Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 301Soru →

A financial enterprise is deploying a mission-critical transactional ledger on Google Cloud. The system requires a relational database capable of providing global synchronous consistency, multi-region high availability, and horizontal write scalability. Regulatory compliance mandates that all data at rest must be encrypted using key management service integration (Cloud KMS) rather than raw keys managed by the application team. Additionally, all infrastructure must be provisioned using automated Terraform pipelines. To support concurrent pipeline runs and prevent configuration corruption, how should the database and infrastructure state management be configured?

Cevabı ve açıklamayı göster

Cevap: Provision Cloud Spanner across multiple regions with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and store the Terraform state in a Cloud Storage remote backend with object versioning and state locking enabled.

Cevap

Provision Cloud Spanner across multiple regions with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and store the Terraform state in a Cloud Storage remote backend with object versioning and state locking enabled.
The correct solution selects Cloud Spanner to satisfy global consistency and horizontal write scalability, integrates CMEK via Cloud KMS to comply with encryption governance without taking on raw key management burdens, and uses a locked, versioned Cloud Storage remote backend to prevent state corruption during automated CI/CD pipeline deployments.

Adım Adım Çözüm

1
Evaluate database requirements for global relational transactions and horizontal scaling
Cloud Spanner is selected because Cloud SQL cannot scale write operations horizontally across multiple regions with global consistency.
Relational workloads requiring global scale and multi-region synchronous write availability require Cloud Spanner.
2
Evaluate encryption key management compliance requirements
Customer-Managed Encryption Keys (CMEK) using Cloud KMS are chosen over Customer-Supplied Encryption Keys (CSEK).
CMEK allows central policy enforcement and lifecycle management in Cloud KMS without forcing the application team to manage raw key binaries.
3
Establish secure Infrastructure as Code (IaC) state management
Configure a Terraform backend using Google Cloud Storage with object versioning and state locking enabled via Cloud Storage native lock mechanisms.
Remote state backends with locking prevent concurrent pipeline execution conflicts and enable recovery from accidental state corruption.

Anahtar Kavram

Cloud Spanner CMEK Provisioning & Terraform Remote State Management
Tahmini Süre:3m 0s
Soru 302Soru →

An enterprise logistics company is transitioning its Google Cloud infrastructure automation to HashiCorp Terraform. To support collaborative deployment pipelines across multiple engineering teams, the lead architect must establish a centralized state management architecture that prevents concurrent state modification conflicts and enables recovery if state files are corrupted or accidentally deleted. Which strategy satisfies these operational requirements following Google-recommended best practices?

Cevabı ve açıklamayı göster

Cevap: Configure a Terraform Google Cloud Storage remote backend referencing a dedicated GCS bucket with Object Versioning enabled.

Cevap

Configure a Terraform Google Cloud Storage remote backend referencing a dedicated GCS bucket with Object Versioning enabled.
Configuring the standard `gcs` remote backend in Terraform allows teams to store state in Google Cloud Storage. The GCS backend natively supports state locking using Cloud Storage strong consistency and object generation preconditions, preventing concurrent operations from corrupting state. Enabling Object Versioning on the bucket ensures historical state file versions are retained for point-in-time recovery.

Adım Adım Çözüm

1
Identify state locking and concurrency control requirements for multi-developer Terraform environments on GCP.
Recognize that a remote backend is required rather than local state storage.
Local state storage cannot safely handle multi-user concurrent pipeline executions.
2
Evaluate GCP native storage options for Terraform remote backend integration.
Select the GCS backend (`backend "gcs"`), which leverages Cloud Storage object generation metageneration preconditions for atomic state locking.
GCS backend natively provides lock acquisition and release without requiring external database locks.
3
Evaluate data protection and state recovery mechanisms.
Enable Object Versioning on the GCS state bucket.
Object Versioning ensures that previous state snapshots are preserved, allowing rapid rollback if a state file becomes corrupted.

Anahtar Kavram

Terraform Remote Backend with Google Cloud Storage and State Locking
Tahmini Süre:1m 30s
Soru 303Soru →

An organization is deploying two separate workload networks: a Staging VPC and a Production VPC. Both VPCs require private communication with a central Shared VPC that hosts shared services and maintains a Cloud VPN connection to an on-premises data center. To maintain compliance, network traffic between the Staging VPC and Production VPC must be strictly blocked, and direct IP routing between them must not exist. Which TWO network topology configurations should you implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a VPC Network Peering connection between the Staging VPC and the Shared VPC, and a separate VPC Network Peering connection between the Production VPC and the Shared VPC.; Configure the VPC Peering connections to export custom routes from the Shared VPC and import custom routes into the Staging and Production VPCs.

Cevap

To connect Staging and Production VPCs to shared resources and on-premises networks while keeping them completely isolated from each other, configure separate VPC Network Peering connections from each spoke VPC to the Shared VPC, and enable custom route import/export on those peering connections.
The solution leverages the non-transitive property of GCP VPC Network Peering. Peering each spoke VPC individually to the Shared VPC permits communication with central resources while guaranteeing that traffic cannot transit between the Staging and Production VPCs. Additionally, enabling custom route import and export on the peering connections allows dynamic routes learned from the central Cloud VPN connection to be propagated to both spoke VPCs.

Adım Adım Çözüm

1
Evaluate network isolation requirements between Staging and Production VPCs.
Confirm that direct routing between Staging and Production must be absent.
VPC Network Peering does not support transitive routing. If Spoke A is peered to Hub, and Spoke B is peered to Hub, Spoke A cannot reach Spoke B through the Hub VPC unless explicitly connected.
2
Design hub-and-spoke peering connections.
Peer Staging VPC to Shared VPC, and Production VPC to Shared VPC.
This grants both spokes access to the Shared VPC while leveraging non-transitivity to block inter-spoke routing.
3
Enable hybrid route propagation across peering boundaries.
Configure import and export of custom routes on both VPC peering connections.
By default, peering connections do not exchange dynamic routes learned from Cloud VPN/Interconnect. Enabling custom route exchange allows spokes to learn on-premises routes via the Shared VPC's Cloud Router.

Anahtar Kavram

Hub-and-spoke VPC topology using non-transitive VPC Network Peering and custom route exchange
Tahmini Süre:2m 0s
Soru 304Soru →

An organization runs containerized microservices on a Google Kubernetes Engine (GKE) cluster. These microservices need to read data from Google Cloud Storage buckets. Enterprise compliance guidelines strictly prohibit generating, downloading, or storing long-lived service account JSON key files due to the risk of credential leakage. Which architectural solution should you implement to authenticate the GKE workloads against Google Cloud Storage while following Google's recommended security practices?

Cevabı ve açıklamayı göster

Cevap: Enable GKE Workload Identity, bind the Kubernetes service account used by the microservices to a dedicated Google Cloud service account, and grant that Google Cloud service account the Storage Object Viewer role on the required buckets.

Cevap

Enable GKE Workload Identity, bind the Kubernetes service account used by the microservices to a dedicated Google Cloud service account, and grant that Google Cloud service account the Storage Object Viewer role on the required buckets.
The solution using Workload Identity allows Kubernetes service accounts to securely impersonate Google Cloud service accounts without creating, downloading, or managing long-lived service account JSON keys. Granting the Storage Object Viewer role enforces least privilege by giving the microservices only the necessary read permissions on Cloud Storage.

Adım Adım Çözüm

1
Identify key security constraints and authentication requirements.
Long-lived Service Account JSON keys are explicitly banned by enterprise policy, ruling out key file generation and mounting.
Workload authentication must use keyless short-lived credential exchange.
2
Select the native GCP identity mechanism for containerized GKE workloads.
GKE Workload Identity enables pods running under a Kubernetes Service Account (KSA) to act as a Google IAM Service Account (GSA).
Workload Identity eliminates the operational overhead and security risk of managing service account keys.
3
Apply least-privilege IAM permissions.
Assign the fine-grained predefined role 'Storage Object Viewer' (roles/storage.objectViewer) to the Google Cloud Service Account specifically on the target buckets.
Primitive roles like Editor or broad administrative roles violate the principle of least privilege.

Anahtar Kavram

GKE Workload Identity and Service Account Lifecycle Security
Tahmini Süre:1m 30s
Soru 305Soru →

A telecommunications enterprise is implementing Google Cloud Deploy to automate release management for stateless customer portal services on Cloud Run. The security governance policy dictates that deployment automation must strictly adhere to least-privilege principles: release engineers must be allowed to create releases and approve promotions between staging and production environments, but they must not hold direct administrative control over target Cloud Run resources or possess rights to manage IAM service account keys. Which pipeline configuration fulfills these security and delivery requirements?

Cevabı ve açıklamayı göster

Cevap: Configure Cloud Deploy delivery pipelines with dedicated execution service accounts holding the Cloud Deploy Job Runner role, and assign release engineers the Cloud Deploy Releaser role to approve promotions via the Cloud Deploy API.

Cevap

Configure Cloud Deploy delivery pipelines with dedicated execution service accounts holding the Cloud Deploy Job Runner role, and assign release engineers the Cloud Deploy Releaser role to approve promotions via the Cloud Deploy API.
The correct strategy leverages Google Cloud Deploy's native IAM architecture. By granting release engineers the Cloud Deploy Releaser role (`roles/clouddeploy.releaser`), they can initiate releases and approve stage promotions through Cloud Deploy APIs without direct IAM access to the underlying Cloud Run instances. Cloud Deploy performs the actual rendering and deployment operations using a dedicated service account configured with the Cloud Deploy Job Runner role (`roles/clouddeploy.jobRunner`), satisfying strict governance and least-privilege requirements.

Adım Adım Çözüm

1
Analyze security and operational constraints for the deployment pipeline.
Identified the requirement to separate human approval privileges from execution identity privileges without granting administrative access to target environments.
Security policy prohibits engineers from having direct resource modification or key management rights in production.
2
Evaluate Google Cloud Deploy IAM architecture.
Cloud Deploy uses execution service accounts with `roles/clouddeploy.jobRunner` for target resource deployment, while human users interact with `roles/clouddeploy.releaser` to trigger releases and approve rollouts.
This configuration provides role separation and enforces fine-grained access control across environment stages.
3
Select the option that configures proper Cloud Deploy IAM roles without unnecessary infrastructure overhead or over-privileged roles.
The configuration using dedicated execution service accounts with Job Runner permissions combined with Releaser roles for engineers satisfies all security constraints.
It achieves automated deployment with strict compliance to least privilege principles.

Anahtar Kavram

Least-Privilege Security Model in Continuous Deployment Pipelines
Tahmini Süre:1m 30s
Soru 306Soru →

An enterprise organization is deploying core cloud infrastructure to Google Cloud using Terraform. Multiple cloud engineers perform concurrent deployments across automated CI/CD pipelines and local workstations. The lead architect must ensure that Terraform state files are securely protected against corruption, support state locking during concurrent execution, retain historical state versions for disaster recovery, and follow GCP least-privilege security principles. Which architecture configuration should the team implement?

Cevabı ve açıklamayı göster

Cevap: Configure a Cloud Storage (GCS) backend in Terraform with object versioning enabled, using Cloud IAM fine-grained roles for service account access control.

Cevap

Configure a Cloud Storage (GCS) backend in Terraform with object versioning enabled, using Cloud IAM fine-grained roles for service account access control.
Configuring a Cloud Storage (GCS) bucket as the remote backend for Terraform inherently provides atomic state locking and consistency. Enabling object versioning ensures state history retention for rollback or recovery, while applying granular IAM roles enforces security best practices.

Adım Adım Çözüm

1
Identify the storage requirement for remote state management and concurrency protection.
Cloud Storage (GCS) provides a centralized remote backend for Terraform state.
Remote state centralization prevents isolated, conflicting local state files among team members.
2
Enable object versioning on the Cloud Storage bucket and verify state locking capabilities.
GCS natively supports state locking and holds full version history for state recovery.
State locking prevents concurrent executions from mutating state simultaneously, while versioning allows recovery from corrupted state runs.
3
Apply Google Cloud IAM least-privilege access controls.
Service accounts access the GCS state bucket via minimal predefined storage roles (such as Storage Object Admin on the specific state bucket).
Avoids granting excessive project-level primitive roles like Owner or Editor.

Anahtar Kavram

Terraform Remote Backend and State Management Best Practices on GCP
Tahmini Süre:1m 30s
Soru 307Soru →

Your DevOps team needs to provision a Google Kubernetes Engine (GKE) cluster for an internal administration service. The control plane endpoint must not be exposed to the public internet, but cluster administrators must be able to run cluster management commands from specific on-premises corporate IP addresses. Which deployment configuration should you provision to meet these access requirements?

Cevabı ve açıklamayı göster

Cevap: Provision a private GKE cluster with public endpoint access disabled and enable control plane authorized networks for the corporate IP ranges.

Cevap

Provisioning a private GKE cluster with public endpoint access disabled and control plane authorized networks configured for the corporate IP ranges satisfies both privacy and administrative access requirements.
Provisioning a private GKE cluster with public endpoints disabled isolates the control plane to private IP addresses. Enabling control plane authorized networks allows specified corporate IP ranges to securely access the Kubernetes API server via authorized routing.

Adım Adım Çözüm

1
Identify the private endpoint requirement for GKE cluster control plane nodes.
Disabling public control plane access ensures nodes and master endpoints rely on private IP addresses within the VPC.
This prevents direct exposure of cluster control endpoints to the public internet.
2
Configure master authorized networks for remote administration access.
Specify the exact corporate on-premises CIDR blocks allowed to reach the private master endpoint.
Control plane authorized networks enforce network-level access control for administration tasks.

Anahtar Kavram

Private GKE Cluster Endpoint Security and Master Authorized Networks
Soru 308Soru →

A financial services organization needs to transfer 500 TB of static unstructured archival data from their on-premises network attached storage (NAS) to a Cloud Storage bucket in Google Cloud. The organization has a dedicated 10 Gbps Cloud Interconnect line with available bandwidth and requires an automated online transfer mechanism that performs data integrity checks without sending physical hardware. Which Google Cloud service should the cloud architect recommend?

Cevabı ve açıklamayı göster

Cevap: Storage Transfer Service

Cevap

The cloud architect should recommend Storage Transfer Service.
Storage Transfer Service is the recommended Google Cloud solution for online data transfers of large datasets from on-premises storage systems to Cloud Storage over available high-speed network connectivity. It automates file copy, scaling, and checksum validation.

Adım Adım Çözüm

1
Identify the data volume, source/destination, and network constraints.
500 TB of unstructured files need to be moved online from on-premises NAS to Cloud Storage over an existing 10 Gbps Cloud Interconnect.
The bandwidth (10 Gbps) is sufficient to perform an online transfer, eliminating the need for physical media delivery.
2
Evaluate Google Cloud data transfer options.
Storage Transfer Service provides managed, secure, scale-out online data movement for on-premises file data directly into Cloud Storage.
It natively handles automatic retries, checksum validation, and scheduling without manual script maintenance.

Anahtar Kavram

Selecting Online Data Transfer Mechanisms for Cloud Storage
Soru 309Soru →

An enterprise organization wants to collect and centralize application log entries from all Google Cloud projects within its organization hierarchy into a single BigQuery dataset hosted in a dedicated security project. The architecture must adhere to Google Cloud recommended best practices for security and minimal operational overhead. Which approach should the Cloud Architect implement to configure this logging pipeline?

Cevabı ve açıklamayı göster

Cevap: Create an aggregated log sink at the Organization level configured with BigQuery as the destination, and grant the sink's dedicated writer identity the BigQuery Data Editor role on the central dataset.

Cevap

Create an aggregated log sink at the Organization level with BigQuery as the destination, and grant the sink's writer identity the BigQuery Data Editor role on the central dataset.
An aggregated log sink created at the Organization level automatically gathers logs across all descendant resources. Granting the sink's writer identity a specific, predefined role (BigQuery Data Editor) directly on the target dataset satisfies least-privilege security principles.

Adım Adım Çözüm

1
Determine the optimal scope for centralized logging across multiple Google Cloud projects.
Using an Organization-level aggregated log sink ensures all child folders and projects are automatically covered without per-project configuration.
Centralized aggregation minimizes administrative maintenance and guarantees complete operational visibility.
2
Configure the target destination and IAM authorization for the sink's service account.
Set BigQuery dataset as destination and grant `roles/bigquery.dataEditor` to the unique writer identity automatically generated for the sink.
Cloud Logging sinks use service accounts (writer identities) to push logs to destinations; assigning fine-grained roles enforces least-privilege security.

Anahtar Kavram

Organization-level aggregated log sinks and least-privilege destination authorization
Soru 310Soru →

An enterprise organization operates hundreds of Google Cloud projects under a single GCP Organization. The security and operations teams require a centralized logging solution to route high-severity audit logs and operational metrics to an on-premises Security Information and Event Management (SIEM) platform via Cloud Pub/Sub in near real-time. The solution must minimize administrative maintenance, apply least-privilege security access control, and capture logs from newly created projects automatically. Which architectural and configuration strategy should the Cloud Architect implement?

Cevabı ve açıklamayı göster

Cevap: Configure an aggregated log sink at the GCP Organization level with an inclusion filter for the required audit and operational logs, set the sink destination to a Pub/Sub topic in a dedicated logging project, and grant the sink's generated writer identity the Pub/Sub Publisher role (roles/pubsub.publisher) on the target topic.

Cevap

The correct strategy is to configure an aggregated log sink at the GCP Organization level with a Pub/Sub topic destination in a dedicated project and grant the sink's writer identity the Pub/Sub Publisher role (roles/pubsub.publisher) on the target topic.
Configuring an aggregated log sink at the Organization root automatically inherits down the resource hierarchy to catch logs from all present and future projects. Specifying a centralized Pub/Sub topic destination and granting only `roles/pubsub.publisher` to the sink's writer identity satisfies enterprise security compliance, operational automation, and least-privilege access control.

Adım Adım Çözüm

1
Evaluate organizational log collection requirements for multi-project management
Identify that creating individual project sinks causes significant administrative overhead and fails to automatically capture logs from future projects. An Organization-level aggregated log sink is required.
Aggregated sinks at the organization root automatically include all current and future child folders and projects.
2
Determine the destination and least-privilege IAM configuration for the log sink
Direct the aggregated sink to a centralized Pub/Sub topic and assign `roles/pubsub.publisher` specifically to the service account writer identity generated by the sink.
Cloud Logging sink export identities require granular permissions (Pub/Sub Publisher) specifically on the destination resource, adhering to IAM least-privilege principles.

Anahtar Kavram

Aggregated Cloud Logging Sinks and IAM Security Principles
Tahmini Süre:2m 0s
Soru 311Soru →

An enterprise needs to migrate 800 TB of historical archive files from an on-premises data center to Google Cloud Storage. The company operates a dedicated 100 Mbps internet link, of which only 30 Mbps can be safely allocated to migration traffic without degrading existing operations. Company policy mandates that the data transfer must be completed within 30 days. Which data transfer strategy should the cloud architect recommend?

Cevabı ve açıklamayı göster

Cevap: Order a Google Cloud Transfer Appliance, copy the archive data onto the device locally, and ship it to Google for direct ingestion into Cloud Storage.

Cevap

Order a Google Cloud Transfer Appliance, copy the archive data onto the device locally, and ship it to Google for direct ingestion into Cloud Storage.
The decision between online network transfer and offline physical appliance migration is governed by total data volume, available network bandwidth, and acceptable migration time. Transferring 800 TB over an available 30 Mbps link requires more than 6.7 years. Using Google Cloud Transfer Appliance allows high-speed local data ingest onto encrypted hardware, which is physically shipped to Google for rapid upload into Cloud Storage within days.

Adım Adım Çözüm

1
Calculate required transfer throughput
To move 800 TB (800×1012800 \times 10^{12} bytes) in 30 days (2.592×1062.592 \times 10^6 seconds), a sustained transfer rate of approximately 2.47 Gbps2.47\text{ Gbps} (308.6 MB/s308.6\text{ MB/s}) is required.
Determines whether an online transfer over the existing WAN connection is feasible within the target timeline.
2
Compare required throughput against available bandwidth
The available network bandwidth is 30 Mbps (0.03 Gbps0.03\text{ Gbps}), which yields only ∼324 GB/day\sim 324\text{ GB/day}, requiring over 2,460 days for complete migration.
Evaluates network bandwidth limitations against business timeline constraints.
3
Select the appropriate GCP transfer mechanism
Choosing an offline physical transfer method using Google Cloud Transfer Appliance bypasses WAN bandwidth bottlenecks and fulfills the 30-day window.
Transfer Appliance provides high-capacity hardware for secure offline data transport when network bandwidth is inadequate.

Anahtar Kavram

Selecting Online vs. Offline Data Transfer Strategies based on Dataset Size and Network Bandwidth
Tahmini Süre:2m 0s
Soru 312Soru →

An enterprise organization is architecting a public-facing API backend on Google Cloud to handle unpredictable burst traffic for a suite of stateless HTTP microservices. The business strategy mandates strict FinOps governance: infrastructure costs must scale strictly with incoming HTTP request volumes, scaling down to zero baseline cost during off-peak hours. Additionally, the organization has a lean Site Reliability Engineering (SRE) team that requires a fully managed environment to avoid node provisioning, OS patching, and Kubernetes cluster maintenance overhead. The services are packaged as standard OCI container images. Which compute platform architecture should a Cloud Architect recommend to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the containerized microservices directly to fully managed Cloud Run.

Cevap

Deploying the containerized microservices directly to fully managed Cloud Run is the optimal architecture.
Deploying the microservices to fully managed Cloud Run fulfills all architectural constraints. Cloud Run provides a serverless platform that natively runs OCI container images, automatically scales up or down to zero instances based on incoming request traffic, eliminates baseline operational costs during off-peak idle hours, and completely removes cluster and OS maintenance burdens from the SRE team.

Adım Adım Çözüm

1
Analyze technical and operational workload requirements
Workload requires stateless HTTP container execution, fast auto-scaling with zero baseline cost, and minimal operational maintenance.
The SRE team is small and the business mandates scaling costs strictly with request volume without fixed baseline charges.
2
Evaluate GCP compute platform candidates against scaling and management requirements
Compute Engine MIGs and GKE clusters incur baseline instance/cluster management overhead and continuous baseline infrastructure costs.
MIGs require OS management and cannot scale to zero; GKE introduces cluster management overhead and baseline cluster fees.
3
Select optimal serverless container platform
Cloud Run runs standard OCI containers natively, provides pay-per-request pricing, scales seamlessly from zero to high concurrency, and handles all underlying infrastructure management automatically.
Cloud Run fulfills every constraint: stateless container execution, zero cost during idle periods, and zero cluster node administration.

Anahtar Kavram

Selecting Serverless Container Compute (Cloud Run) vs. Managed Kubernetes (GKE) for Stateless Microservices
Tahmini Süre:2m 0s
Soru 313Soru →

A multinational financial clearing corporation is migrating its mission-critical ledger infrastructure to Google Cloud. The architecture requires hybrid connectivity between two on-premises data centers (located in Chicago and Frankfurt) and two Google Cloud regions (us-central1 and europe-west3). The design must deliver a sustained throughput of 40 Gbps per data center, guarantee a 99.99% availability SLA, allow on-premises systems in Chicago to communicate with cloud resources in europe-west3 without traversing public Internet, and prevent routing bottlenecks across regional workloads. Which hybrid network architecture should the Principal Cloud Architect recommend?

Cevabı ve açıklamayı göster

Cevap: Provision Dedicated Interconnect connections with redundant 10 Gbps or 100 Gbps circuits in two separate metropolitan edge availability domains per region, deploy Cloud Routers configured with Global Dynamic Routing in a Shared VPC host project, and establish BGP sessions with on-premises routers.

Cevap

Provision Dedicated Interconnect connections with redundant 10 Gbps or 100 Gbps circuits in two separate metropolitan edge availability domains per region, deploy Cloud Routers configured with Global Dynamic Routing in a Shared VPC host project, and establish BGP sessions with on-premises routers.
To achieve a 99.99% availability SLA and support 40 Gbps bandwidth, Google Cloud requires Dedicated Interconnect configured with redundant connections across two different edge availability domains (metropolitan locations) in each region, with two VLAN attachments per region connected to Cloud Routers. Setting Cloud Router dynamic routing mode to Global ensures that routes learned from on-premises BGP routers in one region (e.g., Chicago) are propagated across the entire VPC network, allowing direct communication with workloads in other regions (e.g., europe-west3).

Adım Adım Çözüm

1
Evaluate bandwidth and SLA requirements against connectivity options.
Sustained 40 Gbps bandwidth and 99.99% SLA eliminate Cloud VPN (which caps around 3 Gbps per tunnel) and mandate Dedicated Interconnect with redundant interconnect attachments across two edge availability domains in each region.
Dedicated Interconnect provides enterprise-grade, dedicated physical connections capable of 10 Gbps or 100 Gbps per link, meeting both high throughput and 99.99% SLA mandates.
2
Analyze cross-region hybrid routing requirements.
Enabling Global Dynamic Routing on Cloud Router allows routes learned via BGP in one region (e.g., us-central1 attached to Chicago) to be advertised to and accessible from subnets in another region (e.g., europe-west3).
Regional dynamic routing limits route propagation to the local VPC region, whereas Global Dynamic Routing enables seamless global VPC-wide connectivity.
3
Validate topology against VPC routing constraints.
Avoid transit VPC designs utilizing VPC Network Peering because VPC Network Peering does not support transitive routing for hybrid interconnects or VPNs.
VPC Network Peering cannot forward traffic between an on-premises router and a third-party peered VPC network.

Anahtar Kavram

Designing 99.99% SLA Hybrid Architecture with Dedicated Interconnect and Global Dynamic Routing
Tahmini Süre:3m 0s
Soru 314Soru →

An enterprise financial organization is deploying a private Google Kubernetes Engine (GKE) cluster for PCI-DSS compliant workloads. Cloud architects must grant security administrators on the corporate on-premises network access to the GKE control plane via Cloud Interconnect while keeping the control plane completely private from the public internet. Additionally, CI/CD deployment service accounts must be restricted to minimal permissions required to bind pod workloads to specific node pool identities. Which set of configuration steps meets these security and operational requirements?

Cevabı ve açıklamayı göster

Cevap: Configure the cluster as a private cluster with a private endpoint, enable Master Authorized Networks including the corporate on-premises CIDR blocks, and grant the CI/CD service account the Service Account User role on the node pool service account.

Cevap

The correct architecture requires provisioning a private GKE cluster with its private endpoint enabled, configuring Master Authorized Networks to permit on-premises CIDR ranges routed over Cloud Interconnect, and scoping CI/CD pipeline IAM permissions to roles/iam.serviceAccountUser on the node service account.
Private GKE clusters use Google-managed VPC peering for the control plane. Accessing the private control plane endpoint from on-premises networks connected via Cloud Interconnect requires Master Authorized Networks to be enabled with those specific CIDR blocks. In addition, scoping CI/CD deployment permissions to the Service Account User role satisfies least-privilege access when attaching node identities.

Adım Adım Çözüm

1
Analyze GKE Control Plane Private Access Requirements
Private GKE control plane endpoints reside in a Google-managed VPC. To allow corporate on-premises networks connected over Cloud Interconnect/VPN to reach this private endpoint, Master Authorized Networks must be explicitly configured with the on-premises CIDR blocks.
Without Master Authorized Networks configured for on-premises IP ranges, traffic originating outside the cluster VPC subnets will be blocked by default.
2
Determine Identity and Access Management (IAM) Privilege Bounds for CI/CD Pipelines
Deployment service accounts require permissions to assign service account identities to workloads/nodes.
Granting roles/iam.serviceAccountUser provides the minimum required permission to attach service accounts without granting administrative rights over IAM service account management (roles/iam.serviceAccountAdmin).
3
Synthesize Architecture Options
Combining private control plane endpoint authorization with minimal IAM service account assignment role satisfies security and functional constraints.
This meets both zero-public-exposure networking requirements and least-privilege identity governance policies.

Anahtar Kavram

Provisioning Private GKE Clusters and IAM Privilege Scoping
Tahmini Süre:2m 0s
Soru 315Soru →

An operations team needs to export security audit logs from multiple Google Cloud projects into a central BigQuery dataset for long-term compliance analysis. Which Cloud Logging mechanism should be configured in each source project to route these log entries to the destination dataset?

Cevabı ve açıklamayı göster

Cevap: A log sink configured with an inclusion filter that specifies the central BigQuery dataset as the destination

Cevap

Configure a log sink in each source project with an inclusion filter set to export logs to the central BigQuery dataset.
In Google Cloud Logging, log sinks control the export of log entries. By creating a sink with an inclusion filter pointing to a BigQuery dataset destination, Cloud Logging automatically routes matching log entries to BigQuery.

Adım Adım Çözüm

1
Identify the component used in Cloud Logging for external log routing.
Recognize that log sinks are the Google Cloud resource designed for routing log entries.
Log sinks specify filters to select log entries and define destinations outside or inside Cloud Logging.
2
Define inclusion criteria and destination details.
Set the inclusion filter for audit logs and specify the BigQuery dataset path.
Inclusion filters ensure only relevant audit log entries are forwarded to BigQuery.
3
Configure proper IAM authorization for the sink's writer identity.
Grant BigQuery Data Editor permissions to the sink service account on the target dataset.
The writer identity of the log sink requires permissions on the destination resource to append log data successfully.

Anahtar Kavram

Configuring log sinks in Google Cloud Logging for log export and centralization
Soru 316Soru →

A Cloud Architecture team is setting up Terraform for multi-developer infrastructure provisioning on Google Cloud. They need to ensure safe state collaboration, avoid state corruption during concurrent updates, and preserve historical state versions. Which backend architecture should the team implement to adhere to Google Cloud best practices?

Cevabı ve açıklamayı göster

Cevap: Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning enabled to support remote state locking and recovery.

Cevap

Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning enabled.
Using a Google Cloud Storage bucket with object versioning enabled as the Terraform remote backend is the recommended standard. It provides state locking natively to prevent concurrent executions from corrupting state, while object versioning enables easy recovery if a state file becomes corrupted or accidentally overwritten.

Adım Adım Çözüm

1
Identify the requirements for collaborative Terraform infrastructure management.
Requirements are central remote state storage, automated locking during concurrent executions, and version history for state recovery.
Team deployments require centralized state management to prevent race conditions and accidental data loss.
2
Evaluate Google Cloud Storage (GCS) backend capabilities for Terraform.
The GCS backend automatically leverages Cloud Storage object locking while bucket versioning preserves previous state snapshots.
This aligns directly with Google Cloud operational and security best practices for Infrastructure as Code.

Anahtar Kavram

Terraform Remote State Management with Cloud Storage
Soru 317Soru →

An organization needs to host a simple, stateless HTTP web microservice packaged in a Docker container. The application experiences unpredictable traffic, and the architecture team requires a solution that minimizes operational overhead by avoiding virtual machine or cluster management. Which Google Cloud compute platform should you select?

Cevabı ve açıklamayı göster

Cevap: Cloud Run

Cevap

Cloud Run is the optimal compute platform choice because it is a fully managed serverless service designed specifically for stateless HTTP containers, offering automatic scaling and zero cluster management overhead.
Cloud Run is a fully managed serverless compute platform that directly executes containerized applications. It automatically scales up or down—including down to zero—based on incoming web traffic, eliminating the need to manage virtual machines or Kubernetes clusters.

Adım Adım Çözüm

1
Identify workload characteristics and operational constraints
The application is a stateless HTTP microservice in a container, requiring automatic scaling with zero server or cluster administration overhead.
Matching workload requirements to compute platform capabilities ensures optimal resource selection.
2
Evaluate Google Cloud compute service models
Cloud Run executes containerized applications serverlessly and scales down to zero automatically without requiring VM or Kubernetes cluster provision.
Serverless container execution satisfies both the stateless container requirement and the minimal operational overhead constraint.

Anahtar Kavram

Selecting serverless container platforms for stateless HTTP microservices to minimize operational overhead
Tahmini Süre:45s
Soru 318Soru →

An organization is deploying a financial processing application on a Google Kubernetes Engine (GKE) private cluster. Company security policy dictates that the cluster's control plane must not accept administrative traffic over the public internet, and administrative commands must only originate from a dedicated management subnet in your Virtual Private Cloud (VPC). Which configuration should you implement to satisfy these security requirements while maintaining administrative access?

Cevabı ve açıklamayı göster

Cevap: Enable private endpoint access on the cluster control plane and configure Master Authorized Networks with the CIDR range of the management subnet.

Cevap

Enable private endpoint access on the cluster control plane and configure Master Authorized Networks with the CIDR range of the management subnet.
Enabling private control plane access combined with Master Authorized Networks ensures that only traffic originating from specified internal CIDR blocks (the management subnet) can connect to the Kubernetes API server.

Adım Adım Çözüm

1
Analyze control plane security requirements
The control plane endpoint must block public internet ingress while allowing traffic from a specific VPC subnet.
Organizational governance mandates perimeter restriction for administrative endpoints.
2
Evaluate GKE cluster networking features
Private GKE clusters support private control plane endpoints and Master Authorized Networks.
Master Authorized Networks provide IP-based firewalling for the Kubernetes API server endpoint.
3
Formulate deployment configuration
Specify the management subnet CIDR block under Master Authorized Networks for the cluster's private control plane endpoint.
This allows administrators on the management subnet to communicate with the API server while blocking unauthorized access.

Anahtar Kavram

GKE Private Cluster Control Plane Security & Authorized Networks
Soru 319Soru →

A retail organization is migrating a stateless, containerized REST API microservice to Google Cloud. The microservice experiences unpredictable traffic bursts during flash sales but remains completely idle during off-peak hours. The DevOps team has strict instructions to minimize operational overhead, eliminate baseline cluster management costs, and ensure automatic scaling down to zero instances when idle. Which Google Cloud compute platform should the cloud architect recommend for this workload?

Cevabı ve açıklamayı göster

Cevap: Deploy the containerized service on Cloud Run.

Cevap

Deploying the containerized service on Cloud Run is the optimal recommendation because it offers serverless operation, seamless scale-to-zero capability, pay-per-use billing, and eliminates infrastructure management overhead.
Deploying the service on Cloud Run fulfills all functional and operational constraints. It natively runs stateless container images, manages TLS/HTTPS endpoints out of the box, scales dynamically based on incoming HTTP requests, automatically scales to zero instances when idle to eliminate unnecessary costs, and requires no cluster administration.

Adım Adım Çözüm

1
Analyze workload requirements
The application is stateless, containerized, experiences bursty traffic, stays idle off-peak, and requires minimal operational overhead and zero baseline cost.
Matching technical and business constraints narrows the suitable compute platforms on GCP.
2
Evaluate GCP compute options against constraints
Cloud Run supports containerized deployment, scales down to zero, incurs no cost when idle, and requires no cluster management.
Cloud Run provides fully managed serverless container execution perfectly tailored to stateless HTTP workloads.

Anahtar Kavram

Selecting serverless compute platforms (Cloud Run) versus Kubernetes or virtual machine infrastructure based on workload statefulness, operational overhead limits, and scale-to-zero requirements.
Tahmini Süre:1m 30s
Soru 320Soru →

An online education organization is launching a new stateless HTTP microservice that receives student quiz responses, performs light validation, and publishes events to Google Cloud Pub/Sub. The workload experiences unpredictable, highly variable traffic with prolonged periods of complete inactivity during nighttime hours. The engineering leadership wants to minimize operational overhead and prevent paying for idle compute capacity. Which architecture recommendation best fulfills these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the microservice as a Cloud Run containerized service configured to scale down to zero instances when idle.

Cevap

Deploy the microservice as a Cloud Run containerized service configured to scale down to zero instances when idle.
Deploying to Cloud Run is the optimal architectural choice because Cloud Run automatically handles container execution, scales down to zero instances when no HTTP requests are being processed, and eliminates operational management of underlying infrastructure.

Adım Adım Çözüm

1
Analyze workload characteristics and requirements
The application is a stateless HTTP microservice with unpredictable traffic spikes and long idle periods, requiring minimal operational overhead and zero idle cost.
Identifying statefulness, scaling behavior, and operational constraints is necessary to select the correct compute platform.
2
Evaluate candidate compute platforms against constraints
Cloud Run supports containerized stateless HTTP workloads, scales automatically to zero when inactive to eliminate idle costs, and operates as a fully managed service with minimal operational overhead.
Matching serverless container capabilities against business constraints demonstrates optimal architectural design.

Anahtar Kavram

Selecting serverless container platforms (Cloud Run) for stateless HTTP microservices with variable traffic patterns to minimize operational overhead and cost.
ÖncekiSayfa 16 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin