Tüm alıştırma soruları

1598 soru

Tüm türler1,598 Çoktan seçmeli815 Çoklu seçim537 Sayısal8 Eşleştirme64 Sıralama174

An enterprise infrastructure team is configuring hybrid network connectivity between an on-premises data center and Google Cloud over a Dedicated Interconnect. On-premises workloads require private access to Google APIs (such as Cloud Storage and BigQuery) through a Private Service Connect (PSC) endpoint provisioned in the hub Virtual Private Cloud (VPC) network. The PSC endpoint has been assigned an internal IP address from the VPC subnet. Which TWO actions must the network architect perform to enable on-premises workloads to successfully reach Google APIs using this Private Service Connect endpoint?

Geçerli olan tümünü seçin

Configure custom route advertisements on the Cloud Router managing the Dedicated Interconnect BGP session to advertise the Private Service Connect endpoint IP address to the on-premises router.

Configure on-premises DNS infrastructure to resolve target Google API domain names to the internal IP address of the Private Service Connect endpoint.

Establish a VPC Network Peering connection between the hub VPC and an intermediary VPC, relying on peering transitivity to propagate the endpoint IP to on-premises routers.

Replace the Dedicated Interconnect connection with an HA VPN gateway tunnel to bypass BGP custom route advertisement restrictions for internal service endpoints.

Remove GKE control plane authorized network restrictions across all subnets to grant on-premises systems direct access to internal Google service endpoints.

Cevabı ve açıklamayı göster

Cevap: Configure custom route advertisements on the Cloud Router managing the Dedicated Interconnect BGP session to advertise the Private Service Connect endpoint IP address to the on-premises router.; Configure on-premises DNS infrastructure to resolve target Google API domain names to the internal IP address of the Private Service Connect endpoint.

Cevap

To enable on-premises workloads to reach Google APIs via a Private Service Connect endpoint in a VPC, the architect must configure custom route advertisements on the Cloud Router associated with the Dedicated Interconnect to advertise the endpoint IP address over BGP, and configure on-premises DNS to resolve Google API domains to the internal Private Service Connect endpoint IP address.

Enabling on-premises access to Google APIs via Private Service Connect requires two essential networking steps: routing propagation and DNS resolution. First, the Cloud Router connected to the Dedicated Interconnect must be configured with a custom route advertisement so on-premises routers learn the path to the internal PSC IP. Second, on-premises DNS must be configured to resolve target Google API domain names to the internal PSC endpoint IP address so that client requests are routed privately over the Interconnect.

Adım Adım Çözüm

Configure Cloud Router BGP Custom Route Advertisements

The internal IP address of the Private Service Connect endpoint is advertised over BGP to the on-premises routers.

By default, Cloud Router only advertises VPC subnet primary and secondary ranges over BGP. Private Service Connect endpoint IP addresses require explicit custom route advertisement on the Cloud Router to be reachable from on-premises.

Configure On-Premises DNS Resolution

On-premises API calls targeting Google services (such as *.googleapis.com) resolve to the internal IP address of the Private Service Connect endpoint.

Traffic must be directed to the internal PSC endpoint IP address instead of public IP addresses. Setting up DNS forwarding or local response policies ensures traffic stays private across the Interconnect.

Anahtar Kavram

Configuring Hybrid Connectivity and Private Service Connect Routing

Soru 202Soru →

A Canadian healthcare network is migrating its patient analytics platform to Google Cloud. National data sovereignty regulations mandate that all sensitive personal health information remains physically stored within Canada, data encryption keys are managed by the customer within the designated Canadian region, and any emergency administrative access by cloud service provider personnel requires explicit prior authorization and logging. Which architectural strategy fulfills all regulatory requirements while minimizing operational overhead?

Configure an Organization Policy enforcing the Resource Locations constraint to northamerica-northeast1, manage encryption using Cloud KMS Customer-Managed Encryption Keys (CMEK) located in Montreal, and enable Access Approval with Access Transparency.

Implement Customer-Supplied Encryption Keys (CSEK) for all Cloud Storage buckets and BigQuery datasets, storing the key material exclusively on-premises and passing raw keys with every API request.

Assign primitive Owner roles to internal audit service accounts and configure IAM conditional bindings based on client IP addresses to enforce regional boundary controls.

Deploy IAM role bindings restricting resource access to Canadian service accounts, relying on standard identity permissions to prevent data exfiltration to external projects.

Cevabı ve açıklamayı göster

Cevap: Configure an Organization Policy enforcing the Resource Locations constraint to northamerica-northeast1, manage encryption using Cloud KMS Customer-Managed Encryption Keys (CMEK) located in Montreal, and enable Access Approval with Access Transparency.

Cevap

The combination of Organization Policy resource location constraints, regional CMEK in Cloud KMS, Access Transparency, and Access Approval completely satisfies physical residency, key governance, and operator access controls required by regulatory frameworks while preserving native platform features.

Adım Adım Çözüm

Enforce physical data residency boundaries

Applying the `gcp.resourceLocations` Organization Policy constraint restricts resource creation strictly to the `northamerica-northeast1` (Montreal) region.

This guarantees that storage resources and compute instances cannot be provisioned outside designated Canadian geographic boundaries.

Establish key governance and encryption control

Utilizing Cloud KMS Customer-Managed Encryption Keys (CMEK) hosted in the Montreal region provides full key lifecycle control and rotation capabilities natively integrated with GCP services.

CMEK meets compliance requirements for customer key control without the operational overhead of managing raw AES keys with CSEK.

Implement cloud provider access governance

Enabling Access Transparency provides near real-time audit logs when Google personnel interact with customer data, while Access Approval requires explicit customer permission before Google personnel can access data for support or operational tasks.

This satisfies legal mandates requiring explicit prior consent and auditability for administrative access by third-party cloud provider staff.

Anahtar Kavram

Regulatory Compliance and Data Governance Controls

Soru 203Soru →

A online gaming enterprise hosts two main workloads on Google Cloud: a synchronous Matchmaking Engine that pairs active players for live multiplayer games, and a Weekly Leaderboard Aggregation Pipeline that asynchronously processes player rankings once every seven days. The business requires high player retention during active gameplay sessions, while leaderboard updates can tolerate execution delays of several hours without affecting customer revenue. Which engineering strategy correctly aligns technical Service Level Objectives (SLOs) and Service Level Indicators (SLIs) with the business impact of these two services?

Define a high-availability SLO (e.g.,

99.95\%

) measured via successful request ratio SLI for the Matchmaking Engine, while defining a lower availability and freshness SLO measured via batch completion window SLI for the Leaderboard Pipeline.

Set the target SLO percentage directly as the SLI metric for both services, configuring alerting rules to fire whenever the measured SLI matches the defined SLO target.

Enforce a uniform

99.99\%

availability SLO for both workloads, relying on static CPU utilization alerts to manage system capacity during high-traffic events.

Assign a strict contractual SLA of

99.99\%

availability to the Weekly Leaderboard Pipeline while operating the Matchmaking Engine on a best-effort basis without error budget tracking.

Cevabı ve açıklamayı göster

Cevap: Define a high-availability SLO (e.g., $99.95\%$ ) measured via successful request ratio SLI for the Matchmaking Engine, while defining a lower availability and freshness SLO measured via batch completion window SLI for the Leaderboard Pipeline.

Cevap

Establish a high-availability SLO measured via successful request ratio SLI for the Matchmaking Engine, while defining a lower availability and freshness SLO measured via batch completion window SLI for the Leaderboard Pipeline.

Differentiating service level targets based on business impact ensures that critical real-time services (Matchmaking Engine) receive high reliability goals and appropriate success-rate SLIs, while background processing (Leaderboard Pipeline) receives relaxed goals evaluated on completion windows. This optimizes operational effort and cloud spend while protecting user experience.

Adım Adım Çözüm

Analyze business impact for each service

The Matchmaking Engine directly drives user retention during live gameplay (high business impact), whereas the Leaderboard Pipeline processes data asynchronously with minimal revenue impact during transient delays (low business impact).

SLOs and error budgets must reflect business revenue and user experience impact.

Select appropriate Service Level Indicators (SLIs) for each service pattern

The Matchmaking Engine requires a latency/success ratio metric (e.g., successful requests divided by total requests), whereas the Leaderboard Pipeline requires a data freshness or job completion window metric.

Different architectural patterns (synchronous API vs asynchronous batch) require different SLI measurement types.

Align Service Level Objectives (SLOs) and error budgets

Assign a strict availability goal (such as

99.95\%

) to the Matchmaking Engine and a more relaxed target to the Leaderboard Pipeline to avoid operational over-engineering.

Over-engineering low-impact services wastes operational budget and engineering effort.

Anahtar Kavram

SLO/SLI Alignment with Business Impact

Tahmini Süre:1m 30s

Soru 204Soru →

An online gaming enterprise runs its web frontends on Cloud Run, operates dedicated legacy backend engines on Compute Engine instances, and exports massive raw event logs to Cloud Storage. The platform maintains a predictable baseline load throughout the day, supplemented by sharp, unpredictable traffic spikes during live tournament events. The FinOps team requests an organization-wide cost optimization strategy to lower compute and storage expenses while minimizing operational complexity and maintaining low administrative overhead. Which TWO actions should the Cloud Architect recommend?

Geçerli olan tümünü seçin

Purchase spend-based Flexible Committed Use Discounts (CUDs) at the Cloud Billing account level to cover the baseline usage across Cloud Run and Compute Engine.

Purchase 3-year resource-based Committed Use Discounts (CUDs) sized to match peak instance counts during live tournament spikes on Compute Engine.

Migrate the legacy single-region backend databases from Cloud SQL to multi-region Cloud Spanner instances to reduce database operational expenditures.

Configure Cloud Storage Lifecycle Management rules to automatically transition historical raw event log files from Standard to Coldline storage after 30 days.

Migrate all containerized Cloud Run microservices onto a dedicated Google Kubernetes Engine (GKE) cluster to reduce baseline infrastructure costs.

Cevabı ve açıklamayı göster

Cevap: Purchase spend-based Flexible Committed Use Discounts (CUDs) at the Cloud Billing account level to cover the baseline usage across Cloud Run and Compute Engine.; Configure Cloud Storage Lifecycle Management rules to automatically transition historical raw event log files from Standard to Coldline storage after 30 days.

Cevap

The Cloud Architect should recommend purchasing spend-based Flexible Committed Use Discounts (CUDs) at the Cloud Billing account level and configuring Cloud Storage Lifecycle Management rules to transition log files from Standard to Coldline storage.

The combination of spend-based Flexible Committed Use Discounts (CUDs) and Cloud Storage Lifecycle Management rules addresses both baseline compute spending across different GCP compute products and long-term storage retention costs without introducing unnecessary management overhead.

Adım Adım Çözüm

Analyze the compute workload characteristics across services.

The architecture uses both serverless (Cloud Run) and VM-based (Compute Engine) compute, with a steady baseline and unpredictable spikes.

Flexible CUDs provide spend-based discount coverage across compute products (Compute Engine, Cloud Run, GKE), optimizing steady-state spending across diverse compute models without lock-in to specific instance types or regions.

Analyze storage lifecycle and cost optimization opportunities.

Raw event logs accumulated in Cloud Storage become infrequently accessed over time.

Automated Object Lifecycle Management rules transition objects from Standard to Nearline or Coldline storage based on age, directly reducing storage tier costs without operational overhead.

Evaluate remaining options against operational efficiency and FinOps principles.

Sizing resource-based CUDs to peak loads, migrating regional DBs to Spanner, or moving Cloud Run workloads to GKE increases financial risk or operational overhead.

Distractors introduce unnecessary management complexity or commit funds to transient peak usage.

Anahtar Kavram

Optimizing multi-service compute expenses with spend-based Flexible CUDs and automated Cloud Storage lifecycle rules.

Tahmini Süre:2m 30s

Soru 205Soru →

A global logistics organization manages IoT fleet telemetry pipelines across multiple Google Cloud projects structured within a regional folder hierarchy. The platform engineering team is preparing to launch a fleet telemetry processing cluster in a new expansion region (europe-west9), which requires provisioning 250 Compute Engine N2 virtual machines alongside BigQuery ingestion tables via Infrastructure as Code (IaC). Default project compute quota limits in europe-west9 are insufficient for this workload. To ensure an uninterrupted automated deployment while maintaining proper governance and cost visibility, which action should the cloud architect recommend?

Audit existing regional Compute Engine quotas in europe-west9 and submit a quota increase request for N2 CPUs prior to executing the deployment pipeline.

Assign the primitive Owner role to the CI/CD deployment service account at the folder level so it can automatically bypass regional CPU quota limits.

Grant the CI/CD service account the Service Account Admin role across target projects to allow dynamic compute quota adjustment during IaC execution.

Proceed with IaC execution using default regional quota limits, and manually submit quota requests in the Google Cloud Console only if the pipeline fails.

Cevabı ve açıklamayı göster

Cevap: Audit existing regional Compute Engine quotas in europe-west9 and submit a quota increase request for N2 CPUs prior to executing the deployment pipeline.

Cevap

Audit existing regional Compute Engine quotas in europe-west9 and submit a quota increase request for N2 CPUs prior to executing the deployment pipeline.

Proactively auditing regional quota limits and requesting an increase prior to initiating automated infrastructure deployment ensures that all 250 N2 Compute Engine instances can be provisioned without hitting quota caps. Quotas are hard platform limits enforced independently of IAM roles.

Adım Adım Çözüm

Calculate required regional resource capacity

Identified requirement for 250 N2 instances in europe-west9, exceeding default CPU quotas.

Large compute deployments require verifying target region quota constraints in advance.

Submit quota request prior to deployment execution

Quota request is reviewed and granted before automated IaC pipelines run.

Requesting quota increases proactively avoids deployment failure and pipeline halts.

Enforce IAM and governance rules

Avoid granting excessive IAM permissions, as quota enforcement is managed by GCP platform limits rather than IAM roles.

IAM roles cannot override enforced project or regional resource quotas.

Anahtar Kavram

Proactive Resource Quota Management and IaC Provisioning Governance

Soru 206Soru →

An online insurance platform's backend infrastructure was initially deployed on Google Cloud using ad-hoc automation and direct console actions. An architectural evaluation reveals severe technical debt: developer accounts hold project-level primitive Editor roles, and Terraform state files reside locally on developer laptops without concurrency locking or backup. As the lead cloud architect, which strategy should you recommend to mitigate this technical debt while establishing production governance?

Migrate local Terraform state to a centralized Cloud Storage bucket with versioning and state locking enabled, and replace project-level primitive roles with least-privilege predefined or custom IAM roles.

Commit and push local Terraform state files directly into a private git repository for version tracking, and reassign developers from project Editor roles to project Viewer roles.

Migrate state files to Cloud Storage with versioning enabled, but retain project Editor roles for developers to ensure fast hotfixing and avoid build pipeline disruptions.

Deploy an Autopilot Google Kubernetes Engine (GKE) cluster to manage infrastructure state workloads, while maintaining developer project Editor access for cluster administration.

Cevabı ve açıklamayı göster

Cevap: Migrate local Terraform state to a centralized Cloud Storage bucket with versioning and state locking enabled, and replace project-level primitive roles with least-privilege predefined or custom IAM roles.

Cevap

The correct recommendation addresses both technical debt vectors: migrating Terraform state to a Cloud Storage remote backend ensures state concurrency locking and backup, while replacing primitive Editor roles with fine-grained predefined or custom IAM roles satisfies least privilege governance.

Adım Adım Çözüm

Assess Infrastructure as Code (IaC) state debt

Identify that local state files create high risk of state corruption, secret leakages, and concurrency conflicts.

Centralizing state in Cloud Storage with Object Versioning and backend locking enforces single-source-of-truth governance.

Assess Identity and Access Management (IAM) debt

Identify that primitive roles (Owner, Editor, Viewer) grant excessively broad permissions across all project resources.

Replacing primitive roles with fine-grained predefined or custom roles aligns with GCP security best practices and least privilege.

Anahtar Kavram

Mitigating IaC state management and IAM governance technical debt in cloud architectures

Soru 207Soru →

An analytics platform operating on Google Compute Engine virtual machines in a production environment needs to dynamically retrieve database connection credentials stored in Secret Manager. The platform requires automated rotation of these credentials alongside a zero-trust credential posture that completely eliminates long-lived service account key files. Which TWO security controls should the architecture team implement to meet these requirements while following Google-recommended best practices? (Select TWO.)

Geçerli olan tümünü seçin

Attach a custom service account to the Compute Engine instances and grant that service account the Secret Manager Secret Accessor role on the specific secrets.

Configure automated rotation in Secret Manager linked to a Pub/Sub topic and a Cloud Function running under a service account with the Secret Manager Secret Version Manager role.

Assign the Project Owner primitive role to the service account attached to the Compute Engine instances to allow seamless creation and retrieval of secret payloads.

Grant the service account assigned to the Compute Engine instances the Service Account Admin role so that it can dynamically rotate and regenerate its own key credentials.

Download service account JSON key files and store them encrypted using Customer-Supplied Encryption Keys (CSEK) inside a Cloud Storage bucket mounted to the instances.

Cevabı ve açıklamayı göster

Cevap: Attach a custom service account to the Compute Engine instances and grant that service account the Secret Manager Secret Accessor role on the specific secrets.; Configure automated rotation in Secret Manager linked to a Pub/Sub topic and a Cloud Function running under a service account with the Secret Manager Secret Version Manager role.

Cevap

The platform should attach a custom service account with the Secret Manager Secret Accessor role to the instances, and implement automated rotation using Secret Manager Pub/Sub topics combined with a Cloud Function granted the Secret Manager Secret Version Manager role.

Attaching a custom service account to the compute instances with the Secret Manager Secret Accessor role allows applications to securely access secrets via Application Default Credentials without using static key files. Configuring automated rotation via Pub/Sub and Cloud Functions using a dedicated service account with the Secret Version Manager role enables secure, hands-free credential rotation according to enterprise security standards.

Adım Adım Çözüm

Eliminate service account key file dependency by attaching a workload service account

Compute Engine instances automatically obtain short-lived OAuth tokens via the Metadata Server and Application Default Credentials (ADC).

Eliminates security risks associated with long-lived exported key management.

Apply least-privilege IAM permissions for secret retrieval

Grant the instance service account `roles/secretmanager.secretAccessor` strictly on required secrets.

Allows applications to read secret payloads without granting unnecessary administrative permissions.

Configure event-driven secret rotation workflow

Secret Manager publishes rotation notifications to Pub/Sub, triggering a Cloud Function bound to a service account with `roles/secretmanager.secretVersionManager`.

Automates secret updates and lifecycle management according to compliance guidelines.

Anahtar Kavram

Service Account Lifecycle and Secret Manager Automated Rotation

Soru 208Soru →

A semiconductor manufacturing enterprise is translating its conceptual cloud architecture for a real-time wafer defect analysis platform into logical and physical architectures on Google Cloud. The conceptual model establishes three requirements: 1) high-throughput ingestion and low-latency storage of high-frequency sensor telemetry, 2) large-scale analytical processing for yield optimization, and 3) strict data isolation controls preventing data exfiltration to external projects. Which TWO architectural decisions correctly map these conceptual requirements to physical Google Cloud components and controls? (Select TWO)

Geçerli olan tümünü seçin

Provision Cloud Pub/Sub for telemetry ingestion, Cloud Bigtable for storing low-latency time-series data, and BigQuery for yield analytics.

Implement VPC Service Controls around the Google Cloud project resources to prevent exfiltration of sensitive telemetry data to unauthorized external projects.

Provision a multi-region Cloud Spanner instance as the primary storage layer for raw time-series sensor telemetry and operational metrics.

Rely strictly on granular IAM roles granted to service accounts to guarantee that internal users cannot copy data to external Cloud Storage buckets.

Deploy a multi-zone Google Kubernetes Engine (GKE) cluster dedicated solely to hosting a single stateless payload parsing microservice.

Cevabı ve açıklamayı göster

Cevap: Provision Cloud Pub/Sub for telemetry ingestion, Cloud Bigtable for storing low-latency time-series data, and BigQuery for yield analytics.; Implement VPC Service Controls around the Google Cloud project resources to prevent exfiltration of sensitive telemetry data to unauthorized external projects.

Cevap

The platform should utilize Cloud Pub/Sub, Cloud Bigtable, and BigQuery for the telemetry ingestion, time-series storage, and analytics pipeline, alongside VPC Service Controls to prevent data exfiltration across the perimeter.

The combination of Cloud Pub/Sub, Cloud Bigtable, and BigQuery correctly satisfies the ingestion, low-latency operational storage, and yield analytical requirements of the platform. Additionally, VPC Service Controls enforce a perimeter around the project, preventing network and API-based data exfiltration to unauthorized external destinations.

Adım Adım Çözüm

Evaluate data ingestion and storage requirements against GCP physical services.

Cloud Pub/Sub absorbs stream spikes, Cloud Bigtable provides sub-10ms writes for time-series sensor telemetry, and BigQuery supports SQL analytics for yield optimization.

This combination fulfills both operational write throughput and analytical query needs cost-effectively.

Evaluate security perimeter and data exfiltration requirements.

VPC Service Controls establish network and API-level boundaries preventing copying data outside approved projects.

IAM credentials alone cannot block exfiltration by authorized identities.

Anahtar Kavram

Mapping conceptual business requirements to physical GCP services and network security boundaries

Soru 209Soru →

An organization deploys Compute Engine instances across two regions, us-central1 and europe-west1, within a single custom-mode Virtual Private Cloud (VPC) network. A Cloud Router and Dedicated Interconnect attachment are configured in us-central1 to exchange BGP routes with an on-premises data center. Workloads in us-central1 can communicate with on-premises resources, but workloads in europe-west1 cannot reach on-premises IP ranges because dynamic routes learned by the Cloud Router are missing from the routing table in europe-west1. Which configuration change should the cloud architect implement to enable inter-region dynamic route propagation across the VPC?

Change the dynamic routing mode of the VPC network from Regional to Global.

Establish a VPC Network Peering connection between the us-central1 subnet and the europe-west1 subnet and enable custom route export.

Replace the Dedicated Interconnect with an HA VPN gateway in europe-west1 because Cloud Routers cannot share Interconnect routes across regions.

Create a VPC Service Controls perimeter encompassing the europe-west1 subnet and configure an egress rule for the on-premises network.

Cevabı ve açıklamayı göster

Cevap: Change the dynamic routing mode of the VPC network from Regional to Global.

Cevap

Change the dynamic routing mode of the VPC network from Regional to Global.

Google Cloud VPC networks support two dynamic routing modes: Regional and Global. When set to Regional dynamic routing, a Cloud Router only installs learned BGP routes into the subnets of its local region. Setting the VPC network dynamic routing mode to Global configures Cloud Routers to advertise and install dynamically learned routes across subnets in all regions within the VPC, allowing instances in europe-west1 to seamlessly route traffic through the us-central1 Cloud Interconnect.

Adım Adım Çözüm

Analyze the scope of route propagation in the VPC network.

Identify that the Cloud Router in us-central1 learns on-premises routes via BGP, but these routes are missing from the routing table in europe-west1.

By default, a VPC network configured with Regional dynamic routing only propagates learned dynamic routes to resources within the Cloud Router's local region.

Determine the appropriate VPC network routing setting.

Changing the dynamic routing mode to Global ensures that dynamically learned routes from any region's Cloud Router are available to all subnets across all regions in the VPC network.

Global dynamic routing allows cloud instances in europe-west1 to use the us-central1 Cloud Router and Interconnect path to reach on-premises networks.

Anahtar Kavram

VPC Dynamic Routing Modes (Regional vs. Global)

Soru 210Soru →

A global online gaming platform is designing hybrid network connectivity between its on-premises data center and workloads deployed across multiple Google Cloud regions (`us-central1` and `europe-west1`). The hybrid connection requires a SLA of 99.99% availability and must support a baseline bandwidth of 8 Gbps with sustained peaks up to 15 Gbps. Furthermore, on-premises networks must automatically discover routes to subnets in all GCP regions without manual static route management, while avoiding un-supported transitive routing reliance on VPC Network Peering for third-party service VPCs. Which TWO architectural design choices should the lead cloud architect implement to satisfy these technical requirements? (Select TWO.)

Geçerli olan tümünü seçin

Provision four Dedicated Interconnect connections across two distinct metro locations and two separate Edge Availability Domains (EADs) per metro location, attaching them to Cloud Routers in each region.

Deploy multiple High Availability (HA) Cloud VPN gateways with active-active IPsec tunnels across both target regions and enable ECMP to aggregate bandwidth above 10 Gbps.

Configure Dynamic Routing mode to Global on the Virtual Private Cloud (VPC) network hosting the Cloud Routers.

Establish VPC Network Peering between the hybrid VPC and third-party partner VPCs to transit on-premises traffic directly into the partner networks.

Cevabı ve açıklamayı göster

Cevap: Provision four Dedicated Interconnect connections across two distinct metro locations and two separate Edge Availability Domains (EADs) per metro location, attaching them to Cloud Routers in each region.; Configure Dynamic Routing mode to Global on the Virtual Private Cloud (VPC) network hosting the Cloud Routers.

Cevap

The architect should provision four Dedicated Interconnect connections across two distinct metro locations and edge availability domains, and configure the VPC dynamic routing mode to Global.

Provisioning four Dedicated Interconnect circuits across two metro locations and two EADs per metro satisfies the GCP architecture pattern for 99.99% availability while supplying 10 Gbps/100 Gbps dedicated links capable of handling the 15 Gbps peak. Configuring Global Dynamic Routing enables Cloud Routers in any region to dynamically exchange BGP routes with on-premises routers and make all regional subnets reachable.

Adım Adım Çözüm

Analyze bandwidth and SLA constraints for hybrid connectivity.

The requirement specifies 15 Gbps peak bandwidth and a 99.99% SLA.

Cloud VPN maxes out at 3 Gbps per tunnel over public internet. Dedicated Interconnect is required for bandwidth exceeding 3 Gbps and for enterprise SLAs.

Determine topology requirements for 99.99% HA SLA.

GCP topology guidelines for 99.99% availability require 4 Interconnect attachments across 2 metros and 2 Edge Availability Domains (EADs) per metro.

This redundant design ensures protection against single facility, metro, or hardware failures.

Configure dynamic routing for multi-region accessibility.

Set VPC Dynamic Routing to Global mode.

Regional dynamic routing only advertises routes to subnets in the same region as the Cloud Router. Global dynamic routing enables Cloud Routers to propagate BGP learned routes across all GCP regions.

Anahtar Kavram

99.99% Availability Dedicated Interconnect Architecture & Global Dynamic Routing

Soru 211Soru →

An enterprise financial audit platform processes transaction verification requests using a GraphQL API on Google Kubernetes Engine (GKE). The Site Reliability Engineering (SRE) team needs to establish an alerting strategy to preserve the service's availability Service Level Objective (SLO) of 99.9% over a 30-day rolling window. The team wants to ensure they receive immediate notifications for rapid error budget depletion while avoiding alert fatigue from minor, transient error spikes. Which alerting configuration should the SRE team implement?

Implement multi-window, multi-burn-rate alerting that measures short-term and long-term error budget consumption rates.

Configure a static threshold alert on Cloud Monitoring whenever HTTP 5xx error rates exceed 0.1% over a 5-minute window.

Set up an alert on GKE node CPU utilization when aggregate node pool usage exceeds 85% for more than 10 minutes.

Define the 99.9% successful response target as the Service Level Indicator (SLI) and alert when total HTTP 5xx errors exceed 100 in an hour.

Cevabı ve açıklamayı göster

Cevap: Implement multi-window, multi-burn-rate alerting that measures short-term and long-term error budget consumption rates.

Cevap

The SRE team should implement multi-window, multi-burn-rate alerting that measures short-term and long-term error budget consumption rates.

Implementing multi-window, multi-burn-rate alerting is the recommended GCP SRE best practice for managing error budgets. By monitoring multiple time windows simultaneously (such as short windows for fast burn and long windows for slow burn), SRE teams can quickly catch catastrophic failures before the error budget is exhausted while avoiding noisy alerts from brief, transient error spikes.

Adım Adım Çözüm

Analyze the service availability SLO requirement.

The target availability is 99.9% over a 30-day rolling window, meaning the allowable error budget is 0.1% of total requests.

The alerting strategy must protect this specific budget without causing false positives.

Evaluate alerting approaches against SRE best practices for error budget management.

Static threshold alerts cause alert fatigue or miss slow burns, whereas burn-rate alerts measure how quickly the budget is consumed.

Burn rates standardize alerting based on the severity of the threat to the SLO.

Select multi-window, multi-burn-rate configuration.

Using multiple time windows (short and long) combined with burn-rate thresholds allows precise detection of both rapid budget exhaustion and sustained slow leaks.

Multi-window multi-burn-rate alerting is the Google SRE benchmark standard for SLO reliability monitoring.

Anahtar Kavram

Multi-window, multi-burn-rate alerting for error budgets

Tahmini Süre:1m 30s

Soru 212Soru →

An Educational Technology (EdTech) organization hosts its online testing platform on Google Cloud. The platform features two core workloads: an interactive Student Assessment Submission API that directly impacts user grading and customer contractual SLAs, and an asynchronous Student Learning Analytics Pipeline used for internal nightly progress reporting. The organization experiences unnecessary operational friction because both workloads currently share identical $99.99\%$ availability targets and generic infrastructure alerting. You need to redesign the reliability framework to align technical Service Level Objectives (SLOs) and Service Level Indicators (SLIs) with business impact while preventing burn-out on non-critical outages. Which design strategy should you implement?

Define a high-stringency SLO (99.99%) for the Assessment Submission API measured by an SLI of successful HTTP POST requests divided by total requests, and establish a relaxed SLO (99.0%) for the Analytics Pipeline measured by an SLI of batch job completion within a 4-hour window.

Define the SLI for both services as a target goal of 99.99% availability, and set the SLO as the real-time ratio of successful backend requests recorded by Cloud Monitoring.

Enforce a uniform 99.99% SLO across both workloads and configure high-priority PagerDuty alerts triggered whenever backend Compute Engine CPU utilization exceeds static 85% thresholds for more than 5 minutes.

Provision an active-active multi-region failover architecture for both services to ensure zero RPO and RTO, triggering immediate multi-region disaster recovery procedures upon any error budget consumption.

Cevabı ve açıklamayı göster

Cevap: Define a high-stringency SLO (99.99%) for the Assessment Submission API measured by an SLI of successful HTTP POST requests divided by total requests, and establish a relaxed SLO (99.0%) for the Analytics Pipeline measured by an SLI of batch job completion within a 4-hour window.

Cevap

The correct strategy is to establish a strict 99.99% SLO measured by an SLI of successful HTTP POST request ratios for the critical Assessment Submission API, while defining a lower 99.0% SLO measured by job completion latency for the non-critical Analytics Pipeline.

The correct approach sets differentiated reliability targets based on business impact. The real-time Assessment Submission API directly affects student grading and client SLAs, warranting a strict 99.99% SLO and an SLI measured as the ratio of successful requests. Conversely, the asynchronous Analytics Pipeline can tolerate delays, making a 99.0% SLO and a batch completion time SLI appropriate. This avoids over-engineering non-critical infrastructure and protects operational error budgets.

Adım Adım Çözüm

Analyze business impact for each service component

Identified Student Assessment Submission API as high business impact (direct SLA penalties and user experience disruption) and Student Learning Analytics Pipeline as low business impact (internal asynchronous batch reporting).

SLOs and error budgets must directly reflect user-perceived degradation and financial risk.

Select appropriate Service Level Indicators (SLIs) for each workload type

Selected request success ratio (good requests / total requests) for synchronous HTTP submissions, and time-to-completion (jobs finished within window / total jobs) for batch analytics processing.

SLIs must quantify the actual performance metric relevant to how users or downstream systems consume the specific workload.

Set Service Level Objectives (SLOs) aligned with business risk tolerance

Assigned a tight 99.99% target for the high-impact submission service and a relaxed 99.0% target for the batch reporting pipeline.

Differentiating targets preserves engineering operational bandwidth and error budgets where minor downtime is business-acceptable.

Anahtar Kavram

Aligning SLO/SLI selection and error budget allocation directly with business impact.

Soru 213Soru →

A global supply-chain enterprise processes proprietary partner trade records in Google Cloud. Raw telemetry and financial datasets reside in BigQuery and Cloud Storage within a dedicated analytical GCP project. The platform team must fulfill two security mandates: first, mitigate volumetric Layer 7 request floods and web application attacks targeting public API frontend services; second, guarantee that authorized internal data analysts operating within the GCP network cannot exfiltrate analytical datasets to unauthorized external Google Cloud Storage buckets or external GCP organizations. Which TWO architectural solutions must the cloud architect implement to meet these requirements?

Geçerli olan tümünü seçin

Configure Google Cloud Armor security policies with rate-limiting rules and web application firewall (WAF) protections attached to the External HTTP(S) Load Balancer backend services.

Establish a VPC Service Controls perimeter around the analytical project to prevent fully authenticated IAM users from moving data to storage resources outside the perimeter boundary.

Grant fine-grained IAM roles to data analysts while relying exclusively on IAM policies to block file transfers to external buckets outside the organization.

Assign the primitive Editor role to compute service accounts and set up transitive VPC Network Peering to seamlessly bridge network security perimeters across partner networks.

Cevabı ve açıklamayı göster

Cevap: Configure Google Cloud Armor security policies with rate-limiting rules and web application firewall (WAF) protections attached to the External HTTP(S) Load Balancer backend services.; Establish a VPC Service Controls perimeter around the analytical project to prevent fully authenticated IAM users from moving data to storage resources outside the perimeter boundary.

Cevap

To protect against Layer 7 application attacks and prevent internal data exfiltration, the architecture must combine Google Cloud Armor edge policies on the External HTTP(S) Load Balancer with a VPC Service Controls security perimeter around project resources containing sensitive datasets.

Combining Google Cloud Armor and VPC Service Controls fulfills both security mandates. Cloud Armor inspects incoming traffic at the edge of Google's network to mitigate Layer 7 DDoS attacks and enforce rate limiting on public endpoints. Meanwhile, VPC Service Controls creates a perimeter around GCP managed services (BigQuery and Cloud Storage) within the analytical project, ensuring that even users with legitimate IAM access cannot exfiltrate data to external storage resources outside the perimeter.

Adım Adım Çözüm

Analyze public ingress protection requirements against HTTP floods and application threats

Identify Google Cloud Armor as the GCP native edge control mechanism to enforce Layer 7 WAF and rate-limiting rules at the External HTTP(S) Load Balancer level.

Cloud Armor protects backend services from volumetric and application-layer DDoS attacks before traffic enters internal networks.

Analyze data exfiltration prevention requirements for authenticated users accessing BigQuery and Cloud Storage

Identify VPC Service Controls as the required boundary enforcement tool.

VPC Service Controls restricts API communication, blocking reads from inside the perimeter from writing to Google Cloud resources outside the perimeter boundary regardless of IAM permissions.

Evaluate and discard distractor strategies relying on IAM alone or transitive VPC peering

Confirm that IAM policies alone cannot prevent data exfiltration and transitive VPC peering is unsupported in GCP.

Relying on IAM without VPC SC leaves a vulnerability where authorized analysts can copy data to self-owned GCP projects.

Anahtar Kavram

Perimeter security defense-in-depth combining Google Cloud Armor for edge application security with VPC Service Controls for data exfiltration prevention.

Tahmini Süre:2m 0s

Soru 214Soru →

An enterprise online food delivery platform is optimizing its Google Cloud footprint as part of a new FinOps governance initiative. The platform operates a steady-state core order-dispatch service on Compute Engine VMs that runs continuously 24/7 with minimal traffic variance. In addition, the platform runs highly unpredictable, bursty machine learning batch jobs for real-time demand forecasting that execute intermittently for 2 to 4 hours a day. The platform engineering team needs to minimize infrastructure costs while establishing clear cost attribution per microservice team. Which cloud architecture and billing strategy should the Cloud Architect recommend?

Purchase 3-year standard Committed Use Discounts (CUDs) sized to cover the peak capacity of both the steady-state Compute Engine instances and the bursty machine learning batch jobs.

Migrate both the steady-state dispatch service and the intermittent batch workloads onto a dedicated Google Kubernetes Engine (GKE) Enterprise cluster configured with static node pools to simplify billing management.

Purchase 3-year Flexible Committed Use Discounts (CUDs) for the steady-state Compute Engine instances, run the unpredictable batch ML workloads on Spot VMs, and enforce resource labeling linked to Cloud Billing export for cost attribution.

Grant the primitive Owner role to the FinOps lead across all GCP projects so they can manually delete unutilized compute instances and adjust project billing settings.

Cevabı ve açıklamayı göster

Cevap: Purchase 3-year Flexible Committed Use Discounts (CUDs) for the steady-state Compute Engine instances, run the unpredictable batch ML workloads on Spot VMs, and enforce resource labeling linked to Cloud Billing export for cost attribution.

Cevap

Purchase 3-year Flexible Committed Use Discounts (CUDs) for baseline compute, leverage Spot VMs for fault-tolerant bursty batch processing, and apply granular resource labels tied to BigQuery Cloud Billing exports for cost allocation.

Combining Flexible Committed Use Discounts (CUDs) for predictable 24/7 baseline infrastructure with Spot VMs for fault-tolerant, intermittent batch jobs ensures maximum cost efficiency. Additionally, enforcing resource labels linked to Cloud Billing exports satisfies FinOps cost attribution requirements across different application teams.

Adım Adım Çözüm

Analyze workload characteristics for compute cost optimization.

Identified steady-state 24/7 compute requirements alongside intermittent, bursty batch workloads.

Steady-state workloads benefit from term commitments (CUDs), whereas bursty, fault-tolerant workloads achieve maximum savings through preemptible/Spot VMs.

Select appropriate Google Cloud discount models.

Apply Flexible CUDs to baseline Compute Engine instances and utilize Spot VMs for the demand forecasting batch jobs.

Flexible CUDs offer guaranteed discounts on hourly spend for stable compute, while Spot VMs reduce compute costs by up to 60-91% for batch processing.

Implement FinOps governance and cost attribution mechanisms.

Enforce key-value resource labels across infrastructure resources and export detailed billing logs to BigQuery.

Labels provide micro-level visibility into spend by team, environment, or service, enabling accurate showback/chargeback reporting.

Anahtar Kavram

FinOps Cost Optimization and Governance

Soru 215Soru →

A financial enterprise is designing a Continuous Integration and Continuous Delivery (CI/CD) pipeline on Google Cloud using Cloud Build and Terraform to manage infrastructure deployments inside a restricted security environment governed by VPC Service Controls. The architecture team requires that the pipeline prevents configuration drift, protects state files against concurrency corruption and exfiltration, and strictly enforces the principle of least privilege. Which TWO architectural controls should be implemented in this CI/CD pipeline design? (Select TWO.)

Geçerli olan tümünü seçin

Store the Terraform state file in a Cloud Storage bucket configured with object versioning and state locking, executing builds via Cloud Build private worker pools inside the network perimeter.

Grant the Cloud Build trigger service account the Service Account User role (roles/iam.serviceAccountUser) on a dedicated custom deployment service account to perform resource provisioning through short-lived impersonation.

Assign the primitive Owner role (roles/owner) directly to the Cloud Build default service account to prevent permission errors when provisioning complex multi-resource topologies.

Maintain the Terraform state file within the ephemeral container storage of the Cloud Build runner workspace to avoid external network calls and prevent state data exfiltration.

Cevabı ve açıklamayı göster

Cevap: Store the Terraform state file in a Cloud Storage bucket configured with object versioning and state locking, executing builds via Cloud Build private worker pools inside the network perimeter.; Grant the Cloud Build trigger service account the Service Account User role (roles/iam.serviceAccountUser) on a dedicated custom deployment service account to perform resource provisioning through short-lived impersonation.

Cevap

The optimal design requires storing Terraform state in a versioned Cloud Storage bucket with state locking while running builds on Cloud Build private worker pools inside the VPC Service Controls perimeter, and granting the build service account the Service Account User role to impersonate a dedicated deployment service account.

The correct approach combines secure remote state management with private network execution and fine-grained identity impersonation. Storing Terraform state in a Cloud Storage bucket with object versioning and state locking prevents state file corruption and concurrency conflicts during concurrent deployments. Executing Cloud Build builds on private worker pools allows secure deployment within a VPC Service Controls perimeter. Additionally, granting the Cloud Build build trigger service account the `roles/iam.serviceAccountUser` role on a dedicated deployment service account enables minimal, audited permission delegation through service account impersonation.

Adım Adım Çözüm

Establish secure remote state management and network perimeter boundary for IaC execution.

Configuring a Cloud Storage remote backend with state locking and object versioning ensures concurrent apply operations do not corrupt state. Running Cloud Build on private worker pools satisfies VPC Service Controls compliance requirements.

VPC Service Controls block public Cloud Build pool traffic, requiring private worker pools peered to the VPC for internal resource provisioning.

Configure fine-grained IAM privilege separation for build execution.

The Cloud Build service account is granted `roles/iam.serviceAccountUser` on a specific target service account that possesses minimal required deployment permissions.

Impersonation prevents assigning permanent broad privileges directly to build pipeline identities, adhering to GCP security architecture best practices.

Anahtar Kavram

Secure CI/CD Pipeline Design with Cloud Build, IaC State Locking, and IAM Service Account Impersonation

Soru 216Soru →

A retail analytics firm provisions automated data processing jobs using temporary Compute Engine Virtual Machines across multiple sub-projects organized under a dedicated folder. The cloud operations team must ensure that no single sub-project exceeds its allocated infrastructure budget or depletes shared regional quota during peak batch processing windows. Which strategy should the Cloud Architect implement to enforce proactive resource limits and governance across these projects?

Apply consumer quota overrides at the project level to cap maximum VM allocation, and configure Google Cloud Billing budget alerts integrated with Pub/Sub to automate resource capping.

Maintain default regional quotas and submit manual quota increase requests to support team operations only after automated out-of-quota error alerts trigger during batch processing.

Assign the primitive Owner IAM role to each sub-project's automated service account so it can dynamically reallocate quotas and adjust billing accounts during high workload demand.

Maintain independent local Terraform state files on individual operator workstations to manage and sync quota limits and project budget parameters prior to each deployment run.

Cevabı ve açıklamayı göster

Cevap: Apply consumer quota overrides at the project level to cap maximum VM allocation, and configure Google Cloud Billing budget alerts integrated with Pub/Sub to automate resource capping.

Cevap

Apply consumer quota overrides at the project level to cap maximum VM allocation, and configure Google Cloud Billing budget alerts integrated with Pub/Sub to automate resource capping.

The correct strategy combines consumer quota overrides at the project level with programmatic budget notifications. Quota overrides establish hard upper boundaries on resource utilization per project, while Cloud Billing budgets linked to Pub/Sub enable automated actions to prevent cost overruns.

Adım Adım Çözüm

Identify the requirement for proactive quota management and cost isolation across sub-projects.

Determined that resource capping must occur before workloads run out of budget or exhaust shared regional resources.

Preventing batch processing jobs from exceeding budget or starving other environments requires hard quota controls and budget triggers.

Configure consumer quota overrides on the individual sub-projects.

Project-level caps prevent any single project from requesting more VM resources than permitted.

Quota overrides provide administrative control to constrain resource scaling per project.

Set up Cloud Billing budget notifications via Pub/Sub.

Automated billing notifications trigger Cloud Functions or Cloud Run to disable APIs or cap resources when threshold bounds are approached.

Pub/Sub integration provides real-time programmatic cost controls.

Anahtar Kavram

Consumer Quota Overrides & Automated Billing Governance

Tahmini Süre:1m 30s

Soru 217Soru →

A medical SaaS provider operates a telemetry platform on Google Cloud across 40 projects under a single Cloud Billing account. The workload consists of a steady-state API tier on compute resources, predictable database usage, and highly dynamic, bursty data analysis jobs triggered during clinical trial audits. The finance team cannot map costs to specific business units or compute unit costs per active monitoring device, and overall spend is growing faster than revenue. Which combined technical and governance architecture should the Cloud Architect recommend to establish FinOps transparency and maximize cost efficiency?

Export detailed Cloud Billing data to BigQuery at the organization level, enforce standardized resource labeling (such as cost-center and environment) using Organization Policies, purchase Flexible Committed Use Discounts for baseline hourly spend across compute and database services, and use BigQuery autoscaling slots for dynamic analytical workloads.

Purchase 3-year standard Compute Engine Committed Use Discounts locked to specific VM machine families across all projects to capture the highest static discount tier, and manually review monthly billing CSV downloads to allocate costs across business units.

Migrate all regional application relational databases and telemetry analytics pipelines to Cloud Spanner across all environments to consolidate data storage under a single globally managed billing meter.

Assign the primitive Owner role on each project to individual department leads so they can directly modify billing export settings, shut down resources, and adjust resource quotas independently.

Cevabı ve açıklamayı göster

Cevap: Export detailed Cloud Billing data to BigQuery at the organization level, enforce standardized resource labeling (such as cost-center and environment) using Organization Policies, purchase Flexible Committed Use Discounts for baseline hourly spend across compute and database services, and use BigQuery autoscaling slots for dynamic analytical workloads.

Cevap

Export detailed Cloud Billing data to BigQuery at the organization level, enforce standardized resource labeling using Organization Policies, purchase Flexible Committed Use Discounts for baseline hourly spend, and use BigQuery autoscaling slots for dynamic workloads.

The correct strategy combines automated billing data ingestion into BigQuery with organizational policy enforcement of resource labels (tags) to establish accurate chargeback and unit-economics tracking. Utilizing Flexible Committed Use Discounts (CUDs) optimizes steady-state spend across services without locking into static VM configurations, and BigQuery autoscaling slots efficiently accommodate bursty analytical workloads.

Adım Adım Çözüm

Establish centralized visibility and cost attribution.

Detailed Cloud Billing export to BigQuery provides raw data for reporting, while required resource labels (enforced via tag policy/IaC) enable accurate chargeback/showback per business unit and active device metric.

FinOps visibility requires granular data ingestion and structured resource metadata across all 40 projects.

Optimize steady-state compute and database spend.

Flexible Committed Use Discounts (CUDs) apply discounts automatically to hourly spend across eligible compute services (e.g., Compute Engine, Cloud Run) and databases regardless of region or machine family.

Spend-based Flexible CUDs mitigate risk compared to rigid instance-based CUDs while securing baseline discounts.

Manage unpredictable analytical query costs.

Leveraging BigQuery editions with slot autoscaling handles bursty clinical trial audit analysis without requiring idle reserved slot capacity.

Autoscaling slot reservations balance performance during peak audit cycles with low baseline cost.

Anahtar Kavram

FinOps Cost Governance, Resource Allocation via Labels, and Flexible Commitment Models in GCP

Soru 218Soru →

A digital logistics enterprise operates an automated order-routing engine hosted on Google Cloud. Contractual agreements with major enterprise clients define a Service Level Agreement (SLA) requiring $99.9\%$ of order-routing requests to be processed in under $200\text{ ms}$ each month, with financial penalties enforced for non-compliance. The Site Reliability Engineering (SRE) team must align technical metrics with business goals without over-engineering operational overhead. Which strategy correctly establishes the Service Level Indicator (SLI) and Service Level Objective (SLO) to protect business interests?

Define the SLI as the proportion of valid requests completed within

150\text{ ms}

, and set an internal SLO target of

99.95\%

, creating a performance buffer before breaching the external SLA.

Define the SLO as the metric ratio of requests completed under

200\text{ ms}

captured in Cloud Monitoring, and use the business SLA target of

99.9\%

as the SLI measurement.

Configure static Cloud Monitoring alert thresholds that trigger immediate on-call pages whenever request latency exceeds

200\text{ ms}

over a 5-minute window, bypassing internal SLO error budget tracking.

Deploy a multi-region active-active architecture targeting

99.999\%

continuous availability to guarantee that latency thresholds are never exceeded under any failure condition.

Cevabı ve açıklamayı göster

Cevap: Define the SLI as the proportion of valid requests completed within $150\text{ ms}$ , and set an internal SLO target of $99.95\%$ , creating a performance buffer before breaching the external SLA.

Cevap

The correct strategy defines the SLI as the percentage of valid requests completed within a tighter response time (

150\text{ ms}

) and sets an internal SLO (

99.95\%

) tighter than the external SLA (

99.9\%

200\text{ ms}

) to establish a protective error budget buffer.

Defining the SLI as a specific measurable request metric (

\le 150\text{ ms}

) and setting an internal SLO (

99.95\%

) tighter than the business SLA (

99.9\%

200\text{ ms}

) aligns engineering objectives with business risk. The margin creates an actionable error budget buffer, enabling engineering teams to detect and fix performance degradation before external SLA breaches and financial penalties occur.

Adım Adım Çözüm

Differentiate SLI, SLO, and SLA roles in SRE practice.

SLI is the metric measuring actual performance, SLO is the internal target percentage for that metric, and SLA is the external business contract with financial penalties.

Clear layer separation ensures technical metrics directly track operational risks against business impact.

Establish protective margin between internal goals and external commitments.

Setting an internal SLO target of

99.95\%

150\text{ ms}

provides proactive alerting and error budget management prior to reaching the contractual SLA boundary of

99.9\%

200\text{ ms}

Allows SRE teams to mitigate issues before business penalties are triggered.

Anahtar Kavram

Aligning Technical SLOs/SLIs with Business SLAs

Soru 219Soru →

A multinational retail supply chain platform operates dozens of Google Cloud projects under a central Cloud Billing account. The organization is establishing a formal FinOps function to improve cost visibility, enforce governance, and reduce overall cloud expenditure without compromising workload performance. The architecture includes steady-state core databases, variable microservices, and multi-departmental development environments. Which of the following governance and cost optimization strategies should the lead Cloud Architect recommend? (Select THREE).

Geçerli olan tümünü seçin

Export detailed Cloud Billing data to BigQuery and construct centralized dashboard reports to analyze cost allocations and unit economics across business units.

Configure Cloud Billing budgets with programmatic Pub/Sub notifications to send real-time alerts and trigger automated governance workflows when thresholds are exceeded.

Acquire spend-based Flexible Committed Use Discounts (CUDs) at the Billing Account level to cover baseline compute usage across multiple regions and service types.

Purchase 3-year standard resource-based Committed Use Discounts (CUDs) for highly variable, short-term batch container workloads running on GKE node pools.

Assign primitive Owner IAM roles to financial analysts across all child projects so they can directly modify and shut down underutilized cloud infrastructure.

Cevabı ve açıklamayı göster

Cevap: Export detailed Cloud Billing data to BigQuery and construct centralized dashboard reports to analyze cost allocations and unit economics across business units.; Configure Cloud Billing budgets with programmatic Pub/Sub notifications to send real-time alerts and trigger automated governance workflows when thresholds are exceeded.; Acquire spend-based Flexible Committed Use Discounts (CUDs) at the Billing Account level to cover baseline compute usage across multiple regions and service types.

Cevap

The recommended actions are exporting Cloud Billing data to BigQuery for centralized cost visibility, configuring Cloud Billing budget alerts with Pub/Sub notifications for proactive governance, and purchasing spend-based Flexible Committed Use Discounts at the billing account level to baseline compute expenditure across services.

Establishing effective FinOps governance requires a combination of visibility, proactive control, and flexible commitment optimization. Exporting billing data to BigQuery provides the granular datasets necessary for building custom department-level cost reports and tracking metrics. Implementing billing budgets with Pub/Sub topics allows engineering teams to receive automated warnings and trigger programmatic mitigation actions when spend thresholds are approached. Finally, purchasing spend-based Flexible Committed Use Discounts at the Cloud Billing account level ensures baseline compute usage across various services and regions is discounted without locking the organization into rigid instance configurations.

Adım Adım Çözüm

Establish cost visibility and reporting foundation

Detailed Cloud Billing export to BigQuery enables department cost attribution and unit economics analysis.

FinOps governance requires reliable granular data for chargeback, showback, and reporting.

Implement proactive governance and alerting mechanism

Budgets configured with Pub/Sub deliver real-time threshold alerts and support automated remediations.

Automated alerting prevents budget overruns before they accumulate high billing charges.

Optimize baseline compute spending using flexible commitments

Flexible CUDs apply hourly spend commitments across Compute Engine, GKE, and Cloud Run globally.

Spend-based Flexible CUDs maximize discount coverage across diverse and evolving workload types.

Anahtar Kavram

FinOps Cost Optimization and Governance Framework

Soru 220Soru →

A software engineering team is designing a CI/CD pipeline using Cloud Build to automate infrastructure updates with Terraform and deploy microservices to a private Google Kubernetes Engine (GKE) cluster. The pipeline needs to read and update Terraform state files stored in a Cloud Storage bucket, interact with the GKE control plane, and execute containerized deployments. To adhere to Google Cloud security best practices and the principle of least privilege, how should the Cloud Build pipeline permissions and network configuration be designed?

Assign the primitive Owner role to the Cloud Build service account at the project level to ensure full administrative access to Cloud Storage state files and GKE resources.

Grant fine-grained roles such as Storage Object Admin on the specific state bucket and Kubernetes Engine Developer on the cluster, while routing Cloud Build traffic through a private worker pool authorized to access the GKE control plane.

Grant the Cloud Build service account the Service Account Admin role across the project so that it can elevate its privileges dynamically during pipeline execution.

Store the Terraform state files on local ephemeral disks within the Cloud Build build steps to avoid granting Cloud Storage IAM permissions.

Cevabı ve açıklamayı göster

Cevap: Grant fine-grained roles such as Storage Object Admin on the specific state bucket and Kubernetes Engine Developer on the cluster, while routing Cloud Build traffic through a private worker pool authorized to access the GKE control plane.

Cevap

The solution follows security best practices by assigning minimal, resource-scoped IAM roles (Storage Object Admin on the state bucket and Kubernetes Engine Developer on the cluster) and utilizing Cloud Build Private Pools to securely communicate with the private GKE master endpoint.

Adım Adım Çözüm

Identify the minimum required IAM permissions for each pipeline operation

The pipeline requires Object Admin rights restricted to the specific Terraform state bucket and Developer access to the GKE cluster, rather than project-wide primitive or service account admin roles.

Enforces the principle of least privilege and prevents unauthorized operational modifications across other project resources.

Establish secure network connectivity between Cloud Build and private GKE control plane endpoints

Cloud Build Private Pools connected via VPC peering allow worker nodes to access private GKE master IP ranges.

Default public Cloud Build workers cannot access private GKE control planes unless authorized IP ranges or private worker pools are configured.

Ensure durable infrastructure state management

Remote persistent storage in Cloud Storage with object versioning guarantees state file preservation across automated pipeline builds.

Ephemeral runner storage causes loss of state and breaks infrastructure automation.

Anahtar Kavram

Least-privilege IAM configuration and private network isolation for Cloud Build pipelines interacting with GKE and Cloud Storage

ÖncekiSayfa 11 / 80Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram