All practice questions

1598 questions

All types1,598 Multiple choice815 Multiple select537 Numeric8 Matching64 Ordering174

A global logistics enterprise is architecting its core shipment dispatch backend on Google Cloud. The application requires multi-region high availability with continuous write availability ( $RPO = 0$ ), global ACID transaction guarantees across regions, and zero-downtime regional failover. Furthermore, microservices hosted on internal Compute Engine instances must query the database securely without traversing the public internet, while preventing internal users from exfiltrating data to external Cloud Storage buckets or projects. Which architecture meets these technical and availability requirements?

Deploy Cloud Spanner with a multi-region instance configuration, configure Private Google Access for Compute Engine subnets, and implement a VPC Service Controls perimeter around the project resources.

Deploy Cloud SQL for PostgreSQL with high availability (HA) enabled across zones in a primary region and cross-region read replicas in a secondary region, relying on IAM permissions to prevent data exfiltration.

Deploy Cloud Spanner with a multi-region instance configuration, relying exclusively on granular IAM roles and VPC firewall rules to prevent data exfiltration to external resources.

Deploy Compute Engine microservices across two VPC networks connected via VPC Network Peering through a central transit VPC, relying on transitive routing to access Cloud Spanner in a multi-region setup.

Show answer & explanation

Answer: Deploy Cloud Spanner with a multi-region instance configuration, configure Private Google Access for Compute Engine subnets, and implement a VPC Service Controls perimeter around the project resources.

Answer

Deploying Cloud Spanner with a multi-region configuration alongside Private Google Access and VPC Service Controls fulfills all technical, high availability, and anti-exfiltration constraints.

The combination of Cloud Spanner in a multi-region deployment, Private Google Access, and VPC Service Controls addresses all stated architecture needs. Cloud Spanner delivers multi-region ACID consistency with zero data loss (

RPO = 0

), Private Google Access keeps database communication on private Google infrastructure, and VPC Service Controls prevents authorized identities from exporting data outside designated perimeter boundaries.

Step-by-Step Solution

Evaluate database requirements for multi-region ACID transactions and RPO=0.

Cloud Spanner multi-region instance deployment is selected because it provides synchronous cross-region replication, RPO=0, and high availability (99.999% SLA).

Cloud SQL provides regional HA but uses asynchronous replication for cross-region read replicas, failing the zero RPO requirement.

Determine private routing requirements for internal Compute Engine microservices.

Private Google Access is enabled on the subnets housing Compute Engine instances.

Allows instances without public IP addresses to reach Google APIs and Cloud Spanner endpoints over internal Google network paths.

Address data exfiltration security requirements.

VPC Service Controls perimeters are configured around the project.

IAM roles grant permission to access data but cannot restrict where authorized data is written. VPC Service Controls blocks data movement to non-designated external projects or storage locations.

Key Concept

Multi-Region High Availability & Security Perimeters

Question 1582Question →

Match each workload requirement and data access pattern on the left with the most appropriate managed Google Cloud storage or database service on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

1. Global multi-region relational ACID with 99.999% SLA maps to Cloud Spanner.
2. Low-latency time-series key-value IoT telemetry maps to Cloud Bigtable.
3. Mobile app real-time JSON document sync maps to Firestore.
4. Unstructured media and audit log lifecycle management maps to Cloud Storage.

Each GCP database and storage service addresses specific architectural trade-offs: Cloud Spanner for globally distributed relational ACID workloads; Cloud Bigtable for high-throughput, low-latency key-value/time-series data; Firestore for real-time mobile serverless document synchronization; and Cloud Storage for unstructured object data with lifecycle management.

Step-by-Step Solution

Analyze global multi-region relational ACID requirements.

Cloud Spanner is the only relational GCP database service providing multi-region external consistency, ANSI SQL compatibility, and five-nines (99.999%) availability.

Traditional relational databases like Cloud SQL do not provide global multi-region horizontal scaling or 99.999% SLAs.

Analyze high-throughput IoT time-series telemetry data requirements.

Cloud Bigtable provides low-latency key-value write throughput suitable for massive IoT streaming datasets and integrates directly with BigQuery.

Relational databases cannot handle massive, continuous single-digit millisecond write loads efficiently without complex sharding.

Analyze mobile JSON document synchronization requirements.

Firestore provides serverless document storage with native client SDKs supporting offline persistence and automatic real-time listener updates.

Relational and object storage engines lack native client state synchronization and offline caching primitives.

Analyze unstructured object storage and tiering requirements.

Cloud Storage is designed for blob objects like media files and logs, supporting automated transition rules between Nearline, Coldline, and Archive classes.

Database services are inefficient and cost-prohibitive for storing raw binary media files.

Key Concept

Matching workload access patterns, consistency requirements, latency expectations, and data structure types to optimal GCP database and storage services.

Estimated Time:2m 0s

Question 1583Question →

A healthcare company provisions isolated staging environments using Terraform running in a dedicated management Virtual Private Cloud (VPC). During an automated deployment pipeline, Terraform provisions a private Google Kubernetes Engine (GKE) cluster in a target workload VPC. The cluster creation succeeds, but subsequent Terraform steps fail when attempting to deploy cluster workloads because the Terraform runner cannot communicate with the GKE control plane. Which architectural modification should the team implement to resolve this provisioning issue while adhering to Google Cloud security and reliability best practices?

Configure GKE Control Plane Authorized Networks to include the IP range of the management VPC runner subnet and ensure VPC peering or Authorized Network connectivity allows internal access to the private control plane endpoint.

Disable the private control plane endpoint and grant the Primitive Owner role to the pipeline service account so it can bypass cluster endpoint restrictions.

Peer the management VPC to an intermediate transit VPC that is already peered with the cluster VPC, relying on network transitivity for control plane reachability.

Grant the Service Account Admin role to the pipeline service account to allow dynamic generation and injection of service account keys during provisioning.

Show answer & explanation

Answer: Configure GKE Control Plane Authorized Networks to include the IP range of the management VPC runner subnet and ensure VPC peering or Authorized Network connectivity allows internal access to the private control plane endpoint.

Answer

Configure GKE Control Plane Authorized Networks to explicitly allow the management subnet CIDR containing the Infrastructure as Code runner, ensuring secure internal network access to the private master endpoint.

The correct answer addresses private GKE cluster accessibility during automated environment provisioning. Private cluster control planes drop traffic unless the source network is explicitly authorized. Adding the management VPC runner subnet CIDR to Control Plane Authorized Networks establishes secure internal connectivity needed for automated Terraform apply steps.

Step-by-Step Solution

Identify the cause of cluster provisioning failure

The Terraform runner cannot communicate with the private GKE control plane because the master endpoint blocks unauthorized source IP ranges by default.

Private GKE cluster control planes restrict access to authorized network ranges and internal endpoints.

Evaluate network routing and access controls

VPC Network Peering is non-transitive, meaning intermediate VPC hops will not route traffic to the control plane, while public endpoint exposure violates security posture.

GCP networking rules strictly prevent transitive peering and mandate least-privilege network access.

Authorize the runner subnet CIDR range

The IaC pipeline successfully reaches the cluster API server over internal routing to complete workload deployment steps.

Adding the runner's subnet CIDR to Control Plane Authorized Networks grants legitimate, secure deployment access.

Key Concept

Private GKE Cluster Control Plane Connectivity and IaC Provisioning

Question 1584Question →

A global financial payment processor is connecting its on-premises transactional ledger database to a Google Cloud Virtual Private Cloud (VPC) hosting analytical microservices. The connection requires low-latency, a guaranteed minimum capacity of 12 Gbps, and an SLA of 99.99% availability. Which hybrid connectivity architecture should the Cloud Architect recommend?

Provision four Dedicated Interconnect connections distributed across two separate locations (metropolitan areas) and two edge availability domains per location, paired with Cloud Routers running BGP.

Deploy dual HA VPN gateways with four active IPsec tunnels using Cloud Router BGP dynamic routing to aggregate bandwidth up to 12 Gbps.

Establish a VPC Network Peering connection directly between the on-premises network gateway and the Google Cloud VPC network with dynamic route exchange.

Provision a single 100 Gbps Partner Interconnect connection using an HA VPN tunnel as a secondary backup path to satisfy the 99.99% SLA.

Show answer & explanation

Answer: Provision four Dedicated Interconnect connections distributed across two separate locations (metropolitan areas) and two edge availability domains per location, paired with Cloud Routers running BGP.

Answer

Provision four Dedicated Interconnect connections distributed across two separate locations (metropolitan areas) and two edge availability domains per location, paired with Cloud Routers running BGP.

For mission-critical applications requiring 99.99% availability and continuous bandwidth exceeding 10 Gbps, Google Cloud specifies a topology consisting of four Dedicated Interconnect circuits across two different locations (metropolitan areas) and two edge availability domains per location. Dynamic BGP routing managed by Cloud Routers allows automatic traffic rerouting during domain or facility outages.

Step-by-Step Solution

Analyze hybrid connectivity throughput and SLA constraints.

The requirement specifies 12 Gbps capacity, low latency, and a 99.99% availability SLA.

Bandwidth requirements exceeding 10 Gbps combined with strict 99.99% uptime rule out standard Cloud VPN and single-location interconnect configurations.

Evaluate Google Cloud topology requirements for 99.99% availability.

99.99% availability for Dedicated Interconnect requires 2 connections in location 1 (EAD 1 & 2) and 2 connections in location 2 (EAD 1 & 2).

This redundant design ensures fault tolerance against edge availability domain failures and entire metropolitan area outages.

Select the option that configures multi-location redundant Dedicated Interconnect connections with Cloud Router BGP.

The architecture using four Dedicated Interconnect circuits across two locations satisfies both the 12 Gbps bandwidth requirement and the 99.99% SLA.

This topology is the official Google Cloud recommended blueprint for production-critical hybrid infrastructure requiring maximum availability.

Key Concept

99.99% High Availability Topology for Dedicated Interconnect

Estimated Time:1m 30s

Question 1585Question →

A digital media enterprise is architecting a new real-time content recommendation service on Google Cloud. The service processes lightweight, stateless HTTP REST requests that experience erratic traffic patterns and must scale down to zero instances during off-peak hours to minimize operational overhead and baseline compute costs. Additionally, the service must reliably connect to an on-premises media archive with a continuous bandwidth requirement of $15\text{ Gbps}$ and a $99.99\%$ high availability SLA. Which architecture should you deploy to meet these technical and availability requirements?

Deploy the application on Cloud Run integrated with a Serverless VPC Access connector, and establish Dedicated Interconnect with 99.99% availability using dual interconnect attachments across two distinct metro locations.

Deploy the application on a regional Google Kubernetes Engine (GKE) cluster with autoscaling node pools, and establish an HA VPN gateway with dual active-active IPsec tunnels to the on-premises network.

Deploy the application on Cloud Run in a service VPC, and use VPC Network Peering to route traffic through a central hub VPC that connects to on-premises via a single Dedicated Interconnect link.

Deploy the application back-end using Cloud Spanner instances across three zones, and configure Cloud VPN over the public internet to synchronize on-premises assets.

Show answer & explanation

Answer: Deploy the application on Cloud Run integrated with a Serverless VPC Access connector, and establish Dedicated Interconnect with 99.99% availability using dual interconnect attachments across two distinct metro locations.

Answer

Cloud Run is the ideal serverless compute platform for stateless microservices that require scaling down to zero during idle periods. Combining Cloud Run with a Serverless VPC Access connector allows compute instances to reach internal VPC resources. To meet the 15 Gbps bandwidth demand and 99.99% SLA requirement, Dedicated Interconnect with dual connections across two distinct metro locations is the required Google Cloud reference architecture.

Step-by-Step Solution

Evaluate compute options for stateless HTTP microservices requiring zero-scaling.

Cloud Run is the optimal platform because it natively scales down to zero instances when traffic drops to zero, avoiding baseline cluster management overhead associated with GKE.

Choosing GKE for simple stateless microservices introduces unneeded administrative complexity and persistent node costs.

Analyze hybrid network connectivity throughput and availability SLA requirements.

Sustained bandwidth of 15 Gbps exceeds HA VPN tunnel limits (~3 Gbps per tunnel), necessitating Dedicated Interconnect.

Dedicated Interconnect supports 10 Gbps or 100 Gbps physical circuits.

Formulate 99.99% SLA topology for Dedicated Interconnect.

Configure dual interconnect attachments connected to redundant Cloud Routers across two separate metro locations (edge availability domains).

Google Cloud requires dual metro connections to grant a 99.99% availability SLA for Dedicated Interconnect.

Key Concept

Designing High-Availability Hybrid Architectures with Serverless Compute and Dedicated Interconnect

Question 1586Question →

A financial technology firm is architecting a regional payment processing application on Google Cloud. The system requires high availability across multiple availability zones within a single GCP region, an Recovery Time Objective (RTO) of under 1 minute, and zero data loss (RPO = 0) for relational transactions. The architecture consists of a stateless HTTP API microservice tier and a relational database tier. The operational team wants to minimize cluster infrastructure management while preventing cascading service outages caused by transient database latency. Which TWO architectural strategies should you implement to fulfill these technical requirements?

Select all that apply

Deploy the stateless HTTP microservices on Cloud Run to achieve automatic multi-zone high availability with zero cluster management overhead.

Configure the load balancer health check probe to target a shallow application endpoint that verifies local process responsiveness without querying downstream database dependencies.

Provision a multi-zone Google Kubernetes Engine (GKE) Enterprise cluster to host the stateless microservice endpoints.

Deploy a multi-region Cloud Spanner instance as the database storage engine for standard regional ACID transaction requirements.

Configure load balancer health check probes to execute a full database read query to guarantee end-to-end database connectivity before routing traffic.

Show answer & explanation

Answer: Deploy the stateless HTTP microservices on Cloud Run to achieve automatic multi-zone high availability with zero cluster management overhead.; Configure the load balancer health check probe to target a shallow application endpoint that verifies local process responsiveness without querying downstream database dependencies.

Answer

The correct strategies are deploying the stateless HTTP microservices to Cloud Run for fully managed multi-zone scalability without cluster operational burden, and using shallow load balancer health checks targeting local process health rather than downstream database dependencies.

Deploying stateless microservices to Cloud Run ensures built-in multi-zone high availability and zero infrastructure management. Utilizing a shallow health check probe isolates application instance availability from downstream database latency, protecting the service tier against cascading failures.

Step-by-Step Solution

Select compute architecture based on operational requirements and service statelessness.

Cloud Run is selected because it delivers multi-zone serverless execution for stateless HTTP APIs without infrastructure management overhead.

GKE adds unnecessary cluster management overhead for simple stateless web microservices.

Design load balancer health check policy to avoid cascading failures.

A shallow health check endpoint (such as `/healthz`) is selected.

Deep health checks that hit backend databases mark compute nodes unhealthy during database latency spikes, causing cascading instance removals.

Key Concept

Designing High-Availability Regional Architectures and Health Checking Policies

Question 1587Question →

A streaming media platform uses Terraform within automated Cloud Build pipelines to provision short-lived staging environments. During high-frequency deployment periods, multiple pipeline runs targeting the same Google Cloud Storage remote backend fail because concurrent execution attempts cause state file conflicts and partial environment provisioning. Which configuration should the DevOps team implement to ensure state locking and state recovery for reliable environment provisioning?

Configure the Terraform backend using the standard Google Cloud Storage (gcs) backend type and enable Object Versioning on the Cloud Storage bucket.

Store state files locally within the Cloud Build build container workspace and run a post-build script using gsutil rsync to push state files to storage.

Assign the IAM Owner primitive role to the Cloud Build service account to allow it to override concurrent state locks dynamically.

Establish a VPC Network Peering connection between Cloud Build execution networks to route state traffic transitively without using Cloud Storage API locks.

Show answer & explanation

Answer: Configure the Terraform backend using the standard Google Cloud Storage (gcs) backend type and enable Object Versioning on the Cloud Storage bucket.

Answer

Configure the Terraform backend using the standard Google Cloud Storage (gcs) backend type and enable Object Versioning on the Cloud Storage bucket.

The standard Google Cloud Storage (gcs) backend for Terraform natively supports state locking by utilizing GCS object generation and metageneration preconditions. When combined with GCS Object Versioning, state files are protected against concurrent modifications and accidental corruption during automated CI/CD environment deployments.

Step-by-Step Solution

Identify the root cause of concurrent environment provisioning failures in IaC pipelines.

Concurrent pipeline runs collide when writing to the remote state file without proper state locking mechanisms.

Terraform state integrity requires exclusive lock acquisition during modifications to prevent race conditions and partial state updates.

Select the native Google Cloud API mechanism for state management in GCP.

The standard gcs backend type leverages Cloud Storage strong consistency and built-in object lock capabilities automatically.

Google Cloud Storage natively handles atomic operations and generation-based locking for Terraform state operations.

Implement state safety and recovery best practices.

Enabling Cloud Storage Object Versioning ensures previous versions of the state file are retained.

Object Versioning protects against unintended state file corruption or manual execution drift, allowing rapid rollback if needed.

Key Concept

Terraform State Locking and Remote State Management on Google Cloud Storage

Question 1588Question →

A global retail bank is modernizing its core payment authorization service on Google Cloud. The application requires multi-region high availability with an uptime SLA of 99.999%, zero Recovery Point Objective ( $RPO = 0$ ) for transactional ledger data, and low-latency microservice handling. Additionally, the system must establish a sustained 8 Gbps hybrid connection to an on-premises mainframe environment with enterprise SLA guarantees. Which TWO architectural decisions should you recommend to meet these technical requirements? (Select TWO)

Select all that apply

Deploy the transactional ledger database on Cloud Spanner configured with a multi-region instance deployment across primary and secondary regions.

Provision a Dedicated Interconnect topology with redundant 10 Gbps VLAN attachments provisioned across separate metro edge locations.

Configure an HA Cloud VPN gateway with four aggregated 3 Gbps Cloud VPN IPsec tunnels per region to handle cross-premises network traffic.

Configure the internal application load balancer health check probes to execute a SQL database query on every check interval to verify downstream dependency health.

Autoscale the microservice compute tier using Compute Engine managed instance groups (MIGs) driven strictly by a target CPU utilization threshold of 80%.

Show answer & explanation

Answer: Deploy the transactional ledger database on Cloud Spanner configured with a multi-region instance deployment across primary and secondary regions.; Provision a Dedicated Interconnect topology with redundant 10 Gbps VLAN attachments provisioned across separate metro edge locations.

Answer

The architect must deploy Cloud Spanner using a multi-region instance configuration to guarantee

RPO = 0

and 99.999% availability, and establish a Dedicated Interconnect connection with 10 Gbps VLAN attachments to support sustained 8 Gbps hybrid network traffic with SLA guarantees.

Selecting Cloud Spanner with a multi-region configuration meets the strict 99.999% SLA uptime requirement and guarantees synchronous multi-region replication with

RPO = 0

. Selecting Dedicated Interconnect with 10 Gbps VLAN attachments provides the required physical bandwidth capacity and SLA needed for sustained 8 Gbps cross-premises data transfer.

Step-by-Step Solution

Evaluate storage tier high availability and RPO requirements

Cloud Spanner multi-region deployment is selected because it uses Paxos-based synchronous replication to deliver 99.999% availability and zero RPO for transactional data across regional boundaries.

Standard regional Cloud SQL instances offer up to 99.95% SLA and failover latency, failing the multi-region 99.999% SLA and

RPO = 0

requirement.

Evaluate hybrid network bandwidth and SLA requirements

Dedicated Interconnect with redundant 10 Gbps links is selected because it provides dedicated physical infrastructure capability for sustained 8 Gbps traffic.

Cloud VPN is limited to 3 Gbps per tunnel and is unsuited for sustained 8 Gbps enterprise workloads requiring strict SLAs.

Review operational stability and autoscaling design choices

Avoid deep dependency health checks and CPU-only autoscaling to prevent cascading failures and scaling bottlenecks under I/O load.

Shallow health checks isolate backend instance health from database state, avoiding widespread un-healthy node removals.

Key Concept

Designing High-Availability Multi-Region Architectures and Dedicated Hybrid Connectivity

Question 1589Question →

A telecommunications enterprise is designing a hybrid network topology to connect its on-premises data centers and remote operational facilities to Google Cloud. Match each GCP hybrid connectivity technology on the left to its corresponding architectural scenario requirement on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Dedicated Interconnect matches direct physical circuits (10/100 Gbps). Partner Interconnect matches service-provider backed connectivity under 10 Gbps. HA VPN matches encrypted IPsec tunnels over the public internet with 99.99% availability. Cloud Router matches dynamic BGP route exchange.

Each technology is paired correctly based on key Google Cloud network architecture specifications: Dedicated Interconnect provides 10/100 Gbps direct connections; Partner Interconnect offers provider-assisted sub-10 Gbps links; HA VPN provides encrypted 99.99% SLA IPsec tunnels over the public internet; and Cloud Router handles dynamic BGP route exchanges.

Step-by-Step Solution

Analyze high-bandwidth direct physical requirements

Dedicated Interconnect is required for direct 10 Gbps or 100 Gbps physical circuits without third-party service provider mediation.

Dedicated Interconnect directly links your enterprise network to a Google Colocation facility.

Analyze service provider hybrid connectivity needs below 10 Gbps

Partner Interconnect maps to sub-10 Gbps connectivity provided via supported service providers.

Partner Interconnect extends connectivity to locations where dedicated Google points of presence are unavailable or bandwidth needs are smaller.

Identify secure encrypted transport options over public internet

HA VPN matches IPsec encrypted transport delivering up to 3 Gbps per gateway with 99.99% SLA.

HA VPN provides high-availability IPsec tunnels using BGP dynamic routing without requiring private circuit installation.

Determine dynamic routing component

Cloud Router provides dynamic routing using Border Gateway Protocol (BGP).

Cloud Router manages dynamic route exchange between GCP VPCs and on-premises networks across Interconnects or VPNs.

Key Concept

Selecting and combining Google Cloud hybrid connectivity options (Dedicated Interconnect, Partner Interconnect, HA VPN, and Cloud Router) based on enterprise bandwidth, encryption, SLA, and routing requirements.

Question 1590Question →

A global logistics provider is architecting the storage layer for a real-time fleet telematics and dynamic routing platform on Google Cloud. The system must fulfill three distinct operational requirements:

1. High-throughput, low-latency ingest of time-series GPS and vehicle telemetry ( $100,000+$ writes per second) with access patterns focused on vehicle ID and timestamp range queries.
2. A relational datastore for operational vehicle inventory, driver assignments, and active route state requiring single-region strong ACID transactions and standard SQL compliance.
3. Cost-effective long-term archiving of raw trip logs that are accessed infrequently for annual compliance audits, with automated transitions to cold storage after 30 days.

Which combination of Google Cloud storage and database services should the solution architect recommend to meet all technical requirements while minimizing cost and operational overhead?

Cloud Bigtable for time-series vehicle telemetry, Cloud SQL for operational relational fleet data, and Cloud Storage with Object Lifecycle Management for trip log archiving.

Cloud Bigtable for time-series vehicle telemetry, Cloud Spanner for operational relational fleet data, and Cloud Storage with Object Lifecycle Management for trip log archiving.

Cloud Bigtable for time-series vehicle telemetry, Cloud SQL with Customer-Supplied Encryption Keys (CSEK) for operational relational fleet data, and Storage Transfer Service with Transfer Appliance for automated 30-day cold archiving.

Cloud Bigtable for time-series vehicle telemetry, Cloud SQL using Customer-Supplied Encryption Keys (CSEK) managed in Cloud KMS for operational relational fleet data, and Cloud Storage for trip log archiving.

Show answer & explanation

Answer: Cloud Bigtable for time-series vehicle telemetry, Cloud SQL for operational relational fleet data, and Cloud Storage with Object Lifecycle Management for trip log archiving.

Answer

The optimal architecture combines Cloud Bigtable for high-throughput time-series telemetry ingest, Cloud SQL for single-region relational operational fleet data, and Cloud Storage with Object Lifecycle Management for automated cold archiving of historical logs.

The combination of Cloud Bigtable, Cloud SQL, and Cloud Storage with Object Lifecycle Management precisely aligns each workload requirement with its optimal GCP storage service while minimizing cost and operational complexity. Cloud Bigtable excels at high-speed time-series ingestion; Cloud SQL provides robust single-region relational ACID capabilities; and Cloud Storage lifecycle rules automate cost-optimized log archiving.

Step-by-Step Solution

Analyze requirement 1: High-throughput write telemetry ($100k+ writes/sec) with time-series queries.

Identify Cloud Bigtable as the ideal service for high-write-volume NoSQL time-series data indexed by composite row keys (Vehicle ID + Timestamp).

Cloud Bigtable scales linearly for massive write ingestion and low-latency key-range lookups.

Analyze requirement 2: Relational operational data requiring single-region strong ACID compliance.

Select Cloud SQL (PostgreSQL/MySQL) over Cloud Spanner.

Cloud SQL satisfies single-region relational ACID requirements cost-effectively, whereas Cloud Spanner is intended for globally distributed horizontal scaling.

Analyze requirement 3: Long-term unstructured log archiving with automated 30-day transition to cold storage.

Choose Cloud Storage with Object Lifecycle Management policies.

Lifecycle rules natively automate class transitions (e.g., Standard to Nearline/Coldline/Archive) based on object age without operational intervention.

Key Concept

Mapping multi-component application data patterns (high-throughput time-series, single-region relational transactional, and cold blob archiving) to native GCP storage services.

Estimated Time:2m 0s

Question 1591Question →

A global gaming studio is architecting the cloud backend for a online multiplayer platform on Google Cloud. The architecture must maintain high availability with a target availability of 99.99%. The platform requires continuous high-throughput hybrid connectivity of 15 Gbps between on-premises data centers and GCP. Additionally, the web service tier must automatically scale to handle unpredictable traffic spikes without risking cascading failures from backend database health dependency checks. Which TWO architectural options should you select to meet these technical and availability requirements?

Select all that apply

Provision Dedicated Interconnect circuits with redundant VLAN attachments across two distinct edge availability domains.

Establish HA Cloud VPN tunnels in an active-active routing configuration using BGP over public internet links.

Configure load balancer health checks to query deep diagnostic endpoints that validate end-to-end database connectivity and query execution.

Configure load balancer health checks to query shallow HTTP endpoints dedicated strictly to assessing web instance web server process health.

Configure backend autoscaling policies based exclusively on average CPU utilization targets across instance groups.

Show answer & explanation

Answer: Provision Dedicated Interconnect circuits with redundant VLAN attachments across two distinct edge availability domains.; Configure load balancer health checks to query shallow HTTP endpoints dedicated strictly to assessing web instance web server process health.

Answer

The correct architecture requires provisioning Dedicated Interconnect across two edge availability domains to satisfy the 15 Gbps throughput requirement at 99.99% SLA, and using shallow load balancer health checks targeting instance web server responsiveness to prevent cascading failures.

Dedicated Interconnect configured across two distinct edge availability domains provides the necessary physical bandwidth for 15 Gbps while satisfying Google Cloud's 99.99% SLA topology. Additionally, shallow health checks ensure load balancers accurately monitor web application availability without causing fleet-wide cascading dropouts caused by backend database congestion.

Step-by-Step Solution

Analyze bandwidth and SLA constraints for hybrid connectivity.

Requirements specify continuous 15 Gbps throughput and 99.99% availability. HA Cloud VPN per-tunnel limits (3 Gbps) are insufficient, making Dedicated Interconnect with dual edge availability domains mandatory.

Dedicated Interconnect is designed for high-capacity hybrid throughput (>3 Gbps per tunnel) with enterprise availability SLAs.

Evaluate load balancing health check strategy for service availability.

Selecting shallow health checks isolates instance health from backend database dependency degradation.

Deep health checks cause instances to be marked unhealthy when database latency surges, exacerbating outages by cycling healthy compute capacity.

Key Concept

High Availability Hybrid Connectivity and Resilient Load Balancer Health Checking

Question 1592Question →

A biomedical telemetry organization is establishing hybrid network connectivity between its on-premises data center and Google Cloud. The target Google Cloud environment consists of a central Hub VPC peered via VPC Network Peering to two isolated Spoke VPCs (Analytics VPC and Patient Records VPC). The on-premises network requires a secure, encrypted connection to Google Cloud carrying a steady 2 Gbps of telemetry data. Additionally, on-premises diagnostic workloads must communicate directly with services hosted inside both Spoke VPCs. Which TWO network architecture decisions must you implement to satisfy these technical and routing requirements? (Select TWO)

Select all that apply

Deploy an HA VPN gateway with dual active-active IPSec tunnels and Cloud Router dynamic BGP routing in the central Hub VPC.

Establish dedicated HA VPN connections from the on-premises data center to each Spoke VPC individually.

Enable custom route exports on the Hub VPC peering configurations to transitively route on-premises BGP traffic to the Spoke VPCs.

Deploy a Classic VPN gateway with static routes, because dynamic BGP routing over Cloud Router limits encrypted tunnel bandwidth to below 1 Gbps.

Show answer & explanation

Answer: Deploy an HA VPN gateway with dual active-active IPSec tunnels and Cloud Router dynamic BGP routing in the central Hub VPC.; Establish dedicated HA VPN connections from the on-premises data center to each Spoke VPC individually.

Answer

Deploy an HA VPN gateway with dual active-active IPSec tunnels and Cloud Router dynamic BGP routing in the central Hub VPC, and establish dedicated HA VPN connections from the on-premises data center to each Spoke VPC individually.

To satisfy a 2 Gbps encrypted connectivity requirement with high availability, establishing an HA VPN gateway with active-active IPSec tunnels and Cloud Router dynamic BGP routing in the Hub VPC is essential. Furthermore, because GCP VPC Network Peering is non-transitive, on-premises networks cannot reach peered Spoke VPCs through the Hub VPC; establishing direct HA VPN connections to each Spoke VPC ensures full connectivity.

Step-by-Step Solution

Evaluate throughput and encryption requirements for hybrid connectivity.

The requirement calls for 2 Gbps encrypted throughput. A single HA VPN tunnel supports up to 3 Gbps, and active-active configuration provides topology redundancy with a 99.99% SLA.

HA VPN with Cloud Router handles dynamic BGP routing and satisfies both security and SLA targets.

Analyze transitive routing boundaries across VPC Network Peering.

VPC Network Peering does not support transitive routing. Traffic arriving from an on-premises VPN tunnel into the Hub VPC cannot be routed over the peering link into Spoke VPCs.

Direct hybrid connectivity (or gateway proxies/Network Connectivity Center) must be deployed to reach the Spoke VPCs directly from on-premises.

Key Concept

VPC Peering Non-Transitivity and HA VPN Architecture

Question 1593Question →

A software company uses Cloud Build and Terraform to automate the provisioning of ephemeral testing environments in Google Cloud. During parallel build executions, the team occasionally experiences deployment race conditions and unauthorized IAM privilege escalation risks. You need to implement infrastructure as code (IaC) governance practices to ensure reliable provisioning and secure state management. Which TWO actions should you take? (Select TWO answers.)

Select all that apply

Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking enabled.

Grant the Cloud Build service account targeted predefined roles and the Service Account User role on required deployment service accounts.

Store Terraform state files on the local ephemeral disk of the Cloud Build execution runner to maximize state write speeds.

Assign the Owner primitive IAM role to the Cloud Build service account to ensure uninhibited provisioning of all cloud resources.

Show answer & explanation

Answer: Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking enabled.; Grant the Cloud Build service account targeted predefined roles and the Service Account User role on required deployment service accounts.

Answer

Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking, and grant the Cloud Build service account targeted predefined roles along with the Service Account User role.

Configuring a Google Cloud Storage remote backend with state locking ensures that concurrent automated workflows safely mutate infrastructure state without causing state file corruption or deployment race conditions. Furthermore, granting targeted predefined roles and the Service Account User role to the Cloud Build runner enforces the principle of least privilege while allowing legitimate resource provisioning through service account impersonation.

Step-by-Step Solution

Evaluate remote state storage requirements for reliable pipeline execution.

Identified Google Cloud Storage as a remote backend supporting state locking and versioning to prevent race conditions.

Storing state centrally with locking ensures parallel pipelines do not corrupt environment states.

Evaluate IAM permissions for the CI/CD pipeline service account.

Selected fine-grained predefined roles and Service Account User role for service account impersonation.

Ensures least privilege security compliance while granting necessary deployment rights.

Key Concept

Reliable Infrastructure as Code Environment Provisioning

Estimated Time:2m 0s

Question 1594Question →

A regional European gaming studio is designing the persistent database backend for an online multiplayer game's player profile and inventory management system. The database must run in a single Google Cloud region (europe-west3), support strict ACID transactional consistency, provide automated regional failover across multiple availability zones, and handle up to 15,000 IOPS during peak events. The team wants to avoid unnecessary architectural complexity and operational cost. Which storage and database architecture should you recommend to meet these requirements?

Deploy a Cloud SQL for PostgreSQL instance with High Availability (HA) enabled across primary and standby zones within the region.

Provision a multi-region Cloud Spanner instance with global replication to handle all transactional inventory operations.

Use a Google Cloud Transfer Appliance cluster connected to Cloud Storage to handle real-time transactional reads and writes.

Configure a Cloud Bigtable cluster utilizing Customer-Supplied Encryption Keys (CSEK) to maintain strict transactional consistency across player profiles.

Show answer & explanation

Answer: Deploy a Cloud SQL for PostgreSQL instance with High Availability (HA) enabled across primary and standby zones within the region.

Answer

The recommended solution is deploying a Cloud SQL for PostgreSQL instance configured for High Availability (HA) within the single target region.

Deploying Cloud SQL for PostgreSQL with High Availability (HA) is the optimal choice. Cloud SQL provides native relational database capabilities with ACID compliance, and its HA option automatically replicates data synchronously to a standby instance in a secondary zone within the same region (europe-west3), ensuring quick failover while keeping costs and operational overhead aligned with single-region requirements.

Step-by-Step Solution

Analyze the functional database requirements

The application requires ACID compliance for player profiles and inventory, single-region deployment in europe-west3, and high availability across zones.

Relational data modeling with transactional guarantees is required for monetary or inventory operations.

Evaluate GCP database services based on scale and region constraints

Cloud SQL satisfies single-region relational database requirements cost-effectively. Cloud Spanner is intended for globally distributed workloads requiring cross-region consistency.

Choosing Spanner for a single-region deployment incurs unnecessary cost and architectural complexity.

Verify high availability configuration

Enabling High Availability (HA) on Cloud SQL provisions a synchronous standby instance in a second zone within the same region, providing automatic failover.

This satisfies the multi-zone availability requirement without requiring cross-region infrastructure.

Key Concept

Selecting Cloud SQL versus Cloud Spanner for regional relational database workloads.

Question 1595Question →

An international airline is designing the infrastructure for a microservice-based seat reservation API on Google Cloud. The architecture must handle unpredictable traffic spikes, maintain 99.99% availability, eliminate operational overhead associated with container cluster management, and support globally synchronous database transactions across multiple GCP regions with zero Recovery Point Objective (RPO). Which architecture best meets these technical and high-availability requirements?

Deploy the API on Cloud Run across multiple regions behind a Global External HTTP(S) Load Balancer, and store reservation data in a multi-region Cloud Spanner instance.

Deploy the API on GKE (Google Kubernetes Engine) Autopilot clusters in multiple regions behind a Global External HTTP(S) Load Balancer, and store reservation data in a multi-region Cloud Spanner instance.

Deploy the API on Cloud Run across multiple regions behind a Global External HTTP(S) Load Balancer, and store reservation data in a regional Cloud SQL for PostgreSQL instance with High Availability enabled.

Deploy the API on Compute Engine Managed Instance Groups (MIGs) across multiple regions using HA Cloud VPN to synchronize transactions with an on-premises database.

Show answer & explanation

Answer: Deploy the API on Cloud Run across multiple regions behind a Global External HTTP(S) Load Balancer, and store reservation data in a multi-region Cloud Spanner instance.

Answer

Deploying the microservice API on Cloud Run across multiple regions behind a Global External HTTP(S) Load Balancer, paired with a multi-region Cloud Spanner instance for database storage.

Cloud Run is a fully managed serverless platform for containerized stateless applications that scales automatically and eliminates container cluster administration. Fronted by a Global External HTTP(S) Load Balancer, incoming requests are efficiently distributed to regional Cloud Run instances. Cloud Spanner with a multi-region deployment configuration delivers external consistency and multi-region synchronous replication with zero RPO, satisfying strict transactional reservation requirements.

Step-by-Step Solution

Evaluate compute requirement for zero cluster management overhead and serverless scaling

Cloud Run allows deploying stateless containerized APIs without managing GKE clusters or Compute Engine virtual machines.

The requirement explicitly states that operational overhead from container cluster management must be eliminated.

Evaluate database requirement for multi-region zero-RPO synchronous consistency

Cloud Spanner configured across multiple regions uses Paxos consensus to provide strong consistency and synchronous multi-region replication.

Cloud SQL is limited to single-region regional HA, whereas Cloud Spanner natively supports multi-region zero-RPO transactional consistency.

Combine compute and database components with global traffic routing

Global External HTTP(S) Load Balancer routes client requests to the nearest healthy Cloud Run region, which queries the multi-region Cloud Spanner backend.

This combination ensures high availability (99.99% stem target) and low latency worldwide.

Key Concept

Designing multi-region high-availability cloud architectures combining serverless compute and globally consistent relational databases.

Question 1596Question →

An enterprise audit software provider is designing the storage tier for a new compliance tracking application. The application operates entirely within a single GCP region and requires a fully managed relational database with strict ACID transaction guarantees, standard SQL query support, and automatic regional failover for high availability. The workload is projected at 1,200 write transactions per second during peak hours. Which database resource selection best satisfies these requirements while minimizing cost and architectural complexity?

Cloud SQL for PostgreSQL deployed with regional High Availability (HA) enabled

Cloud Spanner deployed with a single-region instance configuration

Cloud SQL for PostgreSQL configured with Customer-Supplied Encryption Keys (CSEK)

Cloud Storage bucket using Storage Transfer Service for real-time transaction ingestion

Show answer & explanation

Answer: Cloud SQL for PostgreSQL deployed with regional High Availability (HA) enabled

Answer

Cloud SQL for PostgreSQL deployed with regional High Availability (HA) enabled

Cloud SQL for PostgreSQL with regional High Availability (HA) provides a fully managed ACID-compliant relational database with automatic cross-zone failover within a single region. It easily handles moderate throughput requirements while optimizing costs and architectural simplicity.

Step-by-Step Solution

Analyze technical and operational constraints

The target workload requires a single-region relational database with full ACID compliance, standard SQL interface, high availability across zones, and modest throughput (1,200 TPS).

Identifying the scope (single region) and data model (relational SQL) narrows down GCP database options.

Compare database services for single-region relational workloads

Cloud SQL is optimized for single-region relational databases. Cloud Spanner is engineered for multi-region global distribution and massive horizontal scaling, making it cost-prohibitive for standard single-region needs.

Matching workload scale to resource capabilities ensures cost-effective architecture.

Verify high availability configuration

Enabling regional HA on Cloud SQL provisions a primary and standby database instance across distinct zones with automatic synchronous replication and failover.

This directly fulfills the high availability requirement without requiring complex multi-master replication.

Key Concept

Selecting Cloud SQL vs. Cloud Spanner based on regional scope, throughput requirements, and cost efficiency

Question 1597Question →

Match each enterprise application storage requirement to the most appropriate Google Cloud database or storage service based on data access patterns, scalability, and structural requirements.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The requirement for real-time NoSQL key-value caching matches Cloud Bigtable; global ACID relational transactions match Cloud Spanner; petabyte-scale serverless SQL analytics matches BigQuery; and regulatory object archival matches Cloud Storage.

Each Google Cloud database and storage offering aligns with specific access patterns and architectural demands: Cloud Bigtable serves high-speed NoSQL key-value patterns; Cloud Spanner handles global ACID relational workloads; BigQuery executes serverless analytical OLAP queries; Cloud Storage manages unstructured object files with WORM regulatory capabilities.

Step-by-Step Solution

Analyze high-throughput NoSQL key-value caching access patterns.

Identify Cloud Bigtable as the optimal service for ultra-low latency NoSQL key-value workloads.

Cloud Bigtable scales seamlessly to handle massive write/read throughput with single-digit millisecond latencies.

Evaluate global transactional relational consistency requirements.

Identify Cloud Spanner as the correct choice for multi-region relational ACID transactions.

Cloud Spanner combines traditional relational schema support and ACID guarantees with global horizontal scalability.

Examine large-scale analytical query requirements.

Identify BigQuery as the appropriate serverless data warehouse.

BigQuery is designed to execute fast SQL queries over petabytes of structured or semi-structured analytical data.

Determine compliance object storage requirements.

Identify Cloud Storage with Bucket Lock features.

Cloud Storage provides durable unstructured object store functionality and legal hold/retention policy compliance.

Key Concept

Selecting and Designing Storage and Database Resources in Google Cloud

Question 1598Question →

Match each application data access pattern on the left with the most appropriate Google Cloud database or storage service on the right based on GCP architectural best practices.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Large binary media files with lifecycle rules match Cloud Storage. High-throughput time-series IoT metrics match Cloud Bigtable. Financial ledger transactions needing multi-region ACID consistency match Cloud Spanner. Mobile app user preferences with offline sync match Firestore.

Each requirement directly aligns with key capabilities of GCP database offerings: Cloud Storage for object lifecycle management; Cloud Bigtable for high-scale time-series ingestion; Cloud Spanner for global ACID relational workloads; and Firestore for mobile document syncing with offline support.

Step-by-Step Solution

Analyze storage object structure and access lifecycle for un-structured data requirement.

Unstructured binary objects with lifecycle management requirements uniquely fit Cloud Storage.

Cloud Storage handles unstructured file objects and lifecycle transitions across storage tiers.

Evaluate throughput and latency metrics for time-series IoT workload.

High-velocity streaming data requiring single-digit millisecond latency matches wide-column NoSQL.

Cloud Bigtable provides sub-10ms performance specifically designed for high-throughput time-series analytics.

Assess consistency and scale demands for relational financial transactions.

Multi-region horizontal scalability with ACID compliance requires Cloud Spanner.

Cloud Spanner is the only GCP service offering globally synchronous transactions with SQL capabilities.

Determine mobile app offline synchronization and document storage needs.

Real-time client updates and offline local caching match Firestore.

Firestore client libraries natively handle offline state persistence and dynamic real-time data sync.

Key Concept

GCP Storage and Database Resource Selection Criteria

PreviousPage 80 / 80

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes