All practice questions

1598 questions

All types1,598 Multiple choice815 Multiple select537 Numeric8 Matching64 Ordering174

Match each hybrid cloud enterprise networking scenario to the most appropriate Google Cloud connectivity solution.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings match each scenario to its required bandwidth, SLA, and topology model: 1) Fintech high-bandwidth 99.99% SLA requires Dedicated Interconnect across two metros; 2) Healthcare clinic requiring IPsec encryption and 99.99% SLA uses HA VPN with dynamic Cloud Router; 3) Retail sub-10 Gbps connectivity without custom colocation hardware uses Partner Interconnect; 4) Logistics dynamic transit routing across VPCs and sites uses Network Connectivity Center.

Each scenario directly maps to the architectural capabilities of GCP hybrid networking products: Dedicated Interconnect is required for unencrypted 10 Gbps direct connections with 99.99% SLA; HA VPN provides encrypted internet connectivity at 99.99% SLA; Partner Interconnect supports sub-10 Gbps private connection through service providers; Network Connectivity Center enables transit routing across hybrid spokes.

Step-by-Step Solution

Analyze bandwidth and colocation requirements for high-capacity hybrid connectivity.

Direct 10 Gbps physical circuits without intermediate provider infrastructure mandate Dedicated Interconnect. Meeting 99.99% availability requires 4 VLAN attachments across 2 metros.

Dedicated Interconnect is designed for 10 Gbps/100 Gbps enterprise requirements direct to Google edge locations.

Identify secure, internet-based connectivity options meeting high availability standards.

HA VPN with dual active IPsec interfaces and Cloud Router dynamic routing provides 99.99% SLA over public internet.

Classic VPN only provides 99.9% SLA, whereas HA VPN topology guarantees 99.99% availability.

Evaluate options for sub-10 Gbps private connectivity without direct colocation access.

Partner Interconnect enables connection speeds from 50 Mbps up to 10 Gbps through a third-party network provider.

Dedicated Interconnect does not support sub-10 Gbps allocations like 500 Mbps.

Select central management architecture for enterprise transit connectivity.

Network Connectivity Center acts as a centralized management hub for global VPC and hybrid transit traffic using BGP spokes.

Standard VPC Peering is non-transitive, so transit routing requires Network Connectivity Center.

Key Concept

Selecting and architecting appropriate Google Cloud hybrid connectivity options (Dedicated Interconnect, Partner Interconnect, HA VPN, and Network Connectivity Center) based on bandwidth, SLA, encryption, and routing requirements.

Question 1522Question →

An enterprise financial trading platform is being re-architected on Google Cloud to satisfy critical business continuity constraints: a Recovery Point Objective (RPO) of $0$ (zero data loss) and a Recovery Time Objective (RTO) of less than $1$ minute in the event of a full regional infrastructure outage. The architecture must also support high-throughput, low-latency relational data access and isolated network communication across multiple internal Virtual Private Cloud (VPC) networks without introducing transitive routing anti-patterns or cascading dependency failures under heavy load. Which TWO architectural decisions should you implement to meet these high availability and technical requirements?

Select all that apply

Provision a multi-region Cloud Spanner instance configuration spanning multiple geographic regions to serve as the core transactional database layer.

Deploy regional application workloads in separate GCP regions behind a Global External Application Load Balancer using Serverless NEGs and automated multi-region health probes.

Provision a Highly Available (HA) regional Cloud SQL instance with cross-region asynchronous read replicas, promoting a read replica during regional disaster recovery.

Connect spoke VPC networks to a central hub VPC using VPC Network Peering, enabling transitive network communication across all spoke VPCs via the central hub.

Configure Load Balancer health checks to execute complex database query endpoints directly to guarantee backend application data layer availability.

Show answer & explanation

Answer: Provision a multi-region Cloud Spanner instance configuration spanning multiple geographic regions to serve as the core transactional database layer.; Deploy regional application workloads in separate GCP regions behind a Global External Application Load Balancer using Serverless NEGs and automated multi-region health probes.

Answer

Deploying a multi-region Cloud Spanner instance along with multi-region compute behind a Global External Application Load Balancer satisfies the zero RPO and sub-minute RTO availability requirements.

Combining a multi-region Cloud Spanner instance with multi-region compute services behind a Global External Application Load Balancer guarantees multi-region resilience. Cloud Spanner uses Paxos-based synchronous cross-region replication to ensure zero data loss (

RPO = 0

), while global load balancing provides sub-minute traffic failover (

RTO < 1\text{ min}

) upon regional failure.

Step-by-Step Solution

Evaluate database requirements for RPO=0 and high availability across regional outages.

Cloud Spanner multi-region configurations utilize Paxos consensus across regional zones to deliver synchronous cross-region write replication, meeting RPO=0 and high availability SLAs.

Cloud SQL cross-region read replicas use asynchronous replication, which violates the strict RPO=0 requirement.

Evaluate compute routing and global load balancing strategy.

Deploying global HTTP(S) load balancing across multi-region backend compute endpoints allows instant health-based traffic redirection without DNS propagation delays.

Global load balancing delivers RTO under 1 minute for application tier failover.

Verify network isolation and health check constraints.

Avoid non-transitive VPC peering assumptions and deep dependency health check probes.

VPC peering does not support transitive routing, and deep health checks introduce risk of cascading cluster outages.

Key Concept

High Availability and Multi-Region Resiliency Architecture

Question 1523Question →

A software company is building a web application on Google Cloud that has two main data storage requirements. First, the application needs to store semi-structured JSON user profile documents and support flexible queries. Second, it needs to store user-uploaded profile images and automatically transition them to lower-cost archival storage after 30 days. Which TWO Google Cloud storage solutions should be selected to meet these requirements?

Select all that apply

Cloud Firestore to store semi-structured JSON user profile documents with flexible querying.

Cloud Storage with Object Lifecycle Management to store binary image files and automatically transition them to colder storage classes after 30 days.

Cloud Spanner to store user profile JSON documents to ensure global multi-region relational ACID compliance.

Transfer Appliance to continuously ingest real-time uploaded binary profile images over an online network connection.

Show answer & explanation

Answer: Cloud Firestore to store semi-structured JSON user profile documents with flexible querying.; Cloud Storage with Object Lifecycle Management to store binary image files and automatically transition them to colder storage classes after 30 days.

Answer

The architectural design should include Cloud Firestore for storing semi-structured JSON user profile documents and Cloud Storage with Object Lifecycle Management for cost-effectively managing image files.

The combination of Cloud Firestore and Cloud Storage with Object Lifecycle Management directly satisfies both requirements. Cloud Firestore provides a serverless NoSQL document database ideal for JSON profiles, while Cloud Storage handles unstructured binary files with automated lifecycle rules for cost-effective archiving.

Step-by-Step Solution

Analyze the data storage requirement for user profile documents.

User profile documents are semi-structured JSON data requiring flexible queries. A NoSQL document database like Cloud Firestore is optimal for this access pattern.

Cloud Firestore natively handles schema-less JSON documents with automated indexing and low latency queries.

Analyze the storage and lifecycle requirement for profile images.

Unstructured binary object storage with automated age-based tiering is needed.

Cloud Storage stores unstructured media files and natively supports Object Lifecycle Management rules to automatically downgrade objects to colder storage classes after 30 days to optimize cost.

Key Concept

Selecting optimal GCP storage and database services based on data structure, query patterns, and lifecycle requirements.

Question 1524Question →

A maritime logistics enterprise hosts its vessel tracking platform on Google Cloud with primary infrastructure running in region `europe-west1` and a warm standby disaster recovery site in `europe-west4`. The architecture utilizes Cloud SQL for PostgreSQL with a cross-region read replica in `europe-west4`, while the stateless application tier runs on Managed Instance Groups (MIGs). In the event of a catastrophic regional outage in `europe-west1`, which TWO operational steps must the site reliability engineering team execute to restore full application write capabilities and user traffic routing within the targeted 15-minute Recovery Time Objective (RTO)?

Select all that apply

Promote the Cloud SQL cross-region read replica in `europe-west4` to a standalone primary database instance to enable write operations.

Reconfigure the HTTP(S) Load Balancer backend service or Cloud DNS routing policies to direct user traffic to the secondary MIG in `europe-west4`.

Rely on existing VPC Network Peering configurations to transitively route incoming client traffic from `europe-west1` entry points to `europe-west4` compute resources without updating public routing.

Submit a quota increase request for Compute Engine vCPUs in `europe-west4` as the first step of the emergency failover runbook to permit instance scaling.

Show answer & explanation

Answer: Promote the Cloud SQL cross-region read replica in `europe-west4` to a standalone primary database instance to enable write operations.; Reconfigure the HTTP(S) Load Balancer backend service or Cloud DNS routing policies to direct user traffic to the secondary MIG in `europe-west4`.

Answer

During a regional disaster failover, write operations must be restored by promoting the cross-region Cloud SQL read replica in europe-west4 to a standalone instance, and user traffic must be redirected by updating the load balancer backend service or Cloud DNS routing policy to target the secondary region.

Executing a disaster recovery failover for a warm standby architecture requires two primary actions: restoring data persistence write capabilities by promoting the Cloud SQL cross-region read replica to a standalone primary instance, and redirecting client network traffic to the secondary region by updating global load balancer backend services or Cloud DNS records.

Step-by-Step Solution

Promote the database replica in the failover region

The Cloud SQL read replica in europe-west4 is converted into a writable standalone database instance.

Cloud SQL cross-region read replicas are read-only until explicitly promoted during a failover procedure.

Redirect network traffic to the secondary region

Ingress traffic is steered directly to the running compute instances in europe-west4.

Updating global load balancing backend weights or DNS records points client requests away from the failed primary region.

Key Concept

Cross-Region Disaster Recovery Execution and Failover Mechanics

Question 1525Question →

A connected vehicle telemetry enterprise provisions its multi-region Google Cloud resources across multiple projects using Terraform managed by an automated CI/CD pipeline. The security and governance teams require that infrastructure state files are securely locked against concurrent writes and protected against state corruption, while CI/CD execution avoids using long-lived service account security keys. Additionally, the team must ensure that out-of-band manual changes are automatically identified before breaking deployment pipelines. Which TWO practices should the lead cloud architect implement to meet these requirements?

Select all that apply

Configure a remote Google Cloud Storage (GCS) backend with Object Versioning enabled and utilize Workload Identity Federation for CI/CD pipeline authentication.

Store Terraform state files within the local filesystem of the CI/CD runner host and encrypt the state directory using Customer-Managed Encryption Keys (CMEK).

Grant the primitive Project Owner role to the pipeline service account to prevent permission errors across projects without rotating keys.

Implement automated, scheduled terraform plan executions in the CI/CD pipeline to continuously evaluate real-world infrastructure against the target state configuration.

Apply critical infrastructure fixes directly through the Google Cloud Console during emergency incidents without updating state files to save time.

Show answer & explanation

Answer: Configure a remote Google Cloud Storage (GCS) backend with Object Versioning enabled and utilize Workload Identity Federation for CI/CD pipeline authentication.; Implement automated, scheduled terraform plan executions in the CI/CD pipeline to continuously evaluate real-world infrastructure against the target state configuration.

Answer

The correct architecture requires configuring a remote Cloud Storage backend with Object Versioning combined with Workload Identity Federation for keyless authentication, alongside implementing automated scheduled terraform plan executions to detect infrastructure drift.

Configuring a Cloud Storage backend with versioning ensures robust remote state management with state locking and disaster recovery, while Workload Identity Federation allows external CI/CD runners to securely authenticate to GCP without managing persistent service account keys. Coupling this with automated scheduled terraform plan pipelines ensures that configuration drift caused by manual changes is promptly identified.

Step-by-Step Solution

Configure backend state security and pipeline authentication

Terraform state is stored in a centralized Cloud Storage bucket with object versioning and state locking, and short-lived tokens are issued via Workload Identity Federation.

Prevents state file corruption, concurrent modification issues, and eliminates long-lived service account key security vulnerabilities.

Establish continuous drift detection

Scheduled CI/CD workflows run terraform plan against live GCP project environments.

Identifies discrepancies between actual cloud resources and declared IaC templates created by unauthorized or manual Console actions.

Key Concept

Terraform Remote Backend Security, Keyless CI/CD Authentication, and Automated Drift Detection

Estimated Time:2m 0s

Question 1526Question →

A site reliability engineering team is establishing an automated local integration testing harness for a microservice that queries Cloud Datastore. To run offline tests without making calls to live Google Cloud endpoints or requiring JSON service account keys, the team starts the Datastore emulator using the gcloud CLI. Which action must the team take to ensure the microservice client library automatically redirects database calls to the running local emulator?

Export the DATASTORE_EMULATOR_HOST environment variable set to the host and port of the running emulator in the test environment.

Deploy a dedicated Google Kubernetes Engine (GKE) cluster in the testing VPC to host containerized database mock instances for local developer execution.

Assign the primitive Owner IAM role to the test execution service account to bypass authentication requirements during local emulator requests.

Grant the test runner container the Service Account Admin role (roles/iam.serviceAccountAdmin) to dynamically issue self-signed key pairs for the emulator.

Show answer & explanation

Answer: Export the DATASTORE_EMULATOR_HOST environment variable set to the host and port of the running emulator in the test environment.

Answer

Export the DATASTORE_EMULATOR_HOST environment variable set to the host and port of the running emulator in the test environment.

Exporting the DATASTORE_EMULATOR_HOST environment variable instructs official Google Cloud client libraries to bypass default GCP endpoints and route calls directly to the specified local emulator address without requiring authentication or live cloud infrastructure.

Step-by-Step Solution

Identify the standard mechanism used by Google Cloud Client Libraries to locate local service emulators.

GCP SDK client libraries automatically inspect specific environment variables (e.g., DATASTORE_EMULATOR_HOST, PUBSUB_EMULATOR_HOST) upon initialization.

Setting these environment variables overrides the default production Google Cloud API endpoints and disables external authentication requirements.

Evaluate the configuration requirements for offline test execution.

Setting DATASTORE_EMULATOR_HOST allows application code to run completely offline without code changes or service account key management.

This establishes a lightweight, isolated local integration testing framework suited for CI/CD runners and local development.

Key Concept

Cloud Emulators Environment Configuration

Question 1527Question →

A regional medical provider plans to migrate a single-region relational database to Google Cloud. The application requires full ACID compliance, standard SQL query support, and managed backups, but operates exclusively within one geographical area without requiring global multi-region scalability. Which Google Cloud service should you recommend to meet these requirements with minimal cost and complexity?

Cloud SQL for PostgreSQL

Cloud Spanner

Transfer Appliance

Cloud Storage configured with Customer-Supplied Encryption Keys (CSEK)

Show answer & explanation

Answer: Cloud SQL for PostgreSQL

Answer

Cloud SQL for PostgreSQL is the optimal selection for standard single-region relational workloads requiring ACID compliance.

Cloud SQL for PostgreSQL provides a fully managed relational database engine supporting full ACID transactions and standard SQL within a single region. It matches the application's requirement for a regional database while maintaining minimal cost and operational complexity.

Step-by-Step Solution

Analyze the workload characteristics

The workload requires standard relational SQL capabilities, ACID compliance, managed operations, and single-region availability.

Identifying spatial scope and relational database constraints dictates service selection.

Evaluate Google Cloud database offerings against constraints

Cloud SQL provides managed PostgreSQL/MySQL/SQL Server instances optimized for single-region relational database workloads without multi-region overhead.

Cloud Spanner is over-provisioned for regional needs, while Cloud Storage and Transfer Appliance are not database services.

Key Concept

Selecting Cloud SQL versus Cloud Spanner based on workload scope and distribution needs.

Question 1528Question →

An e-commerce company operates an automated order fulfillment pipeline using Cloud Functions and Cloud Pub/Sub on Google Cloud. The Site Reliability Engineering (SRE) team established a target Availability Service Level Objective (SLO) of 99.9% measured over a rolling 30-day window. The team requires an operational monitoring solution that triggers urgent notifications when significant portions of the 30-day error budget are being rapidly consumed, while remaining resilient against false alarms caused by brief, transient failures. Which alerting approach should the Cloud Architect recommend?

Configure a multi-window, multi-burn-rate alerting strategy in Cloud Monitoring that monitors error budget consumption rates across both short and long lookback windows.

Configure a static metric threshold alert in Cloud Monitoring that triggers a high-severity incident whenever the request failure rate exceeds 0.1% over a 5-minute evaluation window.

Define the target availability goal of 99.9% as the Service Level Indicator (SLI) and create a Cloud Monitoring alert that notifies engineers whenever the SLI metric drops below 99.9%.

Set up an automated Cloud Monitoring policy to scale out the underlying compute resources whenever CPU utilization exceeds 80% to protect the service availability target.

Show answer & explanation

Answer: Configure a multi-window, multi-burn-rate alerting strategy in Cloud Monitoring that monitors error budget consumption rates across both short and long lookback windows.

Answer

The Cloud Architect should recommend configuring a multi-window, multi-burn-rate alerting strategy in Cloud Monitoring that tracks error budget consumption rates.

According to Google Cloud SRE practices, monitoring reliability against an SLO requires alerting on error budget burn rate rather than instantaneous error thresholds. A multi-window, multi-burn-rate alerting approach uses multiple time windows (such as a 1-hour short window and a 6-hour long window) and burn-rate multipliers to ensure alerts fire promptly when significant budget is at risk while suppressing alerts for brief, self-healing metric blips.

Step-by-Step Solution

Identify the core operational requirement.

The team needs to detect severe error budget depletion in a 99.9% 30-day SLO without generating false positives from temporary metric fluctuations.

Traditional static threshold alerts trigger on brief spikes or fail to catch slow, persistent budget leaks.

Evaluate SRE best practices for Google Cloud SLO alerting.

Multi-window, multi-burn-rate alerts evaluate short (e.g., 1-hour) and long (e.g., 6-hour) lookback windows simultaneously.

This dual-window evaluation ensures alerts trigger quickly when a high percentage of the error budget is consumed while resetting quickly once the issue is mitigated.

Select the correct architectural recommendation.

Choose the option specifying multi-window, multi-burn-rate alerts.

It aligns precisely with GCP SRE principles for managing error budgets and SLIs effectively.

Key Concept

Multi-Window, Multi-Burn-Rate SLO Alerting

Estimated Time:1m 30s

Question 1529Question →

A global supply chain enterprise is designing a hybrid cloud network architecture connecting its primary legacy data centers to Google Cloud. The design must satisfy two strict requirements:
1. The hybrid connection must sustain a continuous data ingestion rate of $12\text{ Gbps}$ with high reliability guaranteed by a $99.99\%$ Service Level Agreement (SLA).
2. Applications hosted in a Spoke VPC must communicate with a third-party vendor network that is peered to a central Hub VPC, without exposing traffic to the public internet or violating VPC routing constraints.

Which TWO network architecture decisions should the Lead Cloud Architect select to meet these requirements?

Select all that apply

Deploy Dedicated Interconnect circuits across two separate metropolitan edge availability domains (facilities) with Cloud Routers configured for global dynamic routing.

Establish a direct VPC Network Peering connection between the Spoke VPC and the Vendor VPC.

Deploy multiple HA VPN gateways with Equal-Cost Multi-Path (ECMP) routing over dedicated internet links to achieve 12 Gbps throughput and a 99.99% SLA.

Configure custom route exports on the Hub-to-Spoke VPC Network Peering connection to allow transitive route propagation from the Vendor VPC.

Show answer & explanation

Answer: Deploy Dedicated Interconnect circuits across two separate metropolitan edge availability domains (facilities) with Cloud Routers configured for global dynamic routing.; Establish a direct VPC Network Peering connection between the Spoke VPC and the Vendor VPC.

Answer

To meet both requirements, the architect must deploy Dedicated Interconnect circuits across two distinct metropolitan edge availability domains for 99.99% SLA and high bandwidth (

12\text{ Gbps}

), and establish a direct VPC Network Peering connection between the Spoke VPC and Vendor VPC because VPC Peering is non-transitive.

The solution requires Dedicated Interconnect deployed across two metropolitan edge domains to guarantee a 99.99% SLA for bandwidth over 10 Gbps, combined with direct VPC Network Peering between Spoke and Vendor VPCs due to the non-transitive nature of VPC Peering.

Step-by-Step Solution

Analyze bandwidth and SLA requirements for hybrid connectivity.

Bandwidth is

12\text{ Gbps}

(exceeding

10\text{ Gbps}

) with a

99.99\%

SLA requirement.

HA VPN maxes out around

3\text{ Gbps}

per tunnel and is unsuited for unencrypted high-bandwidth requirements above

10\text{ Gbps}

. Dedicated Interconnect with 4 connections across 2 metros is required for

99.99\%

SLA.

Analyze routing requirements between Spoke VPC and Vendor VPC.

Traffic must travel between Spoke VPC and Vendor VPC through a Hub VPC.

VPC Network Peering is non-transitive in GCP. Network traffic from Vendor VPC cannot hop through Hub VPC to reach Spoke VPC. A direct VPC Peering connection between Spoke VPC and Vendor VPC is required.

Key Concept

99.99% SLA Dedicated Interconnect Topology and Non-Transitive VPC Network Peering Routing

Estimated Time:2m 0s

Question 1530Question →

A biomedical research facility processes and stores genomic data in a single Google Cloud region ( $us-central1$ ). The organization generates $500\text{ TB}$ of raw genomic sequencing files (FASTQ format) annually alongside structured variant analysis records. The raw sequencing files are accessed heavily during the first 30 days of initial pipeline analysis, queried infrequently between 30 and 365 days, and must be retained for 7 years to satisfy regulatory compliance. The structured variant analysis dataset requires traditional ACID-compliant relational transactions, operates entirely within the single region, and experiences a peak load of 1,500 queries per second. You need to design an infrastructure architecture that minimizes ongoing operational and storage costs while meeting all performance, transactional consistency, and compliance mandates. Which TWO architectural decisions should you recommend?

Select all that apply

Configure Cloud Storage Object Lifecycle Management rules on the raw sequencing data bucket to transition objects to Coldline Storage after 30 days and to Archive Storage after 365 days.

Provision Cloud SQL for PostgreSQL configured with High Availability (regional failover) to manage the structured variant analysis data.

Deploy a multi-region Cloud Spanner instance to store structured variant analysis records to guarantee zero-downtime maintenance windows and horizontal scaling.

Order a Google Cloud Transfer Appliance to perform ongoing daily batch ingestion of raw sequencing files from regional sequencing hardware into Cloud Storage.

Show answer & explanation

Answer: Configure Cloud Storage Object Lifecycle Management rules on the raw sequencing data bucket to transition objects to Coldline Storage after 30 days and to Archive Storage after 365 days.; Provision Cloud SQL for PostgreSQL configured with High Availability (regional failover) to manage the structured variant analysis data.

Answer

The optimal architecture combines Cloud Storage Object Lifecycle Management (transitioning raw files to Coldline after 30 days and Archive after 365 days) with Cloud SQL for PostgreSQL configured for High Availability to handle single-region relational structured data efficiently.

Transitioning raw data from Standard to Coldline after 30 days and to Archive after 365 days aligns storage costs directly with access frequency while satisfying the 7-year compliance policy. For the structured database, Cloud SQL for PostgreSQL with High Availability satisfies single-region ACID requirements and 1,500 QPS at a fraction of the cost of Cloud Spanner.

Step-by-Step Solution

Analyze raw file storage lifecycle access patterns and retention rules

Identified high access for

\le 30

days (Standard Storage), infrequent access between 30 and 365 days (Coldline Storage), and strict 7-year retention with rare access (Archive Storage).

Automating storage class transitions using Lifecycle Management minimizes total cost of storage while retaining required access and compliance.

Evaluate compute and database scalability/consistency requirements for structured data

Workload is regional, requires ACID compliance, and handles 1,500 QPS.

Cloud SQL handles thousands of QPS within a single region cost-effectively, making Cloud Spanner over-engineered and cost-prohibitive for non-global requirements.

Key Concept

Cost optimization through storage lifecycle tiering and database right-sizing based on spatial scale and access patterns.

Question 1531Question →

A financial firm is deploying a regional transactional audit system in a single Google Cloud region (us-east4). The application requires ACID-compliant relational SQL storage with automatic zonal failover. The workload experiences standard traffic patterns, with total data storage expected to stay under 1 TB and throughput under 2,000 IOPS. The Chief Financial Officer requires an architecture that minimizes monthly compute and operational overhead while strictly maintaining regional high availability. Which database deployment strategy best fulfills these requirements?

Deploy a Cloud SQL for PostgreSQL regional instance with High Availability (HA) enabled, utilizing a primary instance and a standby instance in a secondary zone.

Deploy a Cloud Spanner instance with multi-regional instance configuration to store the audit transactions.

Deploy a multi-zone Google Kubernetes Engine (GKE) cluster running a self-managed PostgreSQL StatefulSet with persistent disks.

Purchase 3-year Committed Use Discounts (CUDs) upfront for high-memory Compute Engine virtual machines configured as a custom PostgreSQL failover pair.

Show answer & explanation

Answer: Deploy a Cloud SQL for PostgreSQL regional instance with High Availability (HA) enabled, utilizing a primary instance and a standby instance in a secondary zone.

Answer

Deploying a Cloud SQL for PostgreSQL regional instance with High Availability enabled best satisfies the business and cost requirements.

Cloud SQL with High Availability (HA) provides automatic failover to a standby instance in a secondary zone within the same region. For a single-region relational SQL workload under 1 TB, Cloud SQL offers fully managed backups, patches, and HA at the lowest total cost of ownership.

Step-by-Step Solution

Analyze storage and regional requirements

Workload is single-region (us-east4), relational SQL, under 1 TB, requiring automated zonal failover.

Determines whether multi-region scaling (Cloud Spanner) is necessary or if standard regional relational services suffice.

Evaluate managed service options against cost and operational overhead

Cloud SQL HA provides automated failover and managed maintenance at a significantly lower cost than Cloud Spanner or custom GKE/VM deployments.

Meets the CFO's requirement to minimize monthly costs and operational management.

Key Concept

Selecting Cloud SQL over Cloud Spanner or self-managed GKE databases for single-region relational workloads to minimize cost and operational overhead.

Question 1532Question →

An enterprise architecture team is implementing local developer workstation and CI/CD pipeline integration testing for microservices using Google Cloud Emulators. Match each Google Cloud service emulator on the left with its corresponding configuration environment variable and functional testing behavior on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each Cloud Emulator maps to its corresponding host environment variable and capability profile: Cloud Pub/Sub uses PUBSUB_EMULATOR_HOST with ephemeral state; Cloud Spanner uses SPANNER_EMULATOR_HOST supporting DDL/DML without CMEK; Cloud Firestore uses FIRESTORE_EMULATOR_HOST supporting security rules testing; Cloud Bigtable uses BIGTABLE_EMULATOR_HOST over gRPC without backup/restore capabilities.

Each service emulator requires setting its distinct host environment variable (e.g., PUBSUB_EMULATOR_HOST, SPANNER_EMULATOR_HOST, FIRESTORE_EMULATOR_HOST, BIGTABLE_EMULATOR_HOST) so that Google Cloud client SDKs redirect traffic to local ports instead of production GCP endpoints. Furthermore, each emulator provides specific local capabilities (such as Firestore Security Rules testing or Spanner local DDL execution) while intentionally omitting cloud-scale production capabilities like CMEK or backup/restore.

Step-by-Step Solution

Identify the standard environment variable naming convention used by gcloud emulators for client SDK redirection.

Recognized host environment variables: PUBSUB_EMULATOR_HOST, SPANNER_EMULATOR_HOST, FIRESTORE_EMULATOR_HOST, and BIGTABLE_EMULATOR_HOST.

Google Cloud client SDKs check service-specific environment variables to redirect network calls away from live cloud endpoints toward local localhost ports.

Evaluate the functional scope and limitations of each local emulator implementation.

Pub/Sub handles transient topics/subscriptions; Spanner executes DDL/DML without advanced security options; Firestore tests document queries and Security Rules; Bigtable provides basic gRPC key-value table operations without backup features.

Emulators mimic core functional APIs for integration testing but purposefully omit production cloud capabilities like multi-region replication, managed backups, and CMEK integration.

Key Concept

Google Cloud Emulators and Development Testing Frameworks

Estimated Time:1m 30s

Question 1533Question →

An autonomous drone logistics enterprise manages multi-environment Google Cloud infrastructure using Terraform within a central continuous integration and continuous deployment (CI/CD) pipeline. The security engineering team requires that pipeline executions avoid using long-lived service account keys, prevent concurrent pipeline state corruption, and strictly enforce state file integrity across environments. Which architectural pattern should the cloud architect recommend?

Configure a Google Cloud Storage (GCS) remote backend with object versioning enabled, and authenticate the Cloud Build CI/CD pipeline using Workload Identity Federation bound to a least-privilege service account.

Store Terraform state files on a local shared persistent disk attached to a Compute Engine instance running an NFS server, and execute terraform apply remotely over SSH.

Export a service account key JSON file with the Project Owner primitive role and securely store it as an encrypted environment variable inside the CI/CD pipeline system.

Store state files locally within the CI/CD runner container workspace and instruct operators to manually adjust out-of-sync Cloud Console resources whenever terraform plan reports differences.

Show answer & explanation

Answer: Configure a Google Cloud Storage (GCS) remote backend with object versioning enabled, and authenticate the Cloud Build CI/CD pipeline using Workload Identity Federation bound to a least-privilege service account.

Answer

Google Cloud Storage (GCS) is the recommended native backend for Terraform on GCP because it natively supports object locking to prevent concurrent state modifications and versioning for disaster recovery. Authenticating pipelines via Workload Identity Federation removes the security risk of managing static JSON keys, while scoped service accounts uphold least-privilege security controls.

Step-by-Step Solution

Identify remote state management requirements

Google Cloud Storage backends provide built-in state locking via Cloud Storage object locking to prevent state file corruption during concurrent pipeline executions, alongside object versioning for auditability and state recovery.

Centralized, reliable state locking is required for team-based IaC management.

Identify authentication and identity governance requirements

Workload Identity Federation allows external CI/CD pipelines or GCP-native Cloud Build jobs to impersonate a dedicated IAM service account without downloading static JSON keys.

Eliminating long-lived service account keys adheres to Google Cloud security best practices.

Enforce least privilege access control

Grant only necessary granular IAM roles (such as specific resource admin roles) to the target pipeline service account.

Primitive roles like Owner grant excessive permissions and introduce broad security risks.

Key Concept

Terraform Remote Backend Architecture & Keyless CI/CD Authentication on GCP

Estimated Time:1m 30s

Question 1534Question →

Match each Google Cloud storage or database service on the left to its primary workload characteristic and access pattern on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Cloud Bigtable matches the high-throughput NoSQL wide-column store for time-series/analytical workloads. Cloud Spanner matches the globally distributed relational database with horizontal scaling and ACID compliance. Cloud Storage matches the unstructured object storage service for media and backups. Cloud SQL matches the managed regional relational database supporting PostgreSQL, MySQL, and SQL Server.

Each service is accurately paired with its primary architecture pattern: Cloud Bigtable for high-throughput NoSQL wide-column data, Cloud Spanner for globally consistent multi-region relational data, Cloud Storage for unstructured object data, and Cloud SQL for regional managed relational databases.

Step-by-Step Solution

Identify the data model requirements (structured relational vs. unstructured vs. NoSQL wide-column).

Cloud Storage handles unstructured objects; Cloud Bigtable handles NoSQL wide-column data; Cloud SQL and Cloud Spanner handle structured relational data.

Categorizing services by data model narrows down valid target access patterns.

Evaluate scale and regional constraints for relational services.

Cloud SQL represents regional managed relational engines (MySQL/PostgreSQL/SQL Server), whereas Cloud Spanner represents multi-region horizontal scaling with ACID guarantees.

Distinguishing between regional relational engines and enterprise global relational databases separates Cloud SQL from Cloud Spanner.

Verify NoSQL and object storage use cases.

Cloud Bigtable aligns with high-throughput key-value/time-series data, and Cloud Storage aligns with unstructured binary file and backup object storage.

Matching specific performance characteristics completes all service definitions.

Key Concept

Selecting GCP storage and database services based on data model, consistency needs, scale requirements, and access patterns.

Question 1535Question →

An organization is designing the infrastructure for a critical stateless application hosted on Compute Engine in Google Cloud. The application must remain available even if an entire Availability Zone experiences an outage within a selected region. Which TWO architectural options should the cloud architect implement to achieve regional high availability for this workload?

Select all that apply

Deploy the Compute Engine virtual machines using a Regional Managed Instance Group (MIG) distributed across multiple zones within the region.

Configure an External HTTP(S) Load Balancer in front of the backend instances to distribute incoming web traffic across healthy instances in all active zones.

Replace the stateless application layer with a Cloud Spanner database deployment to handle compute processing across multiple regions.

Migrate the simple stateless workload to a multi-region Google Kubernetes Engine (GKE) cluster to provide basic zonal fault tolerance.

Establish VPC Network Peering between zonal subnetworks and rely on transitive routing to forward traffic during a zonal failure.

Show answer & explanation

Answer: Deploy the Compute Engine virtual machines using a Regional Managed Instance Group (MIG) distributed across multiple zones within the region.; Configure an External HTTP(S) Load Balancer in front of the backend instances to distribute incoming web traffic across healthy instances in all active zones.

Answer

Deploying instances across multiple zones using a Regional Managed Instance Group (MIG) combined with an External HTTP(S) Load Balancer provides automated health checking, traffic distribution, and fault tolerance against single-zone outages.

Regional Managed Instance Groups (MIGs) provision and manage Compute Engine instances across multiple Availability Zones in a single region, ensuring compute redundancy. Pairing a Regional MIG with an External HTTP(S) Load Balancer enables automated health checking and seamless traffic routing to operational instances if a specific zone experiences an outage.

Step-by-Step Solution

Identify the high availability scope requirement

The application requires protection against single-zone failure within a region for a stateless compute workload.

Designing for zonal fault tolerance requires distributing compute resources across multiple zones within the same region.

Select the appropriate compute deployment pattern

Regional Managed Instance Groups (MIGs) spread VM instances evenly across multiple zones.

If one zone fails, instances in the remaining operational zones continue handling application requests.

Select the load balancing mechanism

An External HTTP(S) Load Balancer routes client requests to healthy backends.

Load balancers perform continuous health checks and automatically steer traffic away from instances in an impaired zone.

Key Concept

Regional High Availability with Compute Engine Regional MIGs and Cloud Load Balancing

Question 1536Question →

An international retail logistics enterprise is designing hybrid connectivity between its primary on-premises data center and Google Cloud. The application architecture requires a private connection supporting peak traffic of $6\text{ Gbps}$ with a guaranteed $99.99\%$ availability SLA. Additionally, strict regulatory compliance demands that all data in transit across the hybrid connection must be encrypted using IPsec. Which hybrid networking strategy should the Cloud Architect recommend?

Establish a 99.99% Availability topology using Dedicated Interconnect, and configure HA VPN over the Cloud Interconnect attachments to encrypt all transit traffic.

Deploy standard HA VPN gateways over the public internet, scaling the number of active IPsec tunnels to achieve the required 6 Gbps aggregate throughput.

Provision a single 10 Gbps Partner Interconnect VLAN attachment, relying on Google Cloud default internal network encryption to secure cross-site transport.

Establish VPC Network Peering between the on-premises router and a central Google Cloud hub VPC to enable dynamic BGP route propagation to all spoke VPCs.

Show answer & explanation

Answer: Establish a 99.99% Availability topology using Dedicated Interconnect, and configure HA VPN over the Cloud Interconnect attachments to encrypt all transit traffic.

Answer

Establish a 99.99% Availability topology using Dedicated Interconnect, and configure HA VPN over the Cloud Interconnect attachments to encrypt all transit traffic.

The solution establishing a 99.99% Availability configuration using Dedicated Interconnect layered with HA VPN over Cloud Interconnect is correct. Dedicated Interconnect across redundant edge facilities provides the multi-gigabit bandwidth and strict SLA required by enterprise workloads, while HA VPN over Interconnect enforces IPsec encryption for all transit data across the private physical links.

Step-by-Step Solution

Analyze SLA and bandwidth constraints

Peak throughput of

6\text{ Gbps}

combined with a

99.99\%

availability requirement mandates a redundant Cloud Interconnect deployment across two metro locations rather than public internet VPN.

Public internet HA VPN connections provide a

99.99\%

SLA for the GCP gateway endpoints, but cannot guarantee SLA for the underlying internet transport path.

Analyze security and encryption constraints

Deploying HA VPN over Cloud Interconnect satisfies IPsec encryption in transit while leveraging the high-speed, private Interconnect physical links.

Cloud Interconnect by default transfers raw Ethernet packets without IPsec encryption; layering HA VPN over Interconnect attachments adds IPsec layer-3 security to private links.

Evaluate alternative networking patterns for compliance and topology limits

Single connections lack high-availability redundancy, and VPC Network Peering cannot extend to on-premises hardware or provide transitive hub-and-spoke routing.

VPC Peering strictly connects GCP VPCs and does not support transitive routing or on-premises BGP peerings.

Key Concept

HA VPN over Cloud Interconnect Architecture

Estimated Time:2m 0s

Question 1537Question →

A digital publishing platform delivers static media assets and news articles to a global readership. The application experiences sudden traffic spikes during major news events. The business leadership requires an architectural redesign to minimize global egress latency and bandwidth costs for static assets, while automatically reducing storage costs for published articles that are older than 30 days. Which TWO architectural decisions should you recommend to satisfy these business and cost requirements?

Select all that apply

Store static media assets in a Cloud Storage bucket and enable Cloud CDN to cache assets at edge locations close to global users.

Configure an Object Lifecycle Management rule on the Cloud Storage bucket to automatically transition objects older than 30 days from Standard to Coldline storage.

Deploy a multi-region Google Kubernetes Engine (GKE) cluster with dedicated Nginx proxy pods in every region to cache and serve static media files locally.

Migrate static media files into a multi-region Cloud Spanner database instance to guarantee globally consistent low-latency access.

Show answer & explanation

Answer: Store static media assets in a Cloud Storage bucket and enable Cloud CDN to cache assets at edge locations close to global users.; Configure an Object Lifecycle Management rule on the Cloud Storage bucket to automatically transition objects older than 30 days from Standard to Coldline storage.

Answer

The platform should store static media assets in Cloud Storage with Cloud CDN enabled to cache content at edge locations, and configure an Object Lifecycle Management rule to transition assets older than 30 days to Coldline storage.

Caching static content via Cloud CDN backed by Cloud Storage minimizes network latency and egress fees globally. Automating storage tier transitions to Coldline storage using Object Lifecycle Management ensures that infrequently accessed data incurs lower storage costs automatically.

Step-by-Step Solution

Analyze latency and bandwidth cost optimization requirements for static media delivery.

Cloud CDN integrated with Cloud Storage offloads origin traffic to Google's global edge network, lowering latency and egress pricing.

Serving static files from edge caches minimizes origin bandwidth and delivers content closer to global end users.

Analyze automated storage cost reduction for assets older than 30 days.

An Object Lifecycle Management rule set to transition objects after 30 days from Standard to Coldline storage automates cost savings.

Infrequently accessed data shifted to lower-cost storage classes reduces ongoing monthly storage expenses without requiring custom scripts.

Key Concept

Combining Cloud Storage with Cloud CDN and Object Lifecycle Management optimizes global delivery performance while minimizing compute, network egress, and long-term storage expenses.

Question 1538Question →

An interactive game streaming platform needs to transition its manually provisioned Google Cloud Bigtable clusters and Cloud Storage assets into Terraform management. The platform team requires a safe operational workflow that uses a remote Google Cloud Storage (GCS) backend with state locking to prevent state corruption or service disruption. Arrange the operational steps in the correct sequence to import existing cloud resources into Terraform state.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Write the Terraform HCL code blocks and backend configuration, 2) Run `terraform init` to initialize the remote backend, 3) Execute `terraform import` to bind GCP resource IDs to state, 4) Run `terraform plan` to verify zero drift or unwanted changes, and 5) Execute `terraform apply` to commit the baseline state.

Safely bringing brownfield resources into Terraform management requires defining matching HCL configurations, initializing the GCS remote backend to secure state locks, importing existing GCP resource IDs into state, verifying zero unexpected diffs via `terraform plan`, and finally applying to lock in baseline operational state.

Step-by-Step Solution

Define HCL resource definitions and backend configuration

Local HCL files describe the target infrastructure schema and specify the GCS state bucket location.

Terraform requires code declarations and backend configuration before state operations can be performed.

Execute `terraform init`

The GCS remote state backend is initialized and Google Cloud provider plugins are downloaded.

Backend initialization establishes connectivity and locking mechanisms required for state storage.

Run `terraform import` commands

Live GCP infrastructure objects are mapped to Terraform resource addresses inside the GCS remote state file.

Importing populates state with existing resource attributes without recreating live infrastructure.

Perform `terraform plan` verification

Terraform compares declared HCL with the imported state and outputs a diff report.

Verification ensures that declared configuration attributes match existing GCP resource parameters to prevent accidental destruction.

Run `terraform apply`

The baseline state synchronization is finalized and locked under remote IaC pipeline governance.

Applying completes the import process and verifies that the live environment is fully managed via IaC.

Key Concept

Brownfield Infrastructure as Code Import Workflow

Question 1539Question →

An organization is deploying a stateless web application on Compute Engine in Google Cloud. The application must maintain high availability within a single region and automatically tolerate the failure of an individual zone. Which two configuration choices should you implement to meet these high availability requirements?

Select all that apply

Configure a regional Managed Instance Group (MIG) to automatically distribute compute instances across multiple availability zones.

Deploy a Regional External Application Load Balancer to distribute incoming traffic across instances in all active backend zones.

Migrate the stateless application to a multi-cluster Google Kubernetes Engine (GKE) environment with Anthos Service Mesh across multiple regions.

Configure the load balancer HTTP health check to execute complex database queries against the backend relational database.

Use single-zone unmanaged instance groups and rely on scheduled disk snapshots to manually recreate instances during an outage.

Show answer & explanation

Answer: Configure a regional Managed Instance Group (MIG) to automatically distribute compute instances across multiple availability zones.; Deploy a Regional External Application Load Balancer to distribute incoming traffic across instances in all active backend zones.

Answer

To achieve high availability against zonal outages for a stateless Compute Engine application within a single region, you should configure a regional Managed Instance Group (MIG) across multiple zones and front the instances with a Regional External Application Load Balancer.

Regional Managed Instance Groups automatically maintain compute capacity across multiple availability zones within a Google Cloud region. Pairing regional MIGs with a Regional External Application Load Balancer ensures traffic is seamlessly directed to healthy instances across active zones, providing high availability and protection against zonal outages.

Step-by-Step Solution

Identify compute distribution mechanism for regional high availability.

Selecting a regional Managed Instance Group (MIG) spreads instances automatically across zones within a single region.

Single-zone or unmanaged instance groups leave the workload vulnerable to zonal failures.

Identify regional load balancing mechanism for traffic routing.

Selecting a Regional External Application Load Balancer distributes HTTP requests evenly across healthy backend instances in all assigned zones.

Load balancing provides automated health probe detection and traffic rerouting away from failing instances or zones.

Key Concept

Designing single-region high availability using regional Managed Instance Groups and Regional Load Balancers

Question 1540Question →

A platform engineering team is establishing a progressive canary release pipeline for microservices running on Google Kubernetes Engine (GKE) using Cloud Deploy. The deployment pipeline must ensure secure execution with minimal privileges and support automated verification with automatic rollback if operational performance degrades during traffic shifting. Which TWO deployment pipeline practices should the team implement to fulfill these requirements?

Select all that apply

Configure Cloud Deploy deployment verification to run automated post-rollout checks that validate Cloud Monitoring error rates before proceeding with subsequent canary phases.

Configure Workload Identity Federation for the CI/CD deployment service account with short-lived tokens and specific predefined IAM roles for deployment management.

Grant the primitive Owner role to the CI/CD service account to ensure uninterrupted resource provisioning during canary target deployment.

Store the infrastructure deployment state files inside the unversioned local directory of the deployment worker container to speed up execution.

Configure load balancer ingress health checks to perform deep database queries on every health probe to verify full downstream stack availability before shifting canary traffic.

Show answer & explanation

Answer: Configure Cloud Deploy deployment verification to run automated post-rollout checks that validate Cloud Monitoring error rates before proceeding with subsequent canary phases.; Configure Workload Identity Federation for the CI/CD deployment service account with short-lived tokens and specific predefined IAM roles for deployment management.

Answer

The correct practices are configuring Cloud Deploy deployment verification to execute post-rollout monitoring checks and using Workload Identity Federation with least-privilege IAM roles for the CI/CD deployment pipeline.

Automating post-deployment verification using Cloud Deploy allows progressive canary traffic promotion alongside automated error-budget rollbacks. Combining this with Workload Identity Federation ensures that continuous delivery pipelines run securely under least-privilege constraints without long-lived credentials.

Step-by-Step Solution

Evaluate automated deployment verification strategy

Cloud Deploy verification allows automated post-rollout testing and Cloud Monitoring integration to evaluate metrics and trigger automated rollbacks during canary rollouts.

Ensures reliability and automated progressive deployment management.

Evaluate CI/CD authentication and identity security

Workload Identity Federation provides secure credential management without service account keys, combined with fine-grained predefined roles.

Enforces least privilege security governance in automated release pipelines.

Key Concept

Continuous Delivery and Automated Canary Release Verification in Cloud Deploy

PreviousPage 77 / 80Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept