All practice questions

1598 questions

Question 1181Question

An enterprise fintech startup is launching a stateless REST API microservice to process payment authorization requests. The service experiences unpredictable HTTP traffic spikes during stock market trading hours but receives virtually zero traffic overnight and on weekends. The architecture team must minimize overall infrastructure costs by allowing compute resources to scale down to zero when idle, while also minimizing operational maintenance overhead. Which architectural design best satisfies these business and technical requirements?

Show answer & explanation

Answer: Deploy the application container onto Cloud Run, configuring minimum instances to zero and maximum instances to auto-scale based on incoming HTTP concurrency.

Answer

Deploy the application container onto Cloud Run, configuring minimum instances to zero and maximum instances to auto-scale based on incoming HTTP concurrency.
Deploying the stateless container onto Cloud Run directly aligns with both business requirements: minimizing cost and reducing operational overhead. Cloud Run automatically manages infrastructure operations, scales seamlessly in response to incoming HTTP requests during trading hours, and scales down to zero instances during idle periods, ensuring the startup only pays for active request processing time.

Step-by-Step Solution

1
Analyze the workload characteristics and business requirements.
The application is a stateless HTTP REST API with unpredictable burst traffic and long idle periods (overnight and weekends). Key constraints are zero idle cost and minimal management overhead.
Identifying workload statefulness and traffic patterns dictates whether serverless, container orchestration, or VM-based compute is most cost-effective.
2
Evaluate compute platforms for scale-to-zero capabilities and operational overhead.
Cloud Run provides a fully managed serverless runtime for containerized web applications that natively scales down to zero instances when idle, incurring zero compute cost during inactive periods.
Serverless container platforms eliminate cluster management overhead and billing for idle compute capacity.
3
Reject sub-optimal architectures that incur baseline idle costs or over-provisioning.
Kubernetes clusters incur baseline cluster and pod infrastructure costs even when scaled down, while static Compute Engine MIGs with long-term CUDs waste money during off-peak hours.
Right-sizing compute based on variable demand requires matching compute billing models to actual usage.

Key Concept

Selecting serverless compute platforms (Cloud Run) over GKE or VM MIGs for stateless HTTP workloads with variable traffic to optimize cost and minimize operational overhead.
Question 1182Question

A renewable energy utility enterprise is migrating its smart grid telemetry platform to Google Cloud. The design requires connecting two primary on-premises data centers to a centralized Shared VPC host network in GCP to handle a sustained ingress throughput of 15 Gbps with a strict 99.99% uptime Service Level Agreement (SLA). Furthermore, analytics applications located in separate spoke VPCs peered to the Shared VPC host network must exchange data directly with on-premises databases. Which hybrid network architecture correctly satisfies both the SLA, bandwidth capacity, and VPC peering routing constraints?

Show answer & explanation

Answer: Establish Dedicated Interconnect connections with at least two attachments in two distinct metropolitan locations configured with Cloud Router and dynamic BGP routing in the Shared VPC host project, while utilizing Network Connectivity Center to enable dynamic route exchange between spoke VPCs and the hybrid connection.

Answer

The correct architecture requires establishing Dedicated Interconnect connections across dual metropolitan locations for 99.99% SLA compliance and 15 Gbps throughput capacity, combined with Network Connectivity Center to overcome VPC Peering non-transitivity between spoke VPCs and on-premises networks.
To achieve GCP's 99.99% SLA for hybrid connectivity, an organization must deploy Dedicated Interconnect with redundant links across two distinct metropolitan facilities (edge availability zones) with dynamic BGP routing via Cloud Router. Because the bandwidth demand is 15 Gbps, Dedicated Interconnect is required over Cloud VPN. Furthermore, since VPC Network Peering is non-transitive, Network Connectivity Center (NCC) must be integrated to enable dynamic routing and allow spoke VPC workloads to communicate with on-premises data centers through the host VPC's Interconnect connections.

Step-by-Step Solution

1
Evaluate bandwidth and SLA requirements for hybrid connectivity technology selection.
A 15 Gbps sustained bandwidth requirement exceeds standard Cloud VPN tunnel limits (3 Gbps per tunnel), and a 99.99% SLA explicitly requires dual Dedicated Interconnect links across two distinct metropolitan locations (edge availability domains) with Cloud Router dynamic BGP routing.
Cloud VPN cannot meet the bandwidth without excessive tunnel aggregation, and single-metro Interconnect topologies only guarantee 99.9% SLA.
2
Analyze network topology transitivity constraints between Shared VPC host and spoke VPCs.
VPC Network Peering is strictly non-transitive in Google Cloud, meaning traffic cannot hop from an on-premises network through a host VPC's Interconnect gateway directly into a peered spoke VPC.
Without an enterprise routing hub feature like Network Connectivity Center (NCC) or transit gateway proxies, spoke VPCs remain isolated from on-premises routes established in the host VPC.
3
Synthesize the complete network architecture solution.
Combine dual-metro Dedicated Interconnect for SLA/throughput compliance with Network Connectivity Center for hybrid route propagation across peered spoke VPCs.
This configuration satisfies all availability, performance, and routing constraints.

Key Concept

99.99% HA Dedicated Interconnect Topology and VPC Peering Non-Transitivity
Question 1183Question

A fashion retail enterprise operates an order fulfillment pipeline that renders personalized PDF invoices upon user checkout. The workload is completely stateless and experiences highly unpredictable traffic, ranging from zero requests during off-peak hours to sudden bursts of 300 requests per minute during promotional flash sales. The lead architect needs to select a compute architecture that minimizes overall infrastructure costs by scaling to zero during idle periods while eliminating container orchestration cluster management overhead. Which solution should the architect choose?

Show answer & explanation

Answer: Deploy the containerized application on Cloud Run with minimum instances set to 0.

Answer

Deploy the containerized application on Cloud Run with minimum instances set to 0.
Deploying on Cloud Run with minimum instances set to 0 fulfills all business requirements. Cloud Run automatically scales containers based on incoming web traffic and scales down to zero when no requests are being processed, eliminating idle compute costs. As a fully managed serverless product, it requires zero cluster management overhead.

Step-by-Step Solution

1
Analyze the workload characteristics and operational constraints.
The workload is stateless, highly variable with idle periods, and requires minimal administrative overhead.
Identifying that the workload spends time completely idle requires a compute platform capable of true scale-to-zero.
2
Evaluate Google Cloud compute options against cost and operational overhead criteria.
Cloud Run scales down to 0 instances when idle, incurring zero infrastructure charges during off-peak periods, and is fully managed without cluster administration.
Compute Engine MIGs and standard GKE clusters incur baseline node or cluster costs even when idle.
3
Select the optimal cost-effective architecture.
Cloud Run with minimum instances set to zero satisfies both the business cost optimization goal and operational simplicity requirement.
It handles rapid autoscaling during traffic bursts while charging exclusively per millisecond of active request processing.

Key Concept

Serverless Compute Right-Sizing and Scale-to-Zero Architecture
Question 1184Question

A global healthcare organization is designing a cloud architecture to process batch genomic dataset archives uploaded by partner laboratories. The dataset uploads occur unpredictably throughout the day, with volume fluctuating between zero and several hundred uploads per hour. Each processing task runs a containerized data-transformation binary that takes between 10 and 40 minutes to complete. The business goal is to minimize operational overhead and compute costs by avoiding charges for idle infrastructure while ensuring processing starts within minutes of upload. Additionally, raw uploaded archives must be preserved for compliance for five years, but are rarely accessed after the initial 30 days. Which TWO architectural recommendations should you make to meet these business and cost requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Execute containerized processing workloads using Cloud Run jobs triggered automatically by Cloud Storage object creation events via Eventarc.; Configure an Object Lifecycle Management rule on the Cloud Storage bucket to transition objects from Standard to Coldline storage 30 days after creation.

Answer

The optimal architecture combines Cloud Run jobs triggered by Eventarc upon Cloud Storage uploads with Cloud Storage Object Lifecycle Management transitioning archives to Coldline storage after 30 days.
Executing batch tasks using Cloud Run jobs triggered by Cloud Storage events allows the compute layer to scale to zero when no uploads occur, meeting the business objective of paying only for active processing time. Simultaneously, applying Cloud Storage Object Lifecycle Management to transition raw archives to Coldline storage after 30 days minimizes five-year retention costs for infrequently accessed data.

Step-by-Step Solution

1
Analyze compute cost requirements for unpredictable batch processing
Identified that workloads fluctuate from zero to hundreds of tasks per hour and require execution times up to 40 minutes.
Cloud Run jobs support tasks running up to 24 hours while scaling completely to zero when idle, avoiding GKE cluster overhead and fixed compute provisioning costs.
2
Analyze storage lifecycle and cost optimization requirements
Identified that uploaded raw files are rarely accessed after 30 days but must be retained for 5 years.
Transitioning objects from Standard to Coldline storage after 30 days significantly reduces long-term storage expenditure while maintaining compliance readiness.
3
Evaluate distractors against FinOps and architecture guidelines
Rejected standard CUD commitments, GKE clusters, and Cloud Spanner metadata storage.
These alternatives introduce unnecessary baseline provisioned costs and over-engineered compute/database capacity for episodic workloads.

Key Concept

Serverless containerized batch architecture with automated storage tiering for unpredictable workloads
Question 1185Question

A financial analytics company executes scheduled daily risk-assessment batch computations for corporate clients. The batch job runs for approximately two hours every night, requiring dynamic scaling based on client volume. The application stores financial ledger transaction records in a standard relational database with regional availability requirements. Currently, the infrastructure relies on continuously running Virtual Machines and over-provisioned database instances, incurring high idle costs. You need to redesign the solution architecture to minimize compute and database costs while meeting technical requirements. Which two architectural decisions should you recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Execute the daily batch calculations using Cloud Run Jobs so compute resources automatically scale to zero when jobs complete.; Deploy Cloud SQL with High Availability (HA) enabled for the relational database requirement.

Answer

The optimal architecture combines Cloud Run Jobs for containerized batch execution scaling to zero, and Cloud SQL with High Availability (HA) for regional relational storage.
Executing intermittent batch tasks via Cloud Run Jobs ensures compute resources are billed only for execution time and scale to zero when idle. Utilizing Cloud SQL with High Availability fulfills regional relational database durability requirements at a significantly lower cost than multi-region horizontal database offerings.

Step-by-Step Solution

1
Analyze compute cost requirements
Workload runs intermittently for 2 hours daily.
Containerized intermittent workloads achieve maximum cost efficiency by using serverless execution models (Cloud Run Jobs) that eliminate idle compute costs.
2
Analyze relational storage requirements
Database needs standard relational features within a single region.
Cloud SQL HA satisfies regional uptime requirements without incurring the multi-region global overhead cost of Cloud Spanner.

Key Concept

Selecting serverless compute for intermittent batch workloads and right-sizing relational storage databases to balance cost and availability.
Question 1186Question

A financial services organization needs to establish private, SLA-backed hybrid connectivity between its on-premises data center and a Google Cloud Virtual Private Cloud (VPC). The solution must support a throughput requirement of 1 Gbps without traversing the public internet. The organization does not have a presence in a Google colocation facility. Which Google Cloud connectivity solution should the cloud architect choose?

Show answer & explanation

Answer: Partner Interconnect

Answer

Partner Interconnect is the appropriate choice because it delivers private, SLA-backed connectivity to Google Cloud through a supported service provider without requiring direct physical presence in a Google colocation facility.
Partner Interconnect connects on-premises networks to Google Cloud VPC through a supported service provider. It satisfies requirements for private transport (bypassing the public internet), provides SLA guarantees, supports 1 Gbps capacities, and does not require the customer to co-locate in a Google edge facility.

Step-by-Step Solution

1
Evaluate internet path requirements
Disqualify HA VPN because the requirement explicitly forbids traffic traversing the public internet.
HA VPN relies on public IP routing over the internet for IPsec tunnel establishment.
2
Evaluate co-location constraints
Disqualify Dedicated Interconnect.
Dedicated Interconnect mandates a direct cross-connect at a Google colocation facility.
3
Evaluate network topology and transit rules
Disqualify VPC Network Peering as a hybrid connectivity mechanism.
VPC Peering is non-transitive and connects VPC networks internally, not on-premises sites.
4
Select supported service provider hybrid option
Partner Interconnect fulfills all throughput, private routing, SLA, and co-location constraints.
Partner Interconnect allows connection through a service provider at bandwidths starting from 50 Mbps up to 10 Gbps.

Key Concept

Partner Interconnect for Hybrid Connectivity
Estimated Time:1m 0s
Question 1187Question

An e-commerce company operates a real-time recommendation engine microservice on Google Cloud Run. The Site Reliability Engineering (SRE) team defines a Service Level Objective (SLO) requiring 99.9% of valid requests to return successful HTTP responses over a rolling 30-day window. During flash sales, transient traffic spikes occasionally consume substantial portions of the monthly error budget within a few hours before static alerts trigger, leading to exhaustion of the budget without timely intervention. Which monitoring and alerting configuration should the team implement in Cloud Monitoring to detect fast budget consumption before the error budget is fully depleted?

Show answer & explanation

Answer: Configure multi-window, multi-burn-rate alerts in Cloud Monitoring that measure short-term (e.g., 1-hour) and long-term (e.g., 6-hour) burn rates against a defined percentage of error budget consumption.

Answer

Configure multi-window, multi-burn-rate alerts in Cloud Monitoring that calculate consumption rates over multiple time windows.
Implementing multi-window, multi-burn-rate alerting in Cloud Monitoring allows SRE teams to measure the rate at which the error budget is being consumed over both short (e.g., 1 hour) and longer (e.g., 6 hours) windows. This ensures rapid detection of critical outages while preventing alert fatigue caused by minor, temporary spikes.

Step-by-Step Solution

1
Identify the reliability monitoring requirement.
The requirement is to detect severe, rapid error budget consumption (burn rate) dynamically during high-traffic periods before the 30-day budget is depleted.
Static threshold alerts fail to adapt to varying request volumes and do not reflect budget consumption speed.
2
Evaluate SRE best practices for Cloud Monitoring SLO alerting.
Multi-window, multi-burn-rate alerting uses both short-term (fast reaction) and long-term (high precision) burn-rate thresholds against the total allowable budget.
This strategy alerts page-worthy events promptly when the error budget is burning fast enough to threaten the SLO window.

Key Concept

Error Budget Burn Rate Alerting
Question 1188Question

An aerospace satellite operations company hosts its ground telemetry monitoring system on Google Cloud. The primary workload runs in region `europe-west1`, utilizing Compute Engine Managed Instance Groups (MIGs) for application servers and Cloud SQL for PostgreSQL for critical mission metadata. To comply with regulatory requirements, the system requires a Disaster Recovery (DR) warm standby in `europe-west4` capable of achieving a Recovery Point Objective (RPO) of near-zero and a Recovery Time Objective (RTO) under 15 minutes. A regional catastrophe causes a complete failure of `europe-west1`. Which set of disaster recovery execution steps should the cloud architect specify in the failover runbook?

Show answer & explanation

Answer: Promote the cross-region Cloud SQL read replica in `europe-west4` to a standalone primary instance, reconfigure the `europe-west4` MIG application instances to target the promoted database, and update Cloud DNS routing policies to direct traffic to `europe-west4`.

Answer

Promote the cross-region Cloud SQL read replica in `europe-west4` to a standalone primary instance, reconfigure the `europe-west4` MIG application instances to target the promoted database, and update Cloud DNS routing policies to direct traffic to `europe-west4`.
Promoting a cross-region Cloud SQL read replica to a standalone primary database is the standard GCP disaster recovery pattern for relational workloads requiring near-zero RPO and fast RTO. Because data is asynchronously replicated continuously across regions, promoting the replica provides immediate read-write capability. Updating application configurations and DNS routing completes the regional failover sequence within the required time window.

Step-by-Step Solution

1
Promote the standby database replica in the DR region
The Cloud SQL cross-region read replica in `europe-west4` becomes a read-write primary instance with minimal data latency loss.
Cross-region read replicas continuously replicate write-ahead logs from the primary region, providing near-zero RPO.
2
Reconfigure application connection endpoints
Application workloads in `europe-west4` point directly to the local promoted Cloud SQL instance.
Applications must reference the newly promoted read-write database endpoint to resume operational capability.
3
Switch global network traffic via Cloud DNS
Ingress traffic is rerouted from `europe-west1` to `europe-west4`.
Updating Cloud DNS routing policies directs external telemetry streams to the functional DR region.

Key Concept

Disaster Recovery execution using Cloud SQL cross-region read replica promotion
Estimated Time:1m 30s
Question 1189Question

A financial services organization is automating its multi-region environment deployment pipeline using Terraform executed by Cloud Build. To adhere to Google Cloud operational reliability and security best practices, the pipeline must prevent state file corruption during concurrent automated runs and enforce least privilege during resource provisioning. The deployment worker currently needs to provision compute and network resources across multiple target projects. How should the Site Reliability Engineering (SRE) team configure the Terraform state storage and execution permissions?

Show answer & explanation

Answer: Configure a Cloud Storage backend with Object Versioning enabled for remote state storage, and use service account impersonation by granting the Cloud Build service account the Service Account Token Creator role on a dedicated provisioning service account assigned fine-grained IAM roles.

Answer

Configure a Cloud Storage backend with Object Versioning enabled for remote state storage, and use service account impersonation by granting the Cloud Build service account the Service Account Token Creator role on a dedicated provisioning service account assigned fine-grained IAM roles.
The combination of storing Terraform remote state in a Cloud Storage bucket with Object Versioning enabled and utilizing service account impersonation via the Service Account Token Creator role fulfills all security and reliability constraints. Cloud Storage natively handles lock acquisition to protect state files from concurrent mutation, while short-lived impersonation avoids long-lived service account keys and limits execution authority to fine-grained predefined roles assigned to the target service account.

Step-by-Step Solution

1
Evaluate Terraform state storage reliability requirements.
Identify that Cloud Storage backends provide automatic native object locking via Google Cloud Storage to prevent race conditions during concurrent runs, while Object Versioning allows recovery from corrupted state updates.
Local or repository-bound state storage lacks reliable locking semantics and exposes state sensitive data.
2
Assess identity and access management for automated CI/CD pipelines.
Determine that service account impersonation using the Service Account Token Creator role enables the build runner to acquire short-lived tokens for a dedicated deployment service account without relying on static service account keys or over-privileged roles.
Directly assigning broad roles (like Owner) or administrative roles (like Service Account Admin) breaks security perimeters and governance frameworks.

Key Concept

Reliable Infrastructure as Code environment provisioning requires remote state storage with object locking and versioning in Cloud Storage, combined with short-lived service account impersonation enforcing least privilege.
Question 1190Question

An automotive telematics enterprise needs to establish hybrid connectivity between its on-premises data center and a Google Cloud VPC. The business requirement dictates a continuous, private Layer 3 connection with a bandwidth requirement of 8 Gbps for real-time telemetry streaming, without routing traffic over the public internet. The architecture must minimize ongoing connectivity and data transfer costs while fulfilling these bandwidth and security requirements. Which hybrid networking strategy should the cloud architect recommend?

Show answer & explanation

Answer: Provision a 10 Gbps Dedicated Interconnect connection to directly extend the on-premises network to Google Cloud.

Answer

Provision a 10 Gbps Dedicated Interconnect connection to directly extend the on-premises network to Google Cloud.
Provisioning a 10 Gbps Dedicated Interconnect connection establishes a direct physical link between the on-premises facility and Google Cloud. It satisfies the 8 Gbps bandwidth requirement, keeps data off the public internet, and delivers optimal per-gigabyte transfer costs for high-volume continuous traffic.

Step-by-Step Solution

1
Analyze security and networking transport constraints
Identified that traffic must remain on a private Layer 3 path without traversing the public internet.
Enterprise security policy strictly forbids routing telemetry streams across public IP endpoints.
2
Evaluate throughput requirements against GCP hybrid connectivity products
Determined that 8 Gbps continuous bandwidth exceeds the single-tunnel capacity of HA VPN (3 Gbps per tunnel).
High-throughput traffic exceeding 3 Gbps requires dedicated physical infrastructure rather than software VPN encryption over public networks.
3
Select the optimal cost and operational solution
A 10 Gbps Dedicated Interconnect link satisfies both the 8 Gbps bandwidth requirement and private routing constraint at the lowest per-gigabyte data transfer cost.
Dedicated Interconnect provides reliable high-bandwidth connectivity with lower ongoing network transfer costs for high-volume workloads.

Key Concept

Selecting hybrid connectivity (Dedicated Interconnect vs HA VPN) based on throughput limits, privacy requirements, and cost optimization.
Question 1191Question

A global logistics platform is migrating its backend operational workloads to Google Cloud. The system consists of stateless HTTP REST microservices with highly variable, bursty traffic patterns, alongside a 300 GB300\text{ GB} relational database supporting standard regional ACID transactions. The company's primary business objective is to minimize baseline infrastructure costs and operational management overhead. Which TWO architecture decisions should you recommend to achieve these cost optimization goals? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the stateless REST microservices to Cloud Run to eliminate baseline idle compute costs through automatic scale-to-zero capability.; Migrate the relational database to Cloud SQL for PostgreSQL to fulfill single-region ACID requirements while minimizing baseline licensing and management expense.

Answer

Deploy the stateless microservices on Cloud Run and host the relational database using Cloud SQL for PostgreSQL.
To minimize baseline infrastructure costs for variable stateless microservices and a moderate-sized regional database, serverless compute and regional database offerings are optimal. Cloud Run provides scale-to-zero capabilities for HTTP services, eliminating idle infrastructure expense. Cloud SQL for PostgreSQL delivers fully managed ACID compliance tailored to regional database requirements at a fraction of the cost of globally distributed database services.

Step-by-Step Solution

1
Analyze compute requirements and cost profile.
Stateless REST microservices with variable, bursty traffic benefit from serverless scale-to-zero compute (Cloud Run) rather than paying for idle compute nodes in a managed Kubernetes cluster (GKE).
Cloud Run eliminates baseline compute costs during inactive periods without management overhead.
2
Analyze storage and database requirements and cost profile.
A 300 GB300\text{ GB} single-region relational dataset requiring standard ACID compliance is best served by Cloud SQL for PostgreSQL.
Cloud Spanner is designed for global scale across multiple regions; using it for a single-region moderate workload introduces significant unnecessary minimum node costs.

Key Concept

Matching serverless compute and regional relational databases to workload scale and traffic patterns to optimize Google Cloud infrastructure costs.
Question 1192Question

An enterprise organization is deploying a major application update to a microservice hosted on Google Cloud Run that interacts with a Cloud SQL for PostgreSQL database. During a blue-green deployment, the team executes a database migration script that removes deprecated table columns required by the existing (blue) version as soon as the new (green) version is deployed. As a result, users routed to the blue deployment experience high error rates during the rollout. Which release management strategy should the cloud architect implement to prevent service disruptions during future database migrations?

Show answer & explanation

Answer: Implement an expand-and-contract database migration pattern that ensures schema modifications remain backward-compatible with the active blue version until the green version is fully deployed.

Answer

Implement an expand-and-contract database migration pattern that ensures schema modifications remain backward-compatible with the active blue version until the green version is fully deployed.
The correct answer emphasizes using the expand-and-contract (or parallel run) database migration pattern. When performing zero-downtime releases such as blue-green deployments, both older and newer application instances must run concurrently against the shared database. Decoupling schema changes into backward-compatible steps ensures that the active blue version continues functioning normally while the green version is validated.

Step-by-Step Solution

1
Analyze the cause of the failure during the blue-green deployment.
Identified that breaking database schema updates (removing columns) broke the running blue revision while both revisions were active.
Blue-green deployments require both blue and green application revisions to operate concurrently against the shared database during traffic migration.
2
Design a multi-phase database migration strategy.
Adopted the expand-and-contract pattern to decouple database migrations from application code deployments.
Expanding the schema (adding new columns without removing old ones) keeps the database backward-compatible with the blue application version.
3
Finalize the release lifecycle.
Contract (clean up) the legacy schema elements only after all traffic has migrated to the green revision.
Deferred removal of old schema elements prevents breaking active versions during traffic transition.

Key Concept

Decoupled Database Schema Migrations (Expand-and-Contract Pattern) in Blue-Green Deployments
Question 1193Question

An international retail company is migrating its regional order processing application to Google Cloud. The application relies on a standard relational database with strict ACID transaction requirements, storing 2 TB of data and handling a predictable peak load of 4,000 IOPS. The business requires high availability across zones within a single GCP region, but explicit business constraints require minimizing monthly operational overhead and infrastructure costs. Multi-region redundancy is explicitly out of scope. Which database architecture should you recommend?

Show answer & explanation

Answer: Provision Cloud SQL for PostgreSQL configured with High Availability (regional persistent disk replication across two zones).

Answer

Provision Cloud SQL for PostgreSQL configured with High Availability (regional persistent disk replication across two zones).
Cloud SQL with High Availability (HA) provides automatic failover across zones in a single region using synchronous disk replication. For a single-region 2 TB relational database with moderate throughput requirements, Cloud SQL is fully managed, meets all availability and performance needs, and minimizes monthly infrastructure costs.

Step-by-Step Solution

1
Analyze business and technical requirements
Workload requires relational ACID compliance, 2 TB storage, 4,000 IOPS peak, single-region high availability, minimal operational management, and lowest cost.
Identifying constraints dictates selecting a cost-optimized, fully managed single-region solution rather than multi-region or self-managed infrastructure.
2
Evaluate candidate GCP database offerings
Cloud SQL easily satisfies 2 TB storage and 4,000 IOPS while offering automated HA across zones within a region at a fraction of the cost of horizontally scalable multi-region databases.
Cloud Spanner provides multi-region global consistency and massive horizontal scale, which is unnecessary and far more expensive for a single-region regional RDBMS workload.
3
Select the optimal architectural decision
Recommend Cloud SQL with High Availability.
It achieves regional HA and managed administration while adhering strictly to cost optimization and minimal complexity constraints.

Key Concept

Selecting cost-effective relational database architecture based on regional vs global requirements.
Estimated Time:2m 0s
Question 1194Question

An international financial institution is designing a core transaction platform on Google Cloud. The application requires a relational database capable of global multi-region active-active processing, strong transactional consistency, zero Recovery Point Objective (RPO), and an RTO of under 5 seconds during a full regional outage. Additionally, audit operations require dedicated, SLA-backed private network connectivity from an on-premises data center to Google Cloud capable of sustaining 10 Gbps dedicated bandwidth without traversing the public internet. Which architecture fulfills these high availability and connectivity requirements while adhering to Google Cloud best practices?

Show answer & explanation

Answer: Deploy a multi-region Cloud Spanner instance across two active regions with a witness region, and establish redundant Dedicated Interconnect connections with Private Google Access enabled for private endpoint communication.

Answer

Deploy a multi-region Cloud Spanner instance across two active regions with a witness region, combined with redundant Dedicated Interconnect connections utilizing Private Google Access.
Cloud Spanner multi-region deployment uses synchronous replication across regions via Paxos consensus, delivering global ACID compliance, zero RPO, and automatic failover with sub-second RTO. Pairing this with Dedicated Interconnect ensures private, SLA-backed 10 Gbps physical network throughput for on-premises hybrid traffic via Private Google Access.

Step-by-Step Solution

1
Analyze storage and transactional availability requirements.
Identified that multi-region active-active relational transactions with zero RPO and sub-second RTO necessitate Cloud Spanner rather than Cloud SQL.
Cloud SQL only supports regional HA with synchronous replication within a single region; cross-region Cloud SQL replication is asynchronous and incurs data loss risk (RPO > 0).
2
Analyze hybrid connectivity throughput and SLA requirements.
Identified that SLA-backed 10 Gbps dedicated bandwidth requires Dedicated Interconnect.
Cloud VPN operates over the public internet and maxes out at 3 Gbps per tunnel, whereas Dedicated Interconnect provides 10 Gbps or 100 Gbps private physical pipes directly to Google.
3
Evaluate network routing topology.
Confirmed Private Google Access over Interconnect allows on-premises systems to query Cloud Spanner endpoints privately without relying on invalid transitive VPC Peering configurations.
VPC Network Peering is non-transitive and cannot forward on-premises traffic across peered VPC boundaries.

Key Concept

Multi-region High Availability and Dedicated Hybrid Networking
Question 1195Question

An enterprise organization is designing a high-availability hybrid architecture to connect their on-premises data center to a Google Cloud Virtual Private Cloud (VPC). The workload requires continuous active-active data transfers with an aggregate throughput exceeding 10 Gbps and strict protection against unauthorized data exfiltration to external Google Cloud projects. Which two configurations should you implement to satisfy both technical bandwidth and high availability requirements?

Select all that apply

Show answer & explanation

Answer: Provision a Dedicated Interconnect with redundant VLAN attachments across two distinct edge availability domains (zones) in a single metro.; Establish VPC Service Controls perimeters around the project resources to restrict data movements to authorized projects and services.

Answer

To meet high availability, high throughput, and anti-exfiltration requirements, configure Dedicated Interconnect with redundant VLAN attachments across edge availability domains and establish VPC Service Controls around the project resources.
For hybrid interconnectivity with throughput demands exceeding 10 Gbps, Dedicated Interconnect with redundant VLAN attachments across edge availability domains provides high-availability multi-gigabyte connectivity. To secure the cloud environment against data exfiltration, VPC Service Controls define network security perimeters around Google Cloud resources that prevent data from being copied to untrusted external projects, even by authorized IAM users.

Step-by-Step Solution

1
Evaluate throughput and availability needs for hybrid networking
Identify that bandwidth exceeding 10 Gbps requires Dedicated Interconnect rather than HA VPN tunnels.
HA VPN supports up to 3 Gbps per tunnel, whereas Dedicated Interconnect provides 10 Gbps or 100 Gbps dedicated pipes with high availability topologies.
2
Evaluate security requirements for data exfiltration prevention
Identify VPC Service Controls as the required perimeter security layer.
IAM alone grants permission but does not constrain the destination perimeter, leaving data vulnerable to exfiltration across project boundaries.

Key Concept

Designing High-Availability Hybrid Networking and Network Security Perimeters
Question 1196Question

A global gaming company operates a real-time multiplayer matchmaking service hosted on Google Kubernetes Engine (GKE). To maintain user satisfaction while allowing frequent service updates, the Site Reliability Engineering (SRE) team needs to align operational alerting with customer experience using Google Cloud Observability. Which TWO of the following operational strategies should the team implement to establish an effective reliability framework?

Select all that apply

Show answer & explanation

Answer: Define the Service Level Indicator (SLI) as the ratio of successful latency-compliant requests to the total valid requests measured at the Google Cloud HTTP(S) Load Balancer.; Implement multi-window, multi-burn-rate alerts in Cloud Monitoring to notify the team when error budget consumption rates threaten the SLO.

Answer

The team should define the SLI as the ratio of successful latency-compliant requests to total requests measured at the load balancer, and implement multi-window, multi-burn-rate alerts in Cloud Monitoring based on error budget consumption.
Defining the SLI as a ratio of successful/low-latency requests to total requests correctly measures user experience at the application entry point. Furthermore, using multi-window, multi-burn-rate alerting ensures the team is alerted only when the rate of error budget consumption poses a genuine threat to meeting the SLO, balancing reliability with feature deployment velocity.

Step-by-Step Solution

1
Identify valid Service Level Indicators (SLIs)
Selected the ratio of successful requests over total valid requests measured at the ingress load balancer as the quantifiable metric.
SLIs must quantify performance from the user perspective (e.g., successful/fast requests over total requests).
2
Select the optimal alerting strategy for reliability and velocity
Selected multi-window, multi-burn-rate alerting on error budget consumption.
Burn-rate alerting evaluates how fast the error budget is being consumed over multiple time windows, preventing unnecessary paging while catching critical failures early.

Key Concept

Defining SLIs as user-centric metric ratios and alerting on multi-window error budget burn rates rather than static infrastructure metrics.
Question 1197Question

A multinational logistics company is designing a hybrid network architecture to connect its primary on-premises data center with Google Cloud. The architecture must support continuous database replication requiring sustained bandwidth exceeding 12 Gbps with a guaranteed 99.99% availability SLA. Additionally, several workloads in Spoke VPC networks must communicate directly with one another without routing through a single point of failure. Which TWO architectural decisions must the cloud architect implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Provision Dedicated Interconnect circuits across two distinct edge availability domains in two separate metropolitan locations with redundant VLAN attachments.; Establish direct VPC Network Peering connections between every pair of spoke VPCs that require inter-VPC communication.

Answer

The architect must provision Dedicated Interconnect circuits across two distinct edge availability domains in two separate metropolitan locations, and establish direct VPC Network Peering connections between every pair of spoke VPCs requiring inter-communication.
To achieve a 99.99% SLA for bandwidth demands exceeding 10 Gbps, Google Cloud requires Dedicated Interconnect deployed across two metropolitan locations with dual circuits in each metro (4 connections total across 2 edge availability domains per metro). For inter-VPC traffic between spokes, because VPC Network Peering is non-transitive, spoke VPCs must be directly peered with each other to enable inter-spoke communication.

Step-by-Step Solution

1
Evaluate hybrid connectivity options based on bandwidth (>10 Gbps) and availability SLA (99.99%).
Identify that Cloud VPN (HA VPN) maxes out around 3 Gbps per tunnel and lacks 99.99% physical SLA guarantees, requiring Dedicated Interconnect across 2 metros.
Dedicated Interconnect is required for bandwidth exceeding 10 Gbps and 99.99% SLA availability.
2
Evaluate spoke-to-spoke network topology constraints using VPC Network Peering.
Recognize that VPC Network Peering links are strictly non-transitive, meaning Spoke A cannot talk to Spoke B through a Transit VPC.
Direct VPC Peering between each spoke pair is necessary for direct inter-spoke traffic without custom routing appliances.

Key Concept

Hybrid Connectivity Selection & VPC Network Peering Non-Transitivity
Question 1198Question

An enterprise organization relies on Cloud Build CI/CD pipelines and Terraform to manage and provision production Google Cloud environments across multiple regions. During recent deployments, the engineering team experienced state file lock failures during concurrent pipeline runs, as well as configuration drift caused by emergency manual console modifications. To establish operational reliability and enforce automated environment provisioning standards, which TWO strategies should the team implement?

Select all that apply

Show answer & explanation

Answer: Configure a Google Cloud Storage bucket with Object Versioning enabled as the remote Terraform backend and rely on native backend state locking.; Implement automated scheduled pipelines that execute terraform plan with detailed exit codes to detect drift, while restricting infrastructure write permissions exclusively to the CI/CD service account.

Answer

The team should configure Google Cloud Storage with Object Versioning as the remote Terraform backend for state locking, and establish automated scheduled drift detection via terraform plan while restricting infrastructure update permissions strictly to the CI/CD service account.
To maintain environment provisioning reliability, IaC state must be protected using a Cloud Storage remote backend with Object Versioning and native locking enabled to prevent race conditions. Furthermore, operational drift must be controlled by removing direct write access from human users—forcing all changes through CI/CD—and running automated scheduled plan checks to identify drift quickly.

Step-by-Step Solution

1
Analyze state management requirements for automated provisioning reliability.
Determined that storing state in Cloud Storage with Object Versioning provides distributed locking and state protection against concurrent writes.
Unversioned local or file-share state storage risks state corruption during automated CI/CD executions.
2
Analyze deployment drift and privilege governance requirements.
Determined that revoking manual console write permissions from engineers and scheduling automated drift detection using terraform plan maintains environment integrity.
Preventing manual interventions eliminates out-of-band changes, ensuring the IaC repository remains the single source of truth.

Key Concept

Reliable Infrastructure as Code State Management and Drift Governance
Question 1199Question

A global telemetry platform processes real-time device status payloads ingested across North America and Europe. The workload experiences sudden 10x traffic spikes and requires high availability with minimal operational infrastructure management during low-traffic periods. Additionally, security compliance mandates that sensitive payload logs stored in Cloud Storage must be protected against data exfiltration, ensuring that compromised identity credentials alone cannot copy data to unauthorized external storage buckets outside the corporate perimeter. Which TWO architecture design choices should be implemented to satisfy these technical and availability requirements? (Select TWO choices.)

Select all that apply

Show answer & explanation

Answer: Deploy the HTTP ingestion workload using Cloud Run across multiple regions, configured behind a Global External Application Load Balancer with serverless Network Endpoint Groups (NEGs).; Configure VPC Service Controls around the project resources and define a security perimeter encompassing Cloud Storage services to restrict data egress to authorized networks.

Answer

The correct combination requires using Cloud Run deployed across multiple regions behind a Global External Application Load Balancer with serverless NEGs for stateless autoscaling HTTP ingestion, alongside VPC Service Controls to establish a security perimeter preventing data exfiltration from Cloud Storage.
Combining multi-region Cloud Run deployments behind a Global External Application Load Balancer with serverless NEGs delivers seamless multi-region high availability and rapid autoscaling without keeping idle compute instances running. Pairing this compute tier with VPC Service Controls around Cloud Storage isolates bucket access within a designated security perimeter, preventing compromised IAM credentials from copying internal data to non-permitted external storage targets.

Step-by-Step Solution

1
Analyze compute tier high availability and scaling requirements.
Identified that stateless HTTP ingestion with zero-idle cost and sudden 10x traffic spikes is best served by regional Cloud Run instances behind a Global External Application Load Balancer using serverless NEGs.
GKE requires ongoing cluster administration and baseline node costs, whereas Cloud Run provides fully managed serverless scale-to-zero capabilities with global load balancing.
2
Analyze security and data exfiltration constraints.
Identified that preventing credential-based data exfiltration to external storage buckets requires network perimeter controls via VPC Service Controls.
IAM authorization validates identity but cannot block an authorized user or compromised key from copying objects into an external project outside the corporate perimeter.

Key Concept

Designing multi-region serverless architectures for variable scale and enforcing network perimeters with VPC Service Controls for exfiltration prevention.
Question 1200Question

A smart energy grid company ingests continuous HTTP telemetry streams from millions of regional meters and executes scheduled nightly batch processing for billing calculations. Raw telemetry payloads must be retained for 55 years for regulatory compliance but are accessed less than once per year after 3030 days. The company's database stores regional device state metadata requiring standard relational SQL querying and high availability, but does not require global multi-region write synchronization. The chief architecture officer has set strict business mandates to minimize baseline compute management overhead, eliminate unnecessary database licensing costs, and reduce long-term cold storage expenditure. Which TWO architectural decisions should you recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the stateless HTTP telemetry ingestion microservices on Cloud Run, and set Cloud Storage Lifecycle Management rules to transition raw telemetry objects to Coldline Storage after 30 days and Archive Storage after 365 days.; Provision regional Cloud SQL for PostgreSQL with High Availability for device metadata, and execute nightly batch processing jobs using Spot VMs or Cloud Run Jobs.

Answer

The optimal solution requires deploying stateless HTTP ingestion microservices on Cloud Run paired with Cloud Storage Lifecycle Management rules for cold data archiving, along with utilizing regional Cloud SQL for PostgreSQL with High Availability and executing fault-tolerant nightly batch jobs on Spot VMs or Cloud Run Jobs.
Combining Cloud Run with Cloud Storage Lifecycle Management provides automated scaling down to zero for HTTP services while drastically reducing storage expenses for long-term audit logs. Selecting regional Cloud SQL with HA satisfies relational database needs without Spanner's expensive multi-region overhead, and running batch jobs on Spot VMs capitalizes on discounted, transient compute capacity.

Step-by-Step Solution

1
Analyze stateless microservice compute and long-term storage requirements.
Cloud Run handles HTTP traffic serverlessly with zero idle cost, and Cloud Storage Lifecycle Management automates cost reduction for compliance data by moving objects to Coldline and Archive tiers.
Reduces operational management overhead and storage costs without architectural over-engineering.
2
Evaluate relational database scale and workload batch characteristics.
Regional Cloud SQL for PostgreSQL HA satisfies transactional single-region metadata needs without multi-region Spanner costs. Nightly batch workloads leverage Spot VMs or Cloud Run Jobs to minimize compute expenditure.
Avoids over-provisioning global database infrastructure and eliminates idle compute capacity billing for intermittent batch processing.

Key Concept

Balancing Serverless Compute, Database Right-Sizing, and Automated Lifecycle Storage Optimization in GCP Architecture
Estimated Time:2m 30s
PreviousPage 60 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin