Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 1501Question →

A enterprise team needs to host a standard relational database on Google Cloud for an internal application. The workload requires high availability within a single GCP region with automatic zonal failover, but it has modest traffic and does not require global horizontal scaling or multi-region replication. Which infrastructure solution should you choose to meet these high availability requirements with minimal operational overhead?

Show answer & explanation

Answer: Cloud SQL configured with regional high availability (HA) using automatic zonal failover

Answer

Cloud SQL configured with regional high availability (HA) using automatic zonal failover is the optimal solution.
Cloud SQL regional high availability (HA) provides fully managed primary and standby database instances deployed in separate availability zones within the same region. Synchronous data replication ensures zero-data-loss failover without manual intervention or managing infrastructure.

Step-by-Step Solution

1
Analyze high availability requirements
The requirement mandates regional high availability with automatic failover across zones for a standard relational database.
Single-zone or snapshot-based recovery cannot satisfy low Recovery Time Objectives (RTO) without downtime.
2
Evaluate managed database service options
Cloud SQL provides built-in regional HA with a primary and standby instance in separate zones and automatic synchronous replication.
Choosing a fully managed solution eliminates operational overhead while fulfilling standard relational database constraints.
3
Eliminate over-engineered alternatives
Cloud Spanner and GKE custom StatefulSets are over-engineered for modest regional relational workloads.
Spanner adds high costs aimed at global scale, while GKE adds unnecessary management complexity.

Key Concept

Selecting managed cloud database services with regional High Availability (HA) failover
Question 1502Question →

An enterprise insurance provider is migrating its legacy claims processing platform to Google Cloud to reduce technical debt. The system consists of stateless application services connected to an on-premises relational database. The project team plans to implement a blue-green deployment pattern in Google Cloud to release new cloud-native microservices while updating the underlying database schema. Business continuity policies mandate zero downtime and immediate rollback capabilities if the new release fails. Which architecture strategy should the Cloud Architect recommend to manage database changes during this legacy migration phase?

Show answer & explanation

Answer: Adopt an expand-and-contract database schema migration pattern to ensure backward compatibility for the active blue deployment while supporting the new green release.

Answer

Adopt an expand-and-contract database schema migration pattern to ensure backward compatibility for the active blue deployment while supporting the new green release.
The correct strategy is to adopt an expand-and-contract (parallel change) database schema migration pattern. When executing a blue-green deployment, both the old application version (blue) and the new application version (green) may run concurrently against the database. Using an expand-and-contract strategy ensures all schema changes are additive and backward-compatible during the transition phase, allowing the legacy blue application to remain functional and enabling instant rollback if issues occur with the green version.

Step-by-Step Solution

1
Analyze the zero-downtime and rollback requirements for blue-green application releases during cloud migration.
Identified that both the old (blue) and new (green) application versions must be capable of interacting with the shared database concurrently during traffic cutover.
If schema changes break the blue environment, instant rollback becomes impossible.
2
Evaluate database schema refactoring patterns suitable for legacy cloud migrations.
Determined that the expand-and-contract pattern (adding new columns/tables without removing old ones) supports backward compatibility.
This allows the legacy application to function normally while the upgraded green version utilizes the new schema.
3
Finalize the schema evolution plan for post-migration technical debt remediation.
Plan to contract (remove deprecated columns/tables) only after the green version is fully stabilized and the blue environment is decommissioned.
This completes the technical debt cleanup safely without service interruption.

Key Concept

Expand-and-contract (parallel change) pattern for database schema migrations in zero-downtime deployments
Question 1503Question →

A regional retail firm is selecting a managed database service to handle operational sales orders within a single Google Cloud region. The application requires full ACID transaction compliance and standard relational SQL capabilities, but does not require cross-region replication or global horizontal scale. Which Google Cloud service should be selected?

Show answer & explanation

Answer: Cloud SQL

Answer

Cloud SQL is the optimal choice for single-region relational workloads requiring ACID transactions and standard SQL functionality.
Cloud SQL is a fully managed relational database service supporting PostgreSQL, MySQL, and SQL Server. It delivers full ACID compliance, standard SQL query support, and high availability within a single region, matching the workload requirements while avoiding unnecessary costs.

Step-by-Step Solution

1
Analyze the workload requirements
Identified operational sales order processing requiring relational SQL queries and strict ACID transaction compliance in a single region.
Understanding data structure and access patterns dictates whether relational or NoSQL solutions are required.
2
Evaluate scalability and regional scope
The application operates strictly within a single Google Cloud region and does not require global multi-region synchronous replication.
Single-region relational requirements are best matched with regional database services to optimize licensing and operational costs.
3
Select the optimal GCP database resource
Selected Cloud SQL as it provides fully managed relational database engines with ACID compliance at an appropriate cost profile.
Cloud SQL satisfies all technical requirements without the unnecessary cost overhead of globally distributed engines.

Key Concept

Relational Database Selection for Single-Region Workloads
Question 1504Question →

A multinational retail banking institution is architecting hybrid connectivity to migrate its core transaction processing platform from an on-premises data center to Google Cloud. The architecture requires a sustained throughput of 15 Gbps15\text{ Gbps} for real-time database synchronization between on-premises mainframes and compute instances hosted across two GCP regions. The compliance team mandates zero traversal over the public internet, and the business continuity team specifies a strict uptime Service Level Agreement (SLA) of 99.99%99.99\%. Which hybrid networking design satisfies these requirements?

Show answer & explanation

Answer: Provision dual 10 Gbps Dedicated Interconnect connections in one GCP interconnect location and dual 10 Gbps Dedicated Interconnect connections in a second GCP interconnect location, with Cloud Routers deployed in each region establishing BGP sessions over distinct VLAN attachments.

Answer

Deploy dual 10 Gbps Dedicated Interconnect connections in two distinct GCP interconnect locations with Cloud Routers in each target region.
Deploying dual 10 Gbps Dedicated Interconnect links across two distinct GCP interconnect locations with redundant Cloud Routers in each region fulfills the 15 Gbps bandwidth requirement, provides private connectivity off the public internet, and adheres strictly to Google's 99.99% SLA topology requirements.

Step-by-Step Solution

1
Analyze bandwidth and security constraints.
The requirement calls for sustained 15 Gbps throughput without public internet traversal. HA VPN maxes out at 3 Gbps per tunnel and traverses public networks, ruling out VPN-only strategies.
Dedicated Interconnect provides private, direct physical links capable of 10 Gbps or 100 Gbps per circuit.
2
Evaluate high availability (SLA) requirements.
The requirement specifies a 99.99% SLA.
Google Cloud requires 4 VLAN attachments deployed across 2 separate interconnect locations (metropolitan regions) connected to 2 distinct on-premises routers to qualify for the 99.99% SLA.
3
Evaluate transitive routing mechanisms.
VPC Network Peering does not support transitive routing for hybrid interconnect traffic.
Traffic cannot hop from On-Premises -> Transit VPC -> Peered Spoke VPC via standard VPC Peering alone.

Key Concept

Designing High-Availability (99.99%) Dedicated Interconnect Architectures
Estimated Time:2m 0s
Question 1505Question →

A financial services enterprise needs to establish a secure, private connection from workloads running in its Google Cloud VPC to a third-party software provider's managed API hosted in a separate Google Cloud organization. The security team mandates that communication must remain strictly within the Google Cloud backbone without exposing internal IP ranges or requiring VPC Network Peering. Additionally, the project hosting the enterprise workloads must prevent authorized users from exfiltrating data to unauthorized external resources outside the designated security boundary. Which architectural design fulfills all specified security and connectivity requirements?

Show answer & explanation

Answer: Provision a Private Service Connect (PSC) endpoint inside the consumer VPC pointing to the provider's Service Attachment, and place the consumer project inside a VPC Service Controls perimeter configured with an explicit egress rule allowing access to the target service.

Answer

Provision a Private Service Connect (PSC) endpoint inside the consumer VPC pointing to the provider's Service Attachment, and place the consumer project inside a VPC Service Controls perimeter configured with an explicit egress rule allowing access to the target service.
The correct solution uses Private Service Connect to provide private, single-direction endpoint connectivity to the external service without exposing network topologies or requiring VPC peering. Combining this with VPC Service Controls protects against data exfiltration by locking down API egress while permitting explicitly configured egress rules to the trusted service attachment.

Step-by-Step Solution

1
Analyze connectivity requirements across independent organization boundaries without IP range exposure.
Private Service Connect (PSC) allows private endpoint creation inside the consumer VPC to access published services in another organization via internal IP addresses without requiring VPC Peering.
VPC Peering exposes RFC 1918 subnets between organizations and requires non-overlapping IP space, whereas PSC abstracts the target service into an internal endpoint address.
2
Evaluate data exfiltration protection requirements.
VPC Service Controls (VPC SC) creates a secure perimeter around Google Cloud resources to prevent exfiltration even if IAM credentials are compromised or misused.
IAM grants access identity permission, but only VPC SC enforces spatial network boundaries preventing data copy operations to unauthorized external locations.
3
Synthesize perimeter security rules for permitted third-party service communication.
Configure a VPC SC perimeter with specific ingress and egress rules to allow traffic exclusively to the approved PSC service attachment and target project.
This guarantees that all other unauthorized egress data flows outside the perimeter remain blocked.

Key Concept

Combining Private Service Connect (PSC) with VPC Service Controls egress policies for secure multi-tenant service consumption and anti-exfiltration perimeter defense.
Estimated Time:2m 0s
Question 1506Question →

A pharmaceutical research firm hosts its core analytics pipeline in Google Cloud with a primary deployment in region `us-central1`. The workload consists of a stateless application running on Compute Engine Managed Instance Groups (MIGs) and an operational database on Cloud SQL for PostgreSQL. The firm is configuring a warm standby disaster recovery plan targeting region `us-east4` to achieve an RPO of under 5 minutes and an RTO of under 15 minutes, while keeping idle steady-state costs low. Which of the following execution steps must be included in the emergency failover runbook? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Promote the cross-region Cloud SQL for PostgreSQL read replica located in `us-east4` to become a standalone primary database instance.; Resize the pre-configured warm standby Compute Engine MIG in `us-east4` from its baseline capacity up to full production capacity.

Answer

The correct execution steps are promoting the cross-region Cloud SQL read replica in the DR region to a standalone primary database and scaling up the warm standby Compute Engine Managed Instance Group in the DR region to production capacity.
Executing a warm standby DR failover for relational workloads requires promoting the cross-region read replica to a writable primary database and expanding the compute instance group capacity in the DR region. These actions ensure data accessibility with minimal RPO and restore service capacity rapidly within the target RTO.

Step-by-Step Solution

1
Promote the database replica in the failover region
The Cloud SQL read replica in `us-east4` stops replicating from `us-central1` and becomes an independent, writable primary database.
Data written continuously via asynchronous cross-region replication is preserved, minimizing data loss to satisfy RPO.
2
Scale the application tier in the DR region
The Compute Engine MIG in `us-east4` scales up from minimum baseline instances to the target instance count required for full production load.
This achieves an RTO of under 15 minutes while maintaining low baseline operational costs prior to failover.

Key Concept

Warm Standby Disaster Recovery Execution for Compute Engine and Cloud SQL
Question 1507Question →

An online gaming platform is designing its architecture on Google Cloud for a single-region backend deployment. The system needs to support a relational user profile database that requires regional high availability but does not require multi-region global synchronization. Additionally, the platform runs a short daily batch analytics job that parses 50 GB of match logs stored in Cloud Storage. The architecture team needs to minimize baseline operational costs and avoid paying for idle compute resources during non-peak hours. Which TWO architectural decisions should you recommend to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Use Cloud SQL for PostgreSQL with regional High Availability (HA) for the user profile database.; Execute the daily log processing batch task using containerized Cloud Run jobs scheduled via Cloud Scheduler.

Answer

The optimal solution is to use Cloud SQL for PostgreSQL with regional High Availability for the database tier and execute the daily batch analytics job using scheduled Cloud Run jobs.
Cloud SQL with regional High Availability provides robust single-region failover and relational storage without the high baseline costs of Cloud Spanner. Cloud Run jobs provide a serverless execution environment that runs batch tasks to completion and automatically scales down to zero, ensuring costs are strictly proportional to execution time.

Step-by-Step Solution

1
Evaluate relational storage requirements against cost targets
Since the workload is confined to a single region and requires standard relational HA, Cloud SQL meets all requirements at a fraction of the cost of Cloud Spanner.
Cloud Spanner is designed for multi-region or global horizontal scaling, making it over-engineered and cost-prohibitive for single-region relational needs.
2
Evaluate batch compute execution model
Containerized tasks executing short daily batch jobs are best served by serverless compute such as Cloud Run jobs.
Cloud Run jobs execute containerized workloads on demand and scale to zero upon completion, preventing ongoing compute costs associated with running persistent clusters.

Key Concept

Selecting right-sized database and serverless compute primitives to optimize cloud cost and operational overhead based on application scope.
Question 1508Question →

A global clinical diagnostics enterprise is designing a hybrid cloud architecture to transfer massive genomic sequencing datasets from its primary on-premises data center to Google Cloud for high-performance processing. The architecture requires a private, non-public network connection capable of supporting sustained transfer bandwidth exceeding 12 Gbps while guaranteeing a 99.99% availability Service Level Agreement (SLA). Which TWO architectural decisions must be implemented to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Provision Dedicated Interconnect circuits terminating in two distinct Google Cloud edge availability domains across separate metropolitan facilities.; Deploy Cloud Routers in the VPC network to establish dynamic BGP sessions across all interconnect attachments for automated routing failover.

Answer

To meet the sustained >12 Gbps bandwidth and 99.99% SLA requirements, the architecture must provision Dedicated Interconnect circuits across two distinct metropolitan edge availability domains and deploy Cloud Routers with BGP for dynamic routing failover.
To achieve sustained throughput exceeding 12 Gbps while securing a 99.99% uptime SLA, the solution must utilize Dedicated Interconnect with at least 10 Gbps links distributed across two separate metropolitan edge availability domains. Additionally, Cloud Routers are required to establish BGP sessions to dynamically exchange routes and enable instant failover across the redundant interconnect paths.

Step-by-Step Solution

1
Analyze bandwidth and connectivity medium requirements.
Sustained throughput exceeds 12 Gbps, which rules out Cloud VPN (capped at 3 Gbps per tunnel). Dedicated Interconnect (using 10 Gbps or 100 Gbps physical links) is required.
Dedicated Interconnect provides direct physical connections for high-bandwidth, private hybrid cloud traffic.
2
Determine high availability topology for 99.99% SLA.
Google Cloud requires 4 Dedicated Interconnect attachments across 2 distinct edge availability domains (metropolitan areas) combined with redundant Cloud Routers.
A 99.99% SLA for Dedicated Interconnect demands dual-metro redundancy so that no single facility outage impacts connectivity.
3
Evaluate routing mechanism and VPC Peering transitivity.
Cloud Router with BGP must be configured. VPC Network Peering cannot be used for transitive routing from on-premises to spoke VPCs.
Cloud Router provides dynamic BGP route propagation, whereas VPC Peering does not propagate on-premises routes transitively.

Key Concept

99.99% High Availability Hybrid Topology using Dedicated Interconnect and Cloud Router
Question 1509Question →

A cloud architect is designing a network topology connecting three distinct Google Cloud Virtual Private Cloud (VPC) networks: VPC-A, VPC-B, and VPC-C. Currently, VPC-A is peered directly with VPC-B, and VPC-B is peered directly with VPC-C. Workloads in VPC-A require highly available, low-latency private connectivity to resources in VPC-C without traversing the public internet. Which configuration fulfills this network requirement?

Show answer & explanation

Answer: Establish a direct VPC Network Peering connection between VPC-A and VPC-C.

Answer

Establish a direct VPC Network Peering connection between VPC-A and VPC-C.
Google Cloud VPC Network Peering is strictly non-transitive. Even though VPC-A is peered with VPC-B and VPC-B is peered with VPC-C, workloads in VPC-A cannot reach VPC-C through VPC-B. Creating a direct VPC Network Peering connection between VPC-A and VPC-C satisfies the high availability and low latency requirements using internal IP addresses.

Step-by-Step Solution

1
Analyze the routing properties of GCP VPC Network Peering.
Identify that VPC Network Peering is non-transitive by design.
Routes from peered networks are not re-advertised to other peered networks.
2
Evaluate the connectivity requirements between VPC-A and VPC-C.
Recognize that traffic from VPC-A cannot hop through VPC-B to reach VPC-C.
Non-transitivity prevents VPC-B from acting as an intermediate router for peered traffic.
3
Determine the optimal high-availability configuration.
Create a direct VPC Network Peering link directly between VPC-A and VPC-C.
Direct peering provides low-latency, private, and highly available internal IP connectivity.

Key Concept

VPC Network Peering Non-Transitivity
Question 1510Question →

A digital banking platform hosts its primary transactional processing engine in GCP region `us-central1` with a hot standby disaster recovery (DR) site configured in `us-east4`. The application uses Compute Engine Managed Instance Groups (MIGs) that auto-scale based on incoming traffic demands. During an unannounced disaster recovery simulation where `us-central1` traffic was failed over to `us-east4`, the MIG in `us-east4` failed to scale beyond its baseline count to accommodate peak load, causing service disruption. System logs reveal that compute instance creation requests were rejected due to resource limits. Which action should the Lead Cloud Architect take to ensure reliable execution of the disaster recovery failover plan during a regional outage?

Show answer & explanation

Answer: Submit and maintain proactive requests for Compute Engine vCPU and instance quota increases in the target disaster recovery region (`us-east4`) to match peak production capacity demands.

Answer

Proactively requesting and securing vCPU and instance quota increases in the target disaster recovery region ensures the hot standby compute infrastructure can scale to handle production traffic during regional failover.
The correct response addresses the root cause of the failover failure. Compute Engine quotas in Google Cloud are region-specific. When executing disaster recovery in a secondary region, autoscale actions will fail if the requested vCPU or instance counts exceed the granted regional quota. Proactively requesting quota increases in the secondary region ensures sufficient headroom for peak production workloads.

Step-by-Step Solution

1
Analyze failure symptoms from DR exercise logs
Identified that Compute Engine instance creation failed in region `us-east4` due to hitting regional vCPU quota limits.
GCP resource quotas are enforced per region, and default quota levels in a secondary region may not accommodate peak failover scale.
2
Evaluate potential solutions against GCP resource management behavior
Confirmed that quota increases must be explicitly requested and granted per project and per region prior to executing failover events.
Quota allocation is an administrative control plane setting independent of network layout, database engine, or interconnect choice.
3
Formulate preventative DR execution strategy
Request adequate quota headroom in `us-east4` to match `us-central1` peak load requirements.
Pre-provisioning quota prevents deployment bottlenecks during critical regional failovers.

Key Concept

Disaster Recovery Capacity Planning and Regional Quota Management
Question 1511Question →

A logistics enterprise operates a fleet management webhook microservice that ingests vehicle telemetry updates. The traffic pattern is highly unpredictable, experiencing long periods of zero activity overnight followed by heavy bursts during morning delivery schedules. The business goal is to minimize operational cost by eliminating baseline compute expenses during idle periods while ensuring automatic scale-out during traffic spikes without managing infrastructure cluster nodes. Which cloud architecture should you recommend?

Show answer & explanation

Answer: Deploy the containerized microservice to Cloud Run with the minimum instance count set to zero.

Answer

Deploying the containerized microservice to Cloud Run with minimum instances set to zero achieves the business requirement of zero infrastructure cost during idle periods while providing seamless automated scaling during peak morning workloads.
Deploying to Cloud Run with minimum instances configured to zero satisfies both the operational requirement of automatic request-driven scaling and the business objective of minimizing cost by eliminating all charges during zero-traffic idle periods.

Step-by-Step Solution

1
Analyze business and workload requirements
Identified key requirements: unpredictable bursty traffic with long zero-traffic overnight windows, requirement for zero baseline cost when idle, and minimum administrative infrastructure overhead.
Cost optimization requires matching resource provisioning strategy directly with the workload's consumption pattern.
2
Evaluate compute service scaling behaviors
Compute Engine VMs incur fixed hourly costs even when idle. GKE clusters incur baseline cluster node fees. Cloud Run supports scaling down to 0 instances when idle, incurring zero cost.
Cloud Run bills per-second of actual request execution time when min-instances is set to zero.
3
Select optimal architecture
Cloud Run meets all functional performance requirements while strictly optimizing for the lowest total cost of ownership (TCO).
Serverless container execution eliminates idle compute costs and node management.

Key Concept

Serverless Compute Right-Sizing and Scale-to-Zero Cost Optimization
Question 1512Question →

A global video gaming studio needs to connect its on-premises rendering farm to a Google Cloud Virtual Private Cloud (VPC) to handle burst render workloads. The network connection must support a sustained 4 Gbps bandwidth requirement with encrypted traffic in transit. The studio's physical facility is in a regional data center that does not support direct colocation at a Google Cloud Meet-Me-Point (PoP). Which hybrid connectivity architecture should the Cloud Architect recommend to meet these requirements?

Show answer & explanation

Answer: Provision Partner Interconnect through a supported service provider to reach Google Cloud, and configure HA VPN over the Partner Interconnect attachments to encrypt the traffic.

Answer

Provision Partner Interconnect through a supported service provider to reach Google Cloud, and configure HA VPN over the Partner Interconnect attachments to encrypt the traffic.
Partner Interconnect enables enterprise data centers that do not reside in a Google Cloud colocation facility (Meet-Me-Point) to connect to GCP via a supported service provider. By layering HA VPN over Private Interconnect attachments, the architecture satisfies both the 4 Gbps SLA-backed throughput requirement and the requirement for encrypted traffic in transit.

Step-by-Step Solution

1
Analyze connectivity location and colocation constraints.
Since the facility lacks direct presence at a Google Meet-Me-Point (PoP), Dedicated Interconnect cannot be physically cabled. Partner Interconnect is required to bridge the on-premises data center via a supported service provider.
Partner Interconnect extends GCP network reach to locations where Google does not have a direct colocation facility.
2
Evaluate throughput and security (encryption) requirements.
The requirement demands 4 Gbps throughput with encryption in transit. A standard HA VPN over public internet does not offer dedicated SLA guarantees for sustained 4 Gbps burst workloads.
Deploying HA VPN over Partner Interconnect attachments combines private SLA-backed throughput with IPsec encryption.

Key Concept

Selecting Partner Interconnect with HA VPN for encrypted, high-bandwidth hybrid connectivity from non-colocated facilities
Question 1513Question →

An enterprise healthcare technology platform manages multi-tenant infrastructure on Google Cloud using Terraform. During an internal architecture audit, the security operations team discovers that developers execute Terraform configurations directly from local workstations using user accounts with broad Project Editor permissions, while storing state files on local disks. This practice has resulted in concurrent deployment conflicts and compliance violations. You need to establish a centralized, secure Infrastructure as Code governance and deployment framework that enforces least-privilege execution and prevents state file corruption. Which architecture should you implement?

Show answer & explanation

Answer: Configure a Google Cloud Storage backend with Object Versioning enabled for remote Terraform state storage, and execute deployments via an automated CI/CD pipeline using Workload Identity Federation with a service account bound to fine-grained IAM roles.

Answer

Configure a Google Cloud Storage backend with Object Versioning enabled for remote Terraform state storage, and execute deployments via an automated CI/CD pipeline using Workload Identity Federation with a service account bound to fine-grained IAM roles.
The solution leveraging a Google Cloud Storage remote backend with Object Versioning and automated CI/CD pipeline execution via Workload Identity Federation represents Google Cloud recommended best practices. Cloud Storage backends provide built-in distributed state locking using Object Generation numbers, while Object Versioning protects against accidental state destruction. Workload Identity Federation eliminates key management overhead by authenticating short-lived tokens for CI/CD pipelines, enforcing strict least-privilege IAM access control.

Step-by-Step Solution

1
Establish secure remote state management
Configured a Google Cloud Storage (GCS) bucket as the Terraform remote backend with Object Versioning enabled.
Centralizing state management in GCS ensures state locking (preventing race conditions) and backup protection against state file loss or corruption.
2
Implement secure automated pipeline authentication
Configured Workload Identity Federation between the external CI/CD provider and Google Cloud.
Workload Identity Federation enables short-lived identity impersonation, avoiding the storage and management of static service account JSON keys.
3
Enforce least-privilege deployment execution
Bound the deployment pipeline service account to specific, fine-grained predefined or custom IAM roles instead of primitive roles.
Restricts IaC deployment authority strictly to the cloud resources managed by the automated pipeline.

Key Concept

Enterprise Infrastructure as Code Governance and Secure Remote State Management
Estimated Time:1m 30s
Question 1514Question →

An enterprise logistics provider processes real-time vehicle telemetry ingested by a fleet of Compute Engine instances in a Managed Instance Group (MIG) behind an External HTTP(S) Load Balancer. During peak operating hours, incoming message throughput surges by 400%400\%. Load testing demonstrates that while the application is heavily network I/O-bound, the MIG autoscaler is currently configured to scale based on average CPU utilization, causing severe latency spikes before new instances launch. Additionally, project telemetry forecasts indicate that scaling to meet peak load will exceed the project's allocated Compute Engine regional vCPU quota in us−central1us-central1. Which pair of actions should the Cloud Architect recommend to optimize workload scaling and ensure adequate infrastructure capacity?

Show answer & explanation

Answer: Submit a regional vCPU quota increase request for us−central1us-central1 prior to peak events, and reconfigure the MIG autoscaler to use a Cloud Monitoring metric based on open network connections or load balancer request count.

Answer

Submit a regional vCPU quota increase request for us−central1us-central1 prior to peak events, and reconfigure the MIG autoscaler to use a Cloud Monitoring metric based on open network connections or load balancer request count.
For network I/O-bound workloads, CPU utilization remains low even under heavy network load, resulting in delayed autoscaling. Configuring custom metrics via Cloud Monitoring (e.g., HTTP request rates or connection counts) ensures the MIG scales in direct response to network demand. Furthermore, Compute Engine regional vCPU quotas are fixed administrative limits that must be increased in advance via the Google Cloud Console to prevent instance creation errors during scale-out events.

Step-by-Step Solution

1
Evaluate the bottleneck characteristic of the workload
Identified that the application is network I/O-bound rather than CPU-bound, making CPU utilization an ineffective signal for autoscaling.
Autoscaling on CPU utilization for I/O-bound tasks causes delayed scaling and latency degradation.
2
Select an appropriate scaling metric
Configure Cloud Monitoring metrics such as load balancer request count per instance or active TCP connection count.
Custom/I/O metrics trigger autoscaling proactively as incoming network traffic increases.
3
Assess quota constraints
Determine that scaling beyond current limits requires an explicit quota request in advance.
Compute Engine quotas are enforced per region/project and require manual approval before provisioning high instance counts.

Key Concept

Workload-specific autoscaling metric selection and proactive regional quota management
Question 1515Question →

An enterprise organization is designing a security perimeter for its Google Cloud environment. The security architecture must prevent authorized users and service accounts with valid IAM read permissions from exfiltrating sensitive analytics data in Cloud Storage to external locations. Furthermore, the infrastructure team needs to enforce organization-wide firewall guardrails that apply dynamically to instances based on their functional role rather than static IP addresses, across all present and future projects. Which architectural approach fulfills these security requirements?

Show answer & explanation

Answer: Enclose the Cloud Storage resources within a VPC Service Controls perimeter, and implement Hierarchical Firewall Policies at the organization level using Secure Tags to dynamically enforce network guardrails.

Answer

Enclose the Cloud Storage resources within a VPC Service Controls perimeter, and implement Hierarchical Firewall Policies at the organization level using Secure Tags to dynamically enforce network guardrails.
The correct solution uses VPC Service Controls to prevent unauthorized data exfiltration from Google Cloud service APIs (such as Cloud Storage) regardless of IAM permissions. Furthermore, Hierarchical Firewall Policies enforced at the organization level combined with Secure Tags allow centralized security teams to dynamically govern network traffic based on workload identity rather than static IP addresses.

Step-by-Step Solution

1
Evaluate data exfiltration mitigation requirements
Determine that IAM permissions alone do not prevent data exfiltration by authorized entities
VPC Service Controls isolates Google Cloud service API communications within a defined perimeter to prevent copying data to unauthorized external resources.
2
Select organization-wide firewall policy management mechanism
Choose Hierarchical Firewall Policies configured at the Organization or Folder node
Hierarchical policies guarantee consistent security rule enforcement across all child projects without requiring individual VPC firewall maintenance.
3
Identify dynamic target selection method for network rules
Use Secure Tags attached to Compute Engine instances
Secure Tags offer IAM-governed, fine-grained control and apply across project boundaries, unlike legacy network tags which are scoped to a single VPC.

Key Concept

Perimeter security using VPC Service Controls and organization-wide Hierarchical Firewall Policies with Secure Tags
Question 1516Question →

A cloud solution architect is establishing local development guidelines for microservices that interact with Google Cloud managed services. Match each Google Cloud service local emulator with its corresponding operational capability or limitation during local integration testing.

Click a left item, then click its matching right item

Items

Cloud Spanner Emulator
Cloud Pub/Sub Emulator
Cloud Firestore Emulator
Cloud Bigtable Emulator

Matches

Show answer & explanation

Answer

Cloud Spanner Emulator pairs with localized DDL/SQL support lacking production IAM enforcement; Cloud Pub/Sub Emulator pairs with PUBSUB_EMULATOR_HOST redirection for topic and subscription testing; Cloud Firestore Emulator pairs with NoSQL CRUD and security rules validation via Firebase CLI; Cloud Bigtable Emulator pairs with single-node in-memory execution configured via BIGTABLE_EMULATOR_HOST.
Each Google Cloud service emulator provides a specific local interface and set of environment variables (`PUBSUB_EMULATOR_HOST`, `BIGTABLE_EMULATOR_HOST`, Firebase suite tooling, and local Spanner DDL parsing) allowing applications to be functionally tested offline without incurring service costs or needing live GCP access.

Step-by-Step Solution

1
Identify the primary function and environment variable for Cloud Spanner local emulation.
Cloud Spanner emulator executes local DDL and transactions but omits production IAM and multi-region features.
Emulators focus on API contract validation rather than replicating complex cloud control planes.
2
Identify the setup requirement for Cloud Pub/Sub emulation.
Set `PUBSUB_EMULATOR_HOST` so client SDKs publish and pull messages locally.
SDKs check this environment variable to redirect gRPC/HTTP traffic away from production endpoints.
3
Determine the ecosystem tooling for Cloud Firestore local testing.
Use Firebase CLI emulator suite for document database operations and security rule verification.
Firestore local testing is integrated into the Firebase emulator suite.
4
Identify the environment variable and storage model for Cloud Bigtable emulation.
Set `BIGTABLE_EMULATOR_HOST` to route requests to an in-memory single-node emulator instance.
Bigtable emulator allows developers to verify schema definitions and table mutations offline.

Key Concept

Google Cloud Service Emulators and Development Testing
Question 1517Question →

A financial technology enterprise is designing an automated monthly statement generation service on Google Cloud. The service processes unpredictable, highly bursty containerized batch rendering tasks (each requiring 2 vCPUs and 4 GB RAM) that run for 15 to 20 minutes when triggered by customer request events. The workload stays completely idle between batches for days at a time. The business requirement is to minimize total operational costs by eliminating all baseline idle infrastructure expenses, while avoiding administrative overhead for cluster management. Which architecture should you recommend?

Show answer & explanation

Answer: Trigger containerized Cloud Run jobs on demand via Eventarc notifications, utilizing Cloud Run Spot instances for execution.

Answer

Trigger Cloud Run jobs on demand via Eventarc notifications using Cloud Run Spot instances.
Cloud Run jobs provide an ideal serverless execution platform for containerized tasks that run to completion and do not serve web traffic continuously. Combined with Eventarc for event-driven triggering and Cloud Run Spot for discounted pricing, this architecture scales to zero, incurring absolute zero cost during idle days while eliminating container cluster administration overhead.

Step-by-Step Solution

1
Analyze the workload characteristics and business requirements.
Identified a stateless containerized batch processing workload with unpredictable bursty usage and long idle periods requiring zero baseline cost and low management overhead.
Choosing the correct compute model requires matching workload lifecycle to cloud billing structures.
2
Evaluate compute execution options against cost and management metrics.
Serverless container execution via Cloud Run jobs offers automatic zero-cost idle state and managed infrastructure, eliminating cluster administration.
Dedicated compute models like GKE or persistent VM instances incur baseline maintenance and control plane or instance fees even when idle.
3
Apply targeted cost optimization features suitable for short-lived batch jobs.
Selecting Cloud Run Spot provides steep pricing discounts for batch tasks that can tolerate potential termination or retries.
Cloud Run Spot reduces execution cost further while meeting SLA requirements for asynchronous containerized batch runs.

Key Concept

Serverless batch architecture and cost optimization for bursty workloads
Question 1518Question →

Match each Google Cloud hybrid networking service to its primary defining capability or implementation requirement.

Click a left item, then click its matching right item

Items

Dedicated Interconnect
Partner Interconnect
HA VPN
Cloud Router

Matches

Show answer & explanation

Answer

Dedicated Interconnect matches with direct physical connection at Google edge facilities; Partner Interconnect matches with connectivity via a third-party service provider; HA VPN matches with high-availability IPsec VPN providing a 99.99% SLA; Cloud Router matches with the fully managed BGP control plane.
Each hybrid connectivity component serves a specific architectural role: Dedicated Interconnect provides direct physical connections at Google facilities; Partner Interconnect offers provider-assisted connectivity; HA VPN establishes encrypted 99.99% SLA IPsec connections over the internet; and Cloud Router manages dynamic BGP routing across these connections.

Step-by-Step Solution

1
Identify direct physical connection requirement without third-party transit.
Dedicated Interconnect directly bridges on-premises networks at a Google facility.
Dedicated Interconnect offers dedicated physical ports at 10 Gbps or 100 Gbps circuits.
2
Identify service provider path options when colocation is unavailable.
Partner Interconnect uses a service provider network to reach GCP.
Partner Interconnect extends connectivity to locations where Google colocation facilities are not present.
3
Determine the encrypted 99.99% SLA Internet option.
HA VPN uses dual active-active tunnels to guarantee high availability over public IP network infrastructure.
Classic VPN only supported 99.9% SLA, while HA VPN configuration achieves 99.99% SLA.
4
Select the dynamic routing component required across all hybrid interconnects and VPNs.
Cloud Router provides dynamic BGP topology route exchanges.
Cloud Router manages control plane BGP sessions across Interconnect attachments and VPN tunnels.

Key Concept

Designing Network Architecture and Hybrid Connectivity
Question 1519Question →

An online retail platform experiences a complete outage in its primary Google Cloud region (us-east1). The platform architecture uses Cloud SQL for PostgreSQL with a cross-region read replica in us-central1, and a Compute Engine Managed Instance Group (MIG) deployed as a warm standby in us-central1 running at 10% capacity. As the Cloud Architect, you must execute the emergency disaster recovery failover runbook to restore operational production capabilities in us-central1. In what sequence should you execute the failover tasks?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for disaster recovery execution is: 1) Promote the cross-region Cloud SQL read replica in us-central1 to standalone primary, 2) Scale up the warm standby Managed Instance Group in us-central1 to 100% capacity, 3) Update application configurations and execute health checks, 4) Update Cloud DNS routing policies to shift live user traffic to us-central1.
The correct failover sequence ensures data consistency and minimal service disruption: first promote the read replica to enable database write operations, next scale up compute capacity to handle production throughput, then update configuration and verify service health, and finally update DNS records to route end-user traffic to the failover region.

Step-by-Step Solution

1
Promote the cross-region Cloud SQL read replica in us-central1.
The replica becomes an independent read-write database instance.
Promoting the database first establishes the single source of truth for write operations before application instances are scaled up.
2
Scale up the warm standby Managed Instance Group (MIG) capacity.
Compute instances in us-central1 reach 100% target production capacity.
Adequate compute capacity must be running and ready to handle target operational load before opening traffic endpoints.
3
Update application database connections and run readiness checks.
Application workloads establish connections to the promoted database and pass synthetic readiness tests.
Validation ensures application instances are fully operational and will not drop requests during cutover.
4
Update Cloud DNS routing policy records.
Live user traffic is directed to the restored application infrastructure in us-central1.
Public traffic routing is updated last to prevent blackholing user requests while infrastructure is being promoted.

Key Concept

Disaster Recovery Failover Execution Sequencing
Question 1520Question →

A financial software development team is designing an automated local integration testing suite for microservices that interact with Cloud Spanner. The team wants to validate database schema migrations, transactional queries, and security features in local developer environments prior to deployment. Which statement accurately describes a key capability or architectural limitation of the Cloud Spanner emulator when integrated into this local testing workflow?

Show answer & explanation

Answer: The emulator supports standard DDL and DML statements locally without needing Google Cloud credentials, but it does not support Customer-Managed Encryption Keys (CMEK) or IAM fine-grained access control.

Answer

The Cloud Spanner emulator supports standard DDL and DML statements locally without needing Google Cloud credentials, but it does not support Customer-Managed Encryption Keys (CMEK) or IAM fine-grained access control.
The correct answer accurately reflects the architecture of the Cloud Spanner emulator. It provides an in-memory implementation of Cloud Spanner that supports standard DDL schema definitions, DML queries, and ACID transactions locally without calling GCP APIs or requiring credentials. However, enterprise security features like Customer-Managed Encryption Keys (CMEK), Cloud KMS, and IAM fine-grained access control are explicitly unsupported in the emulator.

Step-by-Step Solution

1
Identify the purpose of Cloud Emulators in GCP development lifecycle.
Emulators enable local offline unit and integration testing without invoking real cloud resources or incurring costs.
Developers need fast feedback loops during local testing before pushing code to CI/CD pipelines.
2
Evaluate the feature scope and limitations of the Cloud Spanner emulator.
The emulator supports core relational database features (DDL, DML, transactions, session management) in-memory without GCP IAM authorization.
It is designed for functional application testing rather than security infrastructure testing.
3
Determine unsupported enterprise security features in the emulator environment.
Customer-Managed Encryption Keys (CMEK), Cloud KMS integration, IAM fine-grained access control, and multi-region replication are not supported in the emulator.
Cloud KMS and IAM security controls depend on live cloud management planes not present in offline emulators.

Key Concept

Cloud Spanner Emulator Capabilities and Limitations
PreviousPage 76 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin