Tüm alıştırma soruları

174 soru

Tüm türler1,598 Çoktan seçmeli815 Çoklu seçim537 Sayısal8 Eşleştirme64 Sıralama174

An enterprise operations team is experiencing intermittent database timeout errors across multiple microservices. The team needs to configure automated real-time incident notifications based on log entries generated by these failures. Place the operational configuration steps in the correct chronological order to establish a log-based metric and an associated Cloud Monitoring alerting policy.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins by defining an advanced log filter in Cloud Logging, constructing a log-based counter metric from the filtered query, creating a Cloud Monitoring Alerting Policy with threshold conditions set on that metric, and finalizing the policy by attaching notification channels and runbook documentation.

Establishing automated operational alerting based on log events follows a strict dependency path: identifying target logs via query filters, transforming log event occurrences into metric time-series data, building an alert policy with threshold evaluation rules, and attaching notification channels to complete incident dispatch.

Adım Adım Çözüm

Filter target logs in Cloud Logging.

Filtered log stream isolated.

Determines the precise log payload matching database timeout conditions.

Construct a log-based metric.

Custom time-series metric created in Cloud Monitoring.

Converts unstructured log occurrences into continuous quantitative data for evaluation.

Define Alerting Policy condition.

Alert threshold and evaluation window established.

Sets the numeric rules for when log error rates breach operational SLAs.

Bind notification channels and runbook metadata.

Active alert policy configured for automated incident notification.

Ensures on-call engineers receive notifications and standard operating procedures upon policy trigger.

Anahtar Kavram

End-to-end configuration sequence for log-based metrics and operational alert policies in GCP

Soru 42Soru →

An energy utility company is migrating its smart grid analytics and operations workload to Google Cloud. The current environment consists of $3.5\text{ PB}$ of historical smart meter reading archives stored on an on-premises Storage Area Network (SAN) and an active $8\text{ TB}$ operational MySQL database used for billing. The enterprise has a $1\text{ Gbps}$ Dedicated Interconnect link with a policy capping cloud migration bandwidth to $300\text{ Mbps}$ . The target architecture requires minimal downtime for the operational database during cutover (under $1\text{ hour}$ ) and complete data integrity across all systems. In what sequence should the Cloud Architect execute these steps to perform the migration?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct migration sequence is: 1) Order and seed bulk historical archives (

3.5\text{ PB}

) offline using Transfer Appliance; 2) Configure Database Migration Service (DMS) with CDC to continuously replicate the active

8\text{ TB}

MySQL database over Dedicated Interconnect; 3) Execute Storage Transfer Service delta sync for incremental updates accrued during shipping; 4) Stop on-premises write traffic and wait for DMS replication lag to reach zero; 5) Promote Cloud SQL to primary and update application connection endpoints.

The correct operational sequence begins by addressing the largest migration bottleneck offline via Transfer Appliance (

3.5\text{ PB}

bulk historical data). Next, continuous online replication for the active database (

8\text{ TB}

MySQL) is established using Database Migration Service with CDC over the Dedicated Interconnect. Once the physical appliance data is loaded in GCP, Storage Transfer Service updates any delta changes accrued during appliance shipping. Finally, write traffic to the source database is stopped during the cutover window to achieve zero replication lag before promoting Cloud SQL and updating application endpoints.

Adım Adım Çözüm

Seed bulk offline archive data (

3.5\text{ PB}

) via Transfer Appliance.

Initial

3.5\text{ PB}

archive is safely shipped and loaded into Cloud Storage without choking the

300\text{ Mbps}

network cap.

Petabyte-scale transfers over limited bandwidth require physical appliance offloading to meet project schedules.

Establish continuous online database replication using DMS with CDC for the

8\text{ TB}

MySQL workload.

Database replication runs in the background while production write operations continue uninterrupted on-premises.

Continuous CDC minimizes cutover downtime to just the time needed for final log flush and endpoint redirection.

Perform delta catch-up sync using Storage Transfer Service.

Incremental SAN updates generated during Appliance transit are synced to Cloud Storage.

Guarantees complete file storage sync before cutting over application workflows.

Initiate cutover window by stopping writes on-premises and confirming zero DMS replication lag.

Ensures no un-replicated transactions remain in the pipeline.

Prevents split-brain scenarios and data loss before database promotion.

Promote Cloud SQL to primary and update application configurations.

Application traffic resumes pointing directly to Google Cloud services within the

1\text{-hour}

downtime limit.

Final step to complete workload migration and switch over production operations.

Anahtar Kavram

Combining offline bulk transfer (Transfer Appliance) for multi-petabyte historical datasets with online continuous replication (DMS with CDC) for transactional databases to minimize cutover downtime and network saturation.

Tahmini Süre:2m 30s

Soru 43Soru →

Arrange the levels of the Google Cloud resource hierarchy in sequence from the highest level (broadest IAM policy inheritance scope) to the lowest level (most specific resource scope).

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct hierarchy from top to bottom is Organization Node, followed by Folder Node, Project Node, and finally Resource Node.

In Google Cloud Platform, IAM policies are inherited downwards through the resource hierarchy structure. The hierarchy starts at the Organization level at the top, flows down through Folder levels, then to Project levels, and ultimately applies to individual Resource instances.

Adım Adım Çözüm

Identify the top root entity of GCP governance.

The Organization node represents the root of the structure where organization-wide policies and roles are inherited down.

All policies attached at the organization level propagate down to all child nodes.

Identify intermediate administrative groupings.

Folder nodes reside below the Organization node to organize projects into departments or environments.

Folders provide an intermediate level to apply IAM permissions across collections of projects.

Identify the primary resource container.

Project nodes sit inside folders or directly under the organization.

Projects contain individual services and form the main boundary for billing and access policies.

Identify the target service instance level.

Resource nodes (e.g., Cloud Storage buckets, VM instances) sit at the base of the hierarchy inside projects.

Resources inherit all permissions granted at ancestor levels (project, folder, organization).

Anahtar Kavram

Google Cloud Resource Hierarchy and IAM Inheritance

Tahmini Süre:45s

Soru 44Soru →

A cloud architect needs to provision a new relational database using Cloud SQL with Customer-Managed Encryption Keys (CMEK) enabled. What is the correct chronological sequence of steps required to successfully provision this encrypted database infrastructure?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with creating the Cloud KMS Key Ring and CryptoKey, followed by granting the Cloud SQL Service Agent the required Encrypter/Decrypter role on that key, then provisioning the Cloud SQL instance referencing the CMEK, and finally creating the logical database inside the instance.

Provisioning CMEK-encrypted managed services on Google Cloud requires creating the encryption key first, delegating `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Cloud SQL service account second, provisioning the encrypted instance third, and finally creating the logical database.

Adım Adım Çözüm

Create the Cloud KMS key resource

A regional Cloud KMS Key Ring and CryptoKey are available.

Encryption keys must exist before permissions can be assigned or services configured to use them.

Assign IAM roles to the service account

The Cloud SQL service agent is authorized to use the KMS key.

Provisioning will fail if the Cloud SQL service account cannot access the key during instance creation.

Provision the Cloud SQL database instance

An encrypted Cloud SQL instance is running.

The underlying disk storage is encrypted using the specified CMEK during initial instance creation.

Create the application database

The target relational database is ready for data ingestion.

Logical database structures exist on top of the already provisioned and encrypted storage instance.

Anahtar Kavram

Customer-Managed Encryption Key (CMEK) Provisioning Sequence for Managed Storage and Databases

Soru 45Soru →

A global media streaming platform is migrating its on-premises infrastructure to Google Cloud. The environment includes a 1.2 PB archive of video assets on network-attached storage (NAS) and a live 4 TB PostgreSQL database supporting user metadata. The business requires zero downtime for the database cutover and minimal disruption for video asset migration. Arrange the operational steps in the correct architectural sequence to execute this data transfer and migration strategy.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with establishing Dedicated Interconnect network connectivity, followed by configuring Database Migration Service (DMS) with continuous CDC for the relational database. Next, petabyte-scale offline data transfer is performed via Transfer Appliance, followed by an online delta sync using Storage Transfer Service. Finally, application traffic is cut over after verifying database replication synchronization.

The proper architectural sequence begins by provisioning dedicated hybrid networking to secure communications. Continuous database replication (CDC via DMS) is started next so that transactional changes stream continuously. Bulk offline storage transfer (Transfer Appliance) is executed for the 1.2 PB dataset to avoid network saturation, followed by an online delta catch-up sync (Storage Transfer Service) to synchronize changes generated during transit. Finally, database replication lag is verified and traffic cutover is completed.

Adım Adım Çözüm

Establish secure network connectivity

Dedicated Interconnect and private VPC routing are configured.

High-speed network connectivity is a prerequisite for secure database replication and cloud management.

Initialize database replication

Database Migration Service runs continuous CDC from on-premises PostgreSQL to Cloud SQL.

Establishing continuous replication early allows the database to stay in sync with minimal lag while bulk data transfers occur.

Execute bulk data transfer

1.2 PB media archive is moved offline via Transfer Appliance.

Transfer Appliance handles multi-petabyte initial data transfers efficiently without overloading bandwidth.

Perform incremental catch-up sync

Storage Transfer Service copies files added or changed during Transfer Appliance transit.

Storage Transfer Service provides continuous cloud-to-cloud/on-prem to cloud sync for delta changes.

Perform final cutover

Replication lag hits zero, Cloud SQL is promoted, and application traffic is shifted.

Ensures zero data loss and minimal operational downtime during final service promotion.

Anahtar Kavram

Staging Hybrid Cloud Migration and Data Transfer Strategies

Soru 46Soru →

When designing a new cloud solution on Google Cloud, an architect documents the system across different abstraction levels. Arrange the architectural views in order from the highest level of abstraction (business-focused) to the lowest level of abstraction (concrete infrastructure implementation).

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence from highest to lowest abstraction is Conceptual Architecture, followed by Logical Architecture, and finally Physical Architecture.

The design process moves progressively from high abstraction to concrete execution: first establishing business requirements (Conceptual), then structuring functional components and data flows (Logical), and finally specifying exact Google Cloud services and network topologies (Physical).

Adım Adım Çözüm

Identify the conceptual phase.

Conceptual architecture focuses strictly on business capabilities and high-level requirements without technological commitments.

Designing starts by understanding business domain boundaries and strategic objectives at the highest level of abstraction.

Identify the logical phase.

Logical architecture breaks down conceptual needs into functional tiers, data flows, and interactions.

Before selecting specific vendors or products, functional components and communication patterns must be defined.

Identify the physical phase.

Physical architecture maps logical components directly into concrete Google Cloud services and infrastructure configurations.

Physical design is the final, lowest-abstraction implementation stage where specific technical resources (e.g., GKE, Cloud Spanner, VPCs) are selected and configured.

Anahtar Kavram

Architectural Abstraction Layers (Conceptual vs. Logical vs. Physical)

Soru 47Soru →

Your cloud architecture team needs to migrate a local Terraform state file containing critical Google Cloud infrastructure to a centralized, multi-user Google Cloud Storage (GCS) remote backend with state locking and service account impersonation. What is the correct sequence of steps to perform this state migration securely?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with provisioning a GCS bucket with Object Versioning, followed by defining the backend configuration block in code, authenticating via service account impersonation, and finally running terraform init with the -migrate-state flag to copy local state to GCS.

Migrating Terraform state requires establishing the underlying storage bucket first, updating the codebase to point to the new backend, authenticating the CLI session with short-lived service account credentials, and invoking terraform init with the -migrate-state flag to copy local state objects safely.

Adım Adım Çözüm

Provision the destination Cloud Storage bucket configured with Object Versioning.

A secure GCS bucket is created to store state snapshots and protect against state corruption.

Terraform cannot create its own backend storage bucket automatically during state initialization; the bucket resource must pre-exist.

Configure the `backend "gcs"` block in the main Terraform module.

The Terraform CLI is informed of the new remote backend target location.

Terraform requires the target backend declared in source code to recognize that state migration is requested.

Authenticate to GCP and assume the deployment service account identity.

The active session gains short-lived IAM credentials required for bucket access.

State operations require direct object read/write and locking access to the GCS bucket.

Execute `terraform init -migrate-state` in the directory containing the local state.

Terraform copies state items from local disk into GCS and locks the state file.

The `-migrate-state` flag instructs Terraform to safely copy state resources to the newly configured remote backend.

Anahtar Kavram

Terraform Remote State Migration to GCS with Locking and Versioning

Soru 48Soru →

A Site Reliability Engineering (SRE) team needs to set up real-time operational alerting whenever application logs contain critical error events. Sequence the correct administrative steps required to construct a metric-based alerting workflow from Cloud Logging to Cloud Monitoring.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with writing the log filter query in Cloud Logging to select error logs, followed by creating a counter log-based metric from that filter, configuring a notification channel in Cloud Monitoring, and finally constructing an alerting policy that evaluates the log-based metric threshold and targets the notification channel.

The operational workflow begins by isolating relevant log entries using a log filter in Cloud Logging. Once filtered, a counter log-based metric is created to translate these log events into time-series data. Next, a notification channel is defined in Cloud Monitoring to serve as the alert destination. Finally, an alerting policy is created that monitors the custom log-based metric against specified thresholds and dispatches notifications via the defined channel.

Adım Adım Çözüm

Write a log filter query in Cloud Logging.

Identifies and isolates relevant application error log entries.

Log entries must be selected via a log filter before a log-based metric can aggregate them.

Create a counter log-based metric in Cloud Logging.

Converts log count data into a time-series metric available in Cloud Monitoring.

Cloud Monitoring alerting policies operate on time-series metrics rather than unaggregated log streams.

Set up a notification channel in Cloud Monitoring.

Establishes a destination (e.g., Email, Webhook, PagerDuty) for operational notifications.

An alerting policy requires a valid notification channel to dispatch alerts when triggered.

Create an alerting policy referencing the log-based metric and notification channel.

Enables automated monitoring of the metric rate and triggers incidents when thresholds are crossed.

Combines the metric condition threshold and notification endpoint into an active operational monitoring rule.

Anahtar Kavram

Log-based metric creation and operational alerting workflow

Soru 49Soru →

Your enterprise cloud architecture team is establishing an automated, secure progressive delivery pipeline using Cloud Build, Artifact Registry, Binary Authorization, and Google Cloud Deploy. In what chronological sequence should the pipeline execution steps occur to safely roll out a new microservice release from code build to full production traffic?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct release sequence is: (1) Build container image and generate Binary Authorization attestation in Cloud Build -> (2) Register Cloud Deploy release with signed image digest -> (3) Deploy to canary stage and route partial live traffic -> (4) Perform automated SLO canary analysis via Cloud Monitoring -> (5) Promote release in Cloud Deploy to shift 100% traffic to production.

The proper release sequence follows shift-left security and progressive delivery best practices. First, Cloud Build creates the container artifact and signs it with a Cloud KMS key to satisfy Binary Authorization policies. Next, a Cloud Deploy release is declared using the signed image digest. The release is then deployed to a canary phase where a small portion of live traffic is routed. Operational health metrics (latency, error rates) are monitored and verified against SLOs. Once verified, Cloud Deploy promotes the release to receive 100% of production traffic.

Adım Adım Çözüm

Container artifact creation and security attestation

Signed container image stored in Artifact Registry with valid Binary Authorization attestation

Binary Authorization policies require images to be attested before deployment can be initiated.

Delivery pipeline release declaration

Cloud Deploy release object created referencing the exact immutable image digest

Cloud Deploy requires an explicit release declaration to bind target configurations with the container digest.

Canary deployment and initial traffic routing

Workload deployed to canary target phase with initial percentage of traffic directed to it

Progressive delivery minimizes blast radius by testing candidate revisions on real-world traffic subsets.

Canary health and telemetry verification

Metrics validated against latency, error rate, and availability SLOs

Automated metric evaluation confirms system stability before expanding deployment scale.

Full production promotion

100% of production traffic routed to the newly promoted revision

Promoting the release finalizes deployment after passing all automated health gates.

Anahtar Kavram

Automating progressive delivery release pipelines using Cloud Build, Binary Authorization, Google Cloud Deploy, and Cloud Monitoring canary verification.

Soru 50Soru →

A security architect is configuring an enterprise-wide audit logging solution in Google Cloud Platform to stream Cloud Audit Logs from an entire organization to an external SIEM system via Pub/Sub. In what sequence should these steps be executed to establish the log export pipeline successfully?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: first, create the target Pub/Sub topic in the central project; second, create the organization-level Cloud Logging sink pointing to the topic; third, grant the sink's unique writer service account the Pub/Sub Publisher role on the topic; and fourth, configure the SIEM to consume messages from the Pub/Sub subscription.

Establishing a Cloud Logging export pipeline requires creating the destination Pub/Sub topic first. Next, creating the organization-level log sink defines the filter rules and automatically creates a unique service account identity (writer identity). Third, this specific service account must be granted the Pub/Sub Publisher role on the topic to authorize writing. Finally, the downstream SIEM consumer connects to the subscription to pull the audit logs.

Adım Adım Çözüm

Provision the destination Pub/Sub topic resource.

A target Pub/Sub topic is established to receive streamed log messages.

The destination endpoint must be created before a log sink can reference it as a valid destination.

Configure the aggregated Cloud Logging sink at the organization root.

An organization-level sink is created and Google Cloud automatically assigns a unique writer service account identity.

The log sink configuration establishes the audit log filter and generates the specific service account needed for publishing authorization.

Authorize the logging sink service account on the Pub/Sub topic.

The sink's writer service account gains Pub/Sub Publisher privileges on the destination topic.

Cloud Logging sinks do not have implicit write access to Pub/Sub topics across project boundaries without explicit IAM role grants.

Connect the downstream SIEM integration to the Pub/Sub subscription.

The SIEM begins ingesting real-time audit logs from Google Cloud.

Subscriber consumers can only ingest logs reliably once the underlying publisher pipeline and authorizations are fully configured.

Anahtar Kavram

Cloud Audit Logs Aggregated Export & Service Account Authorization Workflow

Soru 51Soru →

An enterprise Cloud Architecture team is establishing an automated progressive release pipeline for a mission-critical microservice deployed to Google Kubernetes Engine (GKE). The release process must integrate Cloud Build, Artifact Registry, Cloud KMS, Binary Authorization, Google Cloud Deploy, and Cloud Monitoring to enforce zero-trust artifact security and automated metric-driven canary verification. Arrange the continuous deployment operational steps in the correct chronological execution sequence from artifact compilation to 100% production traffic cutover.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct execution order is: 1) Cloud Build compiles the image, pushes to Artifact Registry, and creates a Binary Authorization attestation with Cloud KMS; 2) Cloud Build registers a Cloud Deploy release referencing the Skaffold configuration and attested image digest; 3) Cloud Deploy renders manifests to GKE, passing Binary Authorization admission control to establish initial 10% canary traffic; 4) Cloud Deploy verification jobs evaluate Cloud Monitoring SLIs to approve advancing traffic to 50%; 5) Cloud Deploy completes the rollout, directing 100% of live production traffic to the new release revision.

The automated deployment pipeline requires strict sequential dependency ordering: artifacts must be built and cryptographically signed in Cloud Build via Binary Authorization and Cloud KMS before a release can be registered in Cloud Deploy; manifest rendering and GKE admission control must validate signatures at pod creation before the initial canary phase receives traffic; real-time Cloud Monitoring metric verification must confirm health before Cloud Deploy advances traffic percentages; and finally, complete cutover (100% traffic) occurs after all canary gates pass.

Adım Adım Çözüm

Compile container image and produce cryptographic attestation

Attestation signature is verified and linked to the image digest stored in Artifact Registry.

Security governance requires binary provenance and attestation prior to release registration.

Instantiate Cloud Deploy release object

Cloud Deploy registers the release metadata and initiates pipeline rendering.

Cloud Deploy manages progressive delivery targets based on declared Skaffold rendering contexts.

Deploy baseline canary workload to GKE

GKE Binary Authorization admission controller validates attestation and permits pod creation with 10% traffic.

Cluster admission enforcement prevents unverified images from executing while exposing a limited canary population.

Perform automated metric-driven canary verification

Cloud Monitoring telemetric health indicators validate SLO compliance, authorizing phase traffic promotion.

Progressive delivery relies on empirical observability data to advance traffic allocation safely.

Complete production rollout

100% of live production traffic is directed to the fully verified release target.

Successful completion of all verification gates concludes the automated delivery lifecycle.

Anahtar Kavram

Continuous Deployment Pipeline Execution and Progressive Delivery Sequence with Cloud Deploy and Binary Authorization

Tahmini Süre:3m 0s

Soru 52Soru →

An enterprise security architect must establish organization-wide Data Access audit logging for sensitive Cloud Storage resources, store the logs in an immutable archive encrypted with customer-managed keys, and enable Security Command Center (SCC) detection for storage bucket misconfigurations. Arrange the configuration steps in the correct chronological sequence to implement this operational pipeline.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins by enabling Data Access Audit Logs at the organization level, followed by provisioning the destination CMEK-encrypted Cloud Storage bucket with Bucket Lock. Next, the organization-level aggregated log sink is created to obtain its unique writer service account identity. Then, that service account identity is granted the Storage Object Creator role on the destination storage bucket. Finally, Security Command Center Security Health Analytics modules are enabled to provide posture monitoring.

Building an enterprise security logging and monitoring pipeline requires respecting GCP resource dependencies. First, audit log generation must be enabled in IAM audit configuration. Second, the storage target with CMEK and Bucket Lock must be created. Third, the organization-level aggregated sink must be created, which generates a unique writer identity service account. Fourth, this writer identity must be granted Storage Object Creator permissions on the destination bucket. Finally, Security Command Center Security Health Analytics modules are enabled for ongoing posture monitoring.

Adım Adım Çözüm

Enable Cloud Storage Data Access Audit Logs in the Organization IAM Audit Config.

Cloud Storage begins generating DATA_READ, DATA_WRITE, and ADMIN_READ log entries across all organizational resources.

Log generation must be configured before telemetry can be captured by logging sinks.

Create the destination Cloud Storage bucket with CMEK encryption and a locked retention policy.

A secure, immutable log storage target is available.

The destination bucket must exist prior to sink creation so that the sink path can be validated.

Create an organization aggregated log sink targeting the centralized storage bucket.

The log sink is established and outputs a unique writer identity service account.

Aggregated sinks automatically generate a service account that requires explicit destination IAM permissions.

Assign the Storage Object Creator role to the sink's writer service account on the destination bucket.

The aggregated sink receives write authorization to write log archives into the storage bucket.

Without explicit IAM permission grants on the destination resource, log ingestion into the bucket will fail.

Configure Security Command Center Security Health Analytics to monitor bucket security posture.

Automated posture scanning flags misconfigured or publicly accessible storage buckets.

Completes the security logging and vulnerability detection framework across the Google Cloud organization.

Anahtar Kavram

GCP Organization-level aggregated log sink ordering dependencies and security posture auditing

Tahmini Süre:2m 30s

Soru 53Soru →

An organization needs to configure real-time exporting of Google Cloud Security Command Center (SCC) Premium threat findings to an external SIEM solution operating on-premises. Arrange the steps in the correct operational sequence to implement this security log export architecture.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: 1) Enable Security Command Center Premium at the organization level. 2) Create a Pub/Sub topic and subscription in a dedicated project. 3) Configure a continuous export rule in Security Command Center targeting the Pub/Sub topic. 4) Deploy a forwarder service to pull messages from Pub/Sub and stream them to the on-premises SIEM.

The sequence follows standard Cloud Architecture dependencies: first enable the finding source (SCC Premium), then establish the transport messaging buffer (Pub/Sub topic), configure the publishing source to stream to that buffer (SCC Continuous Export), and finally implement the consumer process that delivers findings to the external SIEM.

Adım Adım Çözüm

Activate Security Command Center Premium.

Threat detection capabilities like Event Threat Detection begin generating organization-level finding events.

Findings cannot be exported until the underlying security detection tier is active and generating events.

Provision the destination Pub/Sub messaging pipeline.

A Pub/Sub topic and subscription are available to ingest streamed findings securely.

Export targets must exist before configuring export rules in GCP.

Establish the SCC Continuous Export feed.

SCC findings stream automatically into Pub/Sub in real time as they are generated.

Continuous export connects SCC event creation directly to the Pub/Sub endpoint.

Connect the on-premises SIEM via a Pub/Sub pull subscriber.

Findings are securely delivered from Google Cloud into the external SIEM pipeline.

An active subscriber service is required to consume messages queued in Pub/Sub and ingest them into external systems.

Anahtar Kavram

Security Command Center Continuous Export to Pub/Sub and External SIEM Integration

Soru 54Soru →

A security architect is establishing a new Google Cloud resource hierarchy for an enterprise workload. To ensure proper IAM role inheritance and central governance, arrange the initial administrative setup steps in the correct top-down sequence, starting from the highest scope in the resource hierarchy.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct administrative sequence starts at the Organization node, followed by creating Folders, provisioning Projects within those Folders, and finally granting fine-grained resource-level IAM permissions inside the Projects.

Google Cloud resource hierarchy follows a strict top-down structure: Organization node -> Folders -> Projects -> Resources. IAM permissions granted at parent levels automatically inherit downward to child nodes.

Adım Adım Çözüm

Identify the top root level of the GCP resource hierarchy.

The Organization node is established at the root level to apply central governance and top-level IAM policies.

Policies applied at the Organization level automatically inherit down to all child folders, projects, and resources.

Structure organizational units below the root.

Folders are created under the Organization node to group projects by business unit or environment (e.g., Production, Staging).

Folders inherit Organization policies and pass down combined policy bindings to member projects.

Provision resource management containers.

Google Cloud Projects are created inside the designated Folders.

Projects serve as administrative boundaries for resources and inherit policies from parent Folders and the Organization.

Configure granular resource access control.

Fine-grained IAM roles and service account permissions are assigned to specific resources inside the Projects.

Resource-level grants enforce least-privilege access on individual workloads.

Anahtar Kavram

Google Cloud Resource Hierarchy and Top-Down IAM Policy Inheritance

Soru 55Soru →

An enterprise security architect is establishing an IAM role binding hierarchy for a newly onboarded analytics team requiring access to BigQuery datasets in a production project. To follow Google Cloud best practices for resource hierarchy organization and least privilege inheritance while minimizing administrative overhead, in what order should the architect structure and apply IAM role assignments from the broadest organizational container down to the resource level?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for structuring IAM role assignments top-down through the resource hierarchy is: 1) Define Organization-level policy bindings for security audit and broad governance, 2) Assign job-function predefined roles at the environment Folder level, 3) Grant project-scoped operational roles at the Project level, and 4) Configure fine-grained dataset IAM access controls at the specific Resource level.

Google Cloud IAM follows a top-down policy inheritance model where permissions granted at parent nodes (Organization -> Folder -> Project -> Resource) are inherited by all child resources. Best practices dictate establishing global audit/governance at the Organization root, assigning job-role predefined roles at environment Folders to minimize maintenance overhead, configuring specific workload and service account boundaries at the Project level, and applying object-level access on individual sensitive Resources.

Adım Adım Çözüm

Establish root security baseline at the Organization node.

Organization-wide governance and audit capabilities are enforced across all child folders and projects.

Top-level policies inherit down the entire resource tree, so only broad governance roles belong at the organization root.

Assign functional environment roles at the Folder node.

All projects nested inside the environment folder inherit uniform job-function access.

Folder-level assignments streamline administration by granting permissions once for a logical group of related projects.

Bind project-specific roles and service account permissions at the Project node.

Project operational boundaries and compute/service account identities are constrained to single project scopes.

Project-level IAM prevents administrative leakage across neighboring projects within the same parent folder.

Apply granular dataset-level access at the Resource node.

Individual sensitive datasets enforce precise user/group access control.

Resource-level IAM bindings complement inherited policy by restricting or opening access to specific data objects based on least privilege principles.

Anahtar Kavram

IAM Policy Inheritance and Resource Hierarchy Scoping

Soru 56Soru →

A cloud engineering team is establishing an automated continuous delivery pipeline for a containerized microservice running on Google Kubernetes Engine (GKE). The architecture requires container image building, vulnerability scanning, cryptographic image attestation, progressive canary deployment, and metric-driven production promotion using Cloud Build, Artifact Registry, Binary Authorization, Cloud Deploy, and Cloud Monitoring. In what chronological sequence should these operational pipeline stages execute from source commit to full release verification?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct pipeline execution order is: 1) Triggering Cloud Build to construct and store the container image in Artifact Registry, 2) Scanning the image and creating a signed Binary Authorization attestation with Cloud KMS, 3) Deploying via Cloud Deploy to a GKE canary target with 10% traffic, and 4) Validating metrics via Cloud Monitoring before promoting to 100% production traffic.

The sequence logically progresses through CI build generation, automated vulnerability scanning and policy attestation signing, initial low-risk deployment (canary), and metric-driven full release promotion.

Adım Adım Çözüm

Build and store artifact

Container image created and pushed to Artifact Registry

Source code must be compiled into an immutable artifact before security scanning or deployment can begin.

Vulnerability scanning and cryptographic attestation

Binary Authorization attestation signed using Cloud KMS

Binary Authorization policies require explicit attestation signatures verifying security compliance prior to deployment admittance.

Initiate progressive delivery canary deployment

Cloud Deploy deploys release to GKE and routes 10% of traffic

Canary deployment limits blast radius by verifying new software against a small slice of real traffic.

Monitor health metrics and promote release

Release promoted to full 100% production traffic

Automated verification against SLOs/SLIs ensures system stability prior to full traffic cutover.

Anahtar Kavram

Automated CI/CD Pipeline Sequencing with Cryptographic Attestation and Progressive Delivery

Soru 57Soru →

An online gaming platform is migrating its operational PostgreSQL database and $80\text{ TB}$ of unstructured telemetry logs from an on-premises data center to Google Cloud. To ensure zero data loss and minimal downtime during final cutover, place the migration and data transfer steps in the correct chronological sequence.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of migration steps is: 1) Provision Dedicated Cloud Interconnect connectivity, 2) Execute baseline Storage Transfer Service jobs while configuring Database Migration Service CDC, 3) Perform data integrity validation and verify near-zero replication lag, and 4) Promote the Cloud SQL instance, update application connection endpoints to Google Cloud, and terminate the replication stream.

The correct migration sequence follows standard GCP Cloud Migration Framework phases: Hybrid network connectivity (Dedicated Cloud Interconnect) must be established first. Next, initial bulk historical data transfer (Storage Transfer Service) and continuous database replication (Database Migration Service CDC) run concurrently. Once data replication lag drops to near zero, validation is performed to confirm data parity. Finally, database promotion and application endpoint cutover complete the migration.

Adım Adım Çözüm

Establish hybrid network connectivity

High-bandwidth Dedicated Cloud Interconnect provisioned between data center and VPC.

Hybrid networking must be operational prior to initiating large-scale data migration to guarantee low latency and bandwidth.

Initiate bulk storage backfill and continuous database CDC

$80 TB of historical logs synced to Cloud Storage and live PostgreSQL transactions replicated to Cloud SQL.

Bulk transfer uploads historical data while CDC captures ongoing write activity to prepare for zero-downtime cutover.

Validate data integrity and check replication lag

Target Cloud SQL instance verified for data completeness with negligible replication delay.

Ensures no transactional data is lost or corrupted before cutover decisions are executed.

Promote target instance and perform final traffic cutover

Application traffic redirected to Cloud SQL and migration job finalized.

Promoting the replica and shifting endpoints finalizes the migration with minimal downtime.

Anahtar Kavram

Cloud Data Migration Lifecycle & Zero-Downtime Cutover Strategy

Soru 58Soru →

A cloud architect is standardizing an organization's infrastructure automation practices. The team needs to safely transition a local Terraform state file to a centralized Google Cloud Storage (GCS) backend to support team collaboration and state locking. In what order should the architect execute the steps for this migration process?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: first provision the GCS bucket with versioning, next define the gcs backend configuration block, then execute terraform init to migrate the state file, and finally delete the local state file while restricting bucket permissions.

Establishing a GCS remote backend requires provisioning the prerequisite Cloud Storage bucket first, declaring the backend gcs block in configuration code second, running terraform init to trigger state migration third, and completing post-migration local cleanup and access restriction fourth.

Adım Adım Çözüm

Provision GCS Bucket

A secure, version-enabled GCS bucket is created.

Terraform requires an existing GCS bucket endpoint before it can store state remotely.

Declare GCS Backend

The Terraform root configuration references the target GCS bucket and path prefix.

Terraform CLI relies on backend configuration code to determine where remote state operations are targeted.

Run Initialization and Migrate

Local state is uploaded to GCS and state lock tracking is initialized.

Executing terraform init detects backend changes and prompts to transfer local state to the newly configured GCS backend.

Post-Migration Cleanup and Security

Local state file is removed and IAM permissions are configured for state protection.

Prevents state drift or accidental state file exposure, while ensuring team access follows least-privilege security controls.

Anahtar Kavram

Remote Infrastructure State Management and Migration in Terraform

Soru 59Soru →

A Principal Cloud Architect is establishing design standards for a mission-critical connected vehicle telematics platform on Google Cloud. Place the architectural design activities in the correct sequential order, starting from initial business abstraction down to concrete physical infrastructure implementation.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with defining the high-level conceptual architecture, followed by constructing the logical architecture tiering, then mapping logical components to concrete Google Cloud services, and concluding with specifying the physical infrastructure deployment layout and security perimeters.

The correct architectural lifecycle progresses from technology-agnostic business definitions to concrete infrastructure deployment. First, the conceptual architecture establishes overall business capabilities and scope. Second, the logical architecture defines functional tiers, interfaces, and data flows. Third, physical architecture begins by mapping these logical components onto appropriate GCP managed services. Finally, the physical architecture is completed by defining low-level infrastructure deployment parameters, network topologies, encryption, and security perimeters.

Adım Adım Çözüm

Identify the conceptual design phase.

Establish business capabilities, domain boundaries, and high-level data flow without technical implementation details.

Architectural translation always begins at the conceptual abstraction layer to align solution boundaries with enterprise business objectives.

Identify the logical design phase.

Decompose conceptual capabilities into logical tiers, functional components, and interface definitions.

Logical architecture defines structural building blocks and technology-agnostic service relationships derived from the conceptual model.

Identify the physical cloud service selection phase.

Map logical tiers to specific Google Cloud managed services (such as Pub/Sub, Dataflow, and Bigtable).

Physical architecture begins by selecting concrete Cloud products that meet the technical requirements defined in the logical design.

Identify the physical network and security specification phase.

Define VPC subnetting, Cloud Interconnect connections, KMS keys, and VPC Service Controls.

The complete physical architecture finalizes environment implementation details, network security perimeters, and operational deployment configurations.

Anahtar Kavram

Architectural Abstraction Layers (Conceptual -> Logical -> Physical Mapping)

Soru 60Soru →

An organization needs to configure a centralized pipeline to stream Google Cloud Audit Logs across all existing and future projects to an external Security Information and Event Management (SIEM) platform in real time. Arrange the required implementation steps in the correct architectural sequence to achieve this workflow.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins by provisioning the central Pub/Sub topic, creating the organization-level aggregated log sink targeting that topic, granting the sink's generated service account permission to publish to the topic, and finally configuring the streaming pipeline consumer to deliver log events to the external SIEM.

Establishing a centralized, real-time audit log streaming architecture requires creating the target Pub/Sub topic first so it exists as a valid sink destination. Creating the organization-level aggregated log sink next creates the log router configuration and automatically generates a unique writer identity service account. Assigning the Pub/Sub Publisher role to this generated service account authorizes cross-project log ingestion. Finally, deploying the downstream consumer on the Pub/Sub subscription initiates telemetry delivery to the SIEM.

Adım Adım Çözüm

Provision the central Pub/Sub destination topic

Establishes a valid target resource URI for incoming audit log messages.

Log sinks require an existing destination resource before sink creation or authorization can be configured.

Configure the organization-level aggregated log sink

Generates a dedicated sink writer service account identity and defines inclusion filters for audit logs.

Aggregated sinks at the organization node automatically capture audit logs across all nested hierarchy levels.

Authorize the log sink's writer identity on the destination Pub/Sub topic

Grants Pub/Sub Publisher permissions to the unique sink service account.

Without explicit IAM publisher authorization on the destination topic, log entry delivery will fail.

Establish downstream streaming consumption to the SIEM platform

Streams real-time audit logs from the Pub/Sub subscription into the SIEM system.

Configuring the consumer completes the end-to-end telemetry integration after log routing and permissions are established.

Anahtar Kavram

Organization-Aggregated Cloud Audit Log Routing with Pub/Sub

ÖncekiSayfa 3 / 9Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram