Tüm alıştırma soruları

An organization must enforce strict data sovereignty and data governance controls for sensitive data stored in Google Cloud. The compliance mandate requires restricting all data storage resources to a specific geographic region and managing encryption keys centrally using Google Cloud services. Which TWO architectural actions should the organization take to satisfy these requirements? (Select TWO)

An enterprise security architect is designing an automated data ingestion pipeline into Google Cloud Storage for a highly regulated financial application. Compliance mandates that all stored customer data must be encrypted at rest using Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. The security policy requires strict separation of duties: storage administrators who provision and manage Cloud Storage buckets must not have direct permissions to encrypt or decrypt data or manage encryption keys, whereas automated system services must be granted least-privilege access to perform key operations. Additionally, the setup must support automatic key rotation every 90 days without re-encrypting existing data manually or breaking access to older object versions. Which architecture and identity configuration satisfies these security and operational requirements?

A enterprise healthcare company operating on Google Cloud needs to establish a centralized security auditing and log monitoring architecture across all projects under its organization. The compliance policy mandates that all read and write operations on sensitive patient data stored in Cloud Storage must be logged and monitored for suspicious activity, while maintaining strict adherence to the principle of least privilege. Which TWO architectural recommendations should a Cloud Architect make to fulfill these requirements?

An enterprise organization is deploying a multi-VPC topology in Google Cloud consisting of a Central Hub VPC and two separate workload networks: Workload-VPC-A and Workload-VPC-B. The Central Hub VPC connects to an on-premises data center using a Dedicated Interconnect with Cloud Router configured for global dynamic routing. The network team has established VPC Network Peering between Workload-VPC-A and the Central Hub VPC, as well as between Workload-VPC-B and the Central Hub VPC, enabling custom route exchange on both peering connections. The architecture team mandates that Workload-VPC-A and Workload-VPC-B must be able to communicate with each other directly while retaining connectivity to the on-premises network. Which configuration accurately satisfies these requirements in accordance with Google Cloud networking rules?

An organization wants to configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS to protect sensitive data stored in a Cloud Storage bucket. Which two actions must the security team perform to successfully implement CMEK? (Select TWO.)

A fintech company needs to establish a secure hybrid connection between its on-premises data center and a Google Cloud VPC to migrate non-critical internal workloads. The expected bandwidth will not exceed 500 Mbps, but the connection requires encrypted IPsec transit and dynamic BGP routing. Which hybrid connectivity solution should the Cloud Architect recommend to meet these requirements with minimal setup time and cost?

A multinational financial enterprise is architecting an analytics and data persistence pipeline on Google Cloud using Cloud SQL and BigQuery. Strict regulatory compliance requirements dictate that all data at rest must be encrypted using cryptographic key material that is stored and generated exclusively within the organization's existing on-premises Hardware Security Module (HSM). The security policy strictly prohibits raw key material from ever being stored within Google Cloud infrastructure, yet GCP services must perform automated encryption and decryption operations seamlessly. Additionally, administrative access must follow the principle of least privilege. Which encryption architecture and identity configuration satisfies all compliance and security requirements?

A software development team migrated a legacy application to Google Cloud and granted primitive Owner roles to several application service accounts to accelerate initial deployment. An architectural review identified this setup as a critical security technical debt risk. Which action should the cloud architect recommend to mitigate this technical debt?

A financial technology company is establishing central security guardrails for a specific Google Cloud folder containing sensitive payment processing workloads. The enterprise security policy dictates that no Compute Engine virtual machine instances created within this folder should have external IP addresses attached, preventing direct internet accessibility. To avoid disrupting existing production services, the security team needs to audit non-compliant resources first before enforcing strict blocking across all projects in the folder. Which architectural approach meets these governance requirements?

A healthcare organization is migrating an on-premises PostgreSQL database to Cloud SQL. Corporate governance mandates that all encryption keys protecting sensitive patient records must reside strictly within an on-premises physical Hardware Security Module (HSM) outside of Google Cloud. Additionally, key access must follow the principle of least privilege, granting permission only to the necessary service identity. Which key management architecture and IAM configuration meets these regulatory requirements?

An enterprise SaaS company manages its Google Cloud infrastructure using an Organization resource hierarchy with two primary folders: `Core-Services` and `Development`. To meet strict corporate compliance standards, the security team must enforce two governance rules:
1. Prevent the creation of external service account keys for all projects located within the `Development` folder.
2. Prevent Compute Engine instances throughout the entire organization from obtaining public IP addresses, with a temporary exception for a single legacy diagnostics project under `Development` that requires public connectivity.

How should the security team configure Google Cloud Organization Policies to enforce these constraints with minimal administrative effort while respecting resource hierarchy inheritance?

An enterprise architecture team is automating the provisioning of managed relational database instances and object storage buckets using Infrastructure as Code (Terraform) within a multi-developer CI/CD pipeline. Corporate governance policies dictate that all storage and database assets must utilize key management controls where keys can be revoked or rotated within Google Cloud without requiring raw cryptographic keys to be handled or transmitted by developers. Additionally, the execution pipeline must prevent state file corruption during simultaneous deployments and safeguard infrastructure history against accidental deletions. Which TWO actions should the team implement in their provisioning configuration? (Select TWO.)

An online retail enterprise uses Google Cloud resource hierarchy to manage environments. To reduce risks associated with unauthorized data movement, the security team needs to prevent service accounts created in non-production projects from attached usage or impersonation across project boundaries into production projects. This restriction must apply to all existing and future projects under the 'Non-Production' folder hierarchy without interrupting production service account workflows. Which solution should the principal cloud architect recommend?

An enterprise architectural team is designing a modernized data ingestion pipeline on Google Cloud. The system includes two separate workloads with distinct runtime requirements:

1. Event Ingestion Webhook: A lightweight HTTP service that receives intermittent data payloads, experiences rapid traffic spikes, requires scale-to-zero capacity during idle periods, and must minimize operational management overhead.
2. Custom Analytics Engine: A long-running backend data processing application that requires specific Linux kernel parameters (`sysctl` network tuning) and direct hardware device driver access.

Which TWO platform architectural decisions should you recommend to meet these requirements efficiently?

A genomic research organization needs to migrate an on-premises data archive of $65\text{ TB}$ of uncompressed sequence files and an operational $400\text{ GB}$ PostgreSQL database to Google Cloud. The organization has an operational $1\text{ Gbps}$ Dedicated Interconnect with $600\text{ Mbps}$ of unallocated bandwidth dedicated to migration tasks. The business requirement dictates a maximum database cutover downtime of $2\text{ hours}$. Which data transfer and database migration strategy should the cloud architect recommend?

A logistics enterprise is deploying an automated deployment pipeline to provision a database for order management limited to a single GCP region. The application requires ACID transactional consistency to handle localized regional traffic, a strict RPO of zero across two zones, and compliance mandates requiring storage encryption keys to be managed directly within Cloud KMS. Furthermore, the infrastructure operations team must manage the deployment declaratively using Terraform without risking local state file corruption or concurrent state writes. Which configuration approach fulfills these database provisioning and infrastructure management requirements?

A digital health platform based in Tokyo must guarantee that all newly created Cloud Storage buckets remain physically located within the asia-northeast1 region to adhere to local data residency compliance mandates. Which Google Cloud solution should the cloud architect implement to automatically enforce this restriction across all current and future projects?

A company deploying Compute Engine virtual machines requires that persistent disks are encrypted using raw 256-bit AES encryption keys generated in their local data center. Security policy dictates that Google Cloud must never store these key strings at rest on Google infrastructure under any circumstances, and the keys must be supplied during disk creation and attach operations. Which encryption mechanism meets these requirements?

A global logistics firm structures its Google Cloud environment using an Organization node with folders for separate business units, including a top-level folder named 'FleetManagement'. A telemetry processing workload running on Compute Engine instances within a specific project under 'FleetManagement' requires reading telemetry data files from Cloud Storage buckets across all current and future projects within the 'FleetManagement' folder tree. Additionally, the application must sign Cloud Storage URL tokens for short-lived downstream download access without possessing administrative permissions over IAM policies or resource configurations. Which access control design best satisfies these requirements while strictly adhering to the principle of least privilege?

An enterprise organization is provisioning a global multi-project Google Cloud network topology across `us-central1` and `europe-west1`. The architecture utilizes a Shared VPC Host Project connecting multiple Service Projects, along with an on-premises data center connected via Cloud Interconnect. The networking team must ensure continuous dynamic route propagation across all regions and hybrid links, alongside secure private connectivity to Google Cloud APIs from workloads that lack external IP addresses. Which TWO configuration steps must be implemented to satisfy these networking and access requirements? (Select TWO.)