Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 1241Question →

A financial analytics startup is building an internal back-office reporting application. The application requires a fully managed relational database supporting standard SQL and ACID transactions within a single Google Cloud region, with no requirement for global multi-region consistency or multi-region horizontal scaling. Which database service should the architect select?

Show answer & explanation

Answer: Cloud SQL

Answer

Cloud SQL is the optimal choice because it provides a fully managed relational database engine (PostgreSQL, MySQL, SQL Server) with standard ACID compliance for single-region applications without the complexity and cost of global scaling services.
Cloud SQL is designed specifically for fully managed relational database workloads (such as PostgreSQL, MySQL, and SQL Server) operating within a single region. It fully supports standard ACID transactions and SQL syntax with minimal operational overhead.

Step-by-Step Solution

1
Analyze database workload requirements
The application requires structured relational database support, standard SQL queries, ACID transaction compliance, and operates entirely within a single Google Cloud region.
Identifying access patterns and regional bounds narrows down the suitable database category.
2
Evaluate GCP managed database options
Cloud SQL delivers standard relational engines suited for single-region scale, whereas Cloud Spanner is engineered for global multi-region horizontal scaling.
Choosing Cloud SQL satisfies all architectural constraints while avoiding unnecessary cost and complexity.

Key Concept

Selecting Cloud SQL for single-region relational database workloads instead of Cloud Spanner
Question 1242Question →

A financial analytics company runs an I/O-intensive reporting application on a Compute Engine Regional Managed Instance Group (MIG) behind an External HTTP(S) Load Balancer. During sudden high-volume processing events, backend instances experience severe memory saturation and active connection pool exhaustion, leading to dropped client requests while CPU utilization stays consistently below 25%. Furthermore, during a recent brief upstream database latency spike, the load balancer marked all backend instances as unhealthy simultaneously because the health check probes an endpoint that performs a live query on the database. Which architectural modification best resolves both the autoscaling failure and the cascading health check failure?

Show answer & explanation

Answer: Configure MIG autoscaling using Custom Cloud Monitoring metrics for memory utilization and database connection pool saturation, and point the load balancer health check to a lightweight local application status endpoint that does not probe downstream database dependencies.

Answer

Configure MIG autoscaling using Custom Cloud Monitoring metrics for memory utilization and database connection pool saturation, and point the load balancer health check to a lightweight local application status endpoint that does not probe downstream database dependencies.
The correct solution addresses both root causes directly. For I/O-bound applications that exhaust memory or connection pools without increasing CPU load, MIG autoscaling must be configured using custom metrics published to Cloud Monitoring. Additionally, load balancer health checks should probe a shallow, local HTTP endpoint on the application server (evaluating local process health) rather than querying backend databases, preventing transient database latency from causing cascading instance removals.

Step-by-Step Solution

1
Analyze the scaling bottleneck metric mismatch
Identified that CPU utilization remains low (<25%) during memory and I/O connection pool exhaustion, demonstrating that CPU-based autoscaling is ineffective.
I/O-bound workloads require custom metrics such as memory utilization or active connection counts to accurately signal horizontal scale-out.
2
Evaluate load balancer health check failure mode
Identified that probing deep database endpoints causes cascading service outages during transient database latency.
Load balancer health checks must evaluate local web server instance health, not downstream infrastructure availability, to avoid misinterpreting database slowdowns as compute node failures.
3
Synthesize the high-availability architectural design
Combine Custom Cloud Monitoring metric autoscaling with shallow local application health probes.
This dual change ensures accurate autoscaling under load and prevents cascading instance failures during database degradation.

Key Concept

Designing High Availability Autoscaling and Health Checking for I/O-Bound Workloads
Question 1243Question →

A global digital publishing enterprise is designing a hybrid network architecture to connect its on-premises content repository to a Google Cloud Virtual Private Cloud (VPC). The architecture requires dedicated bandwidth of 20 Gbps, dynamic BGP routing, and a 99.99% availability SLA. Additionally, on-premises hosts must securely reach Google APIs without traversing the public internet. Which TWO architectural recommendations should the cloud architect make to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Provision Dedicated Interconnect connections across two separate Google Cloud edge availability domains (metropolitan areas) using Cloud Routers for dynamic BGP routing.; Configure Private Google Access for on-premises hosts by advertising Google API IP ranges (such as 199.36.90.4/30 or 199.36.90.8/30) over BGP via Cloud Router.

Answer

To meet the 20 Gbps bandwidth requirement with a 99.99% availability SLA and secure access to Google APIs, the architect must provision Dedicated Interconnect connections across two distinct edge availability domains using Cloud Routers with BGP, and configure Private Google Access for on-premises hosts by advertising Google API VIP ranges via Cloud Router.
The solution requires Dedicated Interconnect spanning two Google Cloud edge availability domains (metropolitan areas) to support 20 Gbps sustained throughput while satisfying GCP's structural prerequisites for a 99.99% SLA. In addition, enabling Private Google Access for on-premises hosts via Cloud Router BGP custom route advertisements allows on-premises systems to communicate with Google services over private Interconnect links without traversing public internet routes.

Step-by-Step Solution

1
Analyze bandwidth and availability SLA requirements for hybrid connectivity.
20 Gbps throughput exceeds standard single HA VPN tunnel capacities (3 Gbps per tunnel). Dedicated Interconnect with multiple 10 Gbps circuits is required. To achieve GCP's 99.99% SLA topology, circuits must terminate in two separate metropolitan edge domains with Cloud Routers in each region.
Dedicated Interconnect provides enterprise-grade dedicated physical links, and dual-metro redundancy guarantees 99.99% SLA.
2
Determine the solution for on-premises access to Google APIs without public internet exposure.
Private Google Access for on-premises hosts must be enabled by configuring custom route advertisements for Google VIP ranges via BGP on Cloud Router.
This routes traffic from on-premises hosts through the private Interconnect pipe directly to Google APIs without going over the public internet.

Key Concept

Designing 99.99% SLA High-Availability Dedicated Interconnect and Private Google Access for On-Premises
Estimated Time:2m 0s
Question 1244Question →

An e-commerce company hosts its backend ordering service on App Engine flexible environment connected to a Cloud SQL for PostgreSQL database. The development team needs to deploy an application update that introduces a database schema change adding a mandatory new column to the orders table. The release must maintain zero downtime, and rolling back to the previous application version if errors occur post-deployment must not cause runtime exceptions or data corruption. Which release management approach should the engineering team implement?

Show answer & explanation

Answer: Implement an expand-and-contract schema pattern by adding the new column as nullable first, deploying the updated application version to write to the column while maintaining backward compatibility with the active version, shifting traffic gradually via App Engine traffic splitting, and making the column non-nullable after validating the release.

Answer

Implement an expand-and-contract schema pattern by adding the column as nullable first, deploying the backward-compatible code, shifting traffic incrementally, and finalizing the column constraint after validation.
The expand-and-contract (parallel change) pattern separates schema changes into phased steps. Making the new column nullable first guarantees that both the old version (which does not populate the column) and the new version (which populates it) can run concurrently during App Engine traffic splitting. If an issue occurs, traffic can be routed back to the old version without database errors.

Step-by-Step Solution

1
Expand database schema
Database updated with a nullable new column that existing application versions can safely ignore.
Allows older code to continue reading/writing without breaking on unexpected non-nullable constraints.
2
Deploy new version and split traffic incrementally
New App Engine version receives traffic gradually while monitoring metrics and error rates.
Ensures real-time verification and allows instant rollback to the old version without database errors.
3
Contract database schema post-validation
Data backfilled and column set to non-nullable once all traffic runs on the new version.
Completes the schema migration safely after confirming release stability.

Key Concept

Expand-and-contract deployment pattern for database-backed application releases
Question 1245Question →

A media streaming platform hosts a video segment processing service on Compute Engine Managed Instance Groups (MIGs). The application is memory-intensive and network I/O-bound as it fetches uncompressed video segments from Cloud Storage, causing average CPU utilization to stay under 35% even when processing latency increases significantly during live events. Additionally, during sudden traffic spikes, MIG autoscaling attempts fail because requested instance counts exceed the project's regional compute resource limits. Which architectural strategy should a Cloud Architect implement to ensure reliable scaling and adequate capacity during high-demand live events?

Show answer & explanation

Answer: Configure the MIG autoscaler using a custom Cloud Monitoring metric based on queue backlog depth, and proactively request regional vCPU quota increases prior to scheduled events.

Answer

Configure the MIG autoscaler using a custom Cloud Monitoring metric based on queue backlog depth, and proactively request regional vCPU quota increases prior to scheduled events.
For I/O-bound processing workloads where CPU utilization remains low despite growing backlogs, Compute Engine MIG autoscalers should be configured using custom Cloud Monitoring metrics such as queue depth. Additionally, capacity planning requires requesting regional compute resource quota increases in advance of anticipated peak events to ensure the cloud provider allows instance expansion.

Step-by-Step Solution

1
Analyze workload resource characteristics and autoscaling metrics.
Identified that the processing service is network I/O and memory bound, meaning CPU utilization does not accurately reflect workload backlog.
Autoscaling I/O-bound workloads based strictly on CPU utilization results in delayed or insufficient scaling.
2
Select an appropriate custom autoscaling metric.
Implemented custom Cloud Monitoring metrics (such as queue backlog depth per instance) to trigger MIG scaling based on actual work waiting to be processed.
Custom metrics directly tied to work queue volume ensure proactive scaling before latency degrades.
3
Evaluate regional capacity and project quota requirements.
Identified that regional vCPU quotas block scaling during peak events.
GCP quotas are hard enforcement limits; regional quota increases must be requested and granted ahead of time to accommodate anticipated capacity needs.

Key Concept

Custom Metric Autoscaling and Capacity Quota Management
Question 1246Question →

A global supply chain enterprise is migrating its core order-processing platform to Google Cloud. The system must support strong transactional consistency with a Recovery Point Objective (RPO) of 0 and a Recovery Time Objective (RTO) of under 5 seconds in the event of a total regional outage. Furthermore, the architecture requires a dedicated, private hybrid network connection between the corporate data center and Google Cloud that supports 15 Gbps of sustained bandwidth while meeting a 99.99% availability SLA. Which TWO architectural components should you include in your design to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy a multi-region Cloud Spanner instance configured across North American regions to handle transactional workloads synchronously.; Provision dual 10 Gbps Dedicated Interconnect circuits terminating at two distinct Google Cloud edge facilities in separate metro locations.

Answer

To meet zero RPO and sub-5-second RTO multi-region availability, deploy a multi-region Cloud Spanner instance. To deliver 15 Gbps sustained hybrid throughput with a 99.99% availability SLA, establish dual Dedicated Interconnect circuits across two distinct metro locations.
Deploying a multi-region Cloud Spanner instance guarantees synchronous multi-region writes via Paxos consensus, providing RPO=0 and automatic failover in under 5 seconds during a regional outage. Deploying dual 10 Gbps Dedicated Interconnect circuits across two separate metro locations satisfies the 15 Gbps sustained bandwidth requirement while meeting Google's explicit architectural blueprint for a 99.99% SLA.

Step-by-Step Solution

1
Analyze database requirements for high availability and disaster recovery
Identified the need for synchronous multi-region replication providing RPO=0 and automatic sub-second failover.
Cloud SQL cross-region replicas replicate asynchronously (RPO > 0), whereas multi-region Cloud Spanner uses Paxos for synchronous cross-region commit and instant failover.
2
Evaluate hybrid networking options for throughput and availability SLA
Determined Dedicated Interconnect with 99.99% topology is required.
HA VPN tunnels are capped at 3 Gbps each and do not scale cleanly to 15 Gbps. Dedicated Interconnect provides 10 Gbps/100 Gbps pipes and guarantees a 99.99% SLA when redundantly configured across two metro locations.
3
Validate network routing constraints
Rejected transitive VPC peering design.
VPC Peering does not forward traffic from external hybrid connections transitively across peered networks.

Key Concept

Multi-Region Relational Availability and High-SLA Enterprise Hybrid Network Topology Design
Estimated Time:2m 0s
Question 1247Question →

An enterprise platform engineering team is preparing to update a stateless microservice deployed on Google Cloud Run that communicates with a Cloud Spanner database. To maintain high availability during releases, the pipeline must implement a progressive canary release strategy with continuous health validation and seamless rollback capabilities. Which TWO architectural practices should the team implement to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy new revisions to Cloud Run without assigning traffic, then use Cloud Run revision traffic splitting to gradually transition user requests to the new revision while monitoring error rates.; Implement an expand-and-contract database migration strategy to guarantee that all database schema changes remain backward-compatible with older active application revisions.

Answer

The correct practices are to deploy new Cloud Run revisions using traffic splitting to gradually route production traffic while monitoring health metrics, and to use an expand-and-contract schema migration pattern to ensure database backward-compatibility for active and previous application revisions.
Safe progressive delivery requires separating application deployment from traffic routing and database migrations. Using Cloud Run revision traffic splitting allows engineering teams to shift small fractions of live production traffic to a new revision while verifying telemetry, providing instantaneous traffic fallback if issues arise. Simultaneously, using an expand-and-contract (decoupled) database migration approach ensures that database schema modifications are backward-compatible, allowing both old and new application revisions to coexist without database errors during canary phases or rollbacks.

Step-by-Step Solution

1
Decouple application release from database schema changes using an expand-and-contract pattern.
Database changes (such as adding columns or tables) are applied in a backward-compatible manner before deploying new code, allowing older revisions to function alongside canary revisions without breaking.
Ensures zero-downtime rollbacks and prevents database schema changes from failing running revisions.
2
Deploy new application versions as distinct revisions in Cloud Run without shifting 100% of live traffic immediately.
A new Cloud Run revision is instantiated while the previous stable revision continues serving the majority of user requests.
Enables side-by-side deployment and isolation of new code.
3
Apply gradual traffic splitting between revisions while monitoring telemetry and error budgets.
Traffic is safely shifted in incremental steps (e.g., 5%, 25%, 100%), allowing immediate traffic rollbacks to the prior revision if metrics degrade.
Minimizes blast radius of potential deployment defects.

Key Concept

Canary Releases and Backward-Compatible Database Migrations
Estimated Time:2m 0s
Question 1248Question →

A pharmaceutical enterprise is establishing hybrid connectivity between its primary on-premises facility and Google Cloud to support an analytics pipeline. The connectivity model must support a sustained transfer rate of 8 Gbps with a guaranteed 99.99% availability SLA. Furthermore, on-premises systems must be able to reach workloads located in a specialized application VPC through a central transit VPC where the hybrid link terminates. Which network architecture should the cloud architect implement to meet these requirements?

Show answer & explanation

Answer: Provision Dedicated Interconnect with redundant VLAN attachments configured across two separate edge availability domains in the same metropolitan area, and establish HA VPN tunnels between the transit VPC and application VPC to enable transitive connectivity from on-premises.

Answer

Provision Dedicated Interconnect with redundant VLAN attachments configured across two separate edge availability domains, and establish HA VPN tunnels between the transit VPC and application VPC to enable transitive connectivity from on-premises.
Dedicated Interconnect provides the necessary capacity for an 8 Gbps sustained pipeline and, when configured with redundant attachments across edge availability domains, satisfies the 99.99% SLA. Additionally, because VPC Network Peering does not allow transitive routing, establishing HA VPN between the transit VPC and the application VPC allows on-premises traffic to route successfully through the transit VPC to the target application workloads.

Step-by-Step Solution

1
Evaluate hybrid connectivity requirements for bandwidth and availability.
Sustained 8 Gbps bandwidth requires Dedicated Interconnect or high-capacity Partner Interconnect rather than Cloud VPN. Achieving a 99.99% SLA requires redundant connections across two edge availability domains.
Cloud VPN tunnels max out at 3 Gbps per tunnel, whereas Dedicated Interconnect provides 10 Gbps or 100 Gbps circuits suitable for heavy sustained data transfer.
2
Evaluate inter-VPC routing requirements between transit VPC and application VPC for on-premises traffic.
VPC Network Peering does not support transitive routing, meaning traffic originating from on-premises cannot traverse a peered link to reach a second VPC.
To achieve reachability between on-premises and an application VPC connected to a transit VPC, an overlay topology such as Cloud VPN tunnels or Network Connectivity Center between VPCs must be used.

Key Concept

GCP Hybrid Connectivity SLA and VPC Peering Transitivity Constraints
Question 1249Question →

An enterprise organization is planning a major version release for a mission-critical financial reporting service deployed on Compute Engine Managed Instance Groups (MIGs) behind an External HTTP(S) Load Balancer. The update involves modifying the underlying database structure. The technical team requires zero application downtime during deployment and the ability to instantly roll back if errors are detected in production without causing data corruption or application failures in the live environment. Which deployment approach should the Cloud Architect recommend to achieve these reliability requirements?

Show answer & explanation

Answer: Implement an expand-contract database schema migration pattern to maintain backward compatibility before triggering a blue-green deployment of the new application version.

Answer

Implement an expand-contract database schema migration pattern to maintain backward compatibility before triggering a blue-green deployment of the new application version.
The correct option advocates for an expand-contract database pattern alongside a blue-green application release strategy. By ensuring that database schema changes are additive and backward-compatible, both the legacy and updated versions of the microservice can run concurrently. This eliminates downtime during traffic switching at the load balancer level and allows for instant, safe rollbacks if anomalies are observed.

Step-by-Step Solution

1
Analyze deployment constraints and downtime/rollback requirements.
Identified that database schema changes must support both old and new application code concurrently to prevent data corruption during cutover or rollback.
Blue-green deployments require both environments to operate independently or gracefully share data repositories during transition.
2
Apply the expand-contract (parallel change) pattern to the database schema.
Database changes are made additively without dropping legacy columns or breaking existing contracts.
Allows the active application version to function without error while the new version is deployed and tested.
3
Provision the new green environment and shift load balancer traffic.
Traffic cutover happens seamlessly with zero downtime, and immediate rollback remains viable.
If issues arise, load balancer target groups can immediately point back to the blue environment because the schema remains compatible.

Key Concept

Database Backward Compatibility in Blue-Green Deployments
Estimated Time:2m 0s
Question 1250Question →

A global retail distribution company is establishing hybrid connectivity between its primary on-premises fulfillment hubs and Google Cloud to process real-time inventory transactions. The connection requires a guaranteed sustained throughput of 12 Gbps and must adhere to a strict 99.99% availability SLA. Architecturally, the security team mandates centralized administration of firewall rules and network subnets, while allowing application workloads running in isolated project environments to communicate directly with on-premises databases. Which network architecture and hybrid connectivity design should the cloud architect recommend?

Show answer & explanation

Answer: Provision Dedicated Interconnect with redundant circuits across two separate edge availability domains in two distinct metros, configured with Cloud Router BGP routing, and deploy a Shared VPC network topology where the host project manages the hybrid interconnect and subnets while attached service projects host the application workloads.

Answer

Provision Dedicated Interconnect with redundant circuits across two distinct metros to meet the 99.99% SLA and 12 Gbps throughput, combined with a Shared VPC host/service project model to maintain centralized network governance and transitivity to on-premises resources.
Dedicated Interconnect is required to support high sustained throughput (>10 Gbps) and achieve a 99.99% SLA when configured with redundant links across two metros. A Shared VPC topology satisfies the requirement for centralized network administration by placing subnets, firewall policies, and Cloud Routers in a host project, while allowing application workloads in attached service projects to communicate natively with on-premises resources over the hybrid connection.

Step-by-Step Solution

1
Evaluate hybrid connectivity throughput and SLA requirements
Requirements specify 12 Gbps sustained bandwidth and a 99.99% SLA. HA VPN cannot scale to 12 Gbps efficiently (3 Gbps per tunnel limit), requiring Dedicated Interconnect (10 Gbps or 100 Gbps circuits) deployed across two edge availability domains in two metros for 99.99% availability.
Choosing between Cloud VPN, Partner Interconnect, and Dedicated Interconnect depends directly on throughput thresholds and SLA strictness.
2
Evaluate cross-project network topologies against VPC Peering constraints
The requirement for centralized network management across multiple projects rules out separate VPCs linked via VPC Network Peering because VPC Peering does not support transitive routing to hybrid connections (Interconnect/VPN).
VPC Network Peering cannot forward traffic between an on-premises Interconnect in VPC A and workloads in peered VPC B.
3
Select Shared VPC as the multi-project architecture pattern
Shared VPC allows network administrators in a host project to maintain centralized control over subnets, Cloud Routers, and Dedicated Interconnect attachments while extending internal IP address connectivity to service projects containing application workloads.
Shared VPC enables workloads in service projects to natively access the host project's hybrid Interconnect connection without routing transitivity barriers.

Key Concept

Hybrid Connectivity Selection & Shared VPC Topology
Estimated Time:2m 0s
Question 1251Question →

A global healthcare diagnostic platform is designing its telemetry processing backend on Google Cloud to handle unpredictable spikes in stateless containerized workloads across two geographic regions. The platform must maintain a strict Service Level Agreement (SLA) of 99.999% availability with a Recovery Point Objective (RPO) of 0 and a Recovery Time Objective (RTO) of near-zero seconds for transactional data operations. The architecture must minimize operational management overhead while supporting multi-region synchronous replication. Which architecture meets these technical requirements?

Show answer & explanation

Answer: Deploy the stateless backend on Cloud Run across multiple regions integrated with a multi-region Cloud Spanner instance.

Answer

Deploy the stateless backend on Cloud Run across multiple regions integrated with a multi-region Cloud Spanner instance.
The combination of Cloud Run across regions and multi-region Cloud Spanner fulfills all criteria. Cloud Run delivers serverless, zero-infrastructure scaling for stateless HTTP services. Cloud Spanner utilizes atomic clocks (TrueTime) and synchronous Paxos replication across regions to guarantee 99.999% availability, strong transactional consistency, and RPO = 0.

Step-by-Step Solution

1
Analyze high availability and database consistency requirements
An SLA of 99.999% and RPO = 0 require synchronous multi-region database replication with strong global consistency.
Asynchronous replication mechanisms in Cloud SQL or Cloud Bigtable suffer from data loss window risks during a regional failover.
2
Evaluate compute tier requirements against operational overhead
Cloud Run automatically handles stateless HTTP microservice scaling without infrastructure or cluster control plane management.
Stateless container workloads do not require full GKE cluster maintenance, making serverless container platforms ideal for operational efficiency.
3
Synthesize the optimal architecture
Multi-region Cloud Spanner provides 99.999% availability and zero RPO via Paxos consensus, coupled with multi-region Cloud Run for auto-scaling stateless compute.
This combination satisfies all technical requirements, availability targets, and minimal operational overhead objectives.

Key Concept

Designing multi-region high availability architectures using Cloud Run and Cloud Spanner for zero RPO and 99.999% availability.
Question 1252Question →

A global logistics enterprise is designing a hybrid network architecture to connect its on-premises inventory database with workloads in Google Cloud. The architecture requires a dedicated private connection supporting 10 Gbps of bandwidth for continuous synchronization with a central management VPC (`vpc-core`). Additionally, an isolated analytics VPC (`vpc-analytics`) requires connectivity to the on-premises database through `vpc-core`. Which TWO architectural design choices should the cloud architect recommend?

Select all that apply

Show answer & explanation

Answer: Deploy Dedicated Interconnect between the on-premises data center and vpc-core to supply the required 10 Gbps hybrid throughput.; Deploy an HA VPN gateway pair between vpc-analytics and vpc-core using Cloud Router to enable routed connectivity between vpc-analytics and the on-premises network.

Answer

The architect should deploy Dedicated Interconnect between the on-premises facility and vpc-core to satisfy the 10 Gbps bandwidth requirement, and establish HA VPN between vpc-analytics and vpc-core to enable transit routing to on-premises.
Dedicated Interconnect is the standard Google Cloud solution for private, high-capacity hybrid connectivity exceeding 3 Gbps, directly satisfying the 10 Gbps requirement. Furthermore, because VPC Peering is non-transitive, connecting vpc-analytics to vpc-core using HA VPN gateways and Cloud Router dynamic routing enables vpc-core to forward traffic securely to on-premises.

Step-by-Step Solution

1
Evaluate hybrid connectivity bandwidth requirement (10 Gbps).
Identify Dedicated Interconnect as the required technology because Cloud VPN tunnels max out at 3 Gbps per tunnel.
Dedicated Interconnect guarantees physical 10 Gbps or 100 Gbps pipes suitable for high-throughput baseline traffic.
2
Evaluate multi-VPC transit requirements from vpc-analytics to on-premises.
Recognize that VPC Peering does not support transitive routing to external networks.
VPC Network Peering only allows communication directly between peered VPC internal IPs and does not forward traffic across third-party interconnects or VPNs.
3
Select valid transit architecture between vpc-analytics and vpc-core.
Choose HA VPN with Cloud Router BGP between vpc-analytics and vpc-core.
Encapsulating traffic over an IPsec tunnel between VPCs enables vpc-core to function as a transit gateway for on-premises connectivity.

Key Concept

Hybrid Network Bandwidth Selection and VPC Transitive Routing Boundaries
Question 1253Question →

An online gaming company is designing a new solution architecture on Google Cloud to handle a new game title launch. The architecture has two primary requirements:

1. A stateless HTTP microservice for player telemetry and session validation that experiences unpredictable traffic spikes and long idle periods during off-peak hours. The company requires zero baseline infrastructure cost when there is no incoming traffic and wants to minimize management overhead.
2. A one-time migration of an 800 TB800\text{ TB} historical telemetry dataset from their on-premises data center to Cloud Storage within a strict 2-week deadline. Their current on-premises uplink is 100 Mbps100\text{ Mbps} and is heavily saturated by current business operations.

Which TWO architectural solutions should the cloud architect recommend to satisfy these business goals while optimizing total cost and operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the stateless telemetry HTTP microservice on Cloud Run to automatically scale down to zero instances during idle periods.; Order a Google Cloud Transfer Appliance to transfer the 800 TB historical dataset to Cloud Storage via physical shipping.

Answer

Deploying the stateless HTTP microservice on Cloud Run and using Google Cloud Transfer Appliance for offline data migration.
Cloud Run provides serverless container execution that automatically scales down to zero during idle hours, fulfilling the requirement for minimal cost and low management overhead for stateless HTTP APIs. For the migration, shipping a physical Google Cloud Transfer Appliance bypasses the limited and saturated 100 Mbps uplink, enabling fast and cost-effective ingestion of the 800 TB archive within the 2-week window.

Step-by-Step Solution

1
Evaluate compute requirement for cost optimization and zero idle cost
Cloud Run allows containerized stateless HTTP microservices to scale to zero instances during zero-traffic periods, incurring zero compute cost when idle and removing node management overhead.
GKE requires ongoing control plane or baseline worker node infrastructure fees and operational maintenance.
2
Calculate data transfer network constraints and timeline
Transferring 800 TB800\text{ TB} (6.4×1015 bits6.4 \times 10^{15}\text{ bits}) over a 100 Mbps100\text{ Mbps} line requires ≈740 days\approx 740\text{ days}, exceeding the 2-week deadline.
An offline physical transfer appliance is mandatory when network bandwidth cannot support the transfer volume within the required RTO/timeline.

Key Concept

Designing compute and data transfer architectures aligned with business cost constraints and physical network throughput limitations.
Question 1254Question →

A financial technology organization hosts a mission-critical payment processing backend on Compute Engine Regional Managed Instance Groups (MIGs) behind an Internal Application Load Balancer. The operations team needs to automate application deployment releases to achieve zero downtime, support progressive instance replacement, and preserve infrastructure state consistency across continuous delivery runs without introducing security vulnerabilities. Which deployment and release management strategy should the Cloud Architect recommend?

Show answer & explanation

Answer: Configure an automated rolling update on the Managed Instance Group with maximum surge capacity while managing all infrastructure definitions through Terraform using a Cloud Storage backend with object versioning enabled.

Answer

Configure an automated rolling update on the Managed Instance Group with maximum surge capacity while managing all infrastructure definitions through Terraform using a Cloud Storage backend with object versioning enabled.
The option recommending an automated rolling update on the Managed Instance Group combined with Terraform using a versioned Cloud Storage backend follows GCP reliability best practices. MIG rolling updates systematically cycle instances to guarantee zero downtime, while remote versioned state storage ensures safe, concurrent, and recoverable infrastructure automation.

Step-by-Step Solution

1
Evaluate application deployment and rollback requirements.
Identify that Compute Engine Regional Managed Instance Groups natively support rolling updates with max surge and max unavailable parameters to ensure zero-downtime releases.
MIG rolling updates replace instances progressively while maintaining total service capacity.
2
Establish Infrastructure as Code state management best practices.
Configure Terraform to use a Cloud Storage remote backend with object versioning and state locking.
Remote state backends prevent local state loss, concurrency race conditions, and drift.
3
Enforce security and operational automation controls.
Utilize fine-grained IAM roles for deployment pipelines instead of primitive roles, avoiding manual console interventions.
Adheres to security compliance and eliminates configuration drift.

Key Concept

Managed Instance Group Rolling Updates and IaC State Reliability
Question 1255Question →

A pharmaceutical research institute is migrating a legacy monolithic clinical trial application from an on-premises data center to Google Cloud. The legacy system relies on an on-premises PostgreSQL database that suffers from technical debt, specifically unnormalized tables accessed directly by multiple legacy modules. The institute must refactor the database into domain-driven data structures and migrate to Cloud SQL for PostgreSQL without introducing downtime or breaking existing regulatory reporting dependencies during the transition period. Which strategy best addresses the technical debt while satisfying the migration constraints?

Show answer & explanation

Answer: Apply the expand-contract pattern by introducing backward-compatible views in PostgreSQL, continuously replicate data to Cloud SQL using Database Migration Service (DMS), and incrementally transition microservices to the new schema before removing legacy structures.

Answer

Apply the expand-contract pattern by introducing backward-compatible views in PostgreSQL, continuously replicate data to Cloud SQL using Database Migration Service (DMS), and incrementally transition microservices to the new schema before removing legacy structures.
The correct strategy combines the expand-contract database refactoring pattern with continuous replication via Database Migration Service (DMS). Creating backward-compatible views ensures existing legacy reporting applications continue to function without breaking, while microservices are incrementally migrated. Database Migration Service ensures real-time data synchronization between on-premises PostgreSQL and Cloud SQL with minimal downtime.

Step-by-Step Solution

1
Analyze technical debt and reporting constraints
Identify that legacy reporting modules cannot tolerate breaking database schema changes during migration.
Direct schema changes cause immediate failures in un-refactored modules.
2
Implement database schema decoupling strategy
Apply the expand-contract (parallel change) pattern using backward-compatible views.
Allows new domain microservices to read/write modern schemas while legacy components continue operating against legacy table structures.
3
Establish continuous data replication and incremental cutover
Use Database Migration Service (DMS) for continuous PostgreSQL replication to Cloud SQL with zero downtime.
Ensures data parity across on-premises and cloud environments until all legacy dependencies are retired.

Key Concept

Managing Database Technical Debt during Migrations using Expand-Contract Pattern and Database Migration Service
Question 1256Question →

An automotive manufacturing enterprise is designing a hybrid network architecture to connect its central assembly plant data center to Google Cloud. The connection must reliably support a continuous throughput of 15 Gbps for real-time telemetry data. Additionally, on-premises systems must be able to communicate with workloads residing in a secondary workload VPC (VPC B) that is connected to the primary landing zone VPC (VPC A). Which hybrid network architecture meets these bandwidth and routing requirements?

Show answer & explanation

Answer: Provision Dedicated Interconnect to satisfy the 15 Gbps throughput requirement, and configure direct hybrid connectivity to both VPCs because VPC Network Peering does not support transitive routing from on-premises networks.

Answer

Provision Dedicated Interconnect to satisfy the 15 Gbps throughput requirement, and configure direct hybrid connectivity to both VPCs because VPC Network Peering does not support transitive routing from on-premises networks.
Dedicated Interconnect provides the required 15 Gbps high-bandwidth capacity. Because VPC Network Peering does not support transitive routing, traffic from an on-premises network connected to VPC A cannot cross a peering link to reach VPC B. Therefore, dedicated hybrid connectivity paths or transit hub solutions (like Network Connectivity Center) must be configured for both VPCs.

Step-by-Step Solution

1
Evaluate throughput requirement
Dedicated Interconnect is required because the dataset transfers exceed the capacity of Cloud VPN (which caps at 3 Gbps per tunnel).
Bandwidth requirements of 15 Gbps necessitate Dedicated Interconnect (offered in 10 Gbps or 100 Gbps circuit sizes).
2
Evaluate routing constraints across VPCs
On-premises networks cannot reach VPC B through VPC A using VPC Network Peering.
VPC Network Peering is strictly non-transitive in Google Cloud.
3
Synthesize optimal network architecture
Combine Dedicated Interconnect with direct routing access to both VPCs (or via Network Connectivity Center / Shared VPC).
Ensures SLA, throughput, and reachability requirements are fully satisfied.

Key Concept

Selecting hybrid connectivity (Dedicated Interconnect vs HA VPN) based on throughput and accounting for VPC Peering non-transitivity.
Question 1257Question →

A global fleet management company is designing a Google Cloud architecture to handle two core workloads for its telematics platform:

1. Real-time ingestion and low-latency point-in-time querying of high-throughput time-series telemetry data originating from millions of vehicle GPS sensors.
2. Archival of unstructured driver inspection PDF logs and vehicle camera images that are accessed frequently for the first 30 days and must automatically transition to low-cost archival storage for long-term compliance retention.

Which TWO storage services and features should the lead cloud architect select to satisfy these requirements while minimizing operational overhead?

Select all that apply

Show answer & explanation

Answer: Cloud Bigtable to ingest high-throughput time-series vehicle telemetry data with millisecond read/write latency.; Cloud Storage buckets combined with Object Lifecycle Management to store unstructured logs and automatically transition aged files to Nearline or Coldline storage.

Answer

The optimal architecture selects Cloud Bigtable for high-throughput time-series vehicle sensor data and Cloud Storage with Object Lifecycle Management for unstructured log and image archival.
Cloud Bigtable is optimized for massive write throughput and time-series data such as telemetry from vehicle sensors. Cloud Storage paired with Object Lifecycle Management provides a cost-effective solution for unstructured documents and images by automatically downgrading storage classes as files age.

Step-by-Step Solution

1
Analyze workload 1 requirement (high-throughput time-series IoT data).
Identify that Cloud Bigtable is the native Google Cloud recommendation for scalable, high-throughput time-series telemetry data.
Bigtable scales seamlessly for write-intensive IoT streaming data while maintaining low latency.
2
Analyze workload 2 requirement (unstructured blob files with lifecycle transitions).
Identify Cloud Storage with Object Lifecycle Management rules.
Cloud Storage handles unstructured PDF and image blobs, and lifecycle rules automate transition to colder storage tiers based on creation time.
3
Evaluate distractors against architectural best practices.
Reject Cloud Spanner for binary blob storage and reject CSEK when managed encryption services like CMEK or Google-managed keys suffice.
Spanner is for structured relational data; CSEK adds unnecessary administrative burden for standard KMS compliance.

Key Concept

Matching workload access patterns (high-throughput time-series telemetry vs unstructured blob lifecycle archival) to managed GCP storage resources.
Estimated Time:2m 0s
Question 1258Question →

A fintech startup has manually provisioned a production environment in Google Cloud consisting of Cloud Pub/Sub topics and BigQuery datasets via the GCP Console. To bring these resources under Infrastructure as Code (IaC) governance, the cloud architecture team needs to safely import the resources into Terraform state while setting up a centralized Cloud Storage (GCS) backend for state storage. In what sequence should the engineering team execute the following operational steps to import the existing infrastructure without accidental resource destruction?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Write matching HCL configuration and GCS backend declarations, 2) Run terraform init to connect to the remote backend, 3) Execute terraform import using full GCP resource IDs, 4) Run terraform plan to verify zero configuration drift, and 5) Commit the verified HCL code to version control.
Safely bringing existing (brownfield) Google Cloud infrastructure under Terraform management requires first writing corresponding HCL code and backend settings, initializing the backend via `terraform init`, executing `terraform import` with exact GCP resource IDs, validating zero drift using `terraform plan`, and finally committing code to Git for CI/CD integration.

Step-by-Step Solution

1
Declare HCL resource definitions and backend settings
Local HCL files represent the expected resource schemas and point state to GCS.
Terraform needs defined resource addresses and a configured remote backend before state initialization.
2
Initialize Terraform working directory with `terraform init`
Provider plugins are downloaded and the GCS backend connection is established.
Remote state tracking and backend locking must be active before binding live cloud infrastructure.
3
Run `terraform import` targeting GCP resource IDs
Existing BigQuery dataset and Pub/Sub topic state records are populated into the remote GCS state file.
Importing maps real GCP infrastructure to Terraform state keys without recreating resources.
4
Run `terraform plan` to detect drift
Output shows 'No changes. Your infrastructure matches the configuration.'
Guarantees HCL declarations exactly reflect the live resource attributes, preventing accidental deletion upon future applies.
5
Commit HCL configurations to Git source repository
Version control tracks infrastructure state and enables CI/CD automation.
Formalizes IaC management and enables automated pipeline governance.

Key Concept

Infrastructure as Code (IaC) Brownfield Resource Import Workflow
Question 1259Question →

A digital media enterprise is architecting an event ingestion microservice on Google Cloud to handle HTTP webhooks triggered by external partners. The workload is stateless, highly bursty, and experiences prolonged idle periods. The architecture must automatically scale to zero during periods of inactivity to eliminate baseline compute costs, sustain high availability across zonal failures, and enforce strict security boundaries that prevent compromised internal service accounts from copying sensitive data to external Cloud Storage buckets outside the enterprise environment. Which architectural strategy best satisfies these technical, availability, and security requirements?

Show answer & explanation

Answer: Deploy the microservice on Cloud Run fully managed, connect it to a Virtual Private Cloud (VPC) network using a Serverless VPC Access connector, and enclose the project resources within a VPC Service Controls perimeter.

Answer

Deploying the stateless microservice on Cloud Run attached to the VPC via Serverless VPC Access inside a VPC Service Controls perimeter satisfies scale-to-zero operational efficiency, high availability, and exfiltration prevention.
Cloud Run satisfies the technical requirement for a stateless HTTP workload that must scale down to zero instances during idle periods while providing native regional high availability across zones. Pairing Cloud Run with Serverless VPC Access and placing resources inside a VPC Service Controls perimeter guarantees that internal services cannot exfiltrate data to external storage destinations, fulfilling all stated security and availability criteria.

Step-by-Step Solution

1
Evaluate compute high availability and scale-to-zero cost requirements for stateless HTTP workloads.
Cloud Run is selected over GKE or Compute Engine MIGs because it scales automatically from zero to thousands of container instances and handles regional multi-zone deployment without baseline infrastructure costs during idle periods.
Simple stateless HTTP microservices with unpredictable bursty traffic benefit from serverless compute to minimize management overhead and cost.
2
Evaluate network security controls to satisfy data exfiltration prevention requirements.
VPC Service Controls must be implemented around the project and storage resources.
IAM permissions control who has access to resources, but VPC Service Controls define a security perimeter preventing data movement to resources outside the perimeter.
3
Integrate serverless compute with private network security boundaries.
A Serverless VPC Access connector routes egress traffic from Cloud Run into the private VPC network where perimeter policies apply.
Ensures Cloud Run instances can securely access internal network services and adhere to perimeter security restrictions.

Key Concept

Designing highly available serverless compute architectures paired with VPC Service Controls for exfiltration protection
Question 1260Question →

A global maritime fleet management enterprise is building an infrastructure on Google Cloud to collect position updates and engine metrics from thousands of cargo vessels worldwide. The position ingestion service is a lightweight stateless HTTP microservice experiencing erratic traffic spikes followed by periods of complete inactivity. Additionally, historical vessel route records must be preserved for 7 years to comply with maritime regulations, but these records are rarely queried after the first 30 days. The primary business requirement is to minimize operational management overhead and infrastructure cost while ensuring high availability. Which TWO architectural decisions should the enterprise implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the stateless position ingestion HTTP microservice to Cloud Run.; Store historical vessel route records in Cloud Storage and configure Object Lifecycle Management to transition objects to Coldline or Archive storage after 30 days.

Answer

The enterprise should deploy the position ingestion microservice to Cloud Run and store historical vessel route records in Cloud Storage with Object Lifecycle Management configured to transition objects to Coldline or Archive storage after 30 days.
Deploying to Cloud Run aligns with the business goal of cost optimization because serverless containers automatically scale down to zero compute instances during idle periods, eliminating baseline infrastructure charges. For storage, utilizing Cloud Storage with Object Lifecycle Management allows automated migration of vessel logs to cheaper Coldline or Archive tiers after 30 days, satisfying compliance requirements at minimal cost.

Step-by-Step Solution

1
Analyze compute requirements and traffic patterns for the position ingestion microservice.
Identified erratic traffic with periods of complete inactivity for a stateless microservice.
Cloud Run scales to zero instances during idle periods, charging only for resources consumed during request processing, which minimizes compute cost and management effort.
2
Analyze storage access patterns and retention compliance rules.
Identified high initial access for 30 days followed by 7 years of low-frequency retention.
Cloud Storage with Object Lifecycle Management transitions data from Standard to Coldline/Archive storage after 30 days, optimizing storage costs while keeping data accessible for compliance.

Key Concept

Designing Serverless Compute and Tiered Storage Lifecycles for Cost Optimization
Estimated Time:1m 30s
PreviousPage 63 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin