Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 601Soru →

A telemetry infrastructure team is designing the provisioning of a high-throughput time-series database on Google Cloud to ingest real-time IoT metrics. Additionally, they must migrate 3 petabytes of historical baseline metrics from their on-premises data center within a strict 14-day window. The company's on-premises internet link is limited to an unreserved 1 Gbps connection. Regulatory compliance mandates that all stored data at rest must be encrypted using keys managed in Cloud KMS with automated monthly rotation, while preventing team overhead associated with storing raw key material. Which combination of services and provisioning strategies meets all throughput, migration timeline, and compliance requirements?

Cevabı ve açıklamayı göster

Cevap: Provision Cloud Bigtable configured with Customer-Managed Encryption Keys (CMEK) referencing Cloud KMS for real-time ingestion, and request Google Cloud Transfer Appliance to perform the offline migration of the 3 PB dataset into Cloud Storage.

Cevap

Provision Cloud Bigtable configured with Customer-Managed Encryption Keys (CMEK) referencing Cloud KMS for real-time ingestion, and request Google Cloud Transfer Appliance to perform the offline migration of the 3 PB dataset into Cloud Storage.
The correct strategy combines Cloud Bigtable for high-throughput time-series telemetry ingestion, Google Cloud Transfer Appliance for migrating 3 PB of data offline within 14 days, and CMEK via Cloud KMS to comply with encryption and automated rotation policies without raw key management overhead.

Adım Adım Çözüm

1
Analyze data transfer timeline constraints
Calculating network throughput for 3 PB over 1 Gbps yields roughly 277 days under ideal conditions (3×1015 bytes×8 bits/byte/109 bps≈2.4×107 seconds3 \times 10^{15} \text{ bytes} \times 8 \text{ bits/byte} / 10^9 \text{ bps} \approx 2.4 \times 10^7 \text{ seconds}). An offline physical transfer appliance is mathematically required to meet the 14-day migration window.
Online streaming via Storage Transfer Service is unviable due to physical bandwidth bottlenecks.
2
Select appropriate database system for time-series IoT workload
Cloud Bigtable is the optimal high-throughput, low-latency target for time-series IoT data.
Cloud Bigtable scales linearly for continuous high-rate writes and reads.
3
Evaluate key management security and compliance requirements
Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow automated key rotation without requiring raw key management overhead (unlike CSEK).
CMEK integrates natively with Cloud Bigtable and Cloud Storage while satisfying regulatory requirements.

Anahtar Kavram

Provisioning scalable storage and database resources using physical transfer mechanisms for petabyte-scale data and CMEK via Cloud KMS for security compliance.
Tahmini Süre:2m 0s
Soru 602Soru →

A enterprise governance team is updating security guardrails for a dedicated `Production` folder containing multiple Google Cloud projects. The team must enforce two main requirements: prevent any newly created Compute Engine VMs or Cloud SQL instances from receiving public IP addresses, and evaluate potential pipeline disruptions by auditing policy violations before actively blocking non-compliant resource deployments. Which TWO actions should you recommend to fulfill these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply Organization Policy constraints `compute.vmExternalIpAccess` and `sql.restrictPublicIp` at the `Production` folder level.; Configure the `dryRunPolicy` specification on the Organization Policy constraints to monitor non-compliant resource requests in Cloud Audit Logs prior to active enforcement.

Cevap

Enforce the `compute.vmExternalIpAccess` and `sql.restrictPublicIp` Organization Policy constraints on the target folder, and utilize the `dryRunPolicy` specification to audit policy violations in Cloud Audit Logs without blocking active operations.
Applying boolean Organization Policy constraints (`compute.vmExternalIpAccess` and `sql.restrictPublicIp`) at the target folder level ensures programmatic guardrails against public IP assignment across all underlying projects. Configuring the `dryRunPolicy` specification enables auditing violations via Cloud Logging before enforcing blocking actions, satisfying the mandate to assess impact on CI/CD pipelines.

Adım Adım Çözüm

1
Identify the proper Google Cloud mechanism for enforcing infrastructure configuration guardrails across resource hierarchies.
Organization Policy constraints (`compute.vmExternalIpAccess` and `sql.restrictPublicIp`) targeted at the folder level prevent public IP assignments.
Organization Policies enforce programmatic configuration restrictions hierarchically across all projects contained within a folder.
2
Determine how to test policy enforcement without breaking existing CI/CD automation pipelines.
Use Organization Policy dry-run mode (`dryRunPolicy`).
Dry-run mode evaluates policy compliance against incoming requests and writes log entries to Cloud Audit Logs without rejecting non-compliant requests.

Anahtar Kavram

Organization Policy constraints and dry-run evaluation mode
Soru 603Soru →

A Principal Cloud Architect is establishing design standards for a mission-critical connected vehicle telematics platform on Google Cloud. Place the architectural design activities in the correct sequential order, starting from initial business abstraction down to concrete physical infrastructure implementation.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with defining the high-level conceptual architecture, followed by constructing the logical architecture tiering, then mapping logical components to concrete Google Cloud services, and concluding with specifying the physical infrastructure deployment layout and security perimeters.
The correct architectural lifecycle progresses from technology-agnostic business definitions to concrete infrastructure deployment. First, the conceptual architecture establishes overall business capabilities and scope. Second, the logical architecture defines functional tiers, interfaces, and data flows. Third, physical architecture begins by mapping these logical components onto appropriate GCP managed services. Finally, the physical architecture is completed by defining low-level infrastructure deployment parameters, network topologies, encryption, and security perimeters.

Adım Adım Çözüm

1
Identify the conceptual design phase.
Establish business capabilities, domain boundaries, and high-level data flow without technical implementation details.
Architectural translation always begins at the conceptual abstraction layer to align solution boundaries with enterprise business objectives.
2
Identify the logical design phase.
Decompose conceptual capabilities into logical tiers, functional components, and interface definitions.
Logical architecture defines structural building blocks and technology-agnostic service relationships derived from the conceptual model.
3
Identify the physical cloud service selection phase.
Map logical tiers to specific Google Cloud managed services (such as Pub/Sub, Dataflow, and Bigtable).
Physical architecture begins by selecting concrete Cloud products that meet the technical requirements defined in the logical design.
4
Identify the physical network and security specification phase.
Define VPC subnetting, Cloud Interconnect connections, KMS keys, and VPC Service Controls.
The complete physical architecture finalizes environment implementation details, network security perimeters, and operational deployment configurations.

Anahtar Kavram

Architectural Abstraction Layers (Conceptual -> Logical -> Physical Mapping)
Soru 604Soru →

A enterprise media streaming platform utilizes a Google Cloud resource hierarchy structured with an Organization node and dedicated subfolders under a main 'Media-Services' folder for separate business units: 'Content-Delivery', 'User-Analytics', and 'Rights-Management'. A centralized security policy mandates two operational requirements:
1. External compliance auditors must be able to view Cloud Asset Inventory metadata and resource configurations across all current and future projects nested within the 'User-Analytics' folder, without granting access to actual workload data or project resource configurations in other folders.
2. Application developers working inside projects within the 'User-Analytics' folder must be able to deploy Compute Engine instances that run under specific workload service accounts, but must not be granted administrative privileges over service account lifecycles or keys.

Which TWO IAM and resource hierarchy configurations should you implement to satisfy these requirements while adhering to Google-recommended best practices for least privilege and operational simplicity? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the roles/cloudasset.viewer and roles/browser roles to the external compliance auditors group on the 'User-Analytics' folder level.; Grant the roles/iam.serviceAccountUser role to the developer user group on the specific workload service accounts or target project scope.

Cevap

The correct architecture requires binding roles/cloudasset.viewer and roles/browser at the 'User-Analytics' folder level for auditor visibility, and granting roles/iam.serviceAccountUser to developers at the specific service account or project level.
To satisfy both requirements securely, you must leverage Google Cloud resource hierarchy inheritance and fine-grained roles. Granting asset viewing and browser roles at the folder node allows auditors to inspect resources and inventory metadata across all current and future projects in that folder subtree while maintaining strict isolation from other folders. Granting the Service Account User role to developers provides precisely the permission needed to attach service accounts to Compute Engine workloads without providing administrative control over service account management.

Adım Adım Çözüm

1
Evaluate the inheritance requirements for auditing permissions across dynamic sub-projects.
Applying predefined asset viewer and browser roles at the folder node allows permissions to inherit automatically to all child projects within that folder without granting organization-wide access.
IAM roles applied at a folder node propagate down the resource hierarchy to child projects and resources.
2
Determine the least-privileged IAM role required for developers to attach service accounts to Compute Engine instances.
Developers require roles/iam.serviceAccountUser to impersonate or bind a service account to a compute instance.
The Service Account User role provides execution and attachment rights without exposing administrative lifecycle permissions.
3
Eliminate flawed choices involving primitive roles or excessive administrative access.
Primitive Viewer at the organization level provides excessive visibility across unrelated folders, and Service Account Admin provides unnecessary security key and policy control.
Google Cloud security best practices mandate fine-grained predefined roles over primitive roles and minimal scoped rights over administrative roles.

Anahtar Kavram

Resource Hierarchy IAM Role Inheritance and Least-Privilege Service Account Delegation
Soru 605Soru →

A platform engineering team is automating the deployment of Google Cloud resources across multiple environments using an automated continuous integration pipeline. The security team mandates strict access controls and high resilience against state loss or concurrent execution conflicts. Which implementation approach satisfies these operational and security requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a Google Cloud Storage remote backend with object versioning and state locking enabled, and assign fine-grained predefined IAM roles to the executing service account.

Cevap

Configure a Google Cloud Storage remote backend with object versioning and state locking enabled, and assign fine-grained predefined IAM roles to the executing service account.
The option specifying a Google Cloud Storage remote backend with object versioning and state locking combined with fine-grained predefined IAM roles represents the Cloud Architect best practice for infrastructure as code automation. Google Cloud Storage natively supports state locking via state file generation checks, versioning provides a fallback safety net for state recovery, and least-privilege predefined roles maintain enterprise security standards.

Adım Adım Çözüm

1
Establish central remote state storage for Terraform
Configured Google Cloud Storage bucket backend with object versioning enabled to maintain state history and protect against accidental corruption.
Centralized remote state ensures team accessibility and backup history.
2
Enforce concurrency control
State locking via Google Cloud Storage prevents simultaneous pipeline executions from mutating state files concurrently.
Prevents state file corruption caused by race conditions during parallel updates.
3
Apply least-privilege IAM permissions
Assigned specific predefined IAM roles required for the target resources instead of broad primitive roles or administrative permissions.
Limits security risks in the automated pipeline environment.

Anahtar Kavram

Terraform Remote State Management and IAM Least Privilege on GCP
Soru 606Soru →

An organization needs to configure a centralized pipeline to stream Google Cloud Audit Logs across all existing and future projects to an external Security Information and Event Management (SIEM) platform in real time. Arrange the required implementation steps in the correct architectural sequence to achieve this workflow.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins by provisioning the central Pub/Sub topic, creating the organization-level aggregated log sink targeting that topic, granting the sink's generated service account permission to publish to the topic, and finally configuring the streaming pipeline consumer to deliver log events to the external SIEM.
Establishing a centralized, real-time audit log streaming architecture requires creating the target Pub/Sub topic first so it exists as a valid sink destination. Creating the organization-level aggregated log sink next creates the log router configuration and automatically generates a unique writer identity service account. Assigning the Pub/Sub Publisher role to this generated service account authorizes cross-project log ingestion. Finally, deploying the downstream consumer on the Pub/Sub subscription initiates telemetry delivery to the SIEM.

Adım Adım Çözüm

1
Provision the central Pub/Sub destination topic
Establishes a valid target resource URI for incoming audit log messages.
Log sinks require an existing destination resource before sink creation or authorization can be configured.
2
Configure the organization-level aggregated log sink
Generates a dedicated sink writer service account identity and defines inclusion filters for audit logs.
Aggregated sinks at the organization node automatically capture audit logs across all nested hierarchy levels.
3
Authorize the log sink's writer identity on the destination Pub/Sub topic
Grants Pub/Sub Publisher permissions to the unique sink service account.
Without explicit IAM publisher authorization on the destination topic, log entry delivery will fail.
4
Establish downstream streaming consumption to the SIEM platform
Streams real-time audit logs from the Pub/Sub subscription into the SIEM system.
Configuring the consumer completes the end-to-end telemetry integration after log routing and permissions are established.

Anahtar Kavram

Organization-Aggregated Cloud Audit Log Routing with Pub/Sub
Soru 607Soru →

In what sequence should a Cloud Security Architect configure an organization-level aggregated log sink to stream Data Access audit logs from all child projects into a centralized BigQuery dataset within a dedicated logging project?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence to set up an organization-level aggregated log sink to a central BigQuery dataset is: First, create the central logging project and target BigQuery dataset. Second, create the organization-level log sink configured with the --include-children flag and audit log filter. Third, retrieve the auto-generated writer identity service account for the log sink. Fourth, grant that writer identity service account the BigQuery Data Editor role on the destination dataset.
The proper administrative workflow begins by establishing the central destination resource (BigQuery dataset) in a dedicated project. Next, the organization log sink is created targeting this dataset with the aggregated option enabled, which provisions a dedicated service account writer identity. The service account name must then be retrieved so that the final step—granting the BigQuery Data Editor IAM role on the destination dataset—can be completed to permit log ingestion.

Adım Adım Çözüm

1
Provision the destination GCP project and the BigQuery dataset.
A valid target destination URI is created for the sink definition.
Creating a log sink requires a valid, pre-existing destination target.
2
Execute the organization-level sink creation command with the audit log filter and --include-children flag.
The aggregated log sink is established at the organization level and a service account writer identity is generated.
The writer identity service account is created as a direct side effect of provisioning the log sink.
3
Identify the writer identity output from the created log sink.
The unique service account email for the sink is retrieved.
You must know the exact service account identity before granting permissions.
4
Assign the BigQuery Data Editor IAM role on the destination dataset to the log sink writer identity.
Data Access audit logs from all existing and future projects start flowing into BigQuery.
Log sinks write data asynchronously using their unique service account identity, requiring write authorization on the destination resource.

Anahtar Kavram

Organization-level aggregated log sink provisioning workflow and service account access control
Tahmini Süre:1m 0s
Soru 608Soru →

An enterprise healthcare provider structures its Google Cloud resource hierarchy into a parent folder named 'Clinical-Data' containing child folders 'Production' and 'Staging'. The governance committee mandates that no Compute Engine virtual machines in any project under 'Clinical-Data' are permitted to acquire external IP addresses, while ensuring that project owners in 'Staging' cannot override this restriction. Furthermore, the security team wants to audit and log potential violations across new projects without immediately blocking deployment pipelines during an initial 30-day evaluation phase. Which architectural strategy meets these governance and operational requirements?

Cevabı ve açıklamayı göster

Cevap: Apply the boolean constraint `constraints/compute.vmExternalIpAccess` at the 'Clinical-Data' folder level with enforcement mode set to dry-run, and ensure project administrators are not granted the Organization Policy Admin role.

Cevap

The correct strategy is to enforce the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the parent folder level in dry-run mode while withholding Organization Policy Administrator permissions from project owners.
Applying the `constraints/compute.vmExternalIpAccess` boolean constraint at the parent folder level ensures that all current and future child projects in both Production and Staging inherit the policy guardrail. Configuring the enforcement mode as dry-run enables the security team to log all non-compliant attempts without impacting active deployment pipelines. Restricting Organization Policy Administrator permissions prevents project-level administrators from modifying or overriding the constraint.

Adım Adım Çözüm

1
Determine the resource hierarchy node for policy placement.
Applying the constraint at the 'Clinical-Data' parent folder ensures child folders ('Production' and 'Staging') inherit the policy restriction automatically.
Hierarchical inheritance ensures consistent enforcement without configuring each project individually.
2
Select the appropriate constraint type and evaluation mode.
Use the boolean constraint `constraints/compute.vmExternalIpAccess` in dry-run mode.
Dry-run mode logs violations to Cloud Audit Logs for inspection during the 30-day trial without breaking existing deployment scripts.
3
Verify access control permissions to prevent policy overrides.
Restrict the `roles/orgpolicy.policyAdmin` role to central governance administrators only.
Project owners without this role cannot override or disable inherited organization policies.

Anahtar Kavram

Organization Policy inheritance, boolean constraints, dry-run evaluation mode, and IAM role separation for central governance.
Soru 609Soru →

Match each Google Cloud data encryption mechanism on the left with its defining key management characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Google-default Encryption
Customer-Managed Encryption Keys (CMEK)
Customer-Supplied Encryption Keys (CSEK)
Cloud External Key Manager (Cloud EKM)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Google-default Encryption matches automatic key management by Google; CMEK matches storing keys in Cloud KMS with customer rotation and IAM control; CSEK matches supplying raw AES-256 keys in API headers; Cloud EKM matches keeping encryption keys in an external third-party HSM outside Google Cloud.
Each encryption mechanism in Google Cloud provides a distinct balance of operational management and key control. Google-default encryption is fully automated. CMEK grants control over key rotation and IAM policies inside Cloud KMS. CSEK allows customers to supply raw keys per API call. Cloud EKM delegates key protection to external on-premises or third-party HSMs.

Adım Adım Çözüm

1
Identify the key storage location and management responsibility for Google-default encryption.
Recognize that Google handles all encryption key lifecycle operations automatically without user intervention.
Google-default encryption is fully managed by GCP for data at rest.
2
Analyze Customer-Managed Encryption Keys (CMEK).
Associate CMEK with Cloud KMS where key policies, rotation, and IAM access are customer-configured.
CMEK provides customer control over key lifecycles hosted within Google Cloud infrastructure.
3
Analyze Customer-Supplied Encryption Keys (CSEK).
Link CSEK to raw AES-256 keys supplied per request header that exist only temporarily in volatile memory.
CSEK guarantees Google does not retain key material after the request finishes.
4
Analyze Cloud External Key Manager (Cloud EKM).
Connect EKM to keys residing in external HSM systems outside Google Cloud.
Cloud EKM enables cryptographic operations using keys hosted in an off-cloud HSM.

Anahtar Kavram

Data Encryption Options and Key Management Models in GCP
Soru 610Soru →

A software architecture team is analyzing their release management lifecycle for microservices running on Cloud Run. To align their continuous integration and continuous deployment (CI/CD) pipelines with security and governance best practices, they must establish appropriate permission boundaries for automated build processes. Which pipeline identity configuration follows Google Cloud recommended practices?

Cevabı ve açıklamayı göster

Cevap: Attach a dedicated service account to Cloud Build with minimal, predefined roles scoped only to the required deployment actions.

Cevap

Attach a dedicated service account to Cloud Build with minimal, predefined roles scoped only to the required deployment actions.
Configuring dedicated service accounts with fine-grained, predefined roles tailored to specific deployment targets adheres to Google Cloud security best practices by implementing the principle of least privilege.

Adım Adım Çözüm

1
Evaluate identity requirements for CI/CD automation
Automated pipelines require distinct service accounts rather than user identities or default high-privilege credentials.
Isolating pipeline identity ensures traceability and security boundaries.
2
Apply the principle of least privilege
Grant only specific predefined roles (such as Cloud Run Developer) to the pipeline service account.
Restricting roles prevents unauthorized modifications to non-pipeline resources.

Anahtar Kavram

Least Privilege Identity Management in CI/CD Pipelines
Soru 611Soru →

A healthcare organization manages its Google Cloud environment using a folder hierarchy where all production database workloads reside under a dedicated folder named Database-Prod. To comply with data sovereignty regulations, the security team must mandate that all resources provisioned within this folder can only be located in us-central1 and us-west1. The guardrail must apply automatically to all existing and future projects created within the Database-Prod folder without relying on custom deployment scripts or per-user IAM permissions. Which configuration correctly satisfies this requirement?

Cevabı ve açıklamayı göster

Cevap: Apply an Organization Policy at the Database-Prod folder level for the Resource Locations constraint (constraints/gcp.resourceLocations), specifying an allowed list containing us-central1 and us-west1.

Cevap

Apply an Organization Policy at the Database-Prod folder level for the Resource Locations constraint (constraints/gcp.resourceLocations), specifying an allowed list containing us-central1 and us-west1.
The Organization Policy service provides centralized governance controls over resource configurations. By binding an Organization Policy containing the constraints/gcp.resourceLocations list constraint to the Database-Prod folder, Google Cloud enforces an explicit allowlist for us-central1 and us-west1. Because Organization Policies inherit down the resource hierarchy, all current and future projects inside that folder inherit this policy automatically.

Adım Adım Çözüm

1
Identify the administrative requirement and scope
The requirement demands continuous, automated enforcement of regional resource limits at the folder level across existing and future child projects.
Governance guardrails operating across resource hierarchies are best enforced via Google Cloud Organization Policies.
2
Select the appropriate Organization Policy constraint
Identify constraints/gcp.resourceLocations as the designated list constraint for restricting geographic deployment locations.
This policy constraint allows administrators to explicitly define allowed or denied locations for GCP services.
3
Determine the resource hierarchy binding point
Apply the policy directly to the Database-Prod folder node with allowed values set to us-central1 and us-west1.
Policy inheritance automatically propagates constraints down to all descendant projects and resources within that folder branch.

Anahtar Kavram

Organization Policy Resource Location Constraints
Soru 612Soru →

A enterprise security architect is auditing access control evaluation for a Google Cloud environment structured with an Organization node, nested Department and Environment Folders, Workload Projects, and Cloud Storage resources. A user requests `storage.objects.get` on a specific bucket. To verify permission resolution and troubleshoot unexpected access results, the architect must trace the exact sequence of Google Cloud Identity and Access Management (IAM) policy evaluation logic.

In what exact sequence does Google Cloud IAM process policy rules and resource hierarchy grants to determine if the user is authorized to perform the action?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct evaluation order begins with checking IAM Deny policies across all hierarchy levels, followed by collecting IAM Allow bindings top-down from the Organization node, through parent Folders, at the Project node, and finally on the target Resource, concluding with computing the union of all Allow permissions to authorize the request.
Google Cloud evaluates authorization by first checking IAM Deny policies across all ancestral nodes (Organization, Folders, Project). If no Deny rule applies, IAM collects Allow permissions top-down starting from the Organization root node, continuing through parent Folders, down to the Project node, and ending at the target Cloud Storage Bucket resource. Finally, it calculates the union of all granted Allow permissions; if the required permission is present, access is granted.

Adım Adım Çözüm

1
Check for IAM Deny overrides across the resource hierarchy.
Confirm that no IAM Deny policy defined at the Organization, Folder, or Project level explicitly blocks `storage.objects.get` for the requesting principal.
Google Cloud IAM enforces Deny policies prior to evaluating any Allow rules. An applicable Deny rule short-circuits evaluation and halts execution with an access denied result.
2
Evaluate top-down inherited IAM Allow permissions from the Organization and Folder nodes.
Collect Allow role bindings inherited from ancestor nodes in the hierarchy tree.
Permissions granted at higher levels in the GCP resource hierarchy automatically propagate down to all child resources due to resource hierarchy inheritance.
3
Evaluate project-level IAM Allow permissions.
Add role bindings granted at the Project containing the target bucket to the candidate permission set.
Project-level role grants complement higher-level folder and organization policies for all resources inside that specific project.
4
Evaluate target resource-level IAM Allow permissions.
Add role bindings defined directly on the Cloud Storage Bucket.
Resource-level IAM policies allow fine-grained access control on individual resources at the leaf node of the hierarchy.
5
Calculate effective authorization by taking the union of all collected Allow permissions.
Authorize the API call if the required permission `storage.objects.get` is contained within the resulting permission set.
IAM permissions in GCP are additive. If any valid Allow binding at any level grants the required permission, and no Deny rule blocks it, access is approved.

Anahtar Kavram

Google Cloud IAM Policy Evaluation and Resource Hierarchy Inheritance
Soru 613Soru →

An enterprise architecture team for a global digital publishing platform is translating high-level business goals into a structured architecture framework on Google Cloud. During this transition, they must map logical system components (such as decoupled messaging, perimeter boundaries, and data persistency) to concrete physical GCP service implementations.

Which TWO architectural mapping decisions correctly translate the logical requirements into physical Google Cloud component selections while avoiding architectural anti-patterns? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Mapping the logical tier for real-time decoupled ingestion and stream analytics to Cloud Pub/Sub combined with Cloud Dataflow.; Mapping the logical security perimeter boundary for cross-service network isolation and data exfiltration defense to VPC Service Controls.

Cevap

The correct architectural mappings are: 1) Mapping real-time decoupled ingestion and stream analytics to Cloud Pub/Sub and Cloud Dataflow, and 2) Mapping perimeter security boundaries for data exfiltration defense to VPC Service Controls.
Mapping real-time decoupled event ingestion to Cloud Pub/Sub with Cloud Dataflow directly aligns the logical requirement for asynchronous messaging and pipeline analytics to managed physical services. Additionally, defining data exfiltration boundaries using VPC Service Controls correctly translates logical perimeter isolation into a physical security boundary on Google Cloud.

Adım Adım Çözüm

1
Analyze the logical requirements for event processing and perimeter security.
Real-time asynchronous messaging maps logically to Pub/Sub and stream processing to Dataflow. Security isolation across service boundaries maps to VPC Service Controls perimeters.
Conceptual architectures define overall capability goals, logical architectures map functional capabilities and boundaries, and physical architectures implement concrete GCP products.
2
Evaluate the invalid physical service choices for storage, compute, and security.
Cloud Spanner for regional relational workloads creates cost overruns; GKE for simple stateless microservices adds unwanted cluster management complexity; primitive IAM roles fail to prevent data exfiltration across perimeters.
Selecting physical GCP components requires balancing non-functional requirements like cost, operational complexity, and zero-trust perimeter defense.

Anahtar Kavram

Translating Logical Architecture into Physical GCP Service Selections
Soru 614Soru →

A global retail enterprise is building a lightweight, stateless microservice to handle peak spikes of HTTP inventory availability queries during high-volume promotional events. Traffic to this microservice exhibits extreme variability, surging from zero requests during off-peak hours to tens of thousands of HTTP requests per second during flash sales. The engineering team requires a containerized execution environment that automatically scales down to zero instances to minimize costs, requires zero underlying server or cluster management overhead, and charges strictly per millisecond of request processing time. Which Google Cloud compute platform should the Cloud Architect select?

Cevabı ve açıklamayı göster

Cevap: Deploy the containerized service to Cloud Run.

Cevap

Deploying the microservice to Cloud Run satisfies all requirements for stateless execution, automatic scaling to zero, zero cluster management overhead, and request-based billing.
Cloud Run is designed specifically for stateless containerized workloads. It scales instances automatically up and down (including scaling down to zero when idle), eliminates infrastructure and cluster administration overhead, and charges only for compute resources consumed while processing requests.

Adım Adım Çözüm

1
Analyze workload characteristics and requirements
Workload is a stateless containerized HTTP microservice with bursty, unpredictable traffic scaling from zero to thousands of requests per second.
Determining scaling dynamics and protocol needs narrows down compute options.
2
Evaluate Google Cloud serverless and container execution platforms
Cloud Run native container deployment provides serverless scaling to zero, zero node management, and per-millisecond request billing.
Matching technical requirements to GCP platform capabilities identifies the most operationally efficient choice.
3
Eliminate platforms with cluster overhead or baseline infrastructure costs
GKE, Compute Engine MIGs, and App Engine Flex require continuous infrastructure maintenance or minimum baseline costs during idle traffic periods.
Eliminating options that introduce management overhead or idle cost fulfills cost-optimization and operational directives.

Anahtar Kavram

Compute Platform Selection for Stateless Bursty Microservices
Soru 615Soru →

A financial services firm is scaling its algorithmic trading platform across 12 newly provisioned Google Cloud projects contained within a dedicated production folder hierarchy. The solution requires hundreds of C2 compute instances across two distinct target regions. To guarantee that automated Infrastructure as Code (IaC) pipelines deploy without runtime resource allocation failures while maintaining centralized financial control, which TWO solutions should the principal cloud architect implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Request proactive regional Compute Engine CPU and instance quota limit increases for both target regions before triggering the IaC deployment pipelines.; Export Organization-level Cloud Billing data into BigQuery and configure programmatic budget alerts using Cloud Pub/Sub topics to monitor cost thresholds.

Cevap

The architect must proactively request regional compute quota increases before running IaC pipelines, and set up Organization-level Cloud Billing exports to BigQuery with Pub/Sub budget notifications.
Proactively requesting quota increases for targeted regional C2 capacity prevents pipeline execution failures caused by regional limit breaches. Configuring organization-level BigQuery billing exports combined with Pub/Sub budget notifications ensures automated, centralized cost governance across multi-project environments.

Adım Adım Çözüm

1
Analyze capacity requirements against regional quotas.
Identified that high-spec C2 instances across 12 projects will exceed default regional quota limits.
Default quota limits in new GCP projects will cause IaC provisioning scripts to fail immediately when quota thresholds are breached.
2
Submit proactive quota increases for target regions via Cloud Console or quota management APIs prior to pipeline execution.
Sufficient regional CPU quota is approved and allocated across the project environments.
Quota increases require manual or automated GCP review and must be secured before automated provisioning begins.
3
Configure Billing Data Export to BigQuery at the Organization level.
Centralized repository for detailed cost and usage metrics across all 12 projects.
Organization-level export standardizes cost tracking across all child projects and folders.
4
Attach Pub/Sub notifications to Cloud Billing Budgets.
Automated notification channel for threshold breaches.
Enables programmatic response or alerting when expenditure reaches critical limits.

Anahtar Kavram

Proactive Quota Planning and Centralized FinOps Governance
Soru 616Soru →

An enterprise platform engineering team is setting up an automated Terraform provisioning pipeline for a production Cloud SQL for PostgreSQL database. Security and networking policies require that the database must utilize Customer-Managed Encryption Keys (CMEK), be accessible strictly via private IP over Private Services Access, and enforce IAM database authentication. To ensure an automated execution without resource dependency deadlocks or authorization failures, in what chronological order must these deployment steps be executed?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for provisioning Cloud SQL with CMEK and Private Services Access is: 1) Create the Cloud KMS key and grant the Encrypter/Decrypter role to the Cloud SQL Service Agent; 2) Reserve an IP range and configure Private Services Access in the VPC; 3) Provision the Cloud SQL instance with private IP, CMEK reference, and IAM authentication; 4) Create database schemas and IAM database users.
Provisioning Cloud SQL infrastructure with CMEK and private connectivity requires strict adherence to foundational dependency chains. First, key permissions must be assigned to the Cloud SQL Service Agent (`[email protected]`) so GCP can access the CMEK key. Second, Private Services Access peering must be established in the VPC network so Cloud SQL can allocate internal IP addresses in the producer network. Third, the Cloud SQL instance is provisioned referencing the CMEK key and private network. Finally, database schemas and IAM database users are created inside the initialized database instance.

Adım Adım Çözüm

1
Set up CMEK security permissions
Cloud SQL Service Agent obtains permissions to encrypt/decrypt using the target CryptoKey
Cloud SQL validates disk encryption permissions during initial instance creation. Lacking this permission causes instance creation to fail immediately.
2
Configure private network infrastructure
VPC peering is established between customer VPC and Google's service producer network
Private IP database instances cannot be attached to a VPC without an established Private Services Access peering connection.
3
Deploy the Cloud SQL instance
The Cloud SQL instance is provisioned with private IP connectivity and CMEK disk encryption
The database instance depends directly on pre-existing KMS role bindings and Private Services Access peering.
4
Configure database objects and access
Database schemas and IAM-mapped users are created
Logical database schemas and user roles are internal to the engine and require an operational database instance.

Anahtar Kavram

Cloud SQL Provisioning Dependency Sequencing
Soru 617Soru →

An enterprise organization with hundreds of Google Cloud projects structured under a multi-folder hierarchy needs to establish a centralized security auditing and threat monitoring architecture. The lead cloud security architect must satisfy three strict requirements:
1. Capture all audit logs (including Data Access audit logs) across all current and future projects and streaming export them to a third-party SIEM running outside Google Cloud.
2. Prevent unauthorized exfiltration of aggregated audit log data by compromised internal identities possessing storage read permissions.
3. Enable real-time detection of threat patterns across the organization hierarchy while adhering to the principle of least privilege for security operations teams.

Which TWO architectural configurations must the security team implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an organization-aggregated log sink with an empty inclusion filter targeting a Pub/Sub topic in a dedicated security project enclosed within a VPC Service Controls security perimeter.; Enable Event Threat Detection in Security Command Center at the organization level and grant security operators dedicated fine-grained roles such as Security Center Admin Viewer (roles/securitycenter.adminViewer).

Cevap

The correct architectural choices are: (1) Creating an organization-aggregated log sink targeting a Pub/Sub topic inside a dedicated logging project protected by a VPC Service Controls perimeter, and (2) Enabling Event Threat Detection within Security Command Center at the organization level while assigning fine-grained security roles.
The correct options combined provide a complete enterprise security solution. Creating an organization-aggregated log sink with an empty inclusion filter routes all log streams (including Data Access logs) from all current and future projects to a Pub/Sub topic. Placing this topic inside a dedicated project enclosed by a VPC Service Controls perimeter guarantees protection against data exfiltration. Furthermore, enabling Event Threat Detection in Security Command Center Premium/Enterprise at the organization level provides automated real-time threat monitoring, while granting fine-grained security roles ensures strict adherence to least-privilege IAM principles.

Adım Adım Çözüm

1
Evaluate centralized audit logging and scope requirements across the organization hierarchy.
An organization-aggregated log sink ensures all present and future projects inherit logging policies and stream audit logs centrally without project-by-project manual setup.
Organization-level aggregation is required to enforce baseline compliance and capture Data Access logs uniformly across child folders and projects.
2
Analyze threat detection and data exfiltration defense mechanisms.
VPC Service Controls boundaries prevent authorized or compromised identities from transferring centralized audit data out of the organization perimeter to external destinations.
IAM rules dictate identity access control, but VPC Service Controls are strictly required to define network-level perimeter guardrails against data exfiltration.
3
Configure Security Command Center threat monitoring with fine-grained access control.
Event Threat Detection in Security Command Center analyzes log streams in real time across the organization resource, while assigning specific roles like roles/securitycenter.adminViewer preserves least-privilege security posture.
Using specialized Security Command Center roles avoids assigning dangerous primitive roles while maintaining complete visibility into security findings.

Anahtar Kavram

Centralized Organization Log Sinks, Event Threat Detection, VPC Service Controls, and Least-Privilege IAM
Soru 618Soru →

A financial analytics company organizes its Google Cloud resources using a dedicated folder named 'Production Payments' containing dozens of project workloads. The security team needs to deploy an automated audit worker on a Compute Engine instance in a separate 'Security Operations' project. This audit worker must inspect Cloud Storage bucket IAM policies and list bucket metadata across all projects in the 'Production Payments' folder, without being allowed to read object contents or modify bucket settings. Additionally, application developers must be able to attach this audit service account to virtual machines in the Security Operations project without being granted administrative access over the service account itself or broad access across the folder. Which configuration strategy satisfies least privilege and operational security requirements?

Cevabı ve açıklamayı göster

Cevap: Create a custom IAM role with storage.buckets.getIamPolicy and storage.buckets.list permissions and bind it to the audit service account at the Production Payments folder level; then grant the roles/iam.serviceAccountUser role on the audit service account resource to the developer group.

Cevap

Create a custom IAM role containing only the storage.buckets.getIamPolicy and storage.buckets.list permissions bound to the audit service account at the Production Payments folder level, and grant the roles/iam.serviceAccountUser role on the specific service account resource to the developer group.
The correct solution defines a fine-grained custom role containing only the required bucket metadata permissions (storage.buckets.getIamPolicy and storage.buckets.list) and binds it at the folder node level so that child projects inherit access automatically. Furthermore, assigning roles/iam.serviceAccountUser directly on the service account resource allows developers to attach the account to instances while adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Determine the required permission scope for the audit worker.
The worker requires storage.buckets.getIamPolicy and storage.buckets.list permissions across all projects under the Production Payments folder without object payload access.
Creating a fine-grained custom IAM role with only these permissions ensures least privilege compared to predefined object viewer or primitive roles.
2
Select the appropriate resource hierarchy node for policy binding.
Binding the custom role at the Production Payments folder level allows all current and future child projects to inherit the audit read permissions automatically.
Inheritance down the resource hierarchy reduces operational overhead compared to per-project policy assignments.
3
Configure developer delegation permissions safely.
Granting roles/iam.serviceAccountUser on the audit service account resource to the developer group allows developers to attach the service account to compute workloads without allowing them to modify service account IAM policies or keys.
Resource-level binding of serviceAccountUser follows recommended delegation practices.

Anahtar Kavram

Resource Hierarchy Role Inheritance and Service Account Delegation
Soru 619Soru →

An energy utility provider is migrating its historical meter telemetry data archive of 450 TB450\text{ TB} and an operational 2 TB2\text{ TB} relational database from an on-premises data center to Google Cloud. The facility has a dedicated 100 Mbps100\text{ Mbps} internet uplink available for the migration process, and business requirements specify that all data must be transferred within a 30 day30\text{ day} window with minimal disruption to ongoing database transactions. Which data transfer strategy best satisfies these technical and operational constraints?

Cevabı ve açıklamayı göster

Cevap: Order a Google Cloud Transfer Appliance to transfer the 450 TB450\text{ TB} telemetry archive offline, and use Database Migration Service (DMS) with continuous replication over a dedicated network connection for the operational database.

Cevap

Order a Google Cloud Transfer Appliance for the 450 TB450\text{ TB} telemetry archive and use Database Migration Service (DMS) for the 2 TB2\text{ TB} operational database.
The correct strategy combines Transfer Appliance for the static 450 TB450\text{ TB} dataset with Database Migration Service (DMS) for the 2 TB2\text{ TB} database. Transferring 450 TB450\text{ TB} over a 100 Mbps100\text{ Mbps} network line requires over 400 days, making online transfer impossible within the 30-day requirement. Transfer Appliance bypasses this network bottleneck by physically shipping high-capacity hardware. Meanwhile, DMS supports continuous change data capture for the active operational database to minimize cutover downtime.

Adım Adım Çözüm

1
Calculate the theoretical minimum transfer time for the 450 TB450\text{ TB} dataset over the available network bandwidth.
At 100 Mbps100\text{ Mbps} (12.5 MB/s12.5\text{ MB/s}), transferring 450 TB450\text{ TB} (450,000 GB450,000\text{ GB}) requires 450,000×109 bytes12.5×106 bytes/sec≈36,000,000 seconds≈416 days\frac{450,000 \times 10^9 \text{ bytes}}{12.5 \times 10^6 \text{ bytes/sec}} \approx 36,000,000\text{ seconds} \approx 416\text{ days}.
An online transfer exceeds the 30-day window, mandating an offline physical transfer option.
2
Select the appropriate Google Cloud offline transfer service for the large static dataset.
Transfer Appliance allows shipping high-capacity physical appliances to ingest the 450 TB450\text{ TB} data locally and upload it to Cloud Storage within days.
Offline transfer bypasses network bandwidth bottlenecks completely.
3
Select the online migration method for the dynamic 2 TB2\text{ TB} database workload.
Database Migration Service (DMS) performs an initial backfill followed by continuous change data capture (CDC) replication over the network.
DMS enables minimal downtime cutover for active relational database workloads.

Anahtar Kavram

Selecting data transfer tools based on bandwidth math and workload state (offline physical transfer for petabyte/terabyte-scale static data over limited links vs. continuous replication for databases).
Soru 620Soru →

A financial analytics company is designing a new cloud architecture on Google Cloud for two distinct backend services within their risk analysis pipeline.

1. Risk Ingestion Service: A high-throughput, stateless HTTP/2 REST API microservice that receives incoming market data webhooks. Traffic fluctuates heavily throughout the day, dropping to zero during market off-hours. It requires zero server maintenance, fast cold-starts, and scaling down to zero instances to minimize idle costs.
2. Monte Carlo Simulation Engine: A high-performance compute workload requiring custom Linux kernel modules, direct hardware access to NVIDIA GPUs, local NVMe SSD scratch storage for fast state caching, and long-running batch job execution lasting up to 14 hours.

Which TWO platform selection decisions should you recommend to fulfill these workload requirements while optimizing cost and operational efficiency? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the Risk Ingestion Service on Cloud Run to take advantage of automatic scaling to zero, pay-per-use billing, and zero cluster management overhead.; Deploy the Monte Carlo Simulation Engine on Compute Engine Managed Instance Groups (MIGs) utilizing custom VM images with required kernel modules, GPU attachments, and local SSDs.

Cevap

Deploy the stateless HTTP Risk Ingestion Service on Cloud Run for scale-to-zero efficiency and operational simplicity, and host the Monte Carlo Simulation Engine on Compute Engine Managed Instance Groups (MIGs) to support custom kernel modules, attached GPUs, local NVMe SSDs, and 14-hour batch runs.
The solution correctly pairs the stateless HTTP API service with Cloud Run to take advantage of scale-to-zero autoscaling, zero management overhead, and request-based pricing, while assigning the complex compute engine with custom kernel, GPU, local SSD, and extended execution time requirements to Compute Engine MIGs.

Adım Adım Çözüm

1
Analyze requirements for the Risk Ingestion Service
Identified a stateless, HTTP/2 REST API with variable traffic dropping to zero.
Cloud Run provides serverless container execution that automatically scales instances to zero during off-hours and handles container deployment without cluster management overhead.
2
Analyze requirements for the Monte Carlo Simulation Engine
Identified requirements for custom kernel modules, GPU acceleration, local NVMe SSDs, and long-running execution (14 hours).
Compute Engine VM instances allow full root access to modify kernel drivers, attach local NVMe storage and GPUs directly, and run unbounded compute jobs.
3
Evaluate invalid compute platform combinations
Eliminated GKE standard clusters for simple stateless ingestion due to idle baseline costs/management overhead, App Engine Standard due to hardware/kernel constraints, and fixed long-term CUD commitments for bursty zero-idle services.
Matching compute workloads strictly to architectural capabilities avoids misallocating infrastructure.

Anahtar Kavram

GCP Compute Platform Selection based on statefulness, execution duration, hardware dependencies, and operational overhead limits.
Tahmini Süre:2m 0s
ÖncekiSayfa 31 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin