Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 1261Question →

A smart grid energy utility is designing a backend solution on Google Cloud to ingest and process daily energy readings from millions of smart meters within a single geographic region. The application requires ACID-compliant relational data storage for daily billing reconciliation. Traffic patterns show predictable daytime peak activity followed by minimal volume overnight. The primary business requirement is to minimize total cost of ownership (TCO) and operational maintenance effort while maintaining single-region high availability. Which architecture should you recommend?

Show answer & explanation

Answer: Deploy the HTTP ingestion API on Cloud Run and store the billing transactional data in Cloud SQL for PostgreSQL configured with High Availability (HA).

Answer

Deploying the HTTP ingestion service on Cloud Run combined with Cloud SQL for PostgreSQL configured for High Availability delivers the lowest cost of ownership and lowest operational overhead while meeting all ACID compliance and single-region availability requirements.
The combination of Cloud Run and Cloud SQL for PostgreSQL provides the optimal balance of operational simplicity and cost efficiency. Cloud Run handles the variable HTTP traffic by scaling down to zero during off-peak hours to eliminate idle compute spend. Cloud SQL delivers full ACID relational compliance for billing records within a single region without the premium baseline costs of multi-region database options.

Step-by-Step Solution

1
Analyze storage requirements for single-region relational ACID compliance.
Cloud SQL for PostgreSQL satisfies single-region ACID requirements at a fraction of the minimum node price of Cloud Spanner.
Cloud Spanner is designed for globally distributed, multi-region relational workloads and is cost-prohibitive for single-region applications.
2
Analyze compute requirements for variable, predictable web API traffic.
Cloud Run automatically scales instances according to demand and scales down to zero when idle, avoiding baseline infrastructure costs during low-traffic periods.
Serverless container platforms eliminate node cluster management overhead and pay-for-idle costs associated with GKE Standard or fixed Compute Engine virtual machines.

Key Concept

Selecting cost-effective compute and database services aligned with regional bounds and variable workload scaling profiles.
Estimated Time:1m 30s
Question 1262Question →

An industrial telemetry platform manages its Google Cloud infrastructure using Terraform within a automated CI/CD pipeline. The lead cloud architect must ensure that infrastructure provisioning is secure, resilient against concurrent execution conflicts, and adheres to the principle of least privilege during deployment. Which TWO strategies should the architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking enabled via standard Cloud Storage backend configuration.; Configure the CI/CD execution pipeline to impersonate a dedicated service account granted only the specific predefined roles necessary for the managed resources.

Answer

The architect should configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking enabled, and configure the CI/CD pipeline to impersonate a dedicated service account granted minimal predefined IAM roles.
Configuring a Cloud Storage backend with versioning and object locking ensures safe collaborative IaC workflows without state corruption. Using fine-grained predefined roles with service account impersonation guarantees least-privilege security for automated pipelines.

Step-by-Step Solution

1
Establish secure remote state management
Terraform state is stored centrally in Cloud Storage with state locking and object versioning.
Prevents concurrent execution conflicts and provides recovery capabilities against state corruption.
2
Implement identity and access governance for CI/CD pipelines
Automated deployments execute under a dedicated service account with fine-grained IAM roles.
Ensures least privilege security compliance for automated infrastructure provisioning.

Key Concept

Terraform State Backend Security and CI/CD IAM Governance
Question 1263Question →

Match each workload data requirement and access pattern on the left with its corresponding optimal managed Google Cloud storage or database service architecture on the right.

Click a left item, then click its matching right item

Items

High-throughput time-series IoT metrics ingestion requiring sustained sub-10ms write latency, seamless scale-out without operational downtime, and native compatibility with the open-source Apache HBase API.
Global financial ledger system requiring multi-region active-active transactional consistency, ANSI SQL support, seamless horizontal read/write scaling, and a 99.999% availability SLA.
Serverless enterprise data warehouse executing ad-hoc analytics over petabytes of structured data, leveraging decoupled compute and columnar storage with automatic query slot management.
Cross-platform mobile collaboration tool requiring document-based hierarchy, real-time client state updates via snapshot listeners, and automatic offline data sync.

Matches

Show answer & explanation

Answer

High-throughput time-series IoT ingestion pairs with Cloud Bigtable. Global financial ledger with ACID consistency and 99.999% SLA pairs with Cloud Spanner. Serverless enterprise analytics over petabytes of data pairs with BigQuery. Cross-platform mobile app with document storage and real-time offline sync pairs with Firestore.
Each Google Cloud database and storage offering is tailored for specific workload characteristics: Cloud Bigtable handles high-throughput NoSQL time-series data with HBase compatibility; Cloud Spanner handles global multi-region relational OLTP with 99.999% SLA; BigQuery handles serverless petabyte-scale analytical querying (OLAP); and Firestore handles NoSQL document data for mobile applications with real-time sync and offline support.

Step-by-Step Solution

1
Analyze latency, API compatibility, and write throughput requirements for IoT telemetry.
Identified Cloud Bigtable due to sub-10ms key-value write latency and native HBase API support.
Cloud Bigtable is optimized for heavy, continuous ingestion of time-series data without relational transactional overhead.
2
Evaluate global consistency, transaction model, and SLA constraints for global financial ledger.
Identified Cloud Spanner due to multi-region global ACID transactions, SQL interface, and five-nines availability SLA.
Cloud Spanner uses TrueTime and distributed consensus to achieve global horizontal scaling with strict ACID compliance.
3
Examine analytical workload pattern, storage format, and query execution scale.
Identified BigQuery for petabyte-scale serverless OLAP execution.
BigQuery separates compute and storage, providing columnar execution and slot-based processing for ad-hoc analytical queries.
4
Assess mobile/web application synchronization and document storage requirements.
Identified Firestore for document hierarchy, live query snapshot listeners, and offline mobile synchronization.
Firestore is specifically architected for client-facing applications requiring document-level real-time updates.

Key Concept

Mapping GCP Storage and Database Services to Application Access Patterns, Consistency Requirements, and SLAs
Estimated Time:2m 0s
Question 1264Question →

A global renewable energy utility company is designing the cloud infrastructure on Google Cloud for its smart grid control and monitoring platform. The architecture must ingest real-time telemetry from control centers and maintain high availability for critical transactional grid operations across multiple geographic regions.

The technical requirements are:
- Zero Recovery Point Objective (RPO=0RPO = 0) and a Recovery Time Objective (RTO<1 minuteRTO < 1\text{ minute}) for global transactional grid state storage during regional outages.
- High-throughput, SLA-backed hybrid network connectivity requiring 20 Gbps20\text{ Gbps} of dedicated bandwidth between on-premises control centers and Google Cloud VPCs.
- Prevention of data exfiltration from Cloud Storage telemetry buckets, ensuring users with valid IAM read permissions cannot copy telemetry data to storage buckets in external projects.

Which TWO architectural choices should the cloud architect implement to satisfy these high availability, throughput, and security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision a multi-region Cloud Spanner configuration across the required regions to host the transactional grid state.; Establish redundant 10 Gbps Dedicated Interconnect circuits and configure a VPC Service Controls perimeter around the project's Cloud Storage resources.

Answer

The correct architecture consists of provisioning a multi-region Cloud Spanner instance for synchronous cross-region transactional storage (RPO=0RPO = 0), establishing redundant 10 Gbps Dedicated Interconnect circuits for 20 Gbps hybrid throughput, and configuring a VPC Service Controls perimeter around Cloud Storage to mitigate data exfiltration.
Provisioning a multi-region Cloud Spanner instance fulfills the strict technical constraint of zero RPO and sub-minute RTO through synchronous multi-region Paxos consensus replication. Deploying Dedicated Interconnect guarantees 20 Gbps SLA-backed throughput between on-premises and GCP VPCs, while wrapping Cloud Storage within a VPC Service Controls perimeter blocks users from copying sensitive telemetry data outside the designated project boundaries.

Step-by-Step Solution

1
Evaluate data persistence requirements for RPO = 0 and RTO < 1 minute across global locations.
Identify that Cloud Spanner with a multi-region configuration uses synchronous Paxos replication across regions, meeting RPO = 0. Cloud SQL relies on asynchronous cross-region replicas which incur replication lag and non-zero RPO.
High availability for globally distributed transactional databases with zero RPO mandates multi-region Cloud Spanner.
2
Evaluate network throughput requirements between on-premises data centers and GCP.
Dedicated Interconnect provides direct 10 Gbps or 100 Gbps physical links with formal SLAs, easily supporting 20 Gbps via redundant connections. HA VPN tunnels max out around 3 Gbps per tunnel and travel over the uncommitted public internet.
Bandwidth demands of 20 Gbps require Dedicated Interconnect rather than HA VPN.
3
Evaluate data exfiltration protection requirements.
VPC Service Controls create a security perimeter preventing data from being copied out of designated project resources to unauthorized external storage buckets. IAM and CMEK alone do not enforce perimeter boundary isolation.
Preventing authorized users from exfiltrating data outside the environment requires VPC Service Controls.

Key Concept

Designing Multi-Region High Availability, High-Throughput Hybrid Connectivity, and Data Exfiltration Prevention in GCP
Estimated Time:2m 30s
Question 1265Question →

An enterprise SaaS company manages its Google Cloud infrastructure using Terraform within a Cloud Build CI/CD pipeline. The lead cloud architect must establish a secure Terraform state management architecture that prevents concurrent execution conflicts, enables state rollback in the event of corruption, and avoids using static, long-lived service account keys for pipeline authentication. Which solution meets these requirements according to Google Cloud best practices?

Show answer & explanation

Answer: Store the Terraform state in a Google Cloud Storage bucket with Object Versioning enabled, rely on the GCS backend's native state locking capabilities, and authenticate Cloud Build via Workload Identity Federation using a fine-grained service account.

Answer

Store the Terraform state in a Google Cloud Storage bucket with Object Versioning enabled, rely on native GCS backend state locking, and authenticate the CI/CD pipeline using Workload Identity Federation with a dedicated, least-privilege service account.
The combination of a Cloud Storage remote backend with Object Versioning and native locking provides centralized, consistent, and recoverable state management. Paired with Workload Identity Federation, the CI/CD pipeline securely authenticates using short-lived credentials assigned to a least-privilege service account without requiring static key storage.

Step-by-Step Solution

1
Configure the remote backend using Cloud Storage with Object Versioning.
Terraform state history is retained, enabling seamless recovery in case of accidental modification or state file corruption.
Google Cloud Storage natively supports object versioning, satisfying the state recovery requirement.
2
Leverage GCS backend native state locking.
Concurrent pipeline executions are prevented from writing to the state file simultaneously.
The GCS backend uses Cloud Storage strongly consistent object updates to lock state during execution without requiring external locking databases.
3
Establish Workload Identity Federation for authentication.
The Cloud Build CI/CD pipeline authenticates securely using short-lived tokens without storing or managing long-lived service account key files.
Workload Identity Federation removes key management overhead and security risks associated with exported service account JSON keys.

Key Concept

Infrastructure as Code (IaC) Remote State Governance and Secure CI/CD Authentication
Question 1266Question →

An enterprise operating strictly within a single GCP region needs to migrate an on-premises PostgreSQL database supporting an enterprise resource planning (ERP) system to Google Cloud. The workload requires full ACID compliance, complex relational SQL joins, automated cross-zone high availability failover, and support for up to 2,000 IOPS on a 600 GB database. The system does not require global read/write distribution or multi-region replication. Cost optimization and low operational overhead are primary business drivers. Which storage and database strategy should the Cloud Architect recommend?

Show answer & explanation

Answer: Deploy a Cloud SQL for PostgreSQL instance configured with High Availability (regional configuration across two zones) and dynamic storage growth enabled.

Answer

Deploy a Cloud SQL for PostgreSQL instance configured with High Availability (regional configuration across two zones) and dynamic storage growth enabled.
Cloud SQL for PostgreSQL configured with High Availability provisions a primary instance and a standby instance in two separate availability zones within the same region. Data is synchronously replicated to the standby persistent disk, enabling automated failover in the event of an outage. This fulfills all requirements for ACID transactions, complex joins, high availability, and performance while remaining cost-optimized for a single-region deployment.

Step-by-Step Solution

1
Analyze workload architectural constraints and data access patterns
The workload is localized to a single GCP region with a 600 GB relational dataset and 2,000 IOPS requirement, needing strict ACID transactions and relational SQL capabilities.
Single-region relational workloads without massive horizontal scaling needs do not warrant global database services.
2
Evaluate candidate GCP database options against availability and cost requirements
Cloud SQL for PostgreSQL configured for High Availability provisions primary and standby nodes in separate zones with synchronous replication, meeting the SLA and zero-data-loss RPO requirements.
Cloud SQL HA provides managed cross-zone failover while keeping operational complexity and baseline costs low.
3
Eliminate misaligned and over-engineered alternatives
Cloud Spanner is over-engineered for single-region workloads, while single-zone options fail the high-availability requirement and introduce key management or security misunderstandings.
Selecting the minimal managed service that satisfies all technical constraints optimizes Cloud FinOps and reliability.

Key Concept

Selecting Cloud SQL over Cloud Spanner for single-region relational database workloads
Estimated Time:2m 0s
Question 1267Question →

An energy utility enterprise is designing a hybrid cloud network architecture to connect its primary control centers, remote regional substations, and third-party partner facilities to Google Cloud. Match each hybrid networking requirement to the appropriate Google Cloud service.

Click a left item, then click its matching right item

Items

Direct physical fiber connection delivering 10 Gbps per link to a Google colocation facility, providing high bandwidth and strict 99.99% SLA without using the public internet.
Private, SLA-backed hybrid connectivity for data centers that cannot physically co-locate in a Google facility, established through a supported service provider.
Encrypted IPsec tunnels operating over public internet connections, providing 99.99% availability for remote branch facilities with bandwidth requirements below 3 Gbps.
Fully managed dynamic routing component that uses Border Gateway Protocol (BGP) to automatically exchange routes between on-premises networks and VPCs.

Matches

Show answer & explanation

Answer

The correct pairings are: 1) Direct 10 Gbps physical fiber connection maps to Dedicated Interconnect; 2) Private connectivity via a service provider maps to Partner Interconnect; 3) Encrypted IPsec tunnels over public internet maps to HA VPN; 4) Managed dynamic BGP routing maps to Cloud Router.
Each hybrid networking requirement maps directly to its corresponding GCP network service based on physical transport mechanism, bandwidth capacity, SLA guarantees, and dynamic routing capabilities.

Step-by-Step Solution

1
Identify high-bandwidth direct physical connectivity requirements.
Map direct physical fiber links in Google colocation facilities to Dedicated Interconnect.
Dedicated Interconnect provides direct physical circuits (10 Gbps or 100 Gbps) without relying on third-party service providers or public internet.
2
Evaluate enterprise sites lacking direct Google colocation presence.
Map third-party service provider hybrid connections to Partner Interconnect.
Partner Interconnect extends GCP VPC connectivity to customer locations through supported service provider networks.
3
Analyze encrypted IPsec connectivity needs over public internet links.
Map dual active-active IPsec tunnels for lower bandwidth branch sites to HA VPN.
HA VPN delivers topology redundancy and an enterprise-grade 99.99% SLA over public internet pathways.
4
Determine the service responsible for automated routing propagation.
Map Border Gateway Protocol (BGP) route exchange to Cloud Router.
Cloud Router manages dynamic BGP routing for Cloud VPN and Cloud Interconnect attachments.

Key Concept

Selecting GCP Hybrid Connectivity Solutions Based on Bandwidth, SLA, Transport, and Routing Requirements
Question 1268Question →

Your organization is establishing an automated, reliable environment provisioning workflow using Terraform and Cloud Build on Google Cloud. What is the correct sequence of steps to safely establish the infrastructure configuration pipeline from initial state storage setup to resource deployment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with creating the GCS state bucket with versioning, configuring the execution service account and IAM permissions, writing Terraform configurations referencing the GCS backend, running terraform init to configure the backend connection, and finally executing terraform plan and terraform apply.
Establishing IaC automation requires creating prerequisites (GCS state bucket and IAM Service Account), defining configuration code referencing those prerequisites, running terraform init to link the environment, and executing terraform plan and terraform apply to deploy resources safely.

Step-by-Step Solution

1
Provision remote state bucket
A secure GCS bucket with versioning is created to hold terraform.tfstate.
Backend storage infrastructure must exist prior to declaring backend initialization.
2
Configure service account and IAM access
A service account with least-privilege permissions and bucket storage access is generated.
The automated deployment pipeline requires authorized identity access to resources and state storage.
3
Define Terraform code and backend configuration
Terraform files declare GCP providers and link to the GCS backend bucket.
Infrastructure definition files must specify the target state storage location before initialization.
4
Initialize backend via terraform init
Provider plugins are downloaded and remote state lock mechanisms are established.
Initialization binds the workspace context to the remote state infrastructure.
5
Execute terraform plan and terraform apply
Resource modifications are evaluated for drift and successfully provisioned.
Specifying plan before apply guarantees changes are inspected prior to resource creation.

Key Concept

Terraform Automated Environment Provisioning Sequence
Question 1269Question →

A retail organization wants to bring a manually created Google Cloud Storage bucket used for transactional archives under Terraform management without destroying the existing bucket. Which sequence of operational steps must the Cloud Architect execute to safely import the bucket into the Terraform state using declarative import configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Declare the resource and import blocks in the HCL configuration file, 2) Execute terraform plan to inspect the import plan without introducing resource destruction, 3) Execute terraform apply to bind the live resource into the remote Cloud Storage state file while acquiring backend locks, and 4) Remove the temporary import block from the configuration.
The correct sequence follows Google Cloud and Terraform best practices for brownfield IaC onboarding: configuration declaration (resource and import blocks), plan verification to prevent resource destruction, apply execution to update state safely with remote backend locking, and post-import cleanup of temporary import metadata.

Step-by-Step Solution

1
Define the target resource block along with an import block specifying the HCL address and live GCP bucket name.
Terraform configuration is prepared with declarative import metadata.
Terraform requires both the HCL schema target and live resource mapping to process an import.
2
Run terraform plan.
The plan output displays an import action without showing any resource replacements or deletions.
Running plan validates that configuration definitions match live infrastructure attributes, preventing accidental destruction.
3
Run terraform apply.
The live resource state is imported into the Google Cloud Storage backend state file.
Applying the plan persists the imported resource into state while maintaining state lock integrity.
4
Remove the import block from the code repository.
The configuration contains only standard resource blocks for ongoing deployment operations.
Leaving import blocks after state registration causes redundant evaluation during future CI/CD execution.

Key Concept

Declarative Infrastructure as Code resource import workflow and state management
Question 1270Question →

An enterprise healthcare platform uses Compute Engine Managed Instance Groups (MIGs) to run I/O-bound microservices that ingest and process HL7 FHIR clinical data streams. During peak admission hours, processing delays increase significantly because the instances fail to scale out, even though individual VM CPU utilization remains below 25%. Furthermore, a planned hospital integration next month is projected to triple the baseline event volume. Which combination of actions should the Cloud Architect take to resolve the autoscaling issue and ensure capacity for the expansion?

Show answer & explanation

Answer: Configure the MIG autoscaler using a Cloud Monitoring custom metric representing active connection queue length, and submit a regional vCPU quota increase request prior to the planned hospital integration.

Answer

Configure the MIG autoscaler using a Cloud Monitoring custom metric representing active connection queue length, and submit a regional vCPU quota increase request prior to the planned hospital integration.
For I/O-bound applications, scaling metrics based on CPU utilization fail to capture true workload bottlenecks. Utilizing Cloud Monitoring custom metrics (such as active connection queue length or Pub/Sub depth) enables the MIG autoscaler to respond dynamically to load. Furthermore, capacity planning requires requesting compute quota increases in advance to ensure the cloud infrastructure can scale up without encountering platform quota caps during anticipated traffic increases.

Step-by-Step Solution

1
Identify the primary scaling bottleneck for the workload.
The application is I/O-bound and experiences processing delays despite low CPU utilization (<25%), indicating that standard CPU-based autoscaling is ineffective.
I/O-bound microservices bottleneck on network sockets or queue backlogs rather than CPU capacity.
2
Select the appropriate autoscaling metric strategy.
Implement custom metric autoscaling in Cloud Monitoring based on queue depth or open connection metrics.
Custom metrics accurately reflect true workload pressure for non-CPU bound services.
3
Perform proactive capacity planning for future growth.
Request regional vCPU resource quota increases in advance of the anticipated workload expansion.
Autoscaling groups cannot provision instances beyond the project's regional resource quotas, and requesting quota increases in advance ensures seamless scaling during peak events.

Key Concept

Auto-scaling for I/O-bound workloads requires custom telemetry metrics (such as queue depth), while capacity planning mandates proactive resource quota management prior to workload expansion.
Question 1271Question →

A global retail platform is migrating its infrastructure to Google Cloud. The architecture team needs to select storage and database services for two core requirements:
1. A transactional relational database for worldwide customer orders requiring strong multi-region ACID consistency and high availability.
2. A scalable unstructured object store for hosting petabytes of product media assets with automated lifecycle policies to transition older assets to colder storage tiers.

Which TWO Google Cloud services should you include in your architecture to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Cloud Spanner for managing globally distributed transactional relational data with multi-region ACID compliance.; Cloud Storage with Object Lifecycle Management for hosting unstructured media assets and automatically transitioning aging objects.

Answer

The correct architecture combines Cloud Spanner for global transactional relational data with multi-region ACID consistency, and Cloud Storage with Object Lifecycle Management for scalable unstructured media storage.
Selecting Cloud Spanner satisfies the requirement for a multi-region relational database with strong ACID consistency across global locations. Selecting Cloud Storage with Object Lifecycle Management satisfies the requirement for petabyte-scale unstructured object storage with automated cost-optimization tiering.

Step-by-Step Solution

1
Analyze the relational database requirement for global scale and multi-region ACID compliance.
Cloud Spanner is identified as the only GCP managed relational database offering multi-region horizontal scaling and strong consistency.
Cloud SQL is limited to single-region primary instances with read-only replicas, making it insufficient for multi-region transactional write requirements.
2
Analyze the unstructured media storage and cost optimization requirement.
Cloud Storage with Object Lifecycle Management satisfies petabyte-scale object storage and automated tiering.
Object Lifecycle Management automates transitions between Standard, Nearline, Coldline, and Archive storage classes based on object age.

Key Concept

Selecting GCP storage and database resources based on access patterns, transactional consistency, global scale, and data lifecycle requirements.
Question 1272Question →

An enterprise utility provider is architecting an IoT smart-grid monitoring platform on Google Cloud. The system must process continuous operational metrics from millions of distributed smart meters across two separate geographic regions. The business requires multi-region high availability with a strict Recovery Point Objective (RPO) of zero and near-zero Recovery Time Objective (RTO) for transactional state data. Furthermore, hybrid network connectivity between the Google Cloud Virtual Private Cloud (VPC) and the on-premises control center must guarantee throughput exceeding 10 Gbps while ensuring sensitive operational telemetry cannot be exfiltrated to external, unapproved cloud storage buckets. Which TWO architectural solutions should you implement to satisfy these technical availability and security requirements?

Select all that apply

Show answer & explanation

Answer: Deploy a multi-region Cloud Spanner database instance to store core transactional telemetry, utilizing synchronous replication across regions to deliver high availability and zero RPO.; Establish Dedicated Interconnect with redundant links across two metro locations for high-throughput hybrid connectivity, and enforce VPC Service Controls perimeters to prevent data exfiltration to external storage buckets.

Answer

The application requires deploying a multi-region Cloud Spanner database for zero RPO transactional consistency and establishing Dedicated Interconnect alongside VPC Service Controls for high-throughput, exfiltration-resistant hybrid networking.
To satisfy zero RPO and multi-region high availability for transactional writes, multi-region Cloud Spanner is required due to its synchronous Paxos-based replication across regions. For hybrid network traffic exceeding 10 Gbps with high availability, Dedicated Interconnect provides enterprise-grade high bandwidth across distinct metro facilities, while VPC Service Controls isolate resources to prevent unauthorized exfiltration to external cloud storage destinations.

Step-by-Step Solution

1
Evaluate storage database requirements for RPO=0 across multiple regions.
Cloud Spanner uses Paxos-based synchronous cross-region replication, guaranteeing transactional consistency and zero RPO failover. Cloud SQL relies on asynchronous cross-region replication which risks data loss.
Selecting Cloud Spanner satisfies the strict zero RPO requirement for multi-region transactional telemetry.
2
Evaluate network connectivity requirements for throughput > 10 Gbps.
Dedicated Interconnect offers 10 Gbps or 100 Gbps physical circuits capable of meeting high-throughput SLA demands across metro locations, whereas HA VPN is limited to 3 Gbps per tunnel.
Dedicated Interconnect provides the necessary bandwidth and high-availability SLA for enterprise hybrid traffic.
3
Evaluate data exfiltration control requirements.
VPC Service Controls form a security perimeter around resources, blocking data transfer calls to Cloud Storage buckets outside the boundary even if IAM rights permit access.
IAM alone permits data movement to external storage if an identity possesses appropriate write permissions.

Key Concept

Multi-region High Availability and Enterprise Security Architecture
Question 1273Question →

An enterprise digital publishing company is migrating its subscription management and billing database from an on-premises PostgreSQL instance to Google Cloud. The workload operates exclusively within a single GCP region (us-east4) and requires full ANSI SQL compliance, multi-zone high availability with automatic failover, and strict transactional ACID guarantees. Peak write throughput is estimated at 1,800 operations per second. Additionally, compliance policy mandates that data at rest must be encrypted using customer-managed encryption keys integrated with Cloud KMS for automated key rotation. Which storage and database architecture should the lead cloud architect select?

Show answer & explanation

Answer: Deploy Cloud SQL for PostgreSQL in a high-availability configuration across two zones in us-east4, configured with Customer-Managed Encryption Keys (CMEK) via Cloud KMS.

Answer

Deploy Cloud SQL for PostgreSQL in a high-availability configuration across two zones in us-east4, configured with Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
Deploying Cloud SQL for PostgreSQL in a regional high-availability configuration satisfies all transactional (ACID), regional availability, performance (1,800 writes/sec), and key management requirements. Cloud SQL supports multi-zone failover within a single region and integrates directly with Cloud KMS to encrypt database disks at rest using Customer-Managed Encryption Keys (CMEK).

Step-by-Step Solution

1
Analyze workload relational and transactional requirements.
The workload requires standard ANSI SQL relational schemas and strict ACID transactional guarantees within a single region at 1,800 writes/sec.
Cloud SQL for PostgreSQL fully supports single-region relational workloads up to tens of thousands of IOPS without requiring horizontally scaled global databases.
2
Evaluate high availability and multi-zone requirements.
Cloud SQL HA configuration provides regional multi-zone redundancy with automatic failover between primary and standby instances in us-east4.
This satisfies the multi-zone HA requirement without needing multi-region replication.
3
Evaluate key management governance requirements.
Customer-Managed Encryption Keys (CMEK) using Cloud KMS allow centralized key management, access auditing, and automated rotation.
CSEK is unnecessary and burdensome, while CMEK satisfies Cloud KMS governance policies seamlessly.

Key Concept

Selecting and Designing Storage and Database Resources
Estimated Time:2m 0s
Question 1274Question →

A global pharmaceutical enterprise is designing a hybrid cloud architecture to connect its on-premises laboratory network to Google Cloud. The architecture must host workloads across two distinct projects—Production and Analytics. The connectivity solution must support an aggregate peak bandwidth of 2 Gbps, provide an SLA of 99.99%, enforce end-to-end IPsec encryption in transit, and minimize operational deployment costs. On-premises systems must be able to communicate securely with workloads in both project environments. Which architectural design should a Cloud Architect recommend?

Show answer & explanation

Answer: Create a Shared VPC architecture hosted in a centralized administration project with subnets for Production and Analytics workloads, and connect the Host VPC to on-premises using HA VPN gateways and Cloud Router.

Answer

The correct architecture uses a Shared VPC host network containing subnets for Production and Analytics workloads, connected to the on-premises environment via HA VPN gateways with Cloud Router.
Establishing a Shared VPC architecture consolidates the networking layer into a central host project while allowing distinct workload projects (Production and Analytics) to manage their respective resources. A single HA VPN deployment with Cloud Router in the host VPC satisfies the 2 Gbps throughput requirement (within the 3 Gbps per tunnel capacity), provides built-in IPsec encryption, guarantees 99.99% availability, and minimizes deployment cost.

Step-by-Step Solution

1
Evaluate throughput and encryption requirements
The requirement is 2 Gbps with IPsec encryption in transit. High Availability (HA) VPN supports up to 3 Gbps per tunnel with native IPsec encryption and a 99.99% SLA at a significantly lower cost than Dedicated Interconnect.
Choosing Dedicated Interconnect for 2 Gbps is cost-inefficient when HA VPN meets throughput, encryption, and availability constraints.
2
Evaluate multi-project hybrid network topology
VPC Network Peering does not allow transitive traffic from hybrid connections (on-premises cannot reach VPC B through VPC A via peering). Using Shared VPC places Production and Analytics subnets into a unified network space under a host project.
Shared VPC allows a single HA VPN deployment in the host network to route traffic seamlessly to all service project subnets without hitting transitive routing limitations.

Key Concept

Shared VPC and HA VPN Hybrid Network Integration
Question 1275Question →

A digital health enterprise is designing a multi-region clinical monitoring architecture on Google Cloud. The solution must fulfill two specific operational requirements:

1. Ingest and store real-time time-series telemetry data emitted by millions of wearable patient devices, requiring single-digit millisecond write latency and high-throughput key-value storage.
2. Store core patient administrative and treatment records requiring strong multi-region ACID compliance, high availability across continents, and ANSI SQL query support.

Which TWO database services should you recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Cloud Bigtable to handle high-throughput, low-latency time-series IoT device telemetry data.; Cloud Spanner to host patient records requiring multi-region relational consistency and ANSI SQL compliance.

Answer

The optimal architecture combines Cloud Bigtable for real-time IoT time-series telemetry ingestion and Cloud Spanner for globally consistent, multi-region relational patient records.
Selecting Cloud Bigtable provides the required low latency and massive scale for real-time time-series IoT telemetry. Selecting Cloud Spanner delivers global multi-region transactional consistency with ANSI SQL compatibility for patient record management.

Step-by-Step Solution

1
Analyze workload 1 (telemetry data)
Identified high-volume time-series IoT data needing single-digit millisecond latency.
Cloud Bigtable provides scalable wide-column NoSQL storage suited for time-series access patterns and high write throughput.
2
Analyze workload 2 (patient records)
Identified relational data requiring multi-region ACID consistency and ANSI SQL support.
Cloud Spanner is the native GCP database designed for globally distributed relational databases requiring multi-region ACID transactions.
3
Evaluate and eliminate unsuitable database alternatives
Cloud SQL cannot support multi-region write scalability; Storage Transfer Service is not an ingestion pipeline engine.
Ensures architectural patterns align with GCP managed service limits and capabilities.

Key Concept

Selecting GCP Database Services for Hybrid Workloads (NoSQL Time-Series vs Global Relational ACID)
Estimated Time:2m 0s
Question 1276Question →

An enterprise platform engineering team is configuring an automated Cloud Build pipeline to provision a isolated staging environment on Google Cloud using Terraform. Place the procedural steps in the correct order to execute a secure, reliable environment provisioning workflow following Google Cloud best practices.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for environment provisioning is: 1) Authenticate pipeline identity via Workload Identity Federation, 2) Initialize Terraform backend and acquire GCS state lock, 3) Generate a deterministic execution plan artifact, 4) Apply the saved execution plan artifact, and 5) Run post-deployment validation tests and release state locks.
The sequence follows GCP enterprise reliability best practices: establish identity authentication first via Workload Identity Federation, initialize the remote backend to lock state and prevent concurrent updates, generate a deterministic plan artifact to lock in expected changes, apply the exact plan artifact to provision resources, and complete post-provisioning integration testing before releasing state locks.

Step-by-Step Solution

1
Authenticate pipeline service account
Pipeline worker gains temporary authorization without relying on long-lived service account keys.
Workload Identity Federation provides least-privilege security before any backend or API calls occur.
2
Initialize Terraform remote backend
GCS backend establishes connection and acquires state lock.
Remote state initialization is necessary before state drift evaluation or execution planning.
3
Generate plan artifact (`terraform plan -out=tfplan`)
Speculative plan artifact is calculated and saved.
Saving the plan artifact prevents race conditions where cloud state changes between plan and apply steps.
4
Apply the saved plan artifact (`terraform apply tfplan`)
GCP resources are created and configured exactly as planned.
Passing the stored plan guarantees idempotency and deterministic deployment.
5
Execute post-deployment validation
Environment reliability is confirmed and lock is released.
Automated validation ensures operational readiness before declaring successful deployment.

Key Concept

Automated Environment Provisioning & IaC State Lifecycle
Estimated Time:1m 30s
Question 1277Question →

A global logistics provider provisions short-lived operational simulation environments in Google Cloud using automated Infrastructure as Code (IaC) workflows. During high-demand testing cycles, automated environment creation fails because the provisioning pipeline attempts to allocate Compute Engine VM instances that exceed the project's regional CPU quota limits before previous temporary environments are destroyed. Which architectural approach best ensures reliable and predictable environment provisioning?

Show answer & explanation

Answer: Proactively request regional compute quota increases based on peak concurrency projections and implement quota monitoring alerts within the environment management pipeline.

Answer

Proactively request regional compute quota increases based on peak concurrency projections and implement quota monitoring alerts within the environment management pipeline.
The correct strategy involves proactively assessing peak capacity requirements, requesting necessary regional compute quota adjustments ahead of deployment, and setting up alerting on quota consumption. This prevents IaC automation from encountering unexpected quota limits during environment provisioning.

Step-by-Step Solution

1
Analyze the root cause of the environment provisioning failures.
Provisioning fails due to regional Compute Engine CPU resource quota limits being exceeded during overlapping lifecycle events.
Google Cloud quotas cap resource usage per region/project to prevent unexpected resource exhaustion.
2
Evaluate the nature of GCP quota adjustments.
Quota increases cannot be applied instantaneously in-line during an IaC apply step.
Quota increases require asynchronous evaluation and approval.
3
Formulate a reliable IaC capacity and provisioning governance strategy.
Forecast peak concurrent resource needs and submit regional quota increase requests ahead of time while monitoring usage via Cloud Monitoring.
This guarantees adequate quota availability for automated environment provisioning.

Key Concept

Resource Quotas and Capacity Governance in Automated Environment Provisioning
Question 1278Question →

A game development studio provisions isolated, short-lived game server fleets across multiple Google Cloud regions using Terraform pipelines. Multiple automated build jobs running concurrently frequently fail due to state file locking collisions and state corruption when attempting to write to the local directory before uploading state. Which approach should the cloud architecture team implement to ensure reliable, concurrent environment provisioning and state integrity?

Show answer & explanation

Answer: Configure a Cloud Storage remote backend with state locking and object versioning enabled.

Answer

Configure a Cloud Storage remote backend with state locking and object versioning enabled.
Configuring a Google Cloud Storage remote backend with object locking and versioning ensures that concurrent execution jobs lock state during operations, preventing simultaneous updates and corruption while maintaining continuous environment reliability.

Step-by-Step Solution

1
Identify the root cause of state locking collisions and state corruption during parallel pipeline executions.
Recognized that local or uncoordinated state management leads to race conditions when multiple Terraform processes execute simultaneously.
Infrastructure as Code pipelines require centralized, synchronized state management to coordinate concurrent environment provisioning.
2
Evaluate Google Cloud architecture best practices for Terraform state backends.
Selected Cloud Storage as a remote backend supporting native strong consistency and state locking.
Google Cloud Storage natively provides object locking and strong consistency to prevent parallel workers from corrupting state.
3
Enable object versioning on the designated Cloud Storage bucket.
Established point-in-time recovery capabilities for infrastructure state history.
Bucket versioning allows rollback to previous state snapshots if unintended state modifications occur.

Key Concept

Centralized remote state management with backend locking and versioning for Infrastructure as Code reliability
Estimated Time:1m 30s
Question 1279Question →

An enterprise automotive company is designing the high-availability cloud architecture on Google Cloud for its connected vehicle telemetry ingestion service. The system must meet three critical technical requirements: establish private hybrid connectivity between their primary data center and Google Cloud with guaranteed throughput exceeding 10 Gbps; auto-scale compute workloads based on incoming message queue backlog rather than CPU metrics; and enforce data exfiltration protections to prevent authorized administrators from copying ingested telemetry files to external Cloud Storage buckets outside the enterprise boundary. Which architecture recommendation satisfies all technical and availability requirements?

Show answer & explanation

Answer: Provision Dedicated Interconnect for hybrid connectivity, configure compute auto-scaling based on Cloud Pub/Sub unacknowledged message count metrics, and configure VPC Service Controls perimeter boundaries around Cloud Storage resources.

Answer

Provision Dedicated Interconnect for high-throughput hybrid connectivity, utilize queue backlog metrics (Cloud Pub/Sub unacknowledged message count) for scaling I/O-bound consumers, and enforce VPC Service Controls to prevent data exfiltration beyond security perimeters.
The combination of Dedicated Interconnect, queue-depth-based autoscaling via Cloud Pub/Sub metrics, and VPC Service Controls fulfills all throughput, availability, and security requirements. Dedicated Interconnect provides native 10 Gbps/100 Gbps dedicated pipes; Pub/Sub unacknowledged message count accurately triggers scaling for queue processing workloads; and VPC Service Controls isolates storage resources within a network perimeter to prevent exfiltration to external projects.

Step-by-Step Solution

1
Evaluate hybrid network connectivity throughput requirements
Requirements specify guaranteed bandwidth exceeding 10 Gbps, which requires Dedicated Interconnect (offering 10 Gbps or 100 Gbps pipes) rather than HA Cloud VPN (max 3 Gbps per tunnel).
Choosing the appropriate physical connectivity option guarantees SLA and throughput constraints.
2
Select autoscaling metric for message ingestion consumers
For queue-based telemetry processing, scaling on Pub/Sub unacknowledged message count (queue depth) ensures compute instances scale ahead of queue backlogs.
CPU utilization metrics do not reflect I/O-bound message queue buildup.
3
Select security controls for exfiltration prevention
VPC Service Controls establishes a boundary blocking communication and data copy actions to GCP services outside the defined perimeter, even for valid IAM identities.
IAM roles grant permission to access data but cannot restrict copying data to external projects.

Key Concept

Designing high-availability hybrid architectures balancing network throughput, workload-appropriate autoscaling metrics, and perimeter security controls.
Question 1280Question →

A financial technology organization is designing the storage tier for a new regional rewards and redemption service operating exclusively within a single Google Cloud region. The service requires strong ACID transactional consistency, complex SQL join operations across relational schemas, and an automated regional failover mechanism to guarantee high availability. Total data volume is estimated at 1.5 TB with a peak workload of 12,000 IOPS. The lead architect emphasizes minimizing ongoing operational cost and management complexity while fulfilling all technical constraints. Which database architecture should you recommend?

Show answer & explanation

Answer: Deploy Cloud SQL for PostgreSQL configured with high availability (regional failover) across two zones within the target region.

Answer

Deploy Cloud SQL for PostgreSQL configured with high availability (regional failover) across two zones within the target region.
Cloud SQL for PostgreSQL with high availability enabled across two zones delivers fully managed ACID-compliant relational storage with automatic zonal failover. For a 1.5 TB single-region workload requiring SQL joins, Cloud SQL meets all functional performance and SLA demands at an optimal cost point.

Step-by-Step Solution

1
Analyze core storage requirements
Workload needs relational schema, complex SQL joins, strict ACID compliance, single-region scope, and 1.5 TB capacity at 12,000 IOPS.
Understanding access patterns and data volume determines whether an OLTP relational database, NoSQL engine, or data warehouse is appropriate.
2
Evaluate scale and regional boundary
Because the workload is strictly single-region and under 10 TB, Cloud SQL can easily handle the throughput and storage demands without requiring globally distributed horizontal scaling.
Cloud Spanner is designed for globally distributed, multi-region relational workloads requiring massive scale. For regional workloads, Cloud SQL is significantly more cost-effective and simpler to operate.
3
Select high availability mechanism
Enabling high availability on Cloud SQL creates a primary instance and a standby instance in a separate zone within the same region using regional persistent disk replication.
Regional failover ensures automatic failover to the standby zone in case of a zonal outage, fulfilling the HA SLA requirement.

Key Concept

Choosing Cloud SQL vs Cloud Spanner based on workload scale, geographic distribution, and operational cost.
PreviousPage 64 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin