-committing.

Step-by-Step Solution

1
Analyze workload characteristics
Identified two distinct operational patterns: a 24/7 steady baseline footprint and variable, fault-tolerant batch processing jobs.
Cost optimization strategies must align discount mechanisms with workload variability and fault tolerance.
2
Evaluate discount commitments for baseline capacity
Selected Flexible CUDs to cover steady-state compute usage.
Flexible CUDs guarantee hourly spending discounts while allowing flexibility across instance families, regions, and projects.
3
Select execution model for variable batch jobs
Selected Spot VMs for batch rendering and valuation tasks.
Spot VMs provide up to 90% discount for stateless, fault-tolerant workloads that can withstand potential preemption.

Key Concept

Optimizing Business Processes through FinOps and Cloud Cost Management
Estimated Time:1m 30s
Question 1084Question →

A global biomedical research institution is migrating its legacy genomic analysis platform to Google Cloud. The executive steering committee demands minimal disruption to ongoing clinical trials, while the principal researchers express strong resistance to adopting new cloud tools due to a lack of Google Cloud expertise. Additionally, the proposed architecture requires substantial compute resource quotas in the target region. As a Cloud Architect, which strategy best aligns business stakeholder goals, technical requirements, and organizational change management principles?

Show answer & explanation

Answer: Establish a structured enablement plan with hands-on sandbox environments for researchers, while submitting regional quota increase requests well in advance of the migration.

Answer

Establish a structured enablement plan with hands-on sandbox environments for researchers, while submitting regional quota increase requests well in advance of the migration.
Combining proactive skill enablement through isolated sandbox environments with early quota increase requests satisfies both the organizational change requirements (up-skilling resistant stakeholders safely) and technical prerequisites (ensuring adequate resource capacity on Google Cloud).

Step-by-Step Solution

1
Analyze stakeholder requirements and change management risks.
Identified team skill gaps and potential resistance to cloud adoption among principal researchers.
Successful cloud adoption requires proactive skill enablement and risk reduction for users.
2
Evaluate operational and infrastructure lead times.
Identified the need to request compute quota increases before initiating migration deployments.
Quota approvals take time and unrequested quota limits block resource provisioning.
3
Synthesize a comprehensive architectural and change strategy.
Combine structured enablement (sandboxes) with proactive quota planning.
Aligns both organizational readiness and technical execution requirements.

Key Concept

Organizational Change Management and Proactive Infrastructure Capacity Planning
Question 1085Question →

An aerospace software engineering enterprise is establishing a multi-layered defense architecture on Google Cloud for its flight simulation microservices. The lead cloud security architect must assign dedicated GCP security products to specific vulnerability management, deploy-time governance, and threat detection requirements. Match each Google Cloud security product to its primary security capability within the application lifecycle.

Click a left item, then click its matching right item

Items

Binary Authorization
Container Analysis
Container Threat Detection
Event Threat Detection

Matches

Show answer & explanation

Answer

Binary Authorization matches with deploy-time signature enforcement; Container Analysis matches with Artifact Registry image vulnerability scanning; Container Threat Detection matches with real-time container runtime memory and kernel syscall monitoring; Event Threat Detection matches with log stream analysis for organization-level threat detection.
Each GCP security service provides a distinct layer of security across the container lifecycle: Container Analysis handles image vulnerability scanning during storage, Binary Authorization enforces cryptographically signed deployment policies, Container Threat Detection monitors runtime kernel and memory behavior on GKE nodes, and Event Threat Detection scans organization audit log streams for cloud-wide threat activity.

Step-by-Step Solution

1
Identify deploy-time prevention controls.
Binary Authorization enforces cryptographic attestations before pod creation in GKE.
Prevents untrusted or unvetted images from entering the production runtime environment.
2
Identify build and storage vulnerability management controls.
Container Analysis continuously scans Artifact Registry repositories for OS and package CVEs.
Provides automated vulnerability visibility prior to container deployment.
3
Identify workload runtime node-level threat detection mechanisms.
Container Threat Detection analyzes hypervisor and kernel memory inside GKE nodes.
Detects active runtime compromises such as execution of unauthorized binaries or reverse shells.
4
Identify log-based cloud management threat monitoring controls.
Event Threat Detection processes Cloud Logging audit streams.
Detects broader account compromises, suspicious identity usage, and data exfiltration patterns.

Key Concept

Defense-in-depth container security and threat detection integration in Google Cloud Platform.
Estimated Time:2m 0s
Question 1086Question →

An operations team is establishing a baseline observability architecture for a hybrid application running on Compute Engine instances and on-premises servers. The team must collect system metrics and log data, centralize observability in Google Cloud, and optimize storage costs by preventing low-severity debug logs from being ingested into log buckets, while maintaining strict access controls. Which TWO actions should the team take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Install and configure the Google Cloud Ops Agent on Compute Engine instances to collect system metrics and application logs.; Configure a Cloud Logging Log Router exclusion filter to prevent log entries with severity levels below INFO (such as DEBUG) from being ingested into log buckets.

Answer

The correct actions are installing the Google Cloud Ops Agent on Compute Engine instances and configuring a Cloud Logging Log Router exclusion filter for severity levels below INFO.
Installing the Google Cloud Ops Agent provides comprehensive metric and log telemetry collection for VM instances. Setting up a Log Router exclusion filter for log severities below INFO prevents excessive storage consumption by filtering out verbose debug messages before ingestion.

Step-by-Step Solution

1
Identify the recommended telemetry collection agent for Compute Engine workloads.
The Google Cloud Ops Agent provides unified logging and telemetry metric collection.
Installing the Ops Agent satisfies the requirement to collect system and application metrics and logs in Google Cloud.
2
Determine the log cost optimization mechanism within Cloud Logging.
Log Router exclusion filters drop specified logs prior to bucket ingestion.
Excluding DEBUG log entries reduces overall storage ingestion costs without discarding operational or warning logs.

Key Concept

Monitoring, Logging, and Observability Integration
Question 1087Question →

A global logistics company manages dozens of Google Cloud projects across multiple departments within a single organization hierarchy. The security team must enforce mandatory baseline ingress firewall rules—such as blocking port 22 from the public internet—across all current and future projects. The design must prevent project-level administrators from overriding or deleting these baseline security rules, while still allowing central security administrators to delegate fine-grained access control using granular service tags. Which network security architecture should the cloud architect recommend to meet these requirements?

Show answer & explanation

Answer: Implement Hierarchical Firewall Policies enforced at the organization or folder level, and utilize Secure Tags to target specific instance workloads.

Answer

Implement Hierarchical Firewall Policies enforced at the organization or folder level, and utilize Secure Tags to target specific instance workloads.
Hierarchical Firewall Policies enable organizational security teams to attach immutable firewall rules at the organization or folder node level. Because these rules are evaluated prior to any VPC-level rules, project administrators cannot override them. Integrating Secure Tags allows central teams to securely delegate tag management and apply rules dynamically to specific instance workloads.

Step-by-Step Solution

1
Analyze the core constraint
Organization-wide mandatory rules are required that cannot be overridden by project admins.
Standard VPC firewall rules are managed at the VPC level and can be altered by project-level network admins.
2
Evaluate GCP organizational security tools
Hierarchical firewall policies sit above VPC firewall rules in the resource hierarchy (Organization and Folder levels).
Rules defined in hierarchical policies are evaluated before local VPC firewall rules and cannot be bypassed by project owners.
3
Evaluate granular targeting capabilities
Secure Tags bound to organization resource hierarchies allow hierarchical policies to selectively apply to tagged virtual machines.
Secure Tags provide fine-grained control and RBAC-governed tag binding for hierarchical policy evaluation.

Key Concept

Hierarchical Firewall Policies and Secure Tags for organization-wide security governance
Question 1088Question →

A healthcare data platform processes streaming clinical records using Google Cloud Pub/Sub and a worker pool running on Compute Engine Managed Instance Groups (MIGs). During sudden peak emergency intake windows, message backlogs accumulate rapidly, yet worker instances fail to scale out in time to prevent processing delays. An operational audit identifies two core constraints: the MIG autoscaler is currently driven by average CPU utilization—which remains low while tasks wait in queue—and recent manual attempts to add capacity hit an error indicating that the region's vCPU quota limit of 500500 vCPUs was reached. Which combination of architectural actions should the Cloud Architect implement to optimize capacity planning and resolve the workload scaling bottlenecks?

Show answer & explanation

Answer: Submit a regional vCPU quota increase request in advance for the target region, and reconfigure the MIG autoscaling policy to scale dynamically based on a Cloud Monitoring metric tracking Pub/Sub unacknowledged message count per instance.

Answer

The Cloud Architect should submit a regional vCPU quota increase request in advance for the target region and reconfigure the MIG autoscaling policy to scale based on a Cloud Monitoring custom metric tracking Pub/Sub unacknowledged message count per instance.
The solution requires addressing both the quota bottleneck and the metric misalignment. Requesting a regional vCPU quota increase in advance ensures sufficient ceiling for Compute Engine instances. Reconfiguring the MIG autoscaler to use Pub/Sub unacknowledged message counts via Cloud Monitoring ensures that instance scaling responds directly to workload queue depth rather than lagging CPU indicators.

Step-by-Step Solution

1
Analyze the capacity ceiling constraint
Identified that scaling is blocked at 500500 vCPUs due to GCP regional quota enforcement.
Compute Engine resource allocation cannot exceed project quotas regardless of autoscaling configuration.
2
Address quota pre-provisioning requirements
Determined that a regional vCPU quota request must be submitted prior to anticipated peak demand.
Quota increases require evaluation and approval time from Google Cloud operations.
3
Analyze the scaling metric bottleneck
Recognized that CPU utilization is a lagging indicator for message-queue-driven workloads.
Tasks accumulate in Pub/Sub before worker instances experience high CPU utilization.
4
Configure queue-based autoscaling metric
Selected Cloud Monitoring metric measuring unacknowledged messages per worker instance for MIG autoscaling.
Custom queue metrics allow proactive horizontal scaling aligned directly with workload backlog growth.

Key Concept

Workload Scaling Optimization and Quota Management
Question 1089Question →

Your DevOps team is setting up automated incident management in Google Cloud Monitoring for a critical backend web service. You need to ensure that when an alert triggers due to high error rates, an incident notification is automatically dispatched to your team's third-party PagerDuty endpoint. Which Cloud Monitoring resource should you configure to define where the incident alerts are sent?

Show answer & explanation

Answer: A Notification Channel

Answer

Configure a Notification Channel in Cloud Monitoring.
In Google Cloud Monitoring, Notification Channels define the third-party integrations (such as PagerDuty, Slack, SMS, or webhooks) used to send alert notifications when an alerting policy triggers an incident.

Step-by-Step Solution

1
Identify the component responsible for routing and delivering alert notifications to external endpoints.
Recognize that Cloud Monitoring uses Notification Channels to dispatch alerts to third-party services such as PagerDuty, Slack, or Webhooks.
Alerting policy conditions decide when an incident opens, while Notification Channels specify where and how responders are notified.

Key Concept

Cloud Monitoring Notification Channels for Incident Management
Question 1090Question →

An enterprise web application running in primary region `us-central1` uses Cloud SQL for PostgreSQL with a cross-region read replica in `us-east4` for disaster recovery. Compute Engine Managed Instance Groups (MIGs) are deployed in both regions behind a Global External HTTP(S) Load Balancer with backends configured in both regions. Following a catastrophic, unexpected regional failure in `us-central1`, the architecture team must execute their disaster recovery runbook to restore complete write functionality and serve application traffic from `us-east4` with an Recovery Time Objective (RTO) of less than 15 minutes. Which TWO steps must the operations team perform as part of this regional disaster recovery failover process?

Select all that apply

Show answer & explanation

Answer: Promote the cross-region Cloud SQL read replica in `us-east4` to a standalone primary database instance and update the application configuration in `us-east4` to point to the promoted instance.; Verify that backend instances in `us-east4` pass HTTP load balancer health checks, allowing the Global External HTTP(S) Load Balancer to automatically redirect global client traffic away from the unresponsive `us-central1` backends.

Answer

The correct execution steps are promoting the cross-region read replica in the standby region to a standalone primary database instance, and allowing the Global External HTTP(S) Load Balancer to automatically reroute client traffic to healthy backends in the secondary region.
In a regional disaster recovery event involving a Warm Standby or Active-Passive pattern, promoting a Cloud SQL cross-region read replica enables write operations in the secondary region within minutes, satisfying stringent RTO constraints. Simultaneously, using a Global External HTTP(S) Load Balancer allows automatic routing of incoming web traffic to healthy Compute Engine backends in the secondary region as soon as health checks fail in the primary region.

Step-by-Step Solution

1
Assess the state of the primary database during a regional disaster in `us-central1`.
Confirm that `us-central1` is completely unavailable and promote the cross-region read replica in `us-east4` to a standalone read-write primary Cloud SQL instance.
Cloud SQL cross-region replicas continuously stream updates. Promoting the replica makes it a writable master without waiting for lengthy disk backups or new database instance provisioning, meeting the RTO requirement of under 15 minutes.
2
Ensure compute application traffic failover via the Global External HTTP(S) Load Balancer.
Confirm backend health check responses from the MIG in `us-east4` so the Global Load Balancer drains traffic from `us-central1` and sends it to `us-east4`.
Global External HTTP(S) Load Balancing provides built-in multi-region failover. When primary backends fail health probes, the load balancer dynamically routes traffic to healthy backends in secondary regions without manual DNS TTL propagation delays.

Key Concept

Disaster Recovery Execution and Multi-Region Failover Patterns in GCP
Estimated Time:3m 0s
Question 1091Question →

A Site Reliability Engineering (SRE) team manages an e-commerce inventory search API deployed on Cloud Run. The team has established a 30-day rolling Service Level Objective (SLO) of 99.9% availability. They want to receive actionable notifications when an outage threatens to consume their remaining error budget, while avoiding alert fatigue caused by brief, temporary error spikes. Which alerting approach should the team implement in Cloud Monitoring?

Show answer & explanation

Answer: Configure a multi-window burn-rate alert policy based on the rate of error budget consumption.

Answer

The team should configure a multi-window burn-rate alert policy based on the rate of error budget consumption.
Configuring multi-window burn-rate alerting ensures notifications fire based on the actual speed of error budget consumption. By evaluating both short (e.g., 1 hour) and long (e.g., 6 hours) windows, Cloud Monitoring alerts SREs when a true incident threatens the 30-day SLO budget while suppressing noise from temporary single-minute spikes.

Step-by-Step Solution

1
Identify the primary operational requirement.
The requirement is to alert on significant error budget consumption for a 99.9% availability SLO while preventing alert fatigue from brief transient spikes.
SRE best practices require aligning alerts directly with customer-impacting SLO breaches rather than raw infrastructure metrics.
2
Evaluate alert mechanism types in SRE practices.
Multi-window burn-rate alerting measures how rapidly the error budget is being spent relative to the SLO target across both short and long lookback windows.
This guarantees high precision (firing when an incident actually threatens the budget) and high recall (catching fast outages quickly).

Key Concept

Error Budget Burn-Rate Alerting
Estimated Time:45s
Question 1092Question →

A cloud architecture team at a healthcare informatics enterprise is transitioning manually provisioned Google Cloud VPC networks and subnetworks into an automated Infrastructure as Code (IaC) workflow managed by Terraform. The team must establish remote state management with state locking, avoid resource recreation, and ensure existing production workloads experience zero downtime during the adoption process. What is the correct sequence of steps to safely import these unmanaged GCP infrastructure resources into Terraform state and align the HCL configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with establishing the Cloud Storage backend configuration and versioning, followed by running terraform init to initialize backend locks. Next, empty or skeleton resource blocks must be declared in HCL so that terraform import commands can bind GCP resource URIs to state addresses. Finally, running terraform plan and adjusting HCL attributes until zero differences remain ensures complete state and code parity without service disruption.
The sequence correctly follows Google Cloud and Terraform best practices for brownfield adoption: 1) Backend setup (GCS bucket + code block), 2) Workspace initialization (terraform init), 3) HCL block declaration, 4) Resource state import (terraform import), and 5) Plan validation and attribute alignment (terraform plan).

Step-by-Step Solution

1
Configure the GCS remote backend bucket with versioning and add the backend "gcs" block to HCL.
Defines the centralized remote state target and locking storage.
Remote state infrastructure must exist prior to initializing Terraform.
2
Run terraform init.
Connects the local workspace to the GCS backend and downloads provider plugins.
State locking and remote storage initialization must precede state modification commands.
3
Declare empty HCL resource blocks (e.g., google_compute_network and google_compute_subnetwork).
Establishes addressable targets within the Terraform configuration.
Terraform import requires an addressable HCL resource block target to bind imported attributes.
4
Execute terraform import commands targeting specific GCP resource URIs.
Populates the GCS remote state file with actual GCP resource attributes.
Brings unmanaged live infrastructure into Terraform state without making runtime changes.
5
Run terraform plan and refine HCL parameters until output indicates 'No changes'.
Achieves complete parity between local code, remote state, and live GCP resources.
Prevents terraform apply from inadvertently modifying or destroying production resources.

Key Concept

Brownfield Infrastructure Import and IaC State Alignment
Question 1093Question →

A mission-critical payment gateway hosted on Google Kubernetes Engine (GKE) processes 20,000,00020,000,000 valid HTTP requests over a rolling 30-day measurement window. The Site Reliability Engineering (SRE) team defines an Availability Service Level Objective (SLO) of 99.9%99.9\%, measured as the ratio of successful (non-HTTP 5xx) requests to total valid requests. During a bad canary release, the service logged 12,00012,000 HTTP 500 responses before being rolled back. No other failure events occurred during the 30-day window. What percentage of the total 30-day error budget remains after this incident?

Show answer & explanation

Answer: 40

Answer

The remaining error budget is 40.0%.
The total error budget for a 30-day period with 20,000,00020,000,000 requests at a 99.9%99.9\% SLO target is 20,000,000×0.001=20,00020,000,000 \times 0.001 = 20,000 allowable failed requests. The incident consumed 12,00012,000 requests (60%60\% of the budget). Therefore, 20,000−12,000=8,00020,000 - 12,000 = 8,000 allowed failed requests remain, which represents (8,000/20,000)×100=40.0%(8,000 / 20,000) \times 100 = 40.0\% of the original error budget.

Step-by-Step Solution

1
Calculate the total allowable error budget (in number of failed requests) from the SLO target.
Total Error Budget = 20,000,000×(1−0.999)=20,00020,000,000 \times (1 - 0.999) = 20,000 requests.
An Availability SLO of 99.9%99.9\% allows an error rate of 0.1%0.1\% (0.0010.001) across all incoming valid requests.
2
Subtract the consumed bad requests from the total allowable error budget.
Remaining Error Budget (in requests) = 20,000−12,000=8,00020,000 - 12,000 = 8,000 requests.
The canary incident consumed 12,00012,000 failed requests out of the 20,00020,000 total allowed budget.
3
Calculate the percentage of the error budget remaining relative to the original error budget.
Remaining Percentage = (8,000/20,000)×100=40.0%(8,000 / 20,000) \times 100 = 40.0\%.
Error budget remaining is expressed as a fraction of the total allowable error budget, not the total request volume.

Key Concept

Error Budget Calculation based on Request-Based SLIs and SLO targets
Question 1094Question →

A healthcare analytics platform organizes its workload projects under a dedicated `Clinical-Analytics` folder within the Google Cloud resource hierarchy. The security team needs to grant a centralized monitoring team read-only access to inspect Cloud Logging logs for all current and future projects within this folder. The solution must strictly adhere to the principle of least privilege without exposing underlying dataset contents in Cloud Storage or BigQuery. Which IAM configuration strategy should the architect recommend to meet these requirements with minimal administrative overhead?

Show answer & explanation

Answer: Grant the predefined `roles/logging.viewer` role to the monitoring team's Google Group at the `Clinical-Analytics` folder level.

Answer

Granting the predefined `roles/logging.viewer` role to the monitoring team's Google Group at the `Clinical-Analytics` folder level fulfills the requirement using least privilege and resource hierarchy inheritance.
Granting the predefined `roles/logging.viewer` role at the folder level leverages Google Cloud resource hierarchy inheritance. All child projects under the `Clinical-Analytics` folder automatically inherit this access without granting read access to underlying storage buckets or database tables.

Step-by-Step Solution

1
Identify the specific permission requirement.
The team requires read-only access strictly to Cloud Logging logs across all projects under a folder.
Least privilege mandates choosing a fine-grained predefined role like `roles/logging.viewer` over broad primitive roles.
2
Determine the optimal resource hierarchy scope.
Binding the role at the parent `Clinical-Analytics` folder level.
Permissions bound at a folder level inherit down to all existing and future child projects, eliminating manual project-by-project maintenance.

Key Concept

GCP IAM Resource Hierarchy Inheritance and Predefined Roles
Question 1095Question →

A security engineer at a financial technology company performed emergency out-of-band updates to a Cloud Storage bucket retention policy and Cloud KMS encryption settings using the Google Cloud Console to mitigate an active security alert. The infrastructure was originally provisioned and managed via Terraform within a Cloud Build CI/CD pipeline. During the next scheduled deployment pipeline run, `terraform plan` detects configuration drift and proposes modifying the bucket settings back to their previous state, which would violate current security compliance requirements. The team needs to align the Terraform code and state with the live GCP infrastructure without causing service disruption or deleting existing data. Which approach should the cloud architecture team follow to resolve this drift safely?

Show answer & explanation

Answer: Update the local Terraform configuration files to match the emergency manual changes made in the Cloud Console, execute `terraform plan` to confirm zero changes will be made, and commit the updated code to version control.

Answer

The team should update the Terraform HCL codebase to reflect the manual emergency modifications, run a plan to verify no infrastructure changes are detected, and commit the updated configuration to source control.
When emergency or out-of-band modifications must be preserved permanently for security compliance, the correct standard operational procedure in Infrastructure as Code is to update the Terraform configuration files to match the live state. Running a subsequent plan confirms zero proposed changes, after which committing the code restores git as the single source of truth.

Step-by-Step Solution

1
Inspect the live infrastructure parameters created during the emergency response using gcloud or GCP Console.
Identified exact configuration attributes applied out-of-band to Cloud Storage retention policies and Cloud KMS keys.
Accurate details are necessary to update the declarative IaC definitions precisely.
2
Modify the Terraform resource definitions in the version-controlled repository to match the updated live settings.
Terraform configuration files match real-world cloud resource states.
Bringing code into alignment with live state is the standard declarative reconciliation method for intentional drift.
3
Run `terraform plan` in the CI/CD pipeline.
Terraform outputs 'No changes. Your infrastructure matches the configuration.'
Verifies that state, code, and actual infrastructure are fully synchronized without triggering resource destruction or modification.

Key Concept

Remediating Intentional Infrastructure Drift in Terraform
Question 1096Question →

An enterprise gaming company hosts its multiplayer matchmaking service on Google Cloud Run. The engineering team is executing a canary deployment strategy using Cloud Deploy to roll out a major version update with revision-based traffic splitting. Shortly after directing 10% of production traffic to the new revision, users assigned to the existing revision begin encountering severe database query failures because the release pipeline applied a breaking schema migration to Cloud SQL prior to traffic shifting. Which architectural modification should the cloud architect implement to enable zero-downtime releases during database schema updates?

Show answer & explanation

Answer: Implement an expand-contract (additive) schema migration strategy that retains existing database fields until all old application revisions are fully decommissioned.

Answer

Implement an expand-contract (additive) schema migration strategy that retains existing database fields until all old application revisions are fully decommissioned.
During canary and blue-green releases, multiple application versions run simultaneously and query the same shared database. Adopting an expand-contract (phase 1: expand additively, phase 2: deploy code, phase 3: contract old fields) schema migration strategy ensures complete backward compatibility, allowing older revisions to function without error while the canary revision is verified.

Step-by-Step Solution

1
Analyze the cause of deployment failure during traffic splitting.
Identified that applying destructive schema changes directly breaks backward compatibility for instances running the older revision.
During canary deployments, multiple application revisions query the same database concurrently.
2
Evaluate schema evolution patterns suitable for zero-downtime canary releases.
Determine that database migrations must follow an expand-contract pattern (add new fields first, migrate data, contract old fields later).
This guarantees that legacy revisions remain operational while the canary revision receives a portion of production traffic.
3
Select the correct architectural solution.
Enforce additive database schema updates prior to shifting traffic, deferring breaking cleanups until old revisions are fully retired.
Ensures complete backward compatibility and zero downtime during the release window.

Key Concept

Database schema backward compatibility in canary deployments (Expand-Contract Pattern)
Question 1097Question →

A video gaming company is implementing an automated CI/CD pipeline using Cloud Build to deploy application infrastructure via Terraform across multiple Google Cloud environments. The security team mandates that Cloud Build must run builds following the principle of least privilege without being granted administrative control over service accounts. Additionally, the pipeline design must ensure that concurrent build executions do not cause state corruption or race conditions. Which combination of IAM configuration and state management should you implement?

Show answer & explanation

Answer: Grant the Cloud Build service account the Service Account User role on a dedicated deployment service account, and configure Terraform to use a Cloud Storage remote backend with state locking enabled.

Answer

Granting the Cloud Build service account the Service Account User role on a dedicated deployment service account, combined with storing Terraform state in a Cloud Storage remote backend with state locking, fulfills both least privilege IAM requirements and prevents infrastructure state corruption.
The correct solution grants the minimal necessary IAM role (`roles/iam.serviceAccountUser`) to Cloud Build so that build steps can execute using the target deployment service account identity. Additionally, configuring a Google Cloud Storage backend with native object locking ensures that multiple parallel builds cannot mutate the Infrastructure as Code state simultaneously, preventing corruption and race conditions.

Step-by-Step Solution

1
Evaluate IAM privileges required for Cloud Build service account impersonation.
The Cloud Build service account requires `roles/iam.serviceAccountUser` to impersonate or attach a dedicated service account, rather than `roles/iam.serviceAccountAdmin` or primitive `roles/owner`.
This enforces the principle of least privilege by restricting Cloud Build from managing service account lifecycles.
2
Evaluate Infrastructure as Code state management requirements for CI/CD automation.
Terraform must be configured with a Cloud Storage backend (`gcs` backend) utilizing state locking via Cloud Storage object versioning/locking mechanisms.
Remote state storage with locking ensures concurrent pipeline triggers do not overwrite state files simultaneously or create configuration drift.

Key Concept

CI/CD Pipeline Security and IaC State Management
Question 1098Question →

A financial services organization hosts sensitive client datasets in Cloud Storage and BigQuery within Google Cloud. The security team must ensure that authorized analysts working from an on-premises network can access these Google Cloud APIs over a Dedicated Interconnect connection, while preventing any authorized user from exfiltrating data to external Cloud Storage buckets outside the organization's control. IAM roles have already been restricted using custom fine-grained permissions. Which security control strategy should you implement to satisfy these perimeter security and exfiltration requirements?

Show answer & explanation

Answer: Configure a VPC Service Controls perimeter encompassing the Cloud Storage and BigQuery projects, and define ingress rules allowing API requests from the designated on-premises IP range over Private Google Access.

Answer

Configure a VPC Service Controls perimeter encompassing the Cloud Storage and BigQuery projects, and define ingress rules allowing API requests from the designated on-premises IP range over Private Google Access.
The correct strategy is to construct a VPC Service Controls perimeter around the storage and analytical projects while utilizing ingress policies to grant access to the specified on-premises network range over Private Google Access. VPC Service Controls effectively mitigates data exfiltration risks by constraining Google API interactions to defined boundaries, even if an authorized user attempts to copy data to external storage targets.

Step-by-Step Solution

1
Identify the data exfiltration risk and perimeter requirement
Recognize that IAM controls alone cannot stop an authorized identity from exfiltrating data to an external, unauthorized GCP resource.
VPC Service Controls is specifically designed to restrict API communication boundaries and prevent data egress to untrusted GCP projects.
2
Select the proper perimeter security technology
Place the target BigQuery and Cloud Storage projects inside a VPC Service Controls service perimeter.
This isolates the Google APIs at the network boundary level regardless of IAM privileges.
3
Configure hybrid access into the perimeter
Use ingress rules and Private Google Access over Dedicated Interconnect to allow authorized on-premises traffic.
Ingress rules explicitly permit incoming network calls matching specified context attributes (such as IP range or identity) across hybrid connections.

Key Concept

VPC Service Controls and Hybrid Perimeter Ingress
Question 1099Question →

A retail platform operates microservices across multiple Google Kubernetes Engine (GKE) clusters and Cloud Run services deployed in multiple Google Cloud projects. The operations team needs to centralize administrative audit logs and application error logs into a single BigQuery dataset for compliance auditing, while minimizing Cloud Logging ingestion costs by excluding high-volume verbose debug logs before they are written to log buckets. Which TWO actions should the cloud architect recommend to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an aggregated Log Router sink at the Organization level with an inclusion filter targeting the centralized BigQuery dataset for audit logs and error severities.; Add log exclusion filters to the log buckets across projects to drop log entries with severity level DEBUG prior to ingestion into the _Default log bucket.

Answer

The team should configure an aggregated Log Router sink at the organization level targeting BigQuery for centralized audit and error logging, and apply exclusion filters on log buckets to drop DEBUG level logs prior to ingestion.
To centralize logging across an organization, an aggregated Log Router sink at the organization level automatically collects audit and operational logs from all projects into a BigQuery dataset. To minimize Cloud Logging ingestion expenses without sacrificing visibility into failures, exclusion filters should be configured on log buckets to drop low-value, high-volume DEBUG logs prior to storage.

Step-by-Step Solution

1
Establish central log aggregation
Aggregated Log Router sink routes audit logs and errors across all projects to BigQuery.
Organization-level sinks automatically aggregate logs from all present and future child projects without requiring individual sink configuration in every project.
2
Optimize Cloud Logging ingestion costs
Exclusion filters drop high-volume DEBUG logs before log storage ingestion.
Exclusion filters evaluate incoming log entries and prevent excluded log entries from incurring storage and ingestion charges in log buckets.

Key Concept

Organization-level aggregated log router sinks combined with log exclusion filters enable centralized compliance logging and cost-optimized log storage.
Question 1100Question →

A enterprise architecture team is defining data encryption standards across Google Cloud workloads to meet distinct compliance and operational mandates. Match each business encryption requirement to the appropriate Google Cloud key management mechanism.

Click a left item, then click its matching right item

Items

Regulatory mandate requiring physical key storage strictly outside Google Cloud infrastructure while using cloud services.
Compliance mandate requiring keys to be generated and stored inside FIPS 140-2 Level 3 validated hardware modules managed in the cloud.
Operational requirement to supply encryption key material transiently per API request without persisting the key in GCP.
Standard baseline security requirement where platform services automatically encrypt data at rest without additional configuration.

Matches

Show answer & explanation

Answer

Cloud EKM corresponds to physical key storage outside Google Cloud; Cloud KMS with Cloud HSM corresponds to FIPS 140-2 Level 3 cloud-hosted keys; CSEK corresponds to transient key delivery per API call; Google-default encryption corresponds to zero-configuration server-side encryption.
The mapping accurately pairs each encryption deployment model (Cloud EKM, Cloud KMS with Cloud HSM, CSEK, and Google-default encryption) to its specific operational characteristics, key custody boundary, and regulatory compliance features.

Step-by-Step Solution

1
Analyze key custody locations
External key storage mandates require Cloud EKM.
Cloud EKM keeps keys residing on-premises or in an external HSM partner while permitting GCP services to encrypt/decrypt data via API calls.
2
Evaluate hardware security requirements in GCP
Cloud-managed FIPS 140-2 Level 3 requirements map to Cloud HSM.
Cloud HSM provides managed hardware security modules integrated into Cloud KMS.
3
Differentiate transient key models from stored keys
Keys passed per API call without cloud storage map to CSEK.
CSEK requires passing key material in API requests for Cloud Storage or Compute Engine, residing only in transient memory during requests.
4
Identify default baseline encryption
Zero-configuration automated encryption maps to Google-default encryption.
GCP encrypts all customer data at rest by default using Google-managed keys.

Key Concept

Data Encryption & Key Management Options in Google Cloud
PreviousPage 55 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin