Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 1201Question →

A digital media enterprise needs to connect its on-premises data center directly to a Google Cloud Virtual Private Cloud (VPC) network. The workload requires a private, high-capacity connection supporting 20 Gbps of bandwidth that bypasses the public internet and provides SLA-backed reliability. Which hybrid connectivity technology should the organization choose?

Show answer & explanation

Answer: Dedicated Interconnect

Answer

Dedicated Interconnect is the correct hybrid connectivity solution for private, SLA-backed throughput above 10 Gbps that bypasses the public internet.
Dedicated Interconnect establishes a direct physical connection between an enterprise network and Google Cloud. It easily satisfies the 20 Gbps bandwidth requirement using 10 Gbps or 100 Gbps circuits, guarantees enterprise-grade SLAs, and operates completely off the public internet.

Step-by-Step Solution

1
Analyze the bandwidth requirement (20 Gbps) and privacy constraints.
Requirements exceed the standard throughput capacity of IPsec VPN solutions (3 Gbps per tunnel) and require a connection isolated from the public internet.
Dedicated Interconnect supports 10 Gbps or 100 Gbps physical circuits directly into Google's network edge.
2
Evaluate GCP hybrid connectivity features.
Dedicated Interconnect provides enterprise SLAs and direct physical routing to Google Cloud VPC resources via private IP addresses.
It fulfills the security, SLA, and high-bandwidth criteria specified in the scenario.

Key Concept

Designing Network Architecture and Hybrid Connectivity
Question 1202Question →

An enterprise security architect is designing a defense-in-depth network architecture across a multi-project Google Cloud deployment. Match each Google Cloud network security control on the left to its primary architectural use case on the right.

Click a left item, then click its matching right item

Items

VPC Service Controls Perimeter
Cloud Armor Security Policy
Hierarchical Firewall Policy with Secure Tags
Private Service Connect Endpoint

Matches

Show answer & explanation

Answer

VPC Service Controls Perimeter maps to defining security boundaries to prevent data exfiltration; Cloud Armor Security Policy maps to mitigating Layer 7 web application vulnerabilities at the edge; Hierarchical Firewall Policy with Secure Tags maps to enforcing top-down network rules using resource tagging; Private Service Connect Endpoint maps to consuming services privately without VPC peering.
Each Google Cloud network security tool addresses a distinct operational layer in the defense-in-depth model: VPC Service Controls secures GCP service API boundaries to prevent data exfiltration; Cloud Armor provides edge L7 WAF protection; Hierarchical Firewall Policies enforce centralized organization-wide L3/L4 rules using Secure Tags; and Private Service Connect provides isolated private endpoint access to services without requiring VPC Peering connections.

Step-by-Step Solution

1
Analyze the role of VPC Service Controls
Identified that VPC Service Controls protect GCP service APIs (e.g., Cloud Storage, BigQuery) from exfiltration, which matches restricting API access across boundaries.
VPC SC acts at the API level rather than traditional IP packet filtering.
2
Analyze the role of Cloud Armor
Identified that Cloud Armor evaluates incoming web traffic at Google's edge, protecting against Layer 7 attacks like SQLi/XSS.
Cloud Armor integrates directly with Cloud Load Balancing for edge security.
3
Analyze Hierarchical Firewall Policies with Secure Tags
Identified that hierarchical policies apply at the organization or folder level and leverage Secure Tags bound to IAM to control instance traffic.
Hierarchical firewalls enforce centralized governance across multiple projects.
4
Analyze Private Service Connect
Identified that Private Service Connect exposes endpoints internally using consumer IP addresses, avoiding VPC Peering requirements.
PSC simplifies private access without IP overlap or transitive peering issues.

Key Concept

Google Cloud Perimeter Security & Network Controls Selection
Estimated Time:1m 30s
Question 1203Question →

A healthcare analytics enterprise is designing a mission-critical patient monitoring architecture on Google Cloud. The system ingests continuous asynchronous event streams with highly variable memory demands and persists high-throughput transactional records. The solution must guarantee zero Recovery Point Objective (RPO=0) and under 30 seconds Recovery Time Objective (RTO) across full regional infrastructure failures. Furthermore, the architecture must minimize operational management overhead for stateless compute containers while strictly preventing authorized internal users from exfiltrating sensitive patient dataset records to external Cloud Storage buckets outside the organization. Which combination of GCP architectural components and security controls fulfills all technical and high availability requirements?

Show answer & explanation

Answer: Deploy Cloud Spanner across a multi-region configuration for transactional data, host stateless event microservices on Cloud Run with memory-based autoscaling, and establish VPC Service Controls around the storage and database resource perimeters.

Answer

Deploy Cloud Spanner across a multi-region instance configuration, host stateless event microservices on Cloud Run, and establish VPC Service Controls around the storage and database perimeters.
The correct strategy combines multi-region Cloud Spanner for zero-RPO database replication, Cloud Run for zero-management serverless microservice execution, and VPC Service Controls to establish network-level perimeter boundaries preventing data exfiltration to unauthorized buckets.

Step-by-Step Solution

1
Evaluate multi-region data storage for RPO=0 requirements.
Cloud Spanner multi-region configurations utilize synchronous Paxos consensus across multi-region zones, guaranteeing RPO=0 and seamless failover within RTO limits.
Regional database solutions like Cloud SQL rely on asynchronous cross-region replication, which violates the strict zero RPO requirement during regional disasters.
2
Select the optimal compute abstraction for stateless event processing with minimal management overhead.
Cloud Run offers fully managed serverless execution for stateless containerized microservices, eliminating cluster administration.
GKE requires ongoing node management, control plane configuration, and capacity planning, which introduces unnecessary operational overhead for stateless microservice workloads.
3
Determine perimeter security mechanism against data exfiltration.
VPC Service Controls form a security perimeter restricting data movement to authorized GCP project boundaries.
IAM alone cannot stop authorized identities from transferring data to external, unauthorized storage buckets outside the security boundary.

Key Concept

Designing Multi-Region High Availability Architectures with Serverless Compute and Data Exfiltration Security
Estimated Time:3m 0s
Question 1204Question →

An international media production studio is designing a hybrid network architecture on Google Cloud. The team connected their primary on-premises data center to a central Hub VPC network using Dedicated Interconnect. To isolate environments for separate project teams, they created standalone VPC networks for a Rendering workload and an Asset Storage workload, connecting both to the Hub VPC using VPC Network Peering. On-premises workstations must communicate directly with resources in both the Rendering and Asset Storage VPCs, but network testing shows traffic from on-premises cannot reach either peered VPC. How should you redesign the network architecture to enable full on-premises connectivity to all workloads while minimizing operational overhead?

Show answer & explanation

Answer: Migrate the cloud footprint to a Shared VPC architecture where a Host Project contains the Dedicated Interconnect and shares subnets with Service Projects hosting the Rendering and Asset Storage workloads.

Answer

Migrate the cloud footprint to a Shared VPC architecture where a Host Project contains the Dedicated Interconnect and shares subnets with Service Projects hosting the Rendering and Asset Storage workloads.
Migrating to a Shared VPC architecture consolidates network infrastructure into a single Host Project while keeping application workloads isolated inside Service Projects. Because all subnets exist natively within the same Shared VPC network, the Dedicated Interconnect connection in the Host Project provides direct IP reachability to all workloads without violating transitive routing restrictions.

Step-by-Step Solution

1
Analyze the connectivity issue and network constraint.
Identified that traffic from on-premises over Dedicated Interconnect cannot reach the Rendering and Asset Storage VPCs because VPC Network Peering does not support transitive routing.
Google Cloud VPC Network Peering strictly limits route propagation to directly peered VPC networks; external routes learned via Cloud Router over Dedicated Interconnect are not advertised across peer boundaries to additional spokes.
2
Evaluate GCP networking patterns for hybrid connectivity across multiple projects.
Determined that Shared VPC allows centralized network management, where a Host Project owns the VPC network, subnets, and Cloud Interconnect attachments, while Service Projects isolate compute resources.
By placing all subnets within a single Shared VPC network across projects, on-premises traffic arriving via Dedicated Interconnect can reach all subnets directly without traversing a peering hop.
3
Select the optimal architectural solution.
Adopted Shared VPC with Dedicated Interconnect provisioned in the Host Project.
This design satisfies high-throughput hybrid connectivity requirements, eliminates the non-transitive routing barrier, and maintains environment separation with minimal management overhead.

Key Concept

VPC Network Peering Non-Transitivity vs Shared VPC Architecture
Question 1205Question →

A media company is designing a high-availability solution on Google Cloud for a stateless REST API that serves mobile clients. The solution must automatically scale to handle unpredictable traffic spikes, provide multi-zone redundancy within a single region, and minimize operational infrastructure management overhead. Which TWO architectural components should the cloud architect select to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Cloud Run deployed in the target region to host the stateless API containers with automatic scaling and zero server management; Global External HTTP(S) Load Balancer to manage incoming client traffic, provide TLS termination, and distribute requests to backend services

Answer

The cloud architect should select Cloud Run to host the stateless API containers serverlessly across zones and a Global External HTTP(S) Load Balancer to manage and route incoming client traffic.
To design a highly available, low-maintenance architecture for a stateless REST API, combining Cloud Run and a Global External HTTP(S) Load Balancer is optimal. Cloud Run provides automated multi-zone deployment, serverless scaling, and zero infrastructure management. The Global External HTTP(S) Load Balancer provides robust front-end ingress management, health checks, and global scalability.

Step-by-Step Solution

1
Analyze compute requirements for stateless autoscaling and operational overhead
Cloud Run satisfies the requirement for containerized, stateless compute with multi-zone availability and minimal management overhead.
Serverless container platforms scale automatically to zero or high volume without needing VM or cluster infrastructure administration.
2
Identify the appropriate traffic routing component for high availability
Global External HTTP(S) Load Balancer provides high availability, global frontend IP, and seamless routing to serverless backends.
Load balancing ensures incoming HTTP(S) traffic from mobile clients is reliably distributed with built-in resilience.

Key Concept

Serverless High Availability and Traffic Management Architecture
Question 1206Question →

An enterprise IoT fleet management service runs its telemetry ingestion endpoint on Google Cloud Run. The Site Reliability Engineering (SRE) team has set a Service Level Objective (SLO) of 99.95%99.95\% availability over a rolling 30-day window (assuming 1 day = 24 hours). During the current 30-day period, an outage caused total service unavailability for 12 minutes, and a performance regression caused an error budget consumption equivalent to another 4 minutes of downtime. What is the remaining allowable downtime in minutes for this service within the 30-day window?

Show answer & explanation

Answer: 5.6

Answer

The remaining allowable downtime is 5.6 minutes.
For a 30-day window, total minutes equal 30×24×60=43,20030 \times 24 \times 60 = 43,200 minutes. With an SLO of 99.95%99.95\%, the allowable downtime percentage is 0.05%0.05\%, giving a maximum allowable downtime of 43,200×0.0005=21.643,200 \times 0.0005 = 21.6 minutes. Since 1616 minutes (12+412 + 4) of error budget have already been consumed, the remaining allowable downtime is 21.6−16=5.621.6 - 16 = 5.6 minutes.

Step-by-Step Solution

1
Calculate the total duration of the rolling window in minutes.
30 days = 43,200 minutes.
The SLO is defined over a 30-day window, so error budget calculations must be based on the total minutes in that timeframe.
2
Calculate total allowable error budget in downtime minutes based on the 99.95% SLO.
Total allowable downtime = 21.6 minutes.
An SLO target of 99.95% permits an allowable unreliability percentage of 0.05%, which corresponds to 43,200 * 0.0005 = 21.6 minutes of downtime.
3
Subtract the total consumed error budget (downtime minutes) from the total allowable budget.
Remaining downtime = 5.6 minutes.
The service experienced 12 minutes of complete outage plus 4 minutes of equivalent downtime, consuming a total of 16 minutes out of the 21.6 allowable minutes.

Key Concept

Error Budget Calculation for Availability SLOs
Estimated Time:1m 30s
Question 1207Question →

A financial trading firm processes high-frequency market order validation using worker instances in a Compute Engine Managed Instance Group (MIG) consuming jobs from a Cloud Pub/Sub queue. During market opening bursts, transaction volume spikes up to 10×10\times baseline. During recent load testing, worker instances failed to scale out quickly enough because scaling was driven solely by CPU utilization while threads blocked on I/O operations, and rapid scale-out attempts triggered resource allocation failures due to regional project limits. Which TWO actions should the Cloud Architect recommend to optimize capacity planning and workload scaling for this architecture? (Select TWO answers)

Select all that apply

Show answer & explanation

Answer: Reconfigure the Managed Instance Group autoscaling policy to use a Cloud Monitoring metric based on Cloud Pub/Sub unacknowledged message count or queue depth.; Audit regional vCPU resource quotas in advance of peak trading events and submit quota increase requests for the target region.

Answer

The Cloud Architect should reconfigure the Managed Instance Group autoscaling policy to scale based on Cloud Pub/Sub queue depth metrics rather than CPU utilization, and proactively audit and request regional vCPU quota increases before peak events.
For queue-based, I/O-bound worker workloads, autoscaling must be tied to queue backlog (such as Pub/Sub unacknowledged messages) rather than CPU utilization. Additionally, capacity planning requires preemptive verification and increases of regional vCPU quotas so that automated scaling does not hit quota caps during burst events.

Step-by-Step Solution

1
Analyze the autoscaling bottleneck for I/O-bound worker workloads.
Workers waiting on network or disk I/O remain idle on CPU, keeping CPU utilization low even when message queues overflow.
Scaling on queue depth metrics ensures instance counts scale proportionally to outstanding work.
2
Evaluate infrastructure provisioning boundaries.
Autoscaling cannot provision instances beyond regional GCP quota limits.
Capacity planning requires requesting regional quota adjustments prior to expected traffic bursts.

Key Concept

Queue-Based Autoscaling and Quota Management
Question 1208Question →

A global energy utility enterprise is designing a hybrid network architecture between its legacy control centers, regional operational offices, and Google Cloud VPC networks. Match each specific architectural requirement to the most appropriate Google Cloud hybrid connectivity or topology solution.

Click a left item, then click its matching right item

Items

Provisioning 50 Gbps dedicated bandwidth from an enterprise colocation facility requiring a guaranteed 99.99% availability SLA.
Connecting a regional operational facility that lacks direct colocation access with a bandwidth requirement of 2 Gbps.
Establishing encrypted IPsec tunnel connectivity over the public internet with automated BGP failover for a 99.99% SLA.
Connecting two distinct Google Cloud VPCs directly for low-latency communications while maintaining strict non-transitive routing boundaries.

Matches

Show answer & explanation

Answer

Each hybrid connectivity requirement matches its corresponding GCP networking solution based on bandwidth capacity, colocation capabilities, availability SLA targets, and routing transitivity constraints.
Matching each requirement accurately aligns GCP connectivity features with operational constraints: Dedicated Interconnect for colocation facilities with high bandwidth requirements (50 Gbps) and dual edge domains for 99.99% SLA; Partner Interconnect for non-colocated facilities with sub-10 Gbps needs (2 Gbps); HA VPN for encrypted internet transport with 99.99% SLA via active-active tunnels; and VPC Network Peering for non-transitive direct VPC communications.

Step-by-Step Solution

1
Evaluate high-bandwidth colocation requirement (50 Gbps, 99.99% SLA)
Select Dual Dedicated Interconnect across edge availability domains.
Dedicated Interconnect supports high-capacity 10/100 Gbps circuits at supported colocation facilities. Redundancy across two edge availability domains is mandatory to fulfill a 99.99% availability SLA.
2
Evaluate non-colocated branch office requirement (2 Gbps capacity)
Select Partner Interconnect.
Partner Interconnect provides hybrid connectivity through supported service providers for locations lacking direct Google colocation facilities and supports sub-10 Gbps capacities.
3
Evaluate encrypted internet connectivity with 99.99% SLA
Select High Availability (HA) Cloud VPN.
HA VPN guarantees 99.99% uptime using dual active-active IPsec tunnels over the public internet paired with BGP dynamic routing.
4
Evaluate direct VPC-to-VPC private connectivity with non-transitive isolation
Select VPC Network Peering.
VPC Network Peering provides low-latency internal IP routing between VPCs without intermediate gateway hops and is strictly non-transitive.

Key Concept

Selecting hybrid connectivity technologies (Dedicated Interconnect, Partner Interconnect, HA VPN) and VPC Peering based on SLA, bandwidth, and location constraints.
Question 1209Question →

An enterprise IoT telemetry platform ingests high-volume device metrics through an External Application Load Balancer into BigQuery and Cloud Storage. The security team mandates two specific security controls: first, protection against Layer 7 HTTP flood denial-of-service (DDoS) attacks at the network edge; second, prevention of unauthorized data movement to external storage locations by internal users who hold legitimate IAM access to the dataset. Which TWO security controls should you implement to satisfy these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Attach a Google Cloud Armor security policy with rate-limiting rules to the External Application Load Balancer backend service.; Configure a VPC Service Controls service perimeter around the BigQuery and Cloud Storage resources.

Answer

The architect must configure a Google Cloud Armor security policy with rate limiting attached to the Load Balancer backend service, and establish a VPC Service Controls service perimeter enclosing the BigQuery and Cloud Storage resources.
Attaching a Google Cloud Armor security policy with rate limiting to the load balancer backend service effectively mitigates Layer 7 HTTP flood attacks at the edge. Additionally, placing BigQuery and Cloud Storage inside a VPC Service Controls perimeter blocks unauthorized data movement to external GCP projects or buckets, mitigating exfiltration risks from credentialed users.

Step-by-Step Solution

1
Address Layer 7 edge DDoS attack mitigation
Google Cloud Armor security policies with rate-limiting rules are attached to backend services of External Application Load Balancers, filtering malicious traffic at Google's network edge.
Cloud Armor protects infrastructure from application-layer DDoS attacks and rate-limits excess traffic prior to backend processing.
2
Address data exfiltration prevention for internal IAM users
Define a VPC Service Controls perimeter around sensitive GCP services (BigQuery and Cloud Storage).
VPC Service Controls restricts communication with Google Cloud APIs across perimeter boundaries, preventing data exfiltration to unauthorized GCP locations even if users have valid IAM permissions.

Key Concept

Combining Google Cloud Armor for edge application security with VPC Service Controls for data exfiltration prevention.
Question 1210Question →

A media publishing enterprise needs to onboard existing, manually provisioned Google Cloud infrastructure—specifically Cloud Storage buckets and Compute Engine instances—into a managed Terraform workflow backed by a secure remote state. What is the correct sequence of operational steps to safely import these resources and ensure configuration alignment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with provisioning the remote GCS backend bucket with versioning and uniform access, followed by configuring the backend and running `terraform init`. Next, matching declarative Terraform HCL resource blocks are defined, after which `terraform import` binds the live GCP resources to state addresses. Finally, `terraform plan` is executed to confirm zero configuration drift.
Safely incorporating existing (brownfield) Google Cloud infrastructure into Terraform requires establishing the infrastructure state lifecycle in a precise sequence. First, the GCS bucket for remote backend state must be created with state protection features (versioning and uniform bucket-level access). Second, `terraform init` initializes the workspace to connect to this remote backend. Third, HCL resource definitions are written to provide the schema target. Fourth, `terraform import` maps the existing live infrastructure IDs into the remote state file. Finally, `terraform plan` validates that no unintended drift or destructive actions will occur when managing the resources declaratively going forward.

Step-by-Step Solution

1
Provision remote state bucket in GCS
A secure GCS bucket with versioning and uniform bucket-level access is available for state storage.
Remote state backend storage must be provisioned before Terraform can use it to maintain state and lock state during operations.
2
Configure backend and initialize Terraform
Terraform working directory is initialized and linked to the GCS remote backend.
Initializing Terraform establishes remote state management and locks access to prevent concurrent state modifications.
3
Define target resource HCL blocks
Declarative resource code blocks exist in Terraform files corresponding to live infrastructure.
`terraform import` requires target resource addresses defined in HCL prior to binding existing live infrastructure.
4
Import existing GCP resources into Terraform state
The Terraform state file is updated with attribute metadata from live GCP resources.
Importing binds existing infrastructure instances to Terraform state without destroying or recreating them.
5
Validate synchronization with terraform plan
Verification confirms that zero infrastructure changes or destructions are pending.
Running a plan immediately after import verifies that the declarative HCL matches the imported live state.

Key Concept

Brownfield resource import into Terraform state using secure GCS remote backend governance
Question 1211Question →

A healthcare technology SaaS provider processes asynchronous, batch-oriented PDF diagnostic report generation tasks. The workload experiences severe traffic spikes during business hours but experiences zero execution demand during nights and weekends. The rendered document metadata must be stored in a consistent relational format. The primary business requirement is to strictly minimize operational overhead and infrastructure costs while maintaining transactional database integrity for single-region operations. Which TWO architectural decisions should you recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Execute the containerized PDF generation tasks using Cloud Run jobs triggered on-demand to leverage automatic scale-to-zero capability.; Store diagnostic report metadata in Cloud SQL for PostgreSQL configured with storage auto-scaling and automatic backups.

Answer

The optimal architectural design requires selecting Cloud Run jobs for on-demand batch execution scaling to zero, combined with Cloud SQL for PostgreSQL to handle single-region relational data cost-effectively.
Combining Cloud Run jobs with Cloud SQL directly addresses the business objective of minimizing cost while fulfilling technical requirements. Cloud Run jobs scale completely to zero during idle periods so you pay strictly per execution second. Cloud SQL provides managed relational persistence aligned with single-region budget parameters.

Step-by-Step Solution

1
Analyze compute workload requirements for batch processing
Identified that PDF report rendering is an asynchronous, bursty batch job with long idle periods.
Serverless containers (Cloud Run jobs) eliminate idle cost by scaling to zero when no tasks are queued.
2
Evaluate database requirements for metadata persistence
Identified single-region relational storage requirement with cost optimization focus.
Cloud SQL fulfills relational ACID requirements with low baseline costs, avoiding the multi-node minimum cost envelope of Cloud Spanner.

Key Concept

Cost-effective serverless batch compute and relational storage selection
Question 1212Question →

An enterprise application deployed on Google Cloud requires regional high availability for a relational database workload operating within a single region. The solution must support standard ACID compliance and provide automatic failover to a secondary availability zone with minimal recovery time objective (RTO) in the event of a zonal outage. Which deployment strategy fulfills these technical availability requirements while avoiding unnecessary architectural complexity?

Show answer & explanation

Answer: Configure a Cloud SQL instance with High Availability (HA) enabled, utilizing regional persistent disk replication and a standby instance in a secondary zone within the same region.

Answer

Configuring a Cloud SQL instance with High Availability (HA) using regional persistent disk replication and a secondary zone standby instance satisfies the single-region high availability requirements with minimal operational complexity.
Configuring Cloud SQL with High Availability (HA) provisions a primary instance in one zone and a standby instance in another zone within the same region. Data is synchronously replicated at the persistent disk layer, allowing Google Cloud to automatically fail over to the standby instance if the primary zone becomes unavailable.

Step-by-Step Solution

1
Analyze the technical requirements
Workload needs single-region relational database HA with automated zonal failover and low RTO.
Determining the scope (single-region vs multi-region) isolates the appropriate managed database product.
2
Evaluate Cloud SQL High Availability configuration
Cloud SQL HA uses synchronous block-level storage replication between a primary and standby zone in the same region, enabling automatic failover.
This natively fulfills the high availability and automated failover criteria for single-region relational workloads.
3
Eliminate over-engineered and improper architectural choices
Cloud Spanner is unnecessary for single-region workloads; direct health checks to DB tables risk cascading failures; daily backups fail automated HA RTO goals.
Selecting native Cloud SQL HA avoids extra cost, complexity, and downtime.

Key Concept

Designing Cloud SQL High Availability for Single-Region Relational Workloads
Question 1213Question →

An organization is deploying a standard internal business application in a single Google Cloud region. The application requires a fully managed relational database that supports standard SQL queries and ACID transactions. The application workload does not require horizontal scaling across multiple regions or global availability. Which Google Cloud service should you select to meet these requirements with minimal cost and operational overhead?

Show answer & explanation

Answer: Cloud SQL

Answer

Cloud SQL is the optimal service for single-region managed relational database workloads requiring standard SQL capabilities and ACID compliance.
Cloud SQL is Google Cloud's managed relational database service specifically built for regional MySQL, PostgreSQL, and SQL Server workloads requiring ACID transactions and full SQL capabilities.

Step-by-Step Solution

1
Analyze workload requirements
Identified the need for a relational database with SQL support, ACID compliance, and single-region operational scope.
Matching access patterns and functional constraints determines the appropriate GCP storage category.
2
Evaluate database service options against operational complexity and cost
Cloud SQL satisfies all relational and transactional requirements within a single region at a lower cost tier compared to globally distributed alternatives.
Cloud Spanner is intended for multi-region or horizontally scaled global relational workloads, making Cloud SQL the best fit for standard single-region applications.

Key Concept

Selecting Cloud SQL versus Cloud Spanner based on regional scale and relational database requirements.
Question 1214Question →

A global freight logistics platform processes time-critical shipment dispatch requests using a Cloud Run microservice. The Site Reliability Engineering (SRE) team has established a Service Level Objective (SLO) requiring a 99.9% success rate for HTTP request processing over a rolling 30-day window. During a recent minor service degradation, 15% of the 30-day error budget was consumed over a 2-hour period without triggering an alert because alerting was configured using a static 5-minute error rate threshold set at 5%. The team needs to redesign the alerting mechanism to ensure prompt notification for high budget burn rates while avoiding false-alarm fatigue caused by brief transient spikes. Which alerting implementation should the Cloud Architect recommend?

Show answer & explanation

Answer: Implement multi-window, multi-burn-rate alerting in Cloud Monitoring that evaluates error budget consumption across both short and long lookback windows.

Answer

Implement multi-window, multi-burn-rate alerting in Cloud Monitoring that evaluates error budget consumption across both short and long lookback windows.
The correct recommendation is to implement multi-window, multi-burn-rate alerts. In Google SRE practices, monitoring error budget burn rates over short lookback windows (e.g., 5 minutes and 1 hour) catches severe outages rapidly, while checking longer lookback windows (e.g., 6 hours and 3 days) ensures sustained smaller error rates are caught before depleting the 30-day budget.

Step-by-Step Solution

1
Analyze the existing alerting defect
The current static 5-minute threshold of 5% failed to detect a sustained 2-hour degradation that consumed 15% of the total monthly error budget.
Static single-window thresholds cannot balance fast detection of sustained low-rate budget leaks with immunity to short-lived spikes.
2
Evaluate SRE best practices for SLO-based alerting
Multi-window, multi-burn-rate alerting calculates burn rates over multiple time windows (e.g., short windows for rapid depletion and longer windows for gradual depletion).
This approach ensures critical alerts fire quickly when large fractions of the error budget are consumed, while preventing alert fatigue.
3
Select the optimal GCP Cloud Monitoring strategy
Configuring Cloud Monitoring burn-rate alerts with multiple lookback windows directly addresses both fast and slow budget consumption scenarios.
This aligns precisely with Google SRE principles and standard GCP Cloud Architect operational requirements.

Key Concept

Multi-window, multi-burn-rate SLO alerting for error budget management
Question 1215Question →

A backend engineering team is configuring an automated integration testing pipeline inside a CI/CD container for a microservice that interacts with Cloud Pub/Sub and Cloud Firestore. They want to execute tests locally against Google Cloud emulators without making live GCP API calls or supplying actual cloud credentials. Which TWO configuration actions must the team take to ensure the client libraries automatically route traffic to the emulators? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Export the PUBSUB_EMULATOR_HOST environment variable set to the host and port where the Pub/Sub emulator is listening.; Export the FIRESTORE_EMULATOR_HOST environment variable set to the host and port where the Firestore emulator is listening.

Answer

To configure Google Cloud client libraries to communicate with local emulators, the team must set the specific host environment variables `PUBSUB_EMULATOR_HOST` and `FIRESTORE_EMULATOR_HOST`. When these environment variables are detected in the execution environment, GCP client libraries automatically disable standard IAM authentication checks and route all network traffic to the designated local host and port endpoints.
Google Cloud client libraries automatically check for specific environment variables upon initialization. When `PUBSUB_EMULATOR_HOST` and `FIRESTORE_EMULATOR_HOST` are present in the runtime environment, the SDKs route all request payloads to the specified local endpoints and bypass authentication requirements. This allows fast, cost-free, isolated integration testing within CI/CD pipelines.

Step-by-Step Solution

1
Identify the standard mechanism used by Google Cloud client SDKs to detect local emulators.
Google Cloud client libraries look for specific service emulator host environment variables at initialization time.
Setting service-specific host variables allows zero-code-change switching between local emulation and production cloud backends.
2
Configure environment variables for Cloud Pub/Sub and Cloud Firestore.
Define `PUBSUB_EMULATOR_HOST` and `FIRESTORE_EMULATOR_HOST` inside the test container execution environment.
These environment variables direct Pub/Sub and Firestore client calls to local container ports (e.g., `localhost:8085` and `localhost:8080`).
3
Evaluate authentication requirements for emulator testing.
Confirm that credentials and service account keys are completely bypassed by the client libraries when emulator variables are set.
Emulators run locally and emulate API behavior without verifying real GCP credentials or IAM role bindings.

Key Concept

Configuring service-specific environment variables for local GCP emulators in automated test pipelines
Question 1216Question →

An enterprise is designing a high-availability infrastructure on Google Cloud to support a mission-critical internal batch analytics pipeline. The workload operates within a single GCP region, requires compute resilience against zonal failures, and requires a dedicated hybrid connection to on-premises systems capable of sustaining continuous traffic exceeding 10 Gbps10\text{ Gbps}. Which of the following architectural design choices should the cloud architect implement to meet these technical availability and connectivity requirements? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Deploy the application instances across a Regional Managed Instance Group (MIG) distributed across multiple zones with auto-healing and load balancer health checks enabled.; Establish Dedicated Interconnect with redundant physical connections between the on-premises data center and Google's network edge.

Answer

The correct architecture uses a Regional Managed Instance Group across multiple zones combined with Dedicated Interconnect for high-throughput hybrid connectivity.
Deploying a Regional Managed Instance Group ensures compute instances are provisioned across multiple availability zones within the region, providing resilience against single-zone failures. For network connectivity exceeding 10 Gbps, Dedicated Interconnect provides enterprise-grade, high-bandwidth circuits to meet high-throughput requirements.

Step-by-Step Solution

1
Evaluate compute high availability requirements
Regional Managed Instance Groups (MIGs) spread virtual machine instances evenly across multiple zones within a single region, providing zonal redundancy and auto-healing capabilities.
Zonal outages will not crash the workload if instances are distributed regionally.
2
Evaluate hybrid network connectivity requirements for throughput > 10 Gbps
Dedicated Interconnect provides 10 Gbps or 100 Gbps circuits extending on-premises networks to Google Cloud.
Cloud VPN tunnels max out at 3 Gbps per tunnel, which cannot meet a 10 Gbps single-tunnel throughput requirement.

Key Concept

High-Availability Compute and High-Throughput Hybrid Connectivity
Question 1217Question →

An enterprise financial organization is designing hybrid connectivity between its primary on-premises data center and Google Cloud. The architecture requires a sustained throughput of 15 Gbps with an availability SLA of 99.99%. Additionally, on-premises systems must seamlessly reach application workloads distributed across multiple business units without encountering routing limitations between networks. Which hybrid networking architecture meets these requirements on Google Cloud?

Show answer & explanation

Answer: Provision a 99.99% High Availability Dedicated Interconnect topology using four VLAN attachments across two metropolitan locations, and deploy a Shared VPC architecture where host and service projects share the Interconnect paths.

Answer

Provision a 99.99% High Availability Dedicated Interconnect topology using four VLAN attachments across two metropolitan locations, and deploy a Shared VPC architecture where host and service projects share the Interconnect paths.
To support 15 Gbps of sustained hybrid traffic with a 99.99% availability SLA, Google Cloud requires Dedicated Interconnect deployed across two metropolitan locations with four total VLAN attachments (two per metro). To allow on-premises systems to reach workloads across multiple business units without hitting VPC Network Peering's non-transitivity limit, deploying a Shared VPC topology is required so service project workloads natively share host VPC network paths.

Step-by-Step Solution

1
Evaluate throughput and SLA requirements for hybrid connectivity
Sustained bandwidth of 15 Gbps exceeds Cloud VPN capacity (3 Gbps per tunnel limit), requiring Dedicated Interconnect. Achieving a 99.99% SLA requires four VLAN attachments across two metropolitan locations with Cloud Routers in each region.
Dedicated Interconnect is necessary for bandwidth requirements above 10 Gbps and strict 99.99% SLA enterprise topologies.
2
Analyze multi-project network connectivity constraints
VPC Network Peering does not support transitive routing, preventing on-premises traffic from passing through a Hub VPC to spoke VPCs. Shared VPC enables service projects to utilize subnets in the host VPC directly.
Shared VPC avoids transit routing restrictions by placing workloads into host VPC subnets that directly utilize the Dedicated Interconnect.

Key Concept

Designing 99.99% SLA Dedicated Interconnect and Shared VPC to bypass VPC Peering transitivity limits
Question 1218Question →

A financial analytics firm executes batch Monte Carlo risk simulations twice per week. Each execution requires rapidly scaling up to 4,000 vCPUs for approximately two hours to perform stateless calculations, after which resource utilization drops back to zero. The firm requires a solution that minimizes total compute costs, eliminates idle infrastructure overhead, and avoids maintaining control plane management overhead when simulations are not running. Which architecture should the Cloud Architect recommend?

Show answer & explanation

Answer: Containerize the simulation application and execute it using Cloud Run jobs, allowing tasks to scale on demand and automatically terminate upon completion.

Answer

Containerize the simulation application and execute it using Cloud Run jobs, allowing tasks to scale on demand and automatically terminate upon completion.
Executing the batch simulations using Cloud Run jobs is the optimal solution because Cloud Run jobs natively supports containerized, run-to-completion workloads with zero ongoing infrastructure costs when idle. It automatically provisions resources to scale out tasks and terminates immediately upon job completion, aligning cost directly with actual usage.

Step-by-Step Solution

1
Analyze the workload's operational characteristics and scheduling profile.
Identified a stateless, batch compute pattern running for 4 hours total per week (twice per week for 2 hours) scaling up to 4,000 vCPUs.
Understanding usage frequency prevents over-provisioning infrastructure that incurs continuous charges while idle.
2
Evaluate Google Cloud compute choices based on the business constraint of minimizing cost and operational overhead.
Cloud Run jobs provides serverless execution for containerized batch tasks with zero baseline control plane fees and automatic scale-to-zero capability.
Serverless containers charge strictly per vCPU/memory second during active execution, optimizing cost for bursty, intermittent workloads.
3
Eliminate sub-optimal compute, billing, and storage architectures.
GKE introduces unnecessary cluster overhead, CUDs incur 24/7 costs for intermittent tasks, and Cloud Spanner introduces high fixed database node costs.
Choosing serverless batch containers meets all technical and business requirements with minimum total cost of ownership.

Key Concept

Serverless Batch Execution for Intermittent Cost-Optimized Workloads
Estimated Time:2m 0s
Question 1219Question →

A global financial enterprise is migrating its core transaction processing application to Google Cloud. The architecture requires multi-region high availability across two Google Cloud regions with a guaranteed minimum hybrid connectivity throughput of 15 Gbps to an on-premises data center. The connection must provide 99.99% availability and withstand the failure of an entire Cloud Interconnect location or region. Additionally, client application ingress traffic must be distributed across both regions through a single static IP address, supporting sub-second failover without relying on client-side DNS caching adjustments. Which architecture design satisfies all technical, high availability, and network throughput requirements according to Google Cloud best practices?

Show answer & explanation

Answer: Provision 99.99% High Availability Dedicated Interconnect using four 10 Gbps circuits terminating across two edge availability domains in both GCP regions with Global Dynamic Routing enabled on the VPC, and front the application tier with a Global External Application Load Balancer targeting multi-region backend services.

Answer

Provision 99.99% High Availability Dedicated Interconnect using four 10 Gbps circuits terminating across two edge availability domains in both GCP regions with Global Dynamic Routing enabled on the VPC, and front the application tier with a Global External Application Load Balancer targeting multi-region backend services.
The correct solution provisions Dedicated Interconnect with four 10 Gbps links across two regions and two Metropolitan Availability Zones (metro edge domains) to satisfy Google Cloud's official 99.99% SLA blueprint while exceeding the 15 Gbps bandwidth threshold. Enabling Global Dynamic Routing ensures seamless cross-region BGP route propagation. Using a Global External Application Load Balancer with Anycast IP addressing ensures instant, sub-second regional failover for ingress client traffic.

Step-by-Step Solution

1
Analyze hybrid connectivity throughput and availability constraints.
The requirement calls for 15 Gbps throughput and 99.99% availability. HA VPN is capped at 3 Gbps per tunnel and is insufficient for high-throughput enterprise connections. Dedicated Interconnect with 10 Gbps circuits is required. To achieve 99.99% SLA, four circuits must be deployed across two edge availability domains in two distinct regions.
Dedicated Interconnect provides the necessary bandwidth and SLA for mission-critical hybrid data transfers.
2
Evaluate multi-region network routing and ingress load balancing requirements.
Global Dynamic Routing must be enabled on the Cloud Router so BGP learned routes from on-premises are advertised across all regions in the custom mode VPC network. For ingress, a Global External Application Load Balancer utilizes a single Anycast IPv4/IPv6 address to route traffic to the closest healthy backend instance without relying on DNS TTL failover.
Anycast IP routing delivers sub-second traffic diversion upon regional backend failure, avoiding client DNS caching delays.
3
Identify architectural pitfalls in alternative options.
VPC Network Peering is non-transitive, eliminating centralized transit topology without Cloud Router/VPN appliances. Deep health checks hitting database backends cause false-positive node evictions under load.
Proper health checks must isolate compute instance responsiveness rather than downstream infrastructure dependencies.

Key Concept

Designing High-Availability Hybrid Networks and Global Ingress Infrastructure
Question 1220Question →

A healthcare organization operates a patient scheduling service hosted on Google Cloud Run backed by Cloud Spanner. The Site Reliability Engineering (SRE) team needs to establish a reliability strategy that balances release velocity with an availability SLO of 99.9% per 30-day rolling window. The team wants to ensure that on-call engineers are paged only for significant reliability risks while transient spikes are ignored. Which TWO practices should the SRE team implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure multi-window, multi-burn-rate alerting based on the consumption speed of the 30-day error budget.; Define the Service Level Indicator (SLI) as the ratio of successful HTTP request executions (non-5xx responses) over the total number of valid incoming HTTP requests.

Answer

The SRE team should implement multi-window, multi-burn-rate alerts based on error budget consumption speed and define the SLI as the ratio of successful HTTP requests over total valid incoming requests.
Defining the SLI as a ratio of successful user requests over total valid requests accurately measures customer experience. Applying multi-window, multi-burn-rate alerting ensures on-call engineers are paged strictly when consumption of the error budget threatens the 30-day SLO target.

Step-by-Step Solution

1
Identify the proper formula and scope for a Service Level Indicator (SLI).
The SLI should quantify user-facing success as the count of good events divided by total valid events (e.g., non-5xx responses over total requests).
SLIs must reflect direct user experience rather than internal server resource metrics.
2
Select an effective alerting strategy tied to Service Level Objectives (SLOs) and Error Budgets.
Multi-window, multi-burn-rate alerts page engineers only when error budget is consuming at a rate that threatens to exhaust the 30-day budget.
Burn-rate alerting balances alert sensitivity and specificity, preventing alert fatigue from transient errors.

Key Concept

SRE SLO, SLI, and Error Budget Alerting Best Practices
PreviousPage 61 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin