Examkin

All practice questions

537 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 1Question →

A financial services organization is modernizing its transaction reconciliation architecture on Google Cloud. The architecture comprises two core workloads: (1) a stateless, containerized HTTP REST microservice that processes customer requests with highly variable traffic spikes and must scale down to zero instances when idle, and (2) a containerized batch job that processes end-of-day financial reconciliation files, running continuously for approximately 6 hours each night. The organization requires a solution that minimizes operational management overhead and eliminates compute infrastructure costs during idle periods. Which TWO compute platform selections should you recommend to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy the stateless HTTP REST microservice to Cloud Run.; Execute the 6-hour financial reconciliation batch job using Cloud Run Jobs.

Answer

Deploy the stateless HTTP REST microservice to Cloud Run, and execute the 6-hour financial reconciliation batch job using Cloud Run Jobs.
Cloud Run is the optimal platform for stateless containerized microservices requiring low management overhead and scale-to-zero capabilities. For containerized batch processes that run to completion over multiple hours (up to 24 hours), Cloud Run Jobs provides a fully managed execution environment that consumes resources only during active execution.

Step-by-Step Solution

1
Analyze the operational and scaling requirements of the stateless microservice
Requirement identified for automatic scaling to zero, low management overhead, and HTTP request handling.
Cloud Run provides a fully managed serverless environment that hosts containerized HTTP microservices with zero cluster setup and automatic scale-to-zero capabilities.
2
Analyze the duration and infrastructure lifecycle requirements of the reconciliation task
Requirement identified for a containerized batch job running to completion over a 6-hour window without standing cluster costs.
Cloud Run Jobs executes task containers that run up to 24 hours and automatically cleans up resources upon completion, avoiding persistent compute billing.
3
Evaluate alternative platform choices against operational overhead and cost constraints
Rejected GKE, Compute Engine MIGs, and App Engine due to added management complexity, static baseline infrastructure costs, or execution duration limits.
GKE and Compute Engine introduce unnecessary operational maintenance, while App Engine Standard is tailored for web request handling rather than multi-hour batch runs.

Key Concept

Selecting serverless compute platforms (Cloud Run services for stateless web APIs and Cloud Run Jobs for long-running batch tasks) to minimize operational overhead and idle costs.
Question 2Question →

A healthcare startup plans to migrate its legacy on-premises architecture to Google Cloud. The environment consists of a 15 TB15\text{ TB} PostgreSQL transactional database and 25 TB25\text{ TB} of unstructured medical imaging files stored on an SMB file share. The company has a dedicated 1 Gbps1\text{ Gbps} network connection to GCP. The migration strategy must ensure minimal downtime for the database and direct online ingestion of the image files into Cloud Storage with automated integrity verification. Which TWO architectural solutions should be included in the migration design? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use Database Migration Service (DMS) with continuous CDC replication to migrate the PostgreSQL database to Cloud SQL.; Use Storage Transfer Service for on-premises data transfer to migrate the medical image files directly into Cloud Storage.

Answer

The strategy should incorporate Database Migration Service (DMS) with continuous CDC for the PostgreSQL database and Storage Transfer Service for moving the file share data to Cloud Storage over the available network link.
The correct strategy combines Database Migration Service (DMS) for continuous CDC replication of the PostgreSQL database to Cloud SQL with Storage Transfer Service for streaming on-premises file share data to Cloud Storage. This design meets the requirements of minimal database downtime and online file migration over the 1 Gbps link.

Step-by-Step Solution

1
Evaluate database migration requirements for operational continuity.
Database Migration Service (DMS) provides continuous replication (CDC) from on-premises PostgreSQL to Cloud SQL, enabling minimal cutover downtime.
Offline methods or schema shifts to distributed databases like Cloud Spanner incur significant downtime or unnecessary architecture modifications.
2
Evaluate bandwidth limits for the 25 TB file transfer.
A 25 TB dataset over a 1 Gbps link takes approximately 55 to 60 hours at theoretical full saturation, which easily fits within online transfer windows using Storage Transfer Service.
Storage Transfer Service automates checksum verification and agent-based multi-threaded transfer over existing network lines without needing physical appliance logistics.

Key Concept

Selecting optimal online migration services (DMS and Storage Transfer Service) based on dataset scale, minimal downtime requirements, and network throughput.
Question 3Question →

A Lead Cloud Architect is transitioning an enterprise infrastructure automation platform from Google Cloud Deployment Manager to Terraform within Cloud Build CI/CD pipelines. The new deployment pipeline must support multi-developer concurrent executions without state corruption, maintain recoverable state history, and strictly observe GCP least-privilege identity access controls during resource provisioning. Which TWO configurations must the architect implement to satisfy these security and operational requirements?

Select all that apply

Show answer & explanation

Answer: Configure a remote Google Cloud Storage (GCS) backend for Terraform state files with object versioning enabled.; Grant the Cloud Build service account the roles/iam.serviceAccountUser role on specific target provisioning service accounts.

Answer

The architect must configure a remote Google Cloud Storage backend with object versioning enabled and grant the Cloud Build service account the Service Account User role on fine-grained target provisioning service accounts.
Configuring a Google Cloud Storage backend with object versioning ensures state locking during execution and retains state backup history. Combining this with granting the Service Account User role on specific target service accounts enforces least-privilege impersonation for Cloud Build deployments.

Step-by-Step Solution

1
Analyze Terraform remote state management requirements for enterprise CI/CD workflows.
Identified that native GCS backends provide automatic object locking and object versioning to protect against concurrent modification and state loss.
Remote state backends prevent race conditions when multiple deployment pipelines run simultaneously.
2
Evaluate IAM least-privilege requirements for automated deployment agents.
Determined that Cloud Build service accounts should use service account impersonation by holding the Service Account User role on dedicated target provisioning service accounts.
Impersonation eliminates the need for primitive roles or static long-lived service account keys.

Key Concept

Enterprise Terraform state backend configuration and secure service account impersonation in Google Cloud.
Question 4Question →

A global gaming enterprise is preparing to launch a real-time multiplayer backend hosted on Google Cloud using automated Infrastructure as Code (IaC) pipelines with Terraform. The design requires deploying regional Compute Engine Managed Instance Groups (MIGs) across multiple zones to process high-throughput UDP traffic. To support the upcoming launch of 50,000 concurrent game instances, the deployment automation must prevent state concurrency conflicts, ensure successful automated resource creation without runtime quota rejections, and strictly observe least-privilege security principles. Which TWO architectural and administrative actions should the team perform as part of the initial provisioning strategy?

Select all that apply

Show answer & explanation

Answer: Configure the Terraform deployment pipeline to use a Cloud Storage backend configured with bucket versioning and object state locking enabled.; Submit a request to increase the regional Compute Engine N2 vCPU quota in the target deployment regions prior to triggering the automated provisioning pipeline.

Answer

The correct provisioning strategy requires storing the Terraform state file in a Cloud Storage backend configured with versioning and object locking, and requesting regional Compute Engine vCPU quota increases before initiating the deployment.
Establishing a remote Cloud Storage backend with object versioning and state locking protects the IaC environment from concurrent modification and state file corruption. Concurrently, requesting regional Compute Engine vCPU quota increases prior to triggering large automated deployments ensures that compute provisioning requests succeed without hitting default quota caps.

Step-by-Step Solution

1
Evaluate IaC state management requirements for automated pipelines
Configuring a Cloud Storage remote backend with state locking prevents race conditions and state corruption during concurrent pipeline executions.
Enterprise IaC automation requires centralized, lockable, and version-controlled remote state.
2
Analyze capacity requirements for large-scale compute resource provisioning
Requesting regional vCPU quota increases prior to deployment guarantees that Compute Engine MIG scaling operations will not be blocked by default quota limits.
Default project quotas in GCP often fall below the requirements of large-scale enterprise deployments, leading to runtime resource creation errors if not increased in advance.
3
Audit security and service choices against GCP architectural best practices
Reject primitive IAM roles and excessive administrative grants in favor of targeted roles like Service Account User, and avoid running non-containerized monoliths on GKE.
Adhering to least-privilege security and matching compute platforms to workload types prevents operational and compliance issues.

Key Concept

Provisioning Compute Engine Resources and IaC State Management
Estimated Time:2m 0s
Question 5Question →

A healthcare research organization needs to migrate its core data assets to Google Cloud within a strict 6-week timeframe. The workload consists of 3.5 PB3.5\text{ PB} of static genomic sequence files on an on-premises SAN and an active 15 TB15\text{ TB} transactional PostgreSQL database. The facility has a single 1 Gbps1\text{ Gbps} dedicated internet connection. The migration plan must ensure minimal database downtime with continuous synchronization, and governance rules mandate strict perimeter security controls to prevent data exfiltration to unauthorized external cloud resources. Which TWO architectural strategies should you incorporate into the migration design?

Select all that apply

Show answer & explanation

Answer: Utilize Google Cloud Transfer Appliance devices to perform an offline bulk migration of the 3.5 PB3.5\text{ PB} genomic dataset, and deploy Database Migration Service (DMS) with continuous Change Data Capture (CDC) for the PostgreSQL database.; Configure VPC Service Controls around the target Cloud Storage buckets and database instances to establish a secure perimeter and block unauthorized data movement.

Answer

The correct architecture requires ordering Transfer Appliance devices for the petabyte-scale static dataset while using Database Migration Service with CDC for continuous database replication, combined with VPC Service Controls to prevent perimeter data exfiltration.
Moving 3.5 PB3.5\text{ PB} over a 1 Gbps1\text{ Gbps} network connection is mathematically impossible within 6 weeks, making offline Transfer Appliance devices mandatory for the static storage. Database Migration Service with CDC handles the live PostgreSQL replication. VPC Service Controls provide the required network perimeter boundary to safeguard against exfiltration to outside GCP projects.

Step-by-Step Solution

1
Calculate data transfer throughput for the 3.5 PB3.5\text{ PB} static dataset.
At 1 Gbps1\text{ Gbps}, uploading 3.5 PB3.5\text{ PB} online requires 3.5×1015×8109×86400≈324\frac{3.5 \times 10^{15} \times 8}{10^9 \times 86400} \approx 324 days. This violates the 6-week constraint, necessitating an offline transfer solution like Transfer Appliance.
Petabyte-scale data transfers over constrained WAN links require physical offline hardware appliances.
2
Select database replication mechanism for zero/minimal downtime.
Database Migration Service (DMS) utilizing Change Data Capture (CDC) allows continuous replication of PostgreSQL WAL logs up to the final cutover window.
CDC minimizes operational downtime by allowing live transactional databases to sync continuously.
3
Select perimeter security mechanism to address data exfiltration requirements.
VPC Service Controls form a logical perimeter isolating target Cloud Storage and database resources.
VPC Service Controls prevent data egress to unauthorized GCP projects even if an identity has legitimate IAM read permissions.

Key Concept

Selecting data transfer appliances vs online transfer services based on bandwidth limitations, paired with VPC Service Controls for perimeter exfiltration defense.
Question 6Question →

A healthcare technology company is architecting a medical diagnostics platform on Google Cloud. The system consists of two distinct components: 1) A stateless REST API backend that receives patient request payloads and returns quick diagnostic summaries with highly variable, bursty web traffic, requiring minimal operational management; 2) A batch processing pipeline that runs legacy, uncontainerized diagnostic algorithms relying on custom Linux kernel modules for 3 hours every night. Which TWO compute solutions should you recommend to fulfill these requirements with the lowest operational overhead and optimal cost efficiency? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Deploy the stateless REST API backend onto Cloud Run.; Deploy the batch processing pipeline onto Compute Engine Managed Instance Groups using Spot VMs.

Answer

Select Cloud Run for the stateless REST API backend and Compute Engine Managed Instance Groups using Spot VMs for the legacy batch processing pipeline.
Cloud Run is ideal for stateless REST APIs with bursty traffic because it automatically scales containers and requires zero cluster maintenance. For legacy workloads requiring custom kernel modules and running for short nightly windows, Compute Engine VMs provide the required OS-level access, while Spot VMs and Managed Instance Groups ensure maximum cost efficiency.

Step-by-Step Solution

1
Analyze the stateless REST API requirements
Identified bursty HTTP traffic, stateless architecture, and minimal operational overhead preference.
Cloud Run is the optimal Google Cloud serverless compute platform for stateless containerized web services, scaling to zero when idle.
2
Analyze the legacy batch processing pipeline requirements
Identified dependency on custom Linux kernel modules and a 3-hour nightly execution window.
Serverless container environments (Cloud Run, Cloud Functions) do not permit custom host kernel modules. Compute Engine VMs permit full OS/kernel customization, and using Spot VMs within a Managed Instance Group optimizes costs for scheduled batch runs.

Key Concept

Selecting appropriate compute platforms based on containerization status, kernel/OS customization needs, scaling patterns, and management overhead constraints.
Question 7Question →

An enterprise architecture team is configuring network connectivity between two VPC networks, vpc-analytics and vpc-core, in Google Cloud. They decide to establish VPC Network Peering to allow internal IP address communication across the two networks. Which TWO statements accurately describe the requirements and behavior of VPC Network Peering in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Peering configuration must be created symmetrically in both directions—from vpc-analytics to vpc-core and from vpc-core to vpc-analytics—before communication is fully established.; Exporting and importing custom routes must be explicitly enabled on the peering configurations if custom static or dynamic routes need to be shared across the peered networks.

Answer

VPC Network Peering requires symmetrical peering setup in both directions and explicit configuration of custom route import/export settings to share non-subnet routes.
VPC Network Peering is established only when both VPC networks create a peering request to each other (symmetrical configuration). Additionally, while subnet routes are exchanged automatically upon peering, sharing custom dynamic or static routes across peered VPCs requires explicitly configuring the import and export custom routes flags on both ends.

Step-by-Step Solution

1
Analyze VPC Network Peering setup requirements.
VPC Peering requires both network administrators to establish a peering configuration pairing both VPCs (bidirectional setup).
Peering stays in an inactive state until both VPCs explicitly approve the peering request.
2
Evaluate route propagation rules across peered VPC networks.
Subnet routes are exchanged by default, but custom dynamic and static routes require setting import and export custom route flags.
Cloud Router dynamic routes and static routes are not automatically shared without explicitly enabling custom route exchange.
3
Identify invalid VPC networking assumptions.
Reject transitive routing, lower-bandwidth HA VPN alternatives for intra-cloud high throughput, and relying solely on IAM for perimeter security.
VPC Network Peering is non-transitive, HA VPN has throughput caps per tunnel (3 Gbps), and VPC Service Controls are necessary to prevent data exfiltration.

Key Concept

VPC Network Peering establishing bilateral setup, non-transitivity, and custom route exchange mechanisms.
Question 8Question →

A global media enterprise is designing the cloud storage and database architecture on Google Cloud for a mission-critical application platform. The architecture must address two key technical requirements:

1. An operational relational database that requires strong consistency (ACID compliance) across multiple geographic regions, along with horizontal scaling for write operations.
2. A one-time bulk migration of a 3 PB3\text{ PB} historical analytics dataset stored on local network-attached storage (NAS) devices, where the available dedicated internet bandwidth is capped at 100 Mbps100\text{ Mbps}.

Which TWO design decisions should the architect select to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy Cloud Spanner as the operational database solution to support multi-region horizontal write scaling while maintaining strong ACID consistency.; Order Google Cloud Transfer Appliance devices to physically capture and ingest the 3 PB dataset into Cloud Storage.

Answer

The optimal solution requires selecting Cloud Spanner for the globally scalable relational database and using GCP Transfer Appliance for the 3 PB offline bulk data migration.
Cloud Spanner is designed specifically for enterprise relational database workloads that require multi-region horizontal scaling for both reads and writes while preserving strict ACID transactional consistency. For the data migration requirement, transferring 3 PB3\text{ PB} over a 100 Mbps100\text{ Mbps} network link is mathematically unviable, taking over seven years. Google Cloud Transfer Appliance provides dedicated hardware for offline data ingestion, allowing petabyte-scale data to be physically transported to GCP securely and efficiently.

Step-by-Step Solution

1
Evaluate operational relational database requirements against GCP database products.
Cloud Spanner satisfies global multi-region horizontal write scaling and strong ACID consistency, whereas Cloud SQL is limited to vertical scaling for writes and a single primary region.
Cloud Spanner uses TrueTime and distributed transactions to allow multi-region relational write scale.
2
Calculate data transfer time for 3 PB over a 100 Mbps network connection.
Transfer time exceeds 7.5 years (t=3×1015 bytes×8 bits/byte100×106 bits/sec≈2.4×108 secondst = \frac{3 \times 10^{15} \text{ bytes} \times 8 \text{ bits/byte}}{100 \times 10^6 \text{ bits/sec}} \approx 2.4 \times 10^8 \text{ seconds}).
Online migration via Storage Transfer Service is unfeasible within reasonable operational timelines.
3
Select the appropriate offline data transfer mechanism.
GCP Transfer Appliance allows shipping physical storage hardware to securely ingest petabyte-scale data into Cloud Storage.
Offline appliances bypass low-bandwidth WAN connections for massive datasets.

Key Concept

Selecting GCP Database and Storage Migration Services Based on Scale, Latency, and Network Throughput Constraints
Question 9Question →

An enterprise media streaming company is designing an automated continuous delivery pipeline for microservices deployed on Cloud Run using Cloud Build and Google Cloud Deploy. The architecture team requires progressive traffic shifting with automated rollback whenever latency or error rate metrics exceed defined thresholds during a release. Additionally, all container images deployed to production must be verifiably built by the authorized continuous integration pipeline, and individual developers must be prevented from executing direct manual deployments to production environments. Which TWO architectural configurations should the team implement to satisfy these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Define Google Cloud Deploy targets and release pipelines configured with automated canary deployment strategies, integrating verification routines and automated rollbacks driven by Cloud Monitoring metric checks.; Configure Binary Authorization on the target Cloud Run services requiring attestations generated by Cloud Build, and restrict production deployment permissions strictly to the Cloud Deploy service account using IAM service account impersonation.

Answer

The team should configure Google Cloud Deploy progressive canary release strategies with automated rollback capabilities based on metric checks, and enforce Binary Authorization attestations signed by Cloud Build while restricting deployment IAM permissions to the Cloud Deploy execution service account.
To achieve secure, automated release management on GCP, Google Cloud Deploy provides built-in progressive delivery features like canary deployments with automated rollback options upon metric or phase check failures. Pairing this with Binary Authorization ensures container images deployed to Cloud Run originate strictly from the verified Cloud Build pipeline. Restricting IAM rights to the deployment pipeline service account ensures compliance and prevents direct developer modifications.

Step-by-Step Solution

1
Configure progressive release automation
Google Cloud Deploy delivery pipelines execute automated canary releases that evaluate metrics via Cloud Monitoring and trigger rollbacks if thresholds are breached.
Meets the requirement for progressive traffic shifting and automated failure mitigation.
2
Enforce artifact governance and minimal IAM access
Binary Authorization ensures only authorized container builds are deployed to Cloud Run, and IAM restrictions prevent developers from deploying directly.
Satisfies supply chain security requirements and enforces centralized CI/CD deployment execution.

Key Concept

Automating Continuous Deployment Pipelines and Release Strategies
Question 10Question →

A financial enterprise is establishing governance controls across its Google Cloud Organization hierarchy. The security compliance team requires that virtual machines cannot be assigned external public IP addresses and that all new infrastructure resources are restricted to the `us-central1` and `europe-west1` regions. Which TWO Organization Policy constraints should the cloud architect implement to enforce these administrative controls?

Select all that apply

Show answer & explanation

Answer: Set the `constraints/compute.vmExternalIpAccess` organization policy constraint to deny external IP address allocation on compute instances.; Set the `constraints/gcp.resourceLocations` organization policy constraint to allow resource creation only within `us-central1` and `europe-west1`.

Answer

The cloud architect should configure the `constraints/compute.vmExternalIpAccess` constraint to block public IP assignment on VMs and the `constraints/gcp.resourceLocations` constraint to limit resource creation to the specified allowed regions.
The combination of the `constraints/compute.vmExternalIpAccess` constraint (which restricts public IP assignment to compute instances) and the `constraints/gcp.resourceLocations` constraint (which limits resource creation to designated GCP regions) centrally enforces the security and compliance requirements across the organization.

Step-by-Step Solution

1
Identify the constraint required for external IP prevention on VMs.
Selecting `constraints/compute.vmExternalIpAccess` prevents Compute Engine instances from receiving external IPv4 or IPv6 addresses.
Organization policies provide programmatic constraints on Compute Engine networking options.
2
Identify the constraint required to restrict resource provisioning regions.
Selecting `constraints/gcp.resourceLocations` with an allowed list containing `us-central1` and `europe-west1` restricts resource deployment geographically.
Resource location constraints define regional boundaries across all supported GCP services in the resource hierarchy.

Key Concept

Organization Policy constraints define centralized programmatic guardrails across the GCP resource hierarchy to enforce security and compliance standards.
Question 11Question →

A global streaming media enterprise uses Google Cloud for its infrastructure. The enterprise security team needs to establish central governance guardrails across the Google Cloud resource hierarchy without causing immediate downtime to running systems. Specifically, they must satisfy two requirements: first, audit and evaluate the impact of prohibiting external IP addresses on Compute Engine instances within the 'Staging' folder before enforcing the block; second, enforce that all new Cloud Storage buckets across the entire organization are created strictly within the 'us-central1' and 'us-east1' regions. Which TWO architecture design choices should you implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure the boolean constraint 'constraints/compute.vmExternalIpAccess' using a dry-run policy on the 'Staging' folder.; Enforce the list constraint 'constraints/gcp.resourceLocations' at the Organization root level with allowed values set to 'in-regions: [us-central1, us-east1]'.

Answer

The correct architecture requires configuring the boolean constraint 'constraints/compute.vmExternalIpAccess' in dry-run mode on the 'Staging' folder and enforcing the list constraint 'constraints/gcp.resourceLocations' at the organization root level with allowed values for the designated regions.
The correct solution uses Google Cloud Organization Policies to enforce governance rules across the hierarchy. Applying the boolean constraint for external VM IP access in dry-run mode on the targeted folder enables logging of policy non-compliance without breaking active development workflows. Simultaneously, enforcing the resource location list constraint at the organization root guarantees inherited compliance for resource provisioning locations across all projects.

Step-by-Step Solution

1
Identify the mechanism for non-disruptive testing of VM external IP restrictions.
Using dry-run organization policies allows security teams to test constraints by generating audit logs upon policy violation without actively denying resource creation.
Dry-run policy evaluation satisfies the requirement to evaluate impact without blocking existing or new staging workloads.
2
Determine the resource hierarchy node and constraint configuration for regional resource restriction.
Organization policies inherit down the resource hierarchy. Applying 'constraints/gcp.resourceLocations' at the Organization root enforces region constraints across all folders and projects.
List constraints with allowed values restricting regions ensure compliance across all Cloud Storage buckets created in the organization.

Key Concept

Organization Policy Dry-Run Evaluation and Resource Location List Constraints
Question 12Question →

An enterprise security team needs to grant an automated compliance auditing application running in a dedicated security project permission to inspect resource configurations and IAM policies across all projects nested within a folder named Production-Workloads. The security team must also allow a DevOps engineer to deploy and attach this service account to Compute Engine audit instances without granting the engineer the ability to modify IAM policies or elevate their own privileges. Which TWO configuration steps should the security architect implement to achieve this with minimal operational overhead and least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the automated service account the Cloud Asset Viewer role (roles/cloudasset.viewer) bound at the Production-Workloads folder level.; Grant the DevOps engineer the Service Account User role (roles/iam.serviceAccountUser) on the specific audit service account resource.

Answer

Grant the automated service account the Cloud Asset Viewer role (roles/cloudasset.viewer) bound at the Production-Workloads folder level, and grant the DevOps engineer the Service Account User role (roles/iam.serviceAccountUser) on the specific audit service account resource.
Inheriting permissions from the folder level enables an automated service account to inspect assets across all child projects using a targeted predefined role. Restricting the DevOps engineer's permissions to the Service Account User role scoped specifically to the target service account permits deployment onto compute resources while preventing administrative privilege escalation.

Step-by-Step Solution

1
Determine the optimal scoping and role for the automated auditing application.
Identify that Cloud Asset Viewer (roles/cloudasset.viewer) provides read access to metadata and IAM policies across resources without exposing underlying payload data.
Granting this role at the Production-Workloads folder level leverages resource hierarchy inheritance to cover all current and future child projects automatically.
2
Determine the least-privilege permission required for the DevOps engineer deploying the compute workload.
Assign the Service Account User role (roles/iam.serviceAccountUser) directly on the target service account resource.
This grants the engineer permission to impersonate or bind the service account to Compute Engine instances without granting Service Account Admin rights or folder-wide IAM administrative capabilities.

Key Concept

Resource Hierarchy IAM Inheritance and Service Account Impersonation Least Privilege
Question 13Question →

A biomedical research company is automating the infrastructure provisioning process on Google Cloud for a distributed genomic processing platform. The architecture requires deploying a private Google Kubernetes Engine (GKE) cluster for core compute services alongside automated Terraform pipelines for provisioning Compute Engine Managed Instance Groups (MIGs). The security and operations teams require that administrative control plane access to the private GKE cluster be strictly limited to trusted corporate networks, and that infrastructure state storage prevents concurrent execution conflicts or loss of state history. Which TWO deployment configuration actions should the Cloud Architect recommend to fulfill these operational and security constraints?

Select all that apply

Show answer & explanation

Answer: Configure control plane authorized networks on the private GKE cluster using explicit corporate CIDR ranges.; Configure a Google Cloud Storage remote backend with object versioning and state locking for Terraform state management.

Answer

The correct architecture requires enabling control plane authorized networks with explicit corporate CIDR ranges on the private GKE cluster and storing Terraform state in a Google Cloud Storage backend configured with object versioning and state locking.
Configuring control plane authorized networks on private GKE clusters ensures master endpoint communication is strictly constrained to authorized corporate IP blocks. Concurrently, using Google Cloud Storage as a remote backend with versioning and state locking protects infrastructure state from corruption and concurrent pipeline conflicts.

Step-by-Step Solution

1
Evaluate private GKE cluster control plane security requirements.
Identified that restricting master endpoint access requires configuring GKE control plane authorized networks with specific CIDR blocks.
Private GKE clusters require explicit authorized network rules to block unauthorized public network requests to the control plane.
2
Evaluate Infrastructure as Code (IaC) state management best practices.
Identified that Cloud Storage backend with state locking and object versioning fulfills concurrency and resilience needs.
Centralized, locked, and versioned remote backends prevent state corruption during automated CI/CD runs.
3
Analyze distractor options regarding IAM roles, IaC state, and compute platform selection.
Eliminated options recommending excessive IAM primitive/admin roles, local state storage, and redundant cluster creation.
These options violate least privilege, introduce state corruption risks, or add unnecessary operational complexity.

Key Concept

Provisioning private GKE clusters with control plane authorized networks and securing automated IaC state management in Cloud Storage.
Question 14Question →

An enterprise logistics corporation is deploying a new fleet management platform across multiple Google Cloud projects organized under a parent folder named `Fleet-Ops`. The compliance team mandates two strict governance guardrails: (1) prevent users from generating external service account keys to mitigate credential leakage risks, and (2) restrict all infrastructure deployment strictly to European regions (`europe-west1` and `europe-west4`). Additionally, the team must evaluate the operational impact of the key creation restriction on existing pipelines prior to active blocking. Which TWO actions should the security architect take to satisfy these governance requirements using Google Cloud Organization Policies?

Select all that apply

Show answer & explanation

Answer: Apply the boolean constraint `iam.disableServiceAccountKeyCreation` at the `Fleet-Ops` folder level with a dry-run policy spec to monitor violations in Cloud Logging before enforcing active blocking.; Apply the list constraint `gcp.resourceLocations` at the `Fleet-Ops` folder level, configuring the allowed values to include `in:europe-west1-locations` and `in:europe-west4-locations`.

Answer

Configure an Organization Policy with a dry-run spec for the boolean constraint iam.disableServiceAccountKeyCreation at the Fleet-Ops folder level, and configure an Organization Policy with the list constraint gcp.resourceLocations allowing in:europe-west1-locations and in:europe-west4-locations at the Fleet-Ops folder level.
The solution requires applying two distinct Google Cloud Organization Policies at the `Fleet-Ops` folder level. First, applying the `iam.disableServiceAccountKeyCreation` boolean constraint with a dry-run policy spec allows security administrators to monitor logs in Cloud Logging for non-compliant service account key creation attempts without breaking current CI/CD pipelines. Second, enforcing the `gcp.resourceLocations` list constraint with explicit region group values restricts resource provisioning across all child projects strictly to `europe-west1` and `europe-west4`.

Step-by-Step Solution

1
Identify the governance requirements for service account key restriction and dry-run evaluation.
Selected the boolean Organization Policy constraint `iam.disableServiceAccountKeyCreation` applied at the `Fleet-Ops` folder level with a dry-run configuration.
Dry-run policy enforcement logs violations to Cloud Logging without blocking actions, fulfilling the requirement to test impact on existing pipelines.
2
Identify the governance requirements for regional resource location boundaries.
Selected the list Organization Policy constraint `gcp.resourceLocations` configured with `in:europe-west1-locations` and `in:europe-west4-locations` at the `Fleet-Ops` folder level.
List constraints at the folder level prevent any underlying project from deploying resources outside the specified regional location groups.

Key Concept

Google Cloud Organization Policies enforcement, dry-run testing, and resource hierarchy inheritance
Question 15Question →

A platform engineering team is automating continuous deployment pipelines using Cloud Build and Cloud Deploy for microservice applications hosted on Google Kubernetes Engine (GKE). The architecture requires strict compliance with least-privilege IAM controls for pipeline execution and resilient infrastructure state management for pipeline provisioning. Which TWO design practices should the team implement to achieve these requirements?

Select all that apply

Show answer & explanation

Answer: Configure Cloud Deploy execution service accounts with least-privilege roles such as Cloud Deploy Job Runner rather than primitive roles.; Store Infrastructure as Code (IaC) Terraform state files in a Cloud Storage backend with object versioning and state locking enabled.

Answer

The correct practices are configuring Cloud Deploy execution service accounts with fine-grained roles such as Cloud Deploy Job Runner, and storing Infrastructure as Code (IaC) Terraform state files in a remote Cloud Storage backend with object versioning and state locking enabled.
Configuring Cloud Deploy execution service accounts with granular predefined roles adheres to least-privilege security principles. Concurrently, utilizing a Cloud Storage remote backend with versioning and object locking for Terraform state management prevents configuration drift, race conditions, and state file corruption during automated release deployments.

Step-by-Step Solution

1
Evaluate IAM least-privilege execution requirements for continuous deployment services.
Identified that dedicated execution service accounts should be assigned granular roles like roles/clouddeploy.jobRunner rather than broad primitive roles.
Restricting deployment pipeline access ensures compliance with enterprise security standards and limits security blast radius.
2
Evaluate Infrastructure as Code state management requirements for automated delivery pipelines.
Selected Cloud Storage as a remote backend with versioning and state locking enabled.
Remote state backends protect against concurrency race conditions and allow safe rollback in automated IaC pipeline runs.

Key Concept

Automating Continuous Deployment Pipelines and Release Strategies with Least Privilege and Resilient IaC State Management
Question 16Question →

An enterprise financial network requires connecting an on-premises data center to a Google Cloud Virtual Private Cloud (VPC). The solution must meet a 99.99% availability SLA, provide mandatory end-to-end IPsec data encryption, and support dynamic route propagation. Which TWO architectural configurations must be implemented together to satisfy all requirements?

Select all that apply

Show answer & explanation

Answer: Deploy HA VPN over Cloud Interconnect using private IP addressing to satisfy both the 99.99% SLA and IPsec encryption constraints.; Configure Cloud Routers with dynamic BGP peering on both ends of the connection to manage automated route exchange and failover.

Answer

To achieve a 99.99% SLA with mandatory IPsec encryption and dynamic routing, the architecture must deploy HA VPN over Cloud Interconnect (Private IP HA VPN) alongside Cloud Routers configured for BGP dynamic routing.
Combining HA VPN over Cloud Interconnect (Private IP HA VPN) fulfills both the 99.99% availability SLA requirement of Cloud Interconnect and the mandatory IPsec encryption requirement. Pair this with Cloud Routers running dynamic BGP to ensure continuous route exchange and high-availability automated failover.

Step-by-Step Solution

1
Evaluate SLA and encryption requirements for hybrid connectivity.
Standard Cloud Interconnect provides a 99.99% SLA but does not natively encrypt traffic; standard HA VPN provides IPsec encryption but has a lower SLA. Combining HA VPN over Private IP Cloud Interconnect satisfies both constraints.
Private IP HA VPN allows IPsec tunnels to be established over Cloud Interconnect attachments, inheriting the 99.99% SLA while maintaining mandatory data encryption.
2
Configure dynamic routing components.
Cloud Routers are deployed to manage BGP sessions across the hybrid connection.
Dynamic BGP routing via Cloud Router enables automatic route propagation and failover necessary for SLA-backed high availability.

Key Concept

Configuring HA VPN over Cloud Interconnect with Cloud Router BGP for 99.99% SLA and encrypted transit
Question 17Question →

A mid-sized retail enterprise plans to migrate its core inventory management system to Google Cloud. During executive alignment meetings, business stakeholders express concern over potential operational disruption, while the IT operations team reports anxiety regarding their lack of cloud experience. Which TWO strategies should the Lead Cloud Architect recommend to address stakeholder requirements and manage organizational change effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Establish a structured training and technical enablement program for operations staff alongside pilot project migrations.; Conduct stakeholder workshops to define Service Level Objectives (SLOs) aligned with business availability requirements prior to migration.

Answer

The Lead Cloud Architect should recommend establishing a structured training program alongside pilot migrations and conducting stakeholder workshops to define business-aligned Service Level Objectives (SLOs).
Managing organizational change requires addressing human readiness through structured enablement programs during pilot phases. Simultaneously, analyzing stakeholder requirements mandates defining clear, business-aligned SLOs to ensure operational expectations are met without disrupting business continuity.

Step-by-Step Solution

1
Evaluate organizational change management and team readiness requirements.
Identified that hands-on training coupled with pilot migrations reduces team anxiety and builds cloud operational skills.
Technical enablement directly addresses the IT team's skill gaps and resistance to change.
2
Assess business stakeholder alignment on system reliability and performance.
Determined that collaborative SLO definition aligns business expectations with cloud technical architecture.
Stakeholders require clear agreement on availability targets to mitigate concerns about migration disruption.
3
Eliminate inappropriate anti-patterns such as primitive IAM role assignment and reliance on IAM alone for data exfiltration prevention.
Rejected options that breach security best practices or fail to provide proper security perimeters.
Least privilege and VPC Service Controls are mandatory GCP architectural principles.

Key Concept

Organizational Change Management and Stakeholder Requirement Alignment
Question 18Question →

An enterprise software organization is establishing centralized security guardrails across its Google Cloud resource hierarchy. The cloud security architect must enforce two specific governance mandates across all projects within a target folder:

1. Prevent developers from generating exportable service account keys to mitigate credential leakage risks.
2. Restrict the deployment of all Google Cloud location-based resources exclusively to the `us-central1` and `us-east1` regions.

Which TWO Organization Policy constraints should be configured at the target folder level to satisfy these mandates?

Select all that apply

Show answer & explanation

Answer: Enforce the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` by setting its policy state to Enforced.; Configure the list constraint `constraints/gcp.resourceLocations` with an allowed list containing `in:us-central1-locations` and `in:us-east1-locations`.

Answer

The correct configurations are enforcing the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` and setting the list constraint `constraints/gcp.resourceLocations` to allow `in:us-central1-locations` and `in:us-east1-locations`.
The correct configuration combines enforcing `constraints/iam.disableServiceAccountKeyCreation` to disable service account key creation and configuring `constraints/gcp.resourceLocations` to restrict GCP resource deployment to specified regions (`us-central1` and `us-east1`).

Step-by-Step Solution

1
Identify the constraint type for service account key prevention.
The constraint `constraints/iam.disableServiceAccountKeyCreation` is a boolean Organization Policy constraint that prevents creation of service account keys when set to Enforced.
Organization Policies provide centralized governance guardrails across the resource hierarchy that IAM permissions alone cannot enforce.
2
Identify the constraint type for geographic location restrictions.
The constraint `constraints/gcp.resourceLocations` is a list constraint that limits where location-based GCP resources can be provisioned.
Specifying value groups such as `in:us-central1-locations` ensures data sovereignty and regional resource compliance across child projects.

Key Concept

Organization Policies and Constraints
Estimated Time:1m 30s
Question 19Question →

A retail enterprise organizes its Google Cloud infrastructure using an Organization node containing top-level folders named Staging and Production. The central Security Operations team requires read-only security visibility across all projects in the Production folder. Additionally, an automated deployment service account must create Compute Engine instances within a specific Production project and attach a pre-configured workload service account to those instances. Which TWO actions should a Cloud Architect recommend to fulfill these security requirements while enforcing least privilege and leveraging resource hierarchy inheritance?

Select all that apply

Show answer & explanation

Answer: Grant the Security Reviewer role (roles/iam.securityReviewer) to the Security Operations group at the Production folder level.; Grant the deployment service account the Compute Instance Admin (v1) role on the project and the Service Account User role (roles/iam.serviceAccountUser) on the specific workload service account.

Answer

Granting the Security Reviewer role to the Security Operations group at the Production folder level leverages resource hierarchy inheritance for broad read-only security visibility. Granting the deployment service account Compute Instance Admin on the project and Service Account User on the specific workload service account ensures instance creation and service account attachment adhere strictly to least privilege.
Inheritance down the resource hierarchy ensures that binding the Security Reviewer role at the Production folder level grants security visibility across all child projects. To attach a pre-configured service account to a Compute Engine instance, the deploying identity needs compute creation privileges on the project and the Service Account User role on the specific service account resource being attached.

Step-by-Step Solution

1
Analyze read-only security visibility requirements across the Production folder hierarchy.
Assigning predefined Security Reviewer role at the Production folder level allows all child projects to inherit read-only security monitoring access automatically.
Resource hierarchy inheritance propagates IAM policy bindings down to child nodes, eliminating operational overhead while avoiding primitive role over-granting.
2
Analyze instance provisioning and service account attachment privileges for the deployment service account.
Grant Compute Instance Admin (v1) on the project and Service Account User on the specific target service account.
Attaching a service account to a compute resource requires roles/iam.serviceAccountUser on the target service account resource, not Service Account Admin.

Key Concept

Resource hierarchy IAM permission inheritance and least-privilege role scoping for compute workloads and service accounts
Question 20Question →

A financial services organization is migrating two distinct workloads to Google Cloud. The architecture team requires solution designs that minimize operational maintenance and infrastructure cost.

• Workload 1: A stateless, containerized HTTP REST API servicing unpredictable fraud check queries that must automatically scale to zero instances during idle periods.
• Workload 2: A containerized nightly batch process that executes non-HTTP financial risk simulations for up to 3 hours per run.

Which TWO Google Cloud compute platform configurations should you select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Workload 1 as a Cloud Run service configured with request-based autoscaling.; Deploy Workload 2 as a Cloud Run job scheduled to execute the containerized task to completion.

Answer

Deploy Workload 1 as a Cloud Run service configured with request-based autoscaling, and deploy Workload 2 as a Cloud Run job scheduled to execute the containerized task to completion.
For stateless HTTP APIs that require scaling to zero and zero server management, Cloud Run services provide fully managed container deployment with request-driven autoscaling. For batch containers that run to completion without listening for incoming network requests, Cloud Run Jobs provides a fully managed execution environment supporting long-running tasks.

Step-by-Step Solution

1
Analyze requirements for Workload 1 (stateless HTTP microservice, unpredictable traffic, scale-to-zero, low operational overhead).
Cloud Run service is the optimal choice as it natively handles HTTP traffic, scales down to zero, and eliminates server maintenance.
Selecting a serverless container platform reduces operational complexity and cost for idle periods.
2
Analyze requirements for Workload 2 (non-HTTP batch container, nightly execution up to 3 hours, low operational overhead).
Cloud Run Jobs is the optimal choice for containerized workloads that run to completion without an HTTP endpoint and exceed typical function timeouts.
Cloud Run Jobs supports task execution up to 24 hours without cluster management overhead.

Key Concept

Selecting serverless container services (Cloud Run services vs Cloud Run Jobs) based on traffic patterns, execution duration, and event triggers.
Page 1 / 27Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin