Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 1101Question →

An enterprise architecture team is designing an automated continuous integration and continuous delivery (CI/CD) pipeline on Google Cloud to securely build, verify, and release containerized microservices to Google Kubernetes Engine (GKE). The pipeline architecture incorporates Cloud Build, Artifact Registry, Binary Authorization, and Cloud Deploy. In what chronological sequence should the pipeline stages execute from initial code submission to final production deployment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for the GCP CI/CD pipeline is: 1) Cloud Build compiles source code and builds the container image; 2) Artifact Registry stores the image and Container Analysis scans for vulnerabilities; 3) Binary Authorization verifies scan results and signs the image digest; 4) Cloud Deploy creates a release and deploys to staging GKE; 5) Cloud Deploy verifies staging health and promotes the release to production GKE.
The pipeline logically flows from artifact creation (Cloud Build) to storage/security scanning (Artifact Registry and Container Analysis), governance attestation (Binary Authorization), staging deployment orchestration (Cloud Deploy), and finally automated production promotion following verification.

Step-by-Step Solution

1
Trigger Continuous Integration Build
Cloud Build compiles source code and produces a container artifact.
Source code compilation and artifact generation are the initial steps in any CI/CD workflow.
2
Store and Scan Artifact
The container image is pushed to Artifact Registry and scanned for vulnerabilities.
Artifacts must be centralized and security-scanned before validation or deployment.
3
Cryptographic Attestation
Binary Authorization attestors verify scan compliance and sign the artifact digest.
Binary Authorization policies require an attestation before GKE admission controllers allow deployment.
4
Staging Release Rollout
Cloud Deploy creates a pipeline release and deploys the attested container to the staging target.
Progressive delivery tools require signed digests before initiating target deployments.
5
Verification and Production Promotion
Staging integration tests validate application health before advancing to production.
Automated verification ensures zero-downtime production deployment gating.

Key Concept

Secure GCP CI/CD Pipeline Lifecycle with Cloud Build, Artifact Registry, Binary Authorization, and Cloud Deploy
Question 1102Question →

A cloud architecture team defines a Service Level Objective (SLO) for an enterprise user authentication API hosted on Google Cloud. The team sets an availability SLO target of 99.9%99.9\% measured over a rolling period of 30 days (43,20043,200 minutes). What is the maximum total downtime in minutes allowed before the service completely exhausts its error budget for this 30-day period?

Show answer & explanation

Answer: 43.2

Answer

The maximum allowable downtime before completely exhausting the 30-day error budget is 43.243.2 minutes.
An availability SLO target of 99.9%99.9\% permits an error budget of 0.1%0.1\% (100%−99.9%100\% - 99.9\%). Across a 30-day window (43,20043,200 minutes), the maximum allowable downtime in minutes is 43,200×0.001=43.243,200 \times 0.001 = 43.2 minutes.

Step-by-Step Solution

1
Determine the error budget percentage allowed by the SLO
0.1%0.1\% or 0.0010.001 of total operational time
The error budget represents the allowable failure rate, calculated as 100%−SLO100\% - \text{SLO} (100%−99.9%=0.1%100\% - 99.9\% = 0.1\%).
2
Calculate total allowable downtime in minutes over the 30-day measurement window
43.243.2 minutes
Multiply total minutes in 30 days (43,20043,200 minutes) by the error budget fraction (0.0010.001): 43,200×0.001=43.243,200 \times 0.001 = 43.2 minutes.

Key Concept

Error Budget Downtime Calculation
Question 1103Question →

An organization is executing its disaster recovery strategy for a critical application. The business requires a Recovery Point Objective (RPO) of zero, meaning no data loss can be tolerated during a complete regional outage. Which Google Cloud database strategy meets this requirement?

Show answer & explanation

Answer: Cloud Spanner deployed with a multi-region configuration

Answer

Cloud Spanner deployed with a multi-region configuration provides synchronous cross-region replication and guarantees zero RPO during a regional disaster.
Cloud Spanner multi-region configurations utilize Paxos consensus to perform synchronous writes across multiple regions. This guarantees strong transactional consistency and zero data loss (RPO = 0) even during a complete regional outage.

Step-by-Step Solution

1
Identify key disaster recovery constraint
The requirement specifies an RPO of zero (no data loss tolerated).
Zero RPO requires synchronous data replication across geographic regions.
2
Evaluate GCP database replication capabilities
Cloud Spanner multi-region deployments use Paxos consensus for synchronous cross-region writes, whereas Cloud SQL cross-region replicas rely on asynchronous replication.
Asynchronous replication leaves uncommitted data vulnerable to data loss during sudden regional failures.
3
Select matching GCP solution pattern
Cloud Spanner multi-region is the correct architecture.
It natively delivers multi-region synchronous replication to guarantee zero RPO execution.

Key Concept

Multi-region disaster recovery execution with zero RPO using Cloud Spanner synchronous replication
Question 1104Question →

A global humanitarian relief organization is planning to migrate its central inventory management and emergency dispatch system from on-premises data centers to Google Cloud. Executive sponsors require zero disruption to active disaster relief operations, while regional operational leads express concern about software workflow changes during active missions. Additionally, local IT personnel have minimal Google Cloud experience, and regional resource demands vary drastically based on active crisis events. Which migration and governance strategy should the Professional Cloud Architect recommend to fulfill stakeholder requirements while managing organizational change and operational risk?

Show answer & explanation

Answer: Implement a phased regional migration path coupled with role-based training programs, audit and proactively request Google Cloud compute quota increases prior to deployment, and enforce least-privilege IAM roles alongside VPC Service Controls.

Answer

The recommended strategy is to implement a phased regional migration accompanied by targeted enablement training, pre-emptively audit and request regional Google Cloud quota increases, and enforce least-privilege IAM roles with VPC Service Controls.
The correct option addresses both the human and technical elements of cloud transformation. By establishing a phased migration schedule alongside targeted role-based enablement, the organization minimizes operational friction for field leads. Pre-emptively requesting regional quota increases ensures capacity availability during emergency surges, while predefined IAM roles and VPC Service Controls protect sensitive mission data.

Step-by-Step Solution

1
Evaluate organizational and operational readiness across regional teams
Identify technical skill gaps and workflow resistance points among regional IT and field staff.
A phased rollout combined with tailored training lowers operational risk and builds organizational confidence during change.
2
Perform proactive quota management
Audit resource usage projections for peak disaster response scenarios and request Google Cloud quota increases before live deployment.
Requesting quota increases early avoids deployment blockages during sudden resource scaling.
3
Design least-privilege security and governance controls
Apply predefined and custom IAM roles rather than broad primitive roles, and protect sensitive data exfiltration vectors using VPC Service Controls.
Ensures robust security compliance without exposing cloud environments to administrative misconfigurations or data leakage.

Key Concept

Organizational Change Management and Stakeholder Requirements Analysis
Question 1105Question →

An enterprise financial services provider runs a payroll processing platform on Google Cloud using Compute Engine Managed Instance Groups (MIGs). The application experiences predictable, severe 10x traffic bursts on the last business day of every month. During the most recent burst, instances failed to scale out despite autoscaling policies triggering, resulting in request timeouts due to hitting regional Compute Engine vCPU quotas. The organization requires a solution that guarantees instance availability for scheduled peak events without incurring continuous baseline compute costs. Which capacity planning and scaling strategy should the principal cloud architect recommend?

Show answer & explanation

Answer: Submit a regional vCPU quota increase request in advance and implement targeted Compute Engine On-Demand Reservations scheduled for the monthly peak window.

Answer

The correct strategy is to request a regional vCPU quota increase in advance and leverage scheduled Compute Engine On-Demand Reservations during the monthly processing window.
Requesting a regional vCPU quota increase in advance ensures the GCP project has sufficient quota headroom for peak demand. Combining this with Compute Engine Reservations guarantees that the physical infrastructure capacity is reserved in the target zone for the predictable burst window, preventing capacity exhaustion while avoiding continuous baseline compute expenditure.

Step-by-Step Solution

1
Analyze the workload failure root cause
Identified that scaling failed due to hitting regional vCPU quota limits and lacking guaranteed compute capacity during predictable traffic bursts.
Autoscaling policies cannot provision resources beyond defined GCP quota ceilings or when zonal capacity is exhausted.
2
Address project quota boundaries
Submit a quota increase request in the GCP Console prior to peak events.
Quota increases require lead time for approval and execution, preventing scaling failures caused by hard limit breaches.
3
Ensure capacity availability cost-effectively
Configure Compute Engine Reservations for the required capacity during the processing window.
Reservations guarantee that hardware resources are available in the target zone during peak windows without requiring instances to remain running continuously outside the peak window.

Key Concept

Capacity Planning and Infrastructure Workload Scaling Optimization
Question 1106Question →

A cloud operations team is establishing an automated incident management and escalation architecture on Google Cloud for a high-throughput healthcare data ingestion service. The team needs to build a workflow that moves from reliability metric definition to alert trigger routing, automated remediation execution, and alert suppression. In what chronological sequence should the cloud architect configure these operational components?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with establishing SLIs/SLOs, configuring the multi-window burn-rate alerting policy, binding a Pub/Sub notification channel, deploying the Cloud Run automated remediation worker, and finally setting up a Cloud Monitoring Muting Rule to suppress secondary alerts during active mitigation.
The proper architectural sequence begins by defining SLIs and SLOs to establish an error budget baseline. Next, a multi-window burn-rate alerting policy evaluates error budget consumption. When triggered, the policy publishes incident notifications to a Pub/Sub topic channel. A Cloud Run remediation service consumes these Pub/Sub messages to execute automated fixes. Finally, Cloud Monitoring Muting Rules suppress secondary alert noise while remediation takes effect.

Step-by-Step Solution

1
Establish foundational reliability metrics.
SLIs and SLOs are created in Cloud Monitoring, defining the service error budget.
You cannot monitor error budget consumption or trigger burn-rate alerts without first defining the baseline SLI and target SLO.
2
Configure the alerting logic based on error budget consumption.
A multi-window, multi-burn-rate alerting policy is established.
Evaluating burn rate requires the defined SLO and error budget to calculate short and long time window consumption.
3
Connect the alert policy to an event-driven messaging channel.
Cloud Monitoring posts incident payload metadata to a designated Pub/Sub topic.
Programmatic incident workflows require event-driven notification channels to pass alert details to automation handlers.
4
Implement automated remediation handlers.
A Cloud Run worker consumes the Pub/Sub event payload and initiates infrastructure or application mitigations.
The remediation service depends on Pub/Sub alert messages to trigger mitigation logic.
5
Suppress redundant secondary notifications.
A Cloud Monitoring Muting Rule suppresses downstream alert floods during remediation.
Muting rules ensure engineers are not spammed by collateral alerts while the automated fix is actively resolving the primary issue.

Key Concept

Incident Response and Automated Alerting Workflow Design
Estimated Time:2m 30s
Question 1107Question →

A global enterprise runs streaming workloads across multiple Google Cloud projects containing Google Kubernetes Engine (GKE) clusters and Compute Engine instances. The central Site Reliability Engineering (SRE) and security teams require a centralized observability pipeline. Specifically, high-severity security audit logs must be retained long-term in BigQuery for regulatory compliance, while operational application error logs must be routed in real time to an external Security Information and Event Management (SIEM) system via Cloud Pub/Sub. To optimize logging costs, ensure minimal log ingestion overhead, and enforce proper access security without dropping critical events, which TWO configuration steps should the cloud architect implement? Select TWO.

Select all that apply

Show answer & explanation

Answer: Create an organization-level aggregated Log Router sink specifying BigQuery as the destination, filtered to include specific audit and error log types, and configure a table retention policy.; Configure a Log Router sink with a real-time error log filter targeting a Cloud Pub/Sub topic, and grant the sink's writer service account the Pub/Sub Publisher role on that topic.

Answer

The optimal architecture combines an organization-level aggregated Log Router sink targeting BigQuery for long-term compliance archiving, and a targeted Log Router sink sending error logs to Cloud Pub/Sub with fine-grained IAM Publisher permissions assigned to the sink service account.
Centralizing long-term audit log retention is best accomplished using an organization-level aggregated Log Router sink pointing to BigQuery. For real-time SIEM streaming, routing targeted error logs to a Pub/Sub topic while assigning the minimal necessary `Pub/Sub Publisher` role to the sink service account ensures secure, low-latency log export.

Step-by-Step Solution

1
Aggregate logs at scale for centralized compliance
Creating an organization-level aggregated Log Router sink captures audit and compliance log data across all GCP projects into a central BigQuery dataset.
Centralized sinks remove the administrative burden of configuring individual sinks per project and enforce organization-wide auditing compliance.
2
Configure real-time log export with least privilege access
Setting up a dedicated sink for error logs to a Cloud Pub/Sub topic and granting `roles/pubsub.publisher` to the sink's service account enables real-time SIEM stream ingestion while adhering to security best practices.
Pub/Sub provides low-latency streaming export, and granular IAM role assignment prevents excessive permissions.

Key Concept

Organization-wide Log Router aggregation, destination sink permissions, and security controls.
Question 1108Question →

A multinational commercial airline is migrating its flight operations analytics and passenger loyalty platform to Google Cloud. Executive leadership demands zero service downtime during high-traffic travel seasons and strict regulatory compliance. However, the internal IT operations team expresses strong resistance to the shift, citing unfamiliarity with GCP operational governance and fears of operational risk during initial rollout. As the Cloud Architect leading this transition, which TWO strategies should you execute to address stakeholder requirements and manage organizational change effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Develop a role-based cloud training and enablement program for the IT team, and submit proactive regional quota requests in advance of major migration cutovers.; Establish a clear cloud governance framework using predefined IAM roles and VPC Service Controls to address security compliance requirements while maintaining operational boundaries.

Answer

The Cloud Architect should develop a role-based cloud training and enablement program paired with proactive regional quota requests, while establishing a governance framework using predefined IAM roles and VPC Service Controls.
Addressing organizational change requires structured upskilling to reduce team anxiety and build operational capability. Proactively requesting regional quotas ensures capacity is available for migration without downtime. Paired with predefined IAM roles and VPC Service Controls, this strategy satisfies security compliance without compromising governance.

Step-by-Step Solution

1
Assess technical and organizational constraints
Identified staff resistance due to skill gaps alongside strict compliance and availability requirements.
Successful cloud adoption requires aligning technical enablement with business stakeholder expectations.
2
Select organizational change and resource management strategies
Combined role-based training with early GCP quota increases.
Training addresses staff resistance and operational confidence, while advance quota planning avoids service disruption.
3
Define security governance controls
Configured predefined IAM roles and VPC Service Control perimeters.
Meets compliance mandates without exposing resources through broad, unsafe permissions.

Key Concept

Analyzing Business Stakeholder Requirements and Managing Organizational Change
Estimated Time:2m 0s
Question 1109Question →

A enterprise team is performing an operational disaster recovery (DR) drill to validate business continuity for an application deployed across two Google Cloud regions. The failover plan requires redirecting network traffic to the secondary region and ensuring database availability. Which of the following execution steps are necessary to successfully complete this regional failover procedure? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Promote the cross-region database read replica in the secondary region to a standalone primary database.; Update DNS records or Global Load Balancer URL maps to route production incoming user traffic to the secondary region backend.

Answer

The necessary steps for regional failover execution are promoting the cross-region read replica in the secondary region to become a standalone primary database, and updating DNS records or load balancer routing to direct production traffic to the secondary region.
Executing a disaster recovery failover to a secondary region requires promoting passive data components (such as cross-region read replicas) to active write mode and updating global ingress routing mechanisms (such as DNS TTL policies or Global Load Balancing URL maps) to direct traffic toward active infrastructure.

Step-by-Step Solution

1
Ensure database write operations can continue in the recovery target site.
Promoting the cross-region read replica makes it a standalone, writable primary database.
Read replicas are read-only; failover requires active write capability.
2
Shift application traffic to the healthy secondary region.
Updating DNS records or Global Load Balancer configurations directs client traffic to the failover location.
Traffic routing ensures users reach operational application backends after a primary region outage.

Key Concept

Disaster Recovery Failover Execution and Traffic Rerouting
Question 1110Question →

An online gaming enterprise hosts multiplayer matchmaking services on Google Kubernetes Engine (GKE) and stores container images in Artifact Registry. The lead security architect must design a container security strategy to achieve two goals: automatically scan container images for operating system vulnerabilities immediately upon push to the registry, and continuously detect runtime container compromises (such as unexpected binary execution or reverse shells) without deploying or managing security monitoring agents on cluster nodes. Which architectural approach fulfills these security and operational requirements?

Show answer & explanation

Answer: Enable Container Analysis vulnerability scanning on Artifact Registry, enforce deployment controls with Binary Authorization, and enable Container Threat Detection in Security Command Center Premium.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry, enforce deployment controls with Binary Authorization, and enable Container Threat Detection in Security Command Center Premium.
The combination of Container Analysis (for automatic Artifact Registry image vulnerability scanning) and Security Command Center Premium Container Threat Detection (for agentless runtime threat monitoring via node hypervisor logs) delivers end-to-end security compliance with zero agent management overhead.

Step-by-Step Solution

1
Identify the automated vulnerability scanning solution for container registries on Google Cloud.
Container Analysis (integrated with Artifact Registry) automatically scans container images for known vulnerabilities upon upload.
Meets the requirement for automated OS vulnerability scanning without manual pipeline execution.
2
Identify the managed service for agentless GKE runtime threat detection.
Container Threat Detection, a component of Security Command Center Premium, monitors GKE container behavior directly via node hypervisor and system logs without requiring installed agents.
Fulfills the operational mandate of zero monitoring agent management overhead.
3
Select the option that combines Container Analysis, Binary Authorization, and Container Threat Detection.
The solution combining Container Analysis, Binary Authorization, and Security Command Center Container Threat Detection satisfies all requirements.
Provides end-to-end container security from build/storage time to runtime without operational overhead.

Key Concept

Container Security Pipeline & Agentless Threat Detection
Question 1111Question →

A digital publishing firm's development and operations teams are standardizing their Google Cloud deployment practices. Developers currently hold the Editor primitive role on project environments so they can run deployment scripts and troubleshoot infrastructure issues. The security and operations teams require implementing strict least privilege and preventing manual configuration drift across environments. Which recommendation should the Cloud Architect give to best align the development and operations teams?

Show answer & explanation

Answer: Configure the automated CI/CD pipeline to authenticate using a dedicated deployment service account with fine-grained custom roles, grant developers permissions to trigger pipeline execution, and revoke developer Editor roles.

Answer

Configure the automated CI/CD pipeline to authenticate using a dedicated deployment service account with fine-grained custom roles, grant developers permissions to trigger pipeline execution, and revoke developer Editor roles.
The architect should advise delegating deployment responsibilities to an automated pipeline that runs under a service account constrained by least-privilege roles. Developers trigger the automated workflow without holding direct administrative privileges on Google Cloud resources, maintaining security compliance and preventing manual environment drift.

Step-by-Step Solution

1
Identify key operational and security requirements
Requirements demand least privilege enforcement, elimination of direct human infrastructure modification, and prevention of configuration drift.
Direct human access with broad primitive roles leads to untracked manual changes and security policy violations.
2
Establish automated deployment service account boundary
CI/CD pipelines use dedicated service accounts with granular permissions, while developers receive only pipeline trigger permissions.
Separating human developer roles from deployment execution roles ensures auditability and enforces automated least privilege releases.

Key Concept

Advising DevOps on Secure Deployment Automation and IAM Least Privilege
Estimated Time:1m 30s
Question 1112Question →

A global logistics company uses Google Cloud folders to organize regional workloads, with separate folders named Logistics-EU and Logistics-NA under the organization node. An internal security audit team requires permission to inspect IAM access policies and asset security configurations across all current and future projects located inside the Logistics-EU folder. The team must not have access to view underlying customer data stored inside Cloud Storage buckets or BigQuery datasets, and solution management overhead must be minimized. Which IAM role assignment strategy should you implement?

Show answer & explanation

Answer: Grant the predefined Security Reviewer role (roles/iam.securityReviewer) on the Logistics-EU folder.

Answer

Grant the predefined Security Reviewer role (roles/iam.securityReviewer) on the Logistics-EU folder.
Granting the predefined Security Reviewer role (roles/iam.securityReviewer) at the Logistics-EU folder level uses resource hierarchy inheritance to grant policy and security metadata inspection capabilities across all child projects. It fulfills least privilege by strictly excluding permissions to view underlying resource data.

Step-by-Step Solution

1
Identify the required permissions for security policy auditing
The audit team requires security metadata and policy inspection permissions without access to data plane contents.
Least privilege mandates avoiding broad data view permissions when only policy auditing is required.
2
Select the appropriate IAM role type
The predefined role `roles/iam.securityReviewer` grants read-only access to security policies, IAM configurations, and resource metadata without granting access to data payload contents.
Predefined security roles target specific administrative control capabilities while avoiding over-privileged primitive roles.
3
Determine the resource hierarchy binding level
Binding the role at the `Logistics-EU` folder node automatically inherits permissions down to all existing and future child projects under that folder.
Inheritance via resource hierarchy eliminates administrative overhead associated with manual per-project role bindings.

Key Concept

Resource Hierarchy IAM Role Inheritance and Least Privilege Security Roles
Estimated Time:1m 30s
Question 1113Question →

A global telecommunications enterprise operates its SaaS management portal and telemetry analytics pipelines across multiple Google Cloud projects linked to a central Cloud Billing account. The engineering and finance leaders need to establish a FinOps governance framework to improve cost visibility and optimize spending across compute and storage resources without sacrificing application performance or release agility. Which of the following strategies should the team implement to achieve these FinOps objectives? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Export detailed Cloud Billing data to BigQuery to enable granular query analysis and build automated programmatic notifications via Cloud Pub/Sub and Budgets API.; Purchase Flexible Committed Use Discounts (CUDs) for baseline compute expenditure across projects to secure cost savings while maintaining operational flexibility for variable workloads.

Answer

The correct strategies are exporting detailed Cloud Billing data to BigQuery for automated governance and purchasing Flexible Committed Use Discounts (CUDs) to cover baseline compute expenditures.
Establishing a FinOps practice on GCP relies on granular cost visibility and flexible commitment strategies. Exporting detailed billing data to BigQuery provides queryable access to resource-level costs and labels, while linking Pub/Sub to Cloud Budgets enables automated programmatic remediation. Applying Flexible Committed Use Discounts (CUDs) reduces hourly spend on baseline compute capacity across project boundaries without locking into fixed machine types.

Step-by-Step Solution

1
Analyze visibility and governance requirements
Exporting detailed billing data to BigQuery enables deep SQL analysis across projects, and attaching Pub/Sub to Cloud Budgets enables programmatic cost alerts and actions.
FinOps governance requires automated monitoring and granular cost allocation down to individual resources.
2
Evaluate compute cost optimization strategy
Flexible CUDs provide committed spend discounts across machine series, regions, and projects for steady-state baseline compute usage.
Commitments should cover predictable baseline compute while leaving variable burst traffic to scale dynamically on demand.

Key Concept

FinOps Cost Governance and Compute Commitment Optimization
Question 1114Question →

An enterprise Cloud Architecture team is establishing an end-to-end automated incident detection and self-healing remediation workflow on Google Cloud for a microservice encountering resource exhaustion. Arrange the operational steps in the correct chronological order from initial alerting setup through incident resolution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the full lifecycle of automated incident detection and remediation: configuring alerting policies with Pub/Sub notification targets, publishing alert payloads upon metric breach, triggering event-driven remediation functions, executing API remediation calls to restore workload health, and auto-closing the incident in Cloud Monitoring upon metric recovery.
The proper operational order follows a logical incident lifecycle: proactive monitoring configuration, metric breach detection with event publishing via Pub/Sub, serverless event ingestion and payload parsing, execution of automated API remediation scripts, and final auto-closure of the incident state by Cloud Monitoring upon verified service recovery.

Step-by-Step Solution

1
Configure Cloud Monitoring alert policies and notification targets
Sets baseline alert thresholds and establishes the Pub/Sub integration pathway.
Alerting policies and messaging channels must be provisioned prior to handling live operational incidents.
2
Emit incident event payload to Pub/Sub
Publishes structured incident metadata when performance thresholds are exceeded.
Cloud Monitoring decouples detection from remediation by delivering alerts via Pub/Sub messaging.
3
Ingest payload via event-driven Cloud Function
Parses resource identifiers and operational context securely using service account IAM roles.
Remediation functions require parsed message attributes to identify specific failing resources.
4
Execute programmatic remediation API calls
Restores instance health through automated lifecycle management commands.
Direct action against Cloud APIs mitigates operational outages without human intervention.
5
Validate metric recovery and resolve incident state
Updates incident telemetry and auto-closes open incident tickets in Monitoring.
Cloud Monitoring automatically closes incidents once consecutive healthy evaluation periods pass.

Key Concept

Automated Incident Lifecycle Management and Event-Driven Remediation in Google Cloud
Question 1115Question →

An Site Reliability Engineering (SRE) team is defining operational reliability metrics for an HTTP-based backend API running on Cloud Run. The team wants to track the exact proportion of successful HTTP requests against total HTTP requests over a 30-day window to measure actual system performance. Which Site Reliability Engineering (SRE) metric component does this specific measurement represent?

Show answer & explanation

Answer: Service Level Indicator (SLI)

Answer

The specific measurement of successful requests over total requests represents a Service Level Indicator (SLI).
The correct answer is Service Level Indicator (SLI). An SLI is a carefully defined quantitative measure of a service's performance, such as latency or successful request ratio. Measuring valid requests divided by total requests yields an SLI.

Step-by-Step Solution

1
Identify the nature of the measurement specified in the scenario.
The metric measures actual historical performance ratio (successful requests divided by total requests).
Quantifiable measurements of service performance constitute indicators.
2
Differentiate between SLI, SLO, and SLA concepts.
SLI is the actual metric measured; SLO is the target objective for that metric; SLA is the formal contract with penalties.
Understanding the baseline definitions ensures proper classification of SRE metrics.

Key Concept

Distinction between Service Level Indicators (SLIs), Service Level Objectives (SLOs), and Service Level Agreements (SLAs).
Question 1116Question →

A software enterprise is structuring its Google Cloud resource hierarchy with dedicated `Production` and `Non-Production` folders under the Organization node. A third-party compliance team requires read-only visibility into security configurations and IAM policy bindings across all existing and future projects without accessing underlying data payloads. Simultaneously, an automated CI/CD pipeline needs permission to launch Compute Engine instances in `Non-Production` projects using a specific managed workload service account, without granting the pipeline administrative rights to modify service account credentials. Which of the following IAM configuration choices follow Google-recommended best practices for least privilege and resource hierarchy inheritance? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the Security Reviewer role (`roles/iam.securityReviewer`) to the third-party compliance group at the Organization level.; Grant the Service Account User role (`roles/iam.serviceAccountUser`) to the CI/CD pipeline identity on the specific workload service account resource.

Answer

The optimal approach is to grant the Security Reviewer role to the compliance group at the Organization level, and grant the Service Account User role to the CI/CD pipeline identity on the specific workload service account.
Granting the Security Reviewer role at the Organization level ensures that read-only security visibility inherits across all folders and projects automatically. Furthermore, binding the Service Account User role directly on the specific workload service account limits the CI/CD pipeline's impersonation rights exclusively to the necessary identity without granting administrative power.

Step-by-Step Solution

1
Analyze compliance monitoring requirements across the organization hierarchy.
Assigning `roles/iam.securityReviewer` at the Organization node ensures inherited read-only access to security settings and IAM policies across all child folders and projects without granting access to resource contents or data payloads.
Resource hierarchy inheritance ensures future projects automatically adopt policy bindings set at the parent Organization level.
2
Evaluate deployment pipeline authorization for Compute Engine service account usage.
Granting `roles/iam.serviceAccountUser` specifically on the target workload service account allows the pipeline to bind that service account to new VMs.
Scoping access to the specific service account resource enforces the principle of least privilege, preventing unauthorized service account impersonation or management.

Key Concept

Resource Hierarchy Inheritance and Fine-Grained Service Account Impersonation
Estimated Time:1m 30s
Question 1117Question →

A smart grid utility enterprise ingests real-time telemetry from millions of sensors into Google Cloud. The core analytical backend relies on a steady, predictable baseline of Compute Engine virtual machines operating continuously 24/7 throughout the year. During severe weather events, compute demand spikes unpredictably up to five times the baseline volume for short durations. The FinOps team must establish a financial governance strategy that minimizes overall compute expenditure while accurately tracking cost attribution across business units. Which strategy best fulfills these requirements?

Show answer & explanation

Answer: Purchase Committed Use Discounts (CUDs) scaled to cover the predictable 24/7 baseline compute capacity, handle unpredictable weather spikes using Spot VMs or auto-scaling standard instances, and enforce cost allocation using resource labels exported to BigQuery Billing data.

Answer

Purchase Committed Use Discounts scaled to cover predictable baseline capacity, handle unpredictable spikes with Spot VMs or auto-scaling standard instances, and enforce cost allocation via resource labels and BigQuery billing exports.
The optimal strategy combines Committed Use Discounts for the predictable 24/7 baseline workload with elastic mechanisms (Spot VMs or auto-scaling standard instances) for unpredictable weather-driven spikes. Detailed billing exports combined with resource labeling provide the necessary governance for organizational cost attribution.

Step-by-Step Solution

1
Analyze workload baseline versus burst characteristics.
Identified a steady 24/7 baseline demand alongside intermittent, unpredictable 5x usage spikes.
FinOps optimization requires matching commitment models to predictable workloads while maintaining elasticity for burst workloads.
2
Select appropriate pricing structures for each workload tier.
Applied CUDs to the 24/7 baseline capacity and utilized Spot VMs / auto-scaling instances for transient weather spikes.
CUDs offer maximum savings for predictable usage, whereas Spot VMs or dynamic scaling prevent paying for idle commit capacity during non-spike periods.
3
Implement governance and cost attribution mechanisms.
Enforced metadata labeling on resources and enabled detailed billing exports to BigQuery.
Provides visibility into expenditure by business unit and allows accurate cost allocation.

Key Concept

FinOps Cost Governance and Workload-based Commitment Strategies
Estimated Time:1m 30s
Question 1118Question →

A gaming studio's backend platform team is establishing automated infrastructure deployment pipelines using Infrastructure as Code (IaC) to provision Compute Engine instance groups and Cloud SQL instances. The lead cloud architect must advise the operations team on securing pipeline credentials and persisting deployment state safely with minimal operational overhead. Which TWO recommendations should the architect provide? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Configure the IaC backend to store state files in a Cloud Storage bucket with Object Versioning enabled.; Grant the CI/CD pipeline deployment service account the Service Account User role (roles/iam.serviceAccountUser) on the target service account attached to compute instances.

Answer

The architect should recommend configuring the Infrastructure as Code backend to store state in a Cloud Storage bucket with Object Versioning enabled, and granting the deployment service account the Service Account User role on the target instance service account.
Centralizing Infrastructure as Code state in Cloud Storage with Object Versioning enables automated locking and version history, preventing concurrent state corruption. Additionally, granting the Service Account User role to the deployment pipeline service account allows it to bind target workload service accounts to Compute Engine instances under the principle of least privilege.

Step-by-Step Solution

1
Evaluate state management options for Infrastructure as Code in team deployment pipelines.
Identify that Cloud Storage backends provide automatic state locking and versioning for safe team collaboration.
Local unversioned state causes race conditions, state drift, and potential state corruption.
2
Evaluate Identity and Access Management (IAM) role assignments for CI/CD deployment service accounts.
Determine that the Service Account User role (roles/iam.serviceAccountUser) allows the deployment pipeline to attach specific service accounts to resources without needing primitive or admin roles.
Following least privilege minimizes security risk while ensuring full operational capability.

Key Concept

Best practices for Infrastructure as Code state management and least privilege IAM delegation for dev/ops deployment pipelines.
Question 1119Question →

An online media streaming company runs a video metadata microservice on Google Cloud. During peak traffic hours, brief network latency spikes of 5 to 10 seconds periodically occur, triggering temporary error rate spikes that resolve automatically. However, the operations team receives dozens of redundant PagerDuty alerts every night, causing severe alert fatigue. You need to configure a Cloud Monitoring automated alerting policy that ignores these transient spikes while ensuring sustained service degradations immediately trigger incident notifications. Which alerting policy configuration should you implement?

Show answer & explanation

Answer: Configure a metric threshold alerting condition with a rolling alignment period of 5 minutes and set the duration condition to require the threshold to be breached continuously for 5 minutes before triggering an alert.

Answer

Configure a metric threshold alerting condition with a rolling alignment period and set the duration condition to require the threshold to be breached continuously for several minutes before triggering an alert.
In Google Cloud Monitoring, configuring a metric threshold alert with a rolling alignment period and setting a duration window (such as 5 minutes continuously) ensures that brief metric spikes are filtered out. An automated incident notification is generated only when the metric stays above the defined threshold continuously for the entire duration, eliminating alert fatigue while reliably detecting real outages.

Step-by-Step Solution

1
Identify the operational challenge.
Observed that transient 5-10 second metric spikes trigger redundant incident notifications, resulting in alert fatigue.
Alerting policies evaluated on raw, instantaneous data points fire immediately without validating sustained impact.
2
Analyze Cloud Monitoring alerting condition parameters.
Determined that using a rolling alignment window and requiring a continuous duration condition prevents transient noise from triggering notifications.
A duration window ensures the monitored metric remains above the threshold for the entire period before firing an alert.
3
Select the appropriate architecture configuration.
Selected the option requiring rolling alignment and continuous metric threshold breach across a multi-minute duration.
This configuration balances noise reduction for transient events with reliable alerting for true service outages.

Key Concept

Cloud Monitoring Alert Policy Duration and Alignment Windows
Question 1120Question →

An enterprise genomics research institution runs large-scale batch DNA sequencing jobs on Google Cloud using Compute Engine Managed Instance Groups (MIGs). The workload experiences predictable, massive surges in compute demand during scheduled bi-weekly alignment runs. During past events, auto-scaling instances failed to launch due to sudden regional compute resource limits, and telemetry data transmission experienced severe bottlenecks across hybrid connections. Which TWO architecture and operational strategy changes should the Cloud Architect implement to optimize workload scaling, ensure guaranteed compute capacity, and manage infrastructure constraints during these peak runs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Submit proactive regional vCPU and N2 instance quota increase requests prior to the scheduled alignment runs.; Create zoned Compute Engine Capacity Reservations matching the required instance specification for the duration of the scheduled batch runs.

Answer

The correct recommendations are submitting proactive regional vCPU quota increase requests prior to scheduled runs and creating zoned Compute Engine Capacity Reservations to guarantee compute resource availability.
To optimize infrastructure workload scaling and guarantee capacity during predictable surge events, cloud architects must perform proactive capacity planning. Submitting regional quota increase requests well before scheduled events ensures scaling is not blocked by project-level quota caps. Combining quota management with zoned Compute Engine Capacity Reservations ensures the underlying host infrastructure is reserved and immediately available when Managed Instance Groups scale out.

Step-by-Step Solution

1
Analyze capacity failure points
Identified that autoscaling failures stem from regional GCP quota limits and lack of guaranteed compute hardware availability during peak periods.
MIG autoscaling cannot provision instances beyond project quotas or if zonal host capacity is exhausted.
2
Formulate proactive capacity planning strategy
Request quota increases in advance to ensure quota ceiling accommodates peak instance counts, and reserve zoned capacity for guaranteed hardware allocation.
Quota increases resolve API/project limits while capacity reservations guarantee physical compute stock in specified zones.

Key Concept

Capacity Planning, Compute Reservations, and Regional Quota Management
PreviousPage 56 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin