Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 1561Question →

A media streaming organization provisions its Google Cloud infrastructure using Terraform. During an operational review, the DevOps team discovers that engineers manually modified VPC firewall rules and Cloud Storage bucket access controls directly via the Google Cloud Console to address emergency hotfixes. Consequently, subsequent automated Terraform deployment pipelines are failing due to configuration drift. Which strategy should a cloud architect implement to safely resolve the configuration drift and prevent future unauthorized manual modifications?

Show answer & explanation

Answer: Reconcile the configuration drift using terraform plan and refresh, update code or state to reflect approved states, and revoke direct compute write permissions from developers while routing all changes through automated CI/CD pipelines.

Answer

Reconcile configuration drift using terraform plan and refresh, update the Terraform code to align with authorized infrastructure changes, and enforce automated CI/CD execution while revoking direct manual write access.
Reconciling drift by executing plan operations, updating configuration files to match legitimate changes, and restricting interactive manual write privileges via IAM enforces strict Infrastructure as Code governance and ensures all cloud resource changes remain repeatable and version-controlled.

Step-by-Step Solution

1
Detect and analyze configuration drift
Identify out-of-band changes made via the Cloud Console using execution plans and refresh commands.
Before modifying state or code, the exact disparity between remote GCP state and code definitions must be understood.
2
Reconcile IaC code and state
Update Terraform code definitions for valid hotfixes or import/revert out-of-band modifications.
Bringing configuration files in sync with desired infrastructure establishes a clean baseline.
3
Enforce IAM access controls and pipeline governance
Restrict interactive administrative write permissions from developer accounts and enforce deployment via scoped CI/CD pipelines.
Preventing direct manual edits eliminates future configuration drift and enforces auditable deployment processes.

Key Concept

IaC Drift Detection, State Reconciliation, and Governance
Question 1562Question →

An enterprise financial reporting service running on Compute Engine Managed Instance Groups (MIGs) processes incoming asynchronous HTTP webhooks. During market open, the service experiences severe latency and request timeouts due to queue backlogs, despite average CPU utilization staying below 25% because the workload is heavily I/O and memory bound. Furthermore, during scheduled quarterly filing events, rapid auto-scaling attempts fail because the target region runs out of available instance quotas. Which combination of actions should the Cloud Architect recommend to resolve both the auto-scaling and capacity issues?

Show answer & explanation

Answer: Configure the MIG autoscaler to scale using a Cloud Monitoring custom metric based on pending queue backlog, and proactively submit a regional Compute Engine quota increase request prior to quarterly filing events.

Answer

Configure the MIG autoscaler to scale using a Cloud Monitoring custom metric based on pending queue backlog, and proactively submit a regional Compute Engine quota increase request prior to quarterly filing events.
For memory and I/O-bound applications, standard CPU utilization metrics fail to reflect workload pressure. Using Cloud Monitoring custom metrics (such as queue backlog depth) allows the MIG autoscaler to respond accurately. Additionally, GCP regional quotas are fixed policy limits that do not expand automatically; submitting quota increase requests prior to planned demand spikes prevents scaling errors.

Step-by-Step Solution

1
Identify the root cause of autoscaling failure during normal spikes.
Because the workload is I/O and memory bound, CPU metrics remain low despite high queue depth. Scaling must be tied to custom Cloud Monitoring metrics such as queue length.
Standard CPU metrics do not accurately reflect capacity constraints for memory/I/O-bound workloads.
2
Identify the root cause of scaling failure during scheduled quarterly events.
MIG autoscaling cannot exceed project/regional quota limits. Submitting a quota increase request in advance ensures sufficient headroom.
Compute limits are strictly enforced by GCP IAM and quota controls and do not auto-increase during traffic surges.

Key Concept

Auto-scaling based on custom Cloud Monitoring metrics and capacity quota management
Question 1563Question →

A global logistics and telematics enterprise is architecting a fleet management platform on Google Cloud to ingest and process real-time telemetry from over 500,000 active vehicles. The system requires continuous high availability across regional outages with a recovery point objective (RPO) of zero and a recovery time objective (RTO) of near-zero for transactional write operations. Furthermore, the hybrid networking architecture must connect on-premises data centers to Google Cloud with dedicated physical connections capable of sustaining sustained throughput exceeding 10 Gbps while guaranteeing a 99.99% availability Service Level Agreement (SLA). Which two architectural strategies should the Cloud Architect implement to satisfy these technical requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Provision a Cloud Spanner multi-region instance configuration across target regions to support globally consistent, highly available relational data writes with zero RPO.; Establish Dedicated Interconnect with redundant circuits provisioned across two distinct colocation facilities (edge availability domains) to meet the 99.99% availability SLA.

Answer

The platform requires deploying a Cloud Spanner multi-region instance configuration to guarantee multi-region strong consistency with zero RPO, along with establishing Dedicated Interconnect across redundant colocation facilities to satisfy the 10 Gbps throughput requirement and 99.99% connectivity SLA.
To satisfy zero RPO and multi-region high availability for transactional database writes, Cloud Spanner multi-region instances use Paxos consensus and TrueTime to perform synchronous cross-region replication. For hybrid networking, achieving a 99.99% SLA with high throughput (>10 Gbps) requires Dedicated Interconnect deployed across two independent colocation facilities.

Step-by-Step Solution

1
Analyze storage and database requirements for RPO=0 and high availability across multi-region write workloads.
Cloud Spanner multi-region configurations provide global synchronous replication using TrueTime, satisfying RPO=0 and high availability across regional failures.
Asynchronous database replication options like Cloud SQL cross-region read replicas introduce replication lag, violating the strict RPO=0 constraint.
2
Analyze hybrid connectivity requirements for high bandwidth (>10 Gbps) and 99.99% SLA availability.
Dedicated Interconnect with redundant circuits in two colocation facilities provides the required 10 Gbps+ bandwidth capacity and qualifies for the 99.99% uptime SLA.
HA VPN has a 3 Gbps per-tunnel bandwidth limit and is less optimal for high-throughput enterprise connections requiring dedicated physical infrastructure.

Key Concept

Multi-region high availability architectures using Cloud Spanner and 99.99% SLA Dedicated Interconnect topology.
Estimated Time:2m 0s
Question 1564Question →

An operations team is establishing an automated canary deployment process for a critical stateless application running on Google Kubernetes Engine (GKE) behind an External HTTP(S) Load Balancer. The deployment pipeline must minimize user risk by using progressive traffic routing and metrics validation. Arrange the steps in the correct chronological order to complete a safe canary release.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for a progressive canary release is: 1) Deploy the candidate release version alongside the existing stable workload, 2) Configure traffic splitting on the backend service to route 5% of traffic to the candidate version, 3) Monitor Cloud Monitoring metrics against SLIs over an observation window, 4) Progressively increase traffic to 100%, and 5) Decommission the old stable workload resources.
A progressive canary release follows a strict sequence: first, the candidate version must be deployed in parallel without receiving traffic. Second, traffic splitting is introduced at a small ratio to limit the blast radius. Third, Cloud Monitoring metrics are evaluated over an observation window to ensure SLIs match SLO requirements. Fourth, traffic is incrementally shifted to 100% upon successful evaluation. Finally, legacy workloads are decommissioned.

Step-by-Step Solution

1
Provision candidate workload pods
Candidate release running and healthy in parallel with stable workload
Workload pods must be active and passing health checks prior to accepting live requests.
2
Initialize traffic split
5% of production traffic routed to candidate pods, 95% remains on stable pods
Limits blast radius in case the candidate release contains undetected regressions.
3
Evaluate operational telemetry
SLIs confirmed within SLO error budget boundaries
Automated verification ensures candidate stability before committing more user traffic.
4
Complete traffic migration
100% of live traffic routed to candidate release
Gradually scaling traffic completes the transition once stability is validated.
5
Clean up baseline resources
Old stable deployment deleted; candidate becomes new baseline
Frees compute capacity and avoids configuration drift.

Key Concept

Progressive Canary Release and Traffic Splitting Management
Question 1565Question →

A financial analytics firm is architecting a hybrid network topology to connect its on-premises infrastructure with Google Cloud. Match each hybrid connectivity requirement on the left with the most appropriate Google Cloud networking solution on the right.

Click a left item, then click its matching right item

Items

Direct physical connection providing 20 Gbps private bandwidth to Google Cloud without traversing the public internet.
IPsec encrypted connectivity over the public internet supporting a 99.99% availability SLA.
Private connection for an office location where direct Google colocation footprint is unavailable and connection must be routed through a service provider.
Dynamic BGP route propagation and automated failover management across hybrid VPN and Interconnect connections.

Matches

Show answer & explanation

Answer

Direct 20 Gbps private connection matches Dedicated Interconnect; IPsec encrypted 99.99% SLA connection matches HA Cloud VPN; Service provider private link matches Partner Interconnect; Dynamic BGP route propagation matches Cloud Router.
Each hybrid networking requirement maps directly to its intended Google Cloud service component: Dedicated Interconnect handles direct physical high-bandwidth connections; HA Cloud VPN offers encrypted public internet connections backed by an SLA; Partner Interconnect enables private links via third-party service providers; and Cloud Router manages dynamic BGP routing.

Step-by-Step Solution

1
Analyze high-bandwidth direct private link requirements without public internet.
Identifies Dedicated Interconnect as the physical direct connectivity product capable of multi-10 Gbps private throughput.
Dedicated Interconnect connects directly to Google facilities at 10 Gbps or 100 Gbps per link.
2
Analyze IPsec encrypted public internet link with 99.99% SLA.
Identifies HA Cloud VPN.
HA Cloud VPN guarantees 99.99% service availability across dual active IPsec tunnels.
3
Analyze private connectivity needs delivered via a third-party service provider.
Identifies Partner Interconnect.
Partner Interconnect enables private GCP access through service provider networks when direct co-location is unavailable.
4
Analyze dynamic routing and automated failover control requirement.
Identifies Cloud Router.
Cloud Router runs BGP to establish dynamic routing across hybrid GCP connections.

Key Concept

Selecting and matching GCP hybrid connectivity services (Dedicated Interconnect, Partner Interconnect, HA Cloud VPN, Cloud Router) according to SLA, bandwidth, encryption, and physical colocation requirements.
Question 1566Question →

A financial analytics company is migrating an event processing platform and a historical audit reporting engine to Google Cloud. The infrastructure architecture must satisfy two core business requirements:
1. Store historical audit records cost-effectively while automatically moving older objects to archival storage after 30 days of non-access.
2. Execute a lightweight, stateless webhook microservice that processes infrequent incoming event payloads while eliminating idle compute expenses.

Which TWO architectural choices should you recommend to minimize cost while fulfilling these business requirements?

Select all that apply

Show answer & explanation

Answer: Store historical audit records in Cloud Storage Standard and implement an Object Lifecycle Management policy to transition objects to Archive Storage after 30 days.; Deploy the stateless webhook event processing microservice to Cloud Run configured to scale down to zero instances when no traffic is present.

Answer

The optimal recommendations are using Cloud Storage with Object Lifecycle Management to transition data to Archive Storage after 30 days, and deploying the webhook microservice on Cloud Run to scale down to zero when idle.
Combining Cloud Storage Object Lifecycle Management with Cloud Run ensures both business requirements are met with minimal expense. Object Lifecycle Management automates transitions to low-cost archival tiers after 30 days, while Cloud Run scales containers to zero during idle periods to eliminate unnecessary compute spending.

Step-by-Step Solution

1
Analyze the storage requirement for historical audit records.
Infrequently accessed audit data requires cost-effective object storage with automated tiering. Cloud Storage combined with Object Lifecycle Management transitions objects to Coldline/Archive storage automatically, reducing long-term storage costs.
Meets the 30-day archival rule without incurring unnecessary relational database provisioning charges.
2
Analyze the compute requirement for the intermittent stateless microservice.
Cloud Run allows containerized stateless services to scale to zero instances during idle periods, charging strictly per request execution time.
Eliminates infrastructure cost during periods of no traffic, satisfying the requirement to avoid idle compute costs.

Key Concept

Selecting serverless compute (Cloud Run) and object storage lifecycle rules (Cloud Storage) for cost-optimized cloud architectures.
Question 1567Question →

A regional bank is migrating a legacy batch transaction processing monolith to Google Cloud. Over years of operation, the application has accumulated significant technical debt: deployments frequently fail due to breaking database schema modifications, infrastructure is modified manually in production causing configuration drift, and application services rely heavily on local disk state.

As the Cloud Architect leading this modernization initiative, which TWO architectural strategies should you implement to eliminate this technical debt and establish a reliable cloud deployment pipeline? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Adopt the expand-contract (parallel change) pattern for all database schema modifications to maintain backward compatibility during application deployments.; Define all GCP infrastructure using Infrastructure as Code (IaC) templates enforced via CI/CD pipelines while revoking manual resource modification access.

Answer

The correct strategies are adopting the expand-contract pattern for database schema migrations and defining infrastructure as code enforced via automated CI/CD pipelines while preventing manual console modifications.
Addressing technical debt during legacy cloud migrations requires decoupling database schema changes from application deployments and eliminating infrastructure configuration drift. The expand-contract pattern introduces database changes in distinct phases (expand, transition, contract), guaranteeing backward compatibility for active application instances. Simultaneously, managing all GCP infrastructure declaratively via Infrastructure as Code (IaC) pipelines and revoking manual mutation rights prevents drift between repository state and runtime environments.

Step-by-Step Solution

1
Analyze the technical debt causes described in the migration scenario.
Identified two core issues: database deployment coupling causing breaking changes, and manual production modifications causing infrastructure drift.
Technical debt remediation requires targeted patterns that explicitly resolve root causes.
2
Evaluate database refactoring techniques for legacy zero-downtime migrations.
The expand-contract (parallel change) pattern allows old and new code versions to run concurrently against the database schema without breaking functionality.
Decoupling application code releases from database schema changes prevents deployment failures.
3
Evaluate infrastructure governance and configuration drift mitigation.
Declarative IaC (e.g., Terraform) managed exclusively through CI/CD pipelines eliminates manual configuration drift.
Restricting manual changes ensures the defined IaC state always matches actual cloud infrastructure.

Key Concept

Legacy Migration Technical Debt Remediation via IaC and Database Expand-Contract Pattern
Question 1568Question →

A platform engineering team is establishing an automated deployment pipeline for an enterprise application running on Google Kubernetes Engine (GKE). The application communicates with a relational database, and all cloud infrastructure is managed using Terraform within a CI/CD pipeline. Which TWO deployment and operational practices should the team implement to ensure release reliability and prevent application outages during rollouts?

Select all that apply

Show answer & explanation

Answer: Apply backward-compatible database schema changes using an expand-contract pattern before routing traffic to new application revisions.; Store Terraform state in a centralized Cloud Storage bucket configured with object versioning and state locking.

Answer

The team should apply backward-compatible database schema changes using an expand-contract pattern before routing traffic to new application revisions, and store Terraform state in a centralized Cloud Storage bucket configured with object versioning and state locking.
Ensuring database schema changes are backward-compatible (using an expand-contract pattern) guarantees that active application versions continue functioning during progressive deployments without causing data errors. Concurrently, utilizing Cloud Storage with state locking and versioning for Terraform state maintains IaC state integrity and prevents race conditions across automated build runners.

Step-by-Step Solution

1
Analyze deployment safety requirements for applications connected to backend databases.
Identified that database schema updates must remain compatible with both the active deployment and the upcoming release to allow zero-downtime rolling updates and instant rollbacks.
Deploying breaking schema modifications simultaneously with new code causes runtime errors on active application instances.
2
Evaluate Infrastructure as Code state management best practices for CI/CD automation.
Identified remote backend state storage with object locking and versioning in Cloud Storage as essential for team collaboration and automated pipelines.
Local state files on ephemeral build instances cause concurrency issues, lost state history, and infrastructure drift.

Key Concept

Release Management and Infrastructure State Integrity
Estimated Time:2m 0s
Question 1569Question →

A healthcare organization is extending its on-premises data center to Google Cloud to host a real-time medical imaging analysis system. The workload requires a dedicated private connection with 4 Gbps bandwidth, strict SLA guarantees, and no traversal of the public internet. Furthermore, on-premises systems must securely communicate with application workloads distributed across multiple distinct GCP project environments. Which hybrid network architecture should you recommend?

Show answer & explanation

Answer: Provision a Partner Interconnect connection in a Shared VPC host project, configure Cloud Routers with BGP, and attach service project subnets directly to the Shared VPC.

Answer

Provision a Partner Interconnect connection in a Shared VPC host project, configure Cloud Routers with BGP, and attach service project subnets directly to the Shared VPC.
Partner Interconnect offers private, SLA-guaranteed hybrid connectivity scalable to 4 Gbps via a service provider. Combining Partner Interconnect with a Shared VPC host project enables all workloads in attached service projects to access on-premises resources directly within the shared network space, circumventing the non-transitive limitation of VPC Network Peering.

Step-by-Step Solution

1
Evaluate hybrid connectivity requirements based on SLA, privacy, and throughput (4 Gbps).
HA VPN is unsuitable because it travels over the public internet and requires multiple tunnels. Partner Interconnect or Dedicated Interconnect provides private, SLA-backed connectivity. For a 4 Gbps requirement, Partner Interconnect with 4 Gbps or 5 Gbps VLAN attachments is the optimal choice.
Dedicated Interconnect is provisioned in 10 Gbps or 100 Gbps physical circuits, whereas Partner Interconnect offers flexible sub-10 Gbps capacities (such as 1, 2, 4, or 5 Gbps) via service providers.
2
Evaluate multi-project cloud topology requirements for hybrid accessibility.
VPC Network Peering does not support transitive routing (traffic from an on-premises Interconnect cannot transit a Hub VPC into a peered Spoke VPC). Using a Shared VPC host project allows subnets from service projects to reside in the same global VPC network.
Shared VPC eliminates the need for transitive routing across project boundaries by centralizing network administration and hybrid interconnects in the host project.

Key Concept

Hybrid Connectivity Selection & Shared VPC Routing Boundaries
Question 1570Question →

An IoT enterprise telemetry platform processes streaming sensor data using Compute Engine Managed Instance Groups (MIGs). The application is network I/O-bound, keeping thousands of concurrent TCP sockets open per instance. During peak ingestion periods, telemetry drops occur due to socket exhaustion while average CPU utilization remains at approximately 30%. Furthermore, during a recent sudden traffic surge, manual scale-out attempts failed because the project exceeded its regional vCPU quota limit. Which combination of actions should a cloud architect implement to ensure automatic, reliable scaling and capacity availability during peak loads?

Show answer & explanation

Answer: Configure the MIG autoscaler to scale using a custom Cloud Monitoring metric tracking active TCP connection count, and proactively request a regional Compute Engine vCPU quota increase for the instance family.

Answer

Configure the MIG autoscaler using a custom Cloud Monitoring metric tracking active TCP connection count, and proactively request a regional Compute Engine vCPU quota increase.
For network I/O-bound workloads with low CPU usage, autoscaling must be based on custom application metrics such as open TCP connections or socket usage. Additionally, because compute instances cannot scale past project quotas, requesting regional vCPU quota increases in advance ensures capacity is available when autoscaling triggers.

Step-by-Step Solution

1
Identify the performance bottleneck metric
Recognize that CPU utilization is an inadequate metric for I/O-bound socket workloads.
I/O-bound services exhaust memory or network sockets long before CPU thresholds are reached.
2
Select the appropriate autoscaling metric strategy
Implement custom metrics via Cloud Monitoring for active TCP connections.
Custom metrics reflect real load and trigger scale-out events before socket exhaustion occurs.
3
Address capacity provisioning constraints
Request regional Compute Engine vCPU quota increases in advance.
Autoscaling policies cannot provision new instances if regional resource quota limits are exceeded.

Key Concept

Custom Metric Autoscaling & Preemptive Quota Management
Question 1571Question →

A logistics organization is updating its regional fleet tracking API service, which runs on Compute Engine Managed Instance Groups (MIGs) managed by an automated Infrastructure as Code (IaC) continuous delivery pipeline. The team needs to ensure zero-downtime rolling updates while maintaining release reliability, state consistency, and security. Which deployment and pipeline configuration should the team implement?

Show answer & explanation

Answer: Configure a dedicated shallow HTTP health check endpoint for the load balancer, maintain Terraform state in a centralized versioned Cloud Storage bucket, and assign least-privilege IAM roles to the CI/CD service account.

Answer

Configure a dedicated shallow HTTP health check endpoint for the load balancer, maintain Terraform state in a centralized versioned Cloud Storage bucket, and assign least-privilege IAM roles to the CI/CD service account.
The combination of shallow HTTP health checks, a centralized versioned Cloud Storage backend for Terraform state, and least-privilege IAM roles ensures zero-downtime rolling updates, protects infrastructural state integrity, and complies with enterprise security controls.

Step-by-Step Solution

1
Evaluate load balancer health check configuration for MIG rolling deployments.
Using a shallow endpoint (e.g., /healthz returning 200 OK without deep database queries) ensures the load balancer accurately measures web server process responsiveness without triggering false-positive instance reinstantiations during database load spikes.
Deep health checks create cascading operational failures across backend instances when downstream dependencies experience transient latency.
2
Assess state file management for automated IaC deployment pipelines.
Persisting Terraform state in Cloud Storage with object versioning and locking ensures concurrent deployment safety and prevents state corruption.
Local disk storage is ephemeral and leads to state drift or loss in automated CI/CD runners.
3
Determine appropriate Identity and Access Management permissions for the release pipeline.
Granting specific predefined or custom roles (such as Compute Instance Admin and Storage Object Admin) enforces security governance.
Primitive roles like Owner grant excessive permissions, violating organizational security controls.

Key Concept

Reliable deployment release engineering combining shallow health checks, secure IaC state management, and least-privilege access controls.
Question 1572Question →

An enterprise supply chain platform uses worker virtual machines deployed in a Compute Engine Managed Instance Group (MIG) to process tracking updates from Cloud Pub/Sub. During peak shipment hours, message backlog accumulates significantly in Pub/Sub, but the MIG autoscaler fails to add instances because CPU utilization on existing workers remains around 25% due to external I/O wait times. Additionally, during major sales events, scaling operations occasionally halt because the project reaches regional compute limits. Which TWO actions should the Cloud Architect implement to ensure reliable auto-scaling and capacity availability? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the MIG autoscaler to scale based on Cloud Pub/Sub queue depth using a custom Cloud Monitoring metric calculated as unacknowledged messages per worker instance.; Request regional Compute Engine CPU quota increases in advance for the target deployment regions prior to expected peak traffic events.

Answer

The correct architecture requires scaling the Managed Instance Group using Cloud Pub/Sub queue depth metrics per worker instead of CPU utilization, and requesting regional Compute Engine quota increases in advance of peak events.
Scaling queue-based processing workloads effectively requires measuring queue backlog (such as Pub/Sub unacknowledged messages per worker) via Cloud Monitoring custom metrics. Additionally, because compute autoscaling cannot exceed regional quota limits, architects must plan capacity and request regional CPU quota increases prior to expected high-traffic events.

Step-by-Step Solution

1
Identify the primary scaling metric bottleneck
Recognize that CPU utilization is an ineffective scaling metric for I/O-bound pub/sub processing workers.
Workers spend time waiting on external API responses, keeping CPU low despite high queue depth.
2
Implement metric-based autoscaling
Configure MIG autoscaling based on a custom Cloud Monitoring metric reflecting Pub/Sub message backlog divided by instance count.
Queue depth accurately reflects demand and triggers scaling regardless of worker CPU load.
3
Address infrastructure capacity limits
Evaluate current regional quotas and submit quota increase requests ahead of high-demand periods.
Autoscaling policies cannot provision instances beyond the project's approved regional resource quotas.

Key Concept

Auto-scaling for I/O-bound queue workloads and proactive regional capacity planning
Estimated Time:2m 0s
Question 1573Question →

A national healthcare scheduling network is migrating its mission-critical appointments backend to Google Cloud. The application requires global ACID transactions, a recovery point objective (RPO) of 0, a recovery time objective (RTO) under 1 minute, and guaranteed 99.999%99.999\% availability. Additionally, the architecture requires dedicated, SLA-backed hybrid connectivity to on-premises data centers capable of sustaining 20 Gbps of bandwidth without relying on public internet routing. Which TWO architectural decisions should you make to satisfy these technical and high availability requirements?

Select all that apply

Show answer & explanation

Answer: Deploy a multi-region Cloud Spanner instance configuration to manage transactional backend data across multiple GCP regions.; Provision redundant 10 Gbps Dedicated Interconnect connections across two distinct colocation facilities (edge availability domains).

Answer

To meet zero RPO, near-zero RTO, 99.999% availability, and high-throughput dedicated hybrid bandwidth, the solution must combine a multi-region Cloud Spanner database deployment with redundant 10 Gbps Dedicated Interconnect connections across two separate edge availability domains.
The combination of multi-region Cloud Spanner and redundant Dedicated Interconnect satisfies all constraints. Multi-region Cloud Spanner provides synchronous global replication with RPO=0, RTO under 1 minute, and a 99.999% SLA. Redundant 10 Gbps Dedicated Interconnect connections deployed across distinct edge locations provide high bandwidth (20 Gbps) and private connectivity backed by Google's enterprise availability SLA.

Step-by-Step Solution

1
Analyze storage high availability and continuity requirements
Cloud Spanner multi-region instance configuration is required because standard Cloud SQL cannot deliver multi-region RPO=0 with active-active global consistency and a 99.999% SLA.
Cloud Spanner uses Paxos consensus and TrueTime to deliver synchronized multi-region replication meeting RPO=0 and sub-minute failover (RTO < 1 min).
2
Evaluate hybrid networking connectivity requirements
Dedicated Interconnect across redundant colocation sites is selected over HA VPN.
HA VPN maxes out at 3 Gbps per tunnel over public lines, whereas 20 Gbps throughput with strict availability SLAs demands Dedicated Interconnect.
3
Eliminate misconfigured architectural patterns
Avoid non-transitive VPC peering reliance and deep dependency health checks.
VPC peering does not extend transitive routes to on-premise interconnects, and database-level load balancer health checks introduce risk of cascading failure.

Key Concept

Designing Enterprise High Availability Architectures for Strict SLA, RPO/RTO, and Hybrid Throughput
Question 1574Question →

A global biotechnology enterprise is architecting a hybrid cloud solution on Google Cloud to ingest continuous high-throughput genomic sequencing datasets from its on-premises laboratories into Cloud Storage and BigQuery. The technical requirements demand a dedicated network throughput of at least 25 Gbps25\text{ Gbps} with a 99.99%99.99\% high availability SLA across physical connection failures, along with protection against data exfiltration by authorized internal identities to external cloud storage locations. Which architectural solution satisfies these technical availability and security requirements?

Show answer & explanation

Answer: Provision redundant 100 Gbps Dedicated Interconnect circuits across two distinct metropolitan locations configured with Global Dynamic Routing, and establish a VPC Service Controls perimeter around the project resources.

Answer

Provision redundant 100 Gbps Dedicated Interconnect circuits across two distinct metropolitan locations configured with Global Dynamic Routing, and establish a VPC Service Controls perimeter around the project resources.
The correct choice fulfills both high availability network performance and security exfiltration requirements. Deploying 100 Gbps Dedicated Interconnect across two distinct metropolitan areas fulfills Google's 99.99% uptime architecture guidelines for high bandwidth (>25 Gbps). Encapsulating the environment with VPC Service Controls creates a security perimeter that blocks data egress to external Google Cloud resources, preventing exfiltration even by authenticated identities.

Step-by-Step Solution

1
Evaluate bandwidth and SLA connectivity requirements.
Sustained 25 Gbps25\text{ Gbps} throughput requires Dedicated Interconnect (as HA VPN is capped at 3 Gbps3\text{ Gbps} per tunnel). Achieving a 99.99%99.99\% SLA requires redundant connections across two different colocation facilities (metropolitan locations).
HA VPN cannot reliably support high continuous throughput scaling over 25 Gbps25\text{ Gbps}, and single-metro interconnects only offer a 99.9%99.9\% SLA.
2
Evaluate data exfiltration protection requirements.
VPC Service Controls must be implemented to create a security perimeter around GCP resources.
IAM permissions govern access rights but do not prevent authorized users or compromised service accounts from copying internal data into external GCP projects or buckets.
3
Synthesize the complete high availability and security architecture.
Selecting dual-metro Dedicated Interconnect combined with VPC Service Controls provides the required throughput, high availability SLA, and exfiltration boundary.
This combination addresses both technical infrastructure and security perimeter constraints without relying on non-transitive VPC peering topologies.

Key Concept

99.99% HA Dedicated Interconnect Architecture and VPC Service Controls Exfiltration Protection
Estimated Time:2m 30s
Question 1575Question →

A pharmaceutical research enterprise needs to establish hybrid network connectivity between its primary on-premises data center and a Google Cloud Virtual Private Cloud (VPC). The application architecture requires continuous, low-latency data transfers for heavy genomic datasets with a baseline bandwidth requirement of 15 Gbps. The enterprise mandates minimizing recurring networking costs while satisfying bandwidth and SLA requirements. Which hybrid connectivity solution should the cloud architect recommend?

Show answer & explanation

Answer: Provision a Dedicated Interconnect connection using 10 Gbps circuits to accommodate the high throughput requirement with direct private connectivity.

Answer

Provisioning a Dedicated Interconnect connection using 10 Gbps circuits is the recommended solution. It provides direct, private, high-bandwidth connectivity designed for sustained data transfers exceeding 10 Gbps, minimizing per-gigabyte network egress costs and operational complexity.
Dedicated Interconnect provides private, high-speed physical connectivity directly into Google Cloud. For continuous workloads requiring more than 10 Gbps bandwidth (such as 15 Gbps), Dedicated Interconnect with 10 Gbps links is the most cost-effective and architecturally sound approach, providing lower egress bandwidth rates and predictable performance.

Step-by-Step Solution

1
Evaluate throughput requirements
The baseline bandwidth requirement is 15 Gbps continuous throughput.
HA VPN tunnels max out at 3 Gbps per tunnel, making VPN aggregation inefficient for bandwidth demands exceeding 10 Gbps.
2
Compare hybrid connectivity options on Google Cloud
Dedicated Interconnect offers 10 Gbps or 100 Gbps physical links with lower egress rates for heavy sustained traffic.
Dedicated Interconnect is the standard choice when bandwidth exceeds 10 Gbps and low latency/high reliability is required.
3
Select the cost-optimized architecture matching business requirements
Dedicated Interconnect delivers necessary throughput while maintaining cost-efficiency over public internet VPN alternatives.
Direct interconnect physical links avoid high VPN tunnel count overhead and offer lower per-GB transfer costs for large dataset transfers.

Key Concept

Selecting cost-effective hybrid network architecture based on bandwidth thresholds and latency requirements.
Question 1576Question →

A media rendering company requires hybrid connectivity between its on-premises data center and a Google Cloud Virtual Private Cloud (VPC) network to stream large raw video files. The connection must support a sustained bandwidth requirement of 15 Gbps, deliver high availability with a 99.99% SLA, and prevent traffic from traversing the public internet. Which hybrid connectivity strategy should the Cloud Architect recommend?

Show answer & explanation

Answer: Provision Dedicated Interconnect with redundant links across two Google Cloud colocation facilities in two distinct metropolitan regions.

Answer

Provision Dedicated Interconnect with redundant links across two Google Cloud colocation facilities in two distinct metropolitan regions.
Dedicated Interconnect provides direct physical connections between an on-premises network and Google Cloud without traversing the public internet. To achieve a 99.99% availability SLA for Dedicated Interconnect, an organization must deploy circuit connections in two separate metropolitan locations (metros) across four edge availability domains with dynamic BGP routing enabled via Cloud Router. This topology comfortably supports 15 Gbps bandwidth requirements using multiple 10 Gbps or 100 Gbps connections.

Step-by-Step Solution

1
Analyze bandwidth and security requirements
Sustained throughput is 15 Gbps and traffic must not traverse the public internet.
Cloud VPN operates over public internet with a 3 Gbps per tunnel cap, eliminating standard HA VPN as a viable choice for high-throughput private transport.
2
Evaluate high availability requirements
The requirement specifies a 99.99% uptime SLA.
Google Cloud requires Dedicated Interconnect circuits deployed in two separate edge availability domains across two distinct metros with Cloud Router BGP dynamic routing to achieve a 99.99% SLA.
3
Select the compliant hybrid connectivity model
Dedicated Interconnect redundant configuration provides 10 Gbps or 100 Gbps private circuits meeting both SLA and bandwidth thresholds.
Dedicated Interconnect meets all constraints: direct private physical connection, 15+ Gbps capacity, and 99.99% availability SLA.

Key Concept

Selecting GCP Hybrid Connectivity based on Bandwidth, Private Routing, and SLA Requirements
Question 1577Question →

An online gaming enterprise is architecting its real-time session state and player inventory backend on Google Cloud. The workload requires zero data loss (RPO=0RPO = 0) during regional outages along with continuous multi-region availability and transactional consistency. Furthermore, the cloud backend must connect to legacy game server hosts in an on-premises data center using private connectivity capable of sustaining throughput exceeding 15 Gbps. Which TWO architectural components should be selected to meet these high availability and technical requirements?

Select all that apply

Show answer & explanation

Answer: Deploy a multi-region Cloud Spanner instance configuration to handle the transactional backend workload with synchronous cross-region replication.; Provision redundant 10 Gbps Dedicated Interconnect circuits configured with Cloud Router BGP routing between on-premises and Google Cloud.

Answer

The architecture should use a multi-region Cloud Spanner instance configuration for zero-RPO transactional data consistency across regions, combined with redundant 10 Gbps Dedicated Interconnect connections to satisfy the private high-throughput hybrid network requirements (>15 Gbps).
Combining a multi-region Cloud Spanner deployment with redundant Dedicated Interconnect links satisfies all requirements. Cloud Spanner guarantees multi-region strong consistency and RPO=0RPO = 0 via synchronous Paxos consensus. Dedicated Interconnect provides private, direct network links that easily support bandwidth requirements greater than 15 Gbps without using the public internet.

Step-by-Step Solution

1
Evaluate multi-region transactional storage requirements
Cloud Spanner multi-region instances utilize Paxos consensus across regional nodes to achieve synchronous write replication, guaranteeing RPO=0RPO = 0 across region failures. Cloud SQL uses asynchronous replication for cross-region replicas, which violates the RPO=0RPO = 0 requirement.
Only Cloud Spanner supports globally distributed synchronous relational transactions on GCP.
2
Evaluate hybrid connectivity throughput constraints
The throughput requirement is >15 Gbps> 15\text{ Gbps}. Standard HA VPN is bounded at 3 Gbps per tunnel, whereas Dedicated Interconnect scales up to multiple 10 Gbps or 100 Gbps links over private fiber connections.
Dedicated Interconnect is required for private hybrid connectivity demanding sustained bandwidth above 3 Gbps.

Key Concept

Multi-region high availability architectures require synchronous data replication services (Cloud Spanner) for RPO=0RPO = 0 requirements and dedicated physical interconnects (Dedicated Interconnect) for high-bandwidth (>3 Gbps) hybrid network transport.
Question 1578Question →

An autonomous fleet management company provisions its Google Cloud infrastructure using Terraform within a automated CI/CD deployment pipeline. The engineering team needs to enforce secure, environment-isolated state management across development, staging, and production while preventing concurrent state execution conflicts and state corruption. Which architecture best adheres to Google Cloud recommendations for Terraform remote backend state governance?

Show answer & explanation

Answer: Store each environment's state in a separate dedicated Cloud Storage bucket with Object Versioning enabled, utilizing native state locking and fine-grained IAM controls.

Answer

Store each environment's state in a separate dedicated Cloud Storage bucket with Object Versioning enabled, utilizing native state locking and fine-grained IAM controls.
According to Google Cloud best practices for Infrastructure as Code, Terraform state for different environments should be isolated into separate Cloud Storage buckets. Object Versioning ensures state history can be restored if corrupted, while GCS natively supports state locking to prevent race conditions during concurrent CI/CD pipeline runs.

Step-by-Step Solution

1
Identify key requirements for enterprise IaC state management
Requirements are environment isolation (dev/stage/prod), concurrency control (state locking), and state versioning/recovery.
Preventing accidental cross-environment modifications and corruption during concurrent CI/CD runs is essential.
2
Evaluate Google Cloud best practices for Terraform backends
Cloud Storage (GCS) provides remote backend functionality, built-in strong consistency, state locking, and versioning.
A separate GCS bucket per environment ensures strict logical and security boundaries using IAM permissions.
3
Compare against incorrect practices
Local storage, primitive IAM roles, and manual console edits introduce drift, security vulnerabilities, and state corruption risks.
Automation pipelines require minimal privileges and reproducible declarative execution without manual out-of-band interventions.

Key Concept

Terraform Remote Backend State Governance in Google Cloud
Question 1579Question →

A financial technology company is modernizing a regional banking compliance and audit application currently running on an on-premises PostgreSQL database. The workload operates entirely within a single Google Cloud region (us-central1) and requires strict ACID compliance, relational joins, automated cross-zone high availability (HA) with zero data loss failover, and point-in-time recovery. Total database storage is projected to reach 4 TB over the next three years, with moderate transaction throughput. The chief architecture office requires a solution that minimizes operational management overhead and unnecessary infrastructure costs while meeting all technical availability requirements. Which storage architecture should the lead Cloud Architect recommend?

Show answer & explanation

Answer: Deploy Cloud SQL for PostgreSQL with a regional High Availability (HA) configuration across two zones, utilizing automatic failover and automated point-in-time backups.

Answer

Deploy Cloud SQL for PostgreSQL with a regional High Availability (HA) configuration across two zones, utilizing automatic failover and automated point-in-time backups.
Cloud SQL for PostgreSQL with a regional High Availability (HA) configuration provides automated zone failover, synchronous replication to a standby instance in a secondary zone within the region, automated point-in-time recovery, and supports storage up to 64 TB. This perfectly meets all single-region compliance requirements while optimizing costs and operational overhead.

Step-by-Step Solution

1
Analyze workload relational and scalability requirements
The application requires PostgreSQL compatibility, relational join capabilities, ACID compliance, and a projected data footprint of 4 TB in a single GCP region.
Cloud SQL for PostgreSQL fully supports up to 64 TB of storage per instance and handles single-region relational workloads without needing global scale.
2
Evaluate high availability and business continuity constraints
A regional Cloud SQL HA deployment places a primary DB instance in one zone and a synchronous standby instance in a second zone within us-central1.
This satisfies the zero data loss failover, automated point-in-time recovery, and regional SLA requirements.
3
Assess cost and operational efficiency against alternative services
Cloud Spanner provides global multi-region consistency but is cost-prohibitive and unnecessary for a single-region 4 TB PostgreSQL workload.
Choosing Cloud SQL provides a fully managed service that minimizes operational management overhead while remaining cost-effective.

Key Concept

Selecting optimal relational storage based on geographical scope, scale, and cost constraints.
Estimated Time:2m 0s
Question 1580Question →

An enterprise telemetry ingestion system deployed on Google Cloud processes real-time vehicle fleet data. The solution requires hosting simple stateless HTTP ingestion microservices with minimal operational overhead, establishing a resilient hybrid connection to an on-premises data center with a sustained bandwidth requirement of 12 Gbps, and maintaining high availability without triggering cascading load balancer failures when backend databases experience transient latency spikes.

Which TWO architectural choices should you include in the design to satisfy these technical requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the stateless HTTP ingestion microservices on Cloud Run and configure the load balancer health checks to target a dedicated shallow endpoint that returns HTTP 200 without executing downstream database queries.; Provision Dedicated Interconnect with redundant VLAN attachments across separate metro locations to handle the sustained 12 Gbps hybrid network connectivity.

Answer

The correct solution involves deploying the stateless microservices on Cloud Run with shallow health checks, and provisioning Dedicated Interconnect across redundant metro locations for the sustained 12 Gbps traffic flow.
Cloud Run is the optimal compute platform for stateless microservices because it eliminates server management overhead while scaling automatically. Pairing Cloud Run (or load balancers) with shallow health check endpoints ensures instances are not marked unhealthy when underlying databases experience temporary latency spikes. For hybrid connectivity, Dedicated Interconnect is required to reliably transport sustained bandwidth exceeding 10 Gbps across redundant metro locations.

Step-by-Step Solution

1
Select compute architecture for stateless HTTP microservices
Cloud Run provides serverless autoscaling with zero node management overhead for stateless web endpoints.
GKE adds unnecessary management complexity and fixed baseline compute costs for simple stateless HTTP services.
2
Determine high-throughput hybrid connectivity mechanism
Dedicated Interconnect supplies 10 Gbps or 100 Gbps physical circuits capable of cleanly supporting a sustained 12 Gbps payload across dual metro locations.
HA VPN is capped at 3 Gbps per tunnel, making it inefficient and prone to throttling for sustained 12 Gbps traffic demands.
3
Design resilient load balancer health checking strategy
Configure a shallow health check endpoint (such as HTTP /healthz returning 200 OK) that evaluates local web server health only.
Probing deep database dependencies in health checks causes backend instances to be declared unhealthy during transient database slowness, triggering cascading failures.

Key Concept

High-availability cloud architecture design balancing minimal operational overhead, scalable hybrid bandwidth, and resilient health check isolation.
PreviousPage 79 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin