Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 861Soru →

A smart grid energy company is configuring identity and access management for an IoT telemetry processing application hosted on Compute Engine instances within a dedicated project. The application must read telemetry configuration files from a Cloud Storage bucket and write metric data to Cloud Monitoring. Additionally, developer teams require permissions to deploy updated Compute Engine instances using the application's service account without acquiring administrative access to IAM policies or other resources. Which TWO architectural recommendations follow Google-recommended security best practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the workload service account fine-grained predefined roles, specifically Storage Object Viewer (roles/storage.objectViewer) and Metric Writer (roles/monitoring.metricWriter), scoped at the project level.; Grant developers the Service Account User role (roles/iam.serviceAccountUser) specifically bound to the workload service account identity.

Cevap

The optimal solution requires granting fine-grained predefined roles (Storage Object Viewer and Metric Writer) to the workload service account, and granting developers the Service Account User role scoped directly to the workload service account.
Following Google Cloud security best practices, workloads should be assigned specific predefined roles (such as Storage Object Viewer and Metric Writer) that match their functional requirements. To allow developers to attach this service account to instances without granting elevated administrative rights, developers should be granted the Service Account User role specifically on the target service account resource.

Adım Adım Çözüm

1
Analyze workload service account permission requirements
Identified specific needs for reading Cloud Storage objects and writing Monitoring metrics.
Least privilege dictates assigning specific predefined roles (Storage Object Viewer and Metric Writer) rather than broad primitive roles.
2
Analyze developer deployment permission requirements
Developers need to attach the workload service account to Compute Engine instances.
Granting the Service Account User role on the specific service account resource enables instance creation without delegating IAM administration rights.

Anahtar Kavram

Applying Least Privilege with Predefined Roles and Service Account User Scoping
Soru 862Soru →

An automotive manufacturer headquartered in Germany is deploying its autonomous vehicle telemetry and clinical research dataset on Google Cloud. To satisfy European Union data sovereignty regulations and internal governance policies, the cloud architecture must strictly ensure two outcomes: first, that storage and compute infrastructure cannot be provisioned outside designated European Union geographic locations; second, that Google support personnel cannot access customer data without explicit, loggable customer approval. Which TWO architectural mechanisms should the Lead Cloud Architect implement to satisfy these compliance requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Organization Policy with the Resource Locations constraint (constraints/gcp.resourceLocations) restricted to the EU location group across the resource hierarchy.; Enable Access Approval at the Organization level to require administrative review and approval before Google personnel can access data during support operations.

Cevap

The architect should enforce an Organization Policy with the Resource Locations constraint restricted to EU regions, and enable Access Approval at the Organization level to require customer consent before Google personnel can access data.
Enforcing the Resource Locations organization policy ensures that all newly provisioned resources (such as Compute Engine, GKE, BigQuery, and Cloud Storage) are constrained to European Union regions. Enabling Access Approval complements this by ensuring Google support and operations engineers cannot access customer datasets without explicit, audited authorization from the customer.

Adım Adım Çözüm

1
Address data sovereignty and location restriction requirements.
Apply an Organization Policy using the `constraints/gcp.resourceLocations` constraint set to `in:eu-locations` to prevent resource creation in non-EU regions.
Organization policies provide programmatic guardrails ensuring resources are provisioned strictly within compliant geographic boundaries.
2
Address provider administrative access and data governance controls.
Enable Access Approval across the GCP organization hierarchy.
Access Approval ensures Google personnel must submit an explicit approval request before accessing customer data for support or operational tasks.

Anahtar Kavram

Data Sovereignty and Administrative Access Controls in GCP
Soru 863Soru →

Place the standard stages of a Google Cloud native CI/CD deployment pipeline for containerized applications in the correct sequential order, starting from the developer code commit to the final application deployment.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequential flow for a GCP containerized CI/CD pipeline is: 1) A developer commits code changes to trigger Cloud Build; 2) Cloud Build compiles source code and builds the container image; 3) Cloud Build pushes the container image to Artifact Registry; 4) Cloud Deploy deploys the container image to the target GKE cluster.
The standard sequence follows continuous integration to continuous delivery practices: source repository updates trigger Cloud Build to compile and test code, the resulting artifact is registered in Artifact Registry, and Cloud Deploy manages release promotion to the target compute environment.

Adım Adım Çözüm

1
Identify the event that initiates the CI/CD pipeline
Code commitment to the repository acts as the entry trigger.
CI/CD automation begins with source code changes.
2
Determine the artifact build and testing phase
Cloud Build executes compilation, testing, and container packaging.
Source code must be converted into a runnable container image.
3
Identify artifact storage management
The compiled container image is uploaded to Artifact Registry.
Deployment services require a centralized, versioned registry to pull deployment images.
4
Determine the release deployment phase
Cloud Deploy orchestrates rolling out the stored image to GKE.
The final stage of CD is runtime deployment to operational infrastructure.

Anahtar Kavram

Google Cloud CI/CD Pipeline Execution Flow
Tahmini Süre:1m 0s
Soru 864Soru →

An educational assessment platform hosted on Google Cloud runs two primary microservices: a real-time Exam Submission API, where any request failure directly interrupts active student testing and breaches compliance rules, and an asynchronous Certificate Generation Service, which processes completion credentials within a 48-hour window. Currently, the engineering team applies a uniform 99.99% availability goal across all microservices, leading to excessive operational toil and unnecessary infrastructure cost. Which strategy should the Cloud Architect implement to properly align technical service levels with business impact?

Cevabı ve açıklamayı göster

Cevap: Define separate Service Level Objectives (SLOs) based on business criticality: establish a strict 99.99% availability SLO for the Exam Submission API, and define a lower 99.0% availability SLO for the asynchronous Certificate Generation Service to preserve error budget for core student workflows.

Cevap

Establish tier-based Service Level Objectives (SLOs) aligned with business impact by assigning a strict 99.99% availability SLO to the critical synchronous Exam Submission API while adopting a relaxed 99.0% availability target for the asynchronous Certificate Generation Service.
Differentiating reliability targets according to business impact ensures operational resources and error budgets are focused where service disruption causes maximum business harm. High-impact synchronous services receive stringent SLOs, while background asynchronous services operate under relaxed targets.

Adım Adım Çözüm

1
Analyze business impact for each microservice
Identified Exam Submission API as high-criticality (real-time impact) and Certificate Generation Service as low-criticality (deferrable asynchronous processing).
Business objectives dictate that downtime on synchronous user workflows incurs high penalty, while background tasks tolerate transient delays.
2
Differentiate SLIs and SLOs based on service tiering
Formulate a strict SLO (99.99%) for real-time submissions and a lower SLO (99.0%) for background generation.
Uniform high SLOs across non-critical services lead to over-engineering, increased infrastructure cost, and wasted operational effort.

Anahtar Kavram

Aligning SLOs and Error Budgets with Business Impact
Soru 865Soru →

A multinational SaaS enterprise operating across multiple GCP projects is establishing an organization-wide FinOps governance framework and cost optimization strategy. The current environment consists of steady-state backend API services processing transactional user requests, predictable daily analytical reporting workloads in BigQuery, and highly variable development and testing environments. Which of the following architectural and governance actions should the Cloud Architect recommend to optimize operational spend while enforcing budget accountability? (Select THREE.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enforce mandatory cost-center tag and label policies across all project resources using Organization Policy constraints and map them to BigQuery detailed billing exports.; Purchase Flexible Committed Use Discounts (CUDs) for baseline spend to ensure cost savings across fluctuating compute machine families and regions.; Transition predictable, high-volume BigQuery analytical query workloads from on-demand pricing to edition-based slot reservations.

Cevap

The Cloud Architect should implement mandatory resource labeling linked to BigQuery billing exports, utilize Flexible Committed Use Discounts for baseline compute spend, and transition predictable analytical workloads to BigQuery slot capacity reservations.
Establishing clear FinOps governance requires structured labeling for cost visibility, flexible commitment models for baseline compute to balance cost and agility, and slot reservations for predictable BigQuery workloads to cap analytical expenses.

Adım Adım Çözüm

1
Establish financial visibility and resource accountability.
Organizational policy constraints enforce required tags and labels on all GCP resources, allowing detailed billing data to be analyzed by cost center in BigQuery.
FinOps accountability requires precise allocation of cloud spend back to business units.
2
Optimize baseline compute spending.
Baseline compute requirements are covered by Flexible CUDs across regions and instance series.
Flexible CUDs provide committed spend savings while retaining architectural flexibility across evolving machine types.
3
Optimize predictable BigQuery query costs.
High-volume recurring analytical queries utilize edition-based slot reservations instead of pay-per-TB pricing.
Capacity slot pricing bounds BigQuery costs and offers significant savings over on-demand rates for consistent reporting jobs.

Anahtar Kavram

Enterprise FinOps Governance and Strategic GCP Cost Optimization
Soru 866Soru →

A smart building management provider on Google Cloud experiences deployment instability and security compliance failures resulting from accrued technical debt. An architecture audit revealed two major issues: infrastructure provisioning relies on local Terraform state files saved on individual engineer workstations without concurrency locking, and application workloads run using the default Compute Engine service account bound to project-level primitive Editor roles. Which TWO architectural remediations should the cloud architect implement to mitigate this technical debt? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Migrate state management to a Google Cloud Storage bucket configured with Object Versioning and enable remote backend state locking.; Replace primitive role assignments by creating dedicated user-managed service accounts with predefined or fine-grained custom roles following least privilege.

Cevap

The team should migrate Terraform state files to a Google Cloud Storage bucket configured with Object Versioning and remote backend locking, and replace project-level primitive roles by creating dedicated user-managed service accounts with fine-grained custom or predefined roles.
Migrating Terraform state management to a Cloud Storage bucket with Object Versioning and state locking ensures isolated, atomic state updates without risk of race conditions or data loss. Creating dedicated user-managed service accounts with scoped custom or predefined roles removes over-privileged primitive Editor roles, establishing robust IAM governance.

Adım Adım Çözüm

1
Assess the Infrastructure as Code (IaC) state management technical debt.
Identify that local unversioned Terraform state files lack locking mechanisms, causing race conditions and configuration drift across engineer environments.
Transitioning to a centralized Google Cloud Storage backend configured with Object Versioning and native locking eliminates concurrent state modification hazards.
2
Assess the Identity and Access Management (IAM) security technical debt.
Identify that workloads running under default service accounts with primitive Editor roles possess broad, unneeded permissions across the Google Cloud project.
Creating dedicated user-managed service accounts bound to specific custom or predefined roles ensures compliance with the principle of least privilege.

Anahtar Kavram

Mitigating technical debt by modernizing IaC state backends and enforcing granular IAM least-privilege permissions on Google Cloud.
Soru 867Soru →

An organization wants to establish an automated CI/CD pipeline on Google Cloud. The pipeline must trigger automatically upon code commits, build container images from source files, and store the compiled images in a secure, fully managed Google Cloud repository. Which combination of Google Cloud services best fulfills these requirements?

Cevabı ve açıklamayı göster

Cevap: Cloud Build to execute automated container builds and Artifact Registry to securely store and manage container images.

Cevap

Cloud Build to execute automated container builds and Artifact Registry to securely store and manage container images.
Combining Cloud Build and Artifact Registry forms the foundation of a GCP-native CI/CD pipeline. Cloud Build handles continuous integration by executing build triggers upon code commits, and Artifact Registry acts as the centralized management tool for storing, scanning, and serving container images.

Adım Adım Çözüm

1
Identify the CI/CD execution tool
Cloud Build provides automated continuous integration capabilities triggered by repository events.
Google Cloud Build natively integrates with source repositories to compile code and build container images without managing infrastructure.
2
Identify the artifact storage service
Artifact Registry provides secure, version-controlled storage for container images.
Artifact Registry is the standard Google Cloud service for managing build artifacts and container images used in deployment pipelines.

Anahtar Kavram

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design
Soru 868Soru →

An enterprise analytics team is preparing to migrate an operational workload to Google Cloud during an upcoming weekend maintenance window. The target architecture requires provisioning 500 N2 vCPUs in the europe-west3 region within a single Google Cloud project. The project currently maintains standard default regional quota allocations. Which operational procedure should the Cloud Architect recommend to ensure the infrastructure deployment executes without failing due to resource ceiling restrictions?

Cevabı ve açıklamayı göster

Cevap: Proactively submit a regional quota increase request for N2 vCPUs in europe-west3 via the Google Cloud Console prior to the migration window.

Cevap

Proactively submit a regional quota increase request for N2 vCPUs in europe-west3 via the Google Cloud Console prior to the migration window.
Google Cloud quotas enforce maximum resource limits per project and region. When planning large-scale deployments that exceed default quotas (such as 500 N2 vCPUs in a single region), administrators must proactively request a quota increase through the GCP Console or Quotas API. This guarantees capacity allocation approval prior to automated pipeline execution.

Adım Adım Çözüm

1
Identify the target resource requirements and current project regional quota ceilings.
Discovered that 500 N2 vCPUs exceeds default regional quota limits in europe-west3.
Google Cloud enforces default quotas per region to prevent unexpected billing spikes and ensure platform stability.
2
Submit a quota increase request via Cloud Console or Quotas API before deployment.
Google Cloud processes and grants the requested vCPU ceiling limit prior to execution.
Quota approvals may require manual evaluation or automated checks by GCP operations, which cannot happen instantly during pipeline execution.

Anahtar Kavram

Proactive Resource Quota Management
Soru 869Soru →

A healthcare provider operates a telemedicine application on Google Cloud serving two distinct capabilities: a real-time emergency video triage service where disruptions create direct clinical risks and financial penalties, and an asynchronous medical record export service where generation can take up to 24 hours without violating compliance obligations. Currently, engineering applies a uniform 99.99% availability target across all infrastructure components and relies on static CPU utilization thresholds for alerting. During load surges, non-critical batch record export failures trigger high-priority paging alerts, consuming error budgets and exhausting on-call personnel. Which TWO architectural and operational adjustments should the lead cloud architect recommend to align technical service levels with business and clinical impact? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Decouple service metrics by establishing separate SLIs and SLOs per user journey, maintaining a 99.99% availability SLO for real-time video triage while defining a relaxed completion latency SLO for asynchronous record exports.; Transition alerting strategies from static CPU utilization thresholds to multi-window, multi-burn-rate alerts based on error budget consumption for critical user journeys.

Cevap

The team should decouple service metrics by establishing separate SLIs and SLOs per user journey (maintaining strict targets for real-time triage and relaxed targets for batch exports) and transition alerting strategies from static CPU thresholds to multi-window, multi-burn-rate error budget alerts.
Establishing separate SLIs and SLOs based on user journey criticality aligns technical targets with business risk, ensuring that low-priority batch jobs do not trigger critical pages. Pairing this with multi-window, multi-burn-rate error budget alerts ensures on-call engineers are paged only when error budget depletion threatens business objectives.

Adım Adım Çözüm

1
Analyze business impact across user journeys
Real-time triage carries severe clinical/financial impact during downtime, whereas asynchronous exports tolerate delayed execution up to 24 hours.
Technical service level objectives (SLOs) must reflect business risk rather than treating all infrastructure components uniformly.
2
Define decoupled SLIs and SLOs
Set a high availability SLO (e.g., 99.99%) for video triage requests and a batch completion SLO (e.g., 99.0% processed within 24 hours) for record exports.
Decoupling prevents low-criticality workload failures from consuming critical operational focus.
3
Modernize operational alerting mechanisms
Implement multi-window, multi-burn-rate alerts tracking error budget consumption on critical journeys instead of static CPU utilization thresholds.
Burn-rate alerting ensures pages occur only when customer-facing reliability is endangered, preventing alert fatigue.

Anahtar Kavram

Aligning SLOs and error budget burn rates with business impact and user journey criticality.
Soru 870Soru →

An enterprise SaaS provider is setting up hybrid connectivity between its primary on-premises management center and a Google Cloud VPC network. To meet internal reliability mandates, the connection must achieve a 99.99% availability SLA using IPsec encryption and dynamic routing. Which TWO configuration steps must be implemented on Google Cloud to fulfill these HA Cloud VPN requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision an HA Cloud VPN gateway in the VPC, which automatically generates two external IP addresses assigned across distinct interfaces.; Establish two VPN Tunnels from the HA Cloud VPN gateway interfaces and configure active BGP sessions on a Cloud Router for each tunnel.

Cevap

To achieve a 99.99% SLA with HA Cloud VPN, you must provision an HA Cloud VPN gateway (which automatically creates two interfaces with unique public IP addresses) and configure two VPN tunnels associated with active BGP sessions on a Cloud Router.
Achieving a 99.99% availability SLA for HA Cloud VPN requires deploying an HA Cloud VPN gateway—which allocates two separate public IP addresses across Interface 0 and Interface 1—and configuring two active IPsec VPN Tunnels paired with dynamic BGP routing on a Cloud Router. This dual-interface, dual-tunnel setup guarantees full redundancy across Google Cloud infrastructure.

Adım Adım Çözüm

1
Deploy an HA Cloud VPN Gateway in the target Google Cloud VPC
Two distinct external IP addresses are automatically provisioned (one for Interface 0 and one for Interface 1).
HA Cloud VPN requires redundancy at the gateway level to guarantee 99.99% availability.
2
Configure Cloud VPN Tunnels and Cloud Router BGP Sessions
Two active IPsec tunnels connect the on-premises VPN device(s) to both HA Cloud VPN interfaces, using dynamic routing via BGP.
Dynamic dynamic BGP routing over two redundant tunnels ensures automatic failover and dynamic route exchange.

Anahtar Kavram

HA Cloud VPN High Availability Requirements (99.99% SLA)
Soru 871Soru →

An enterprise online gaming platform processes real-time multiplayer state and inventory data on Google Cloud, operating primarily out of us-east4 with a disaster recovery (DR) standby target in us-west1. The business mandates a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 15 minutes. The lead cloud architect is establishing a validation procedure for bi-annual DR drills to confirm operational readiness and failover execution without disrupting live production traffic. Which of the following procedural steps must be included in the DR validation framework to satisfy these business continuity requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Perform pre-drill verification of regional resource quotas and capacity reservations in us-west1, coupled with synthetic traffic generation against isolated DR staging endpoints to validate RTO bounds.; Implement continuous automated validation of database replication lag metrics between regions, verifying that the replication delta stays below 5 seconds prior to initiating failover simulation.

Cevap

The validation framework must include pre-drill verification of regional quota limits and capacity in the standby region alongside synthetic traffic testing against isolated endpoints, as well as continuous automated monitoring of database replication lag metrics to verify compliance with the RPO target.
To validate a DR strategy against an RPO < 5 seconds and RTO < 15 minutes without disrupting production, architects must ensure standby infrastructure quotas are pre-approved and perform synthetic load tests on isolated secondary endpoints. Furthermore, verifying that cross-region database replication lag remains consistently below 5 seconds validates that RPO targets are satisfied before failover is initiated.

Adım Adım Çözüm

1
Assess capacity and quota readiness for the disaster recovery region.
Ensure that regional quotas in us-west1 and capacity reservations are locked in prior to the drill so resource allocation succeeds during traffic shift.
GCP resource quotas are regional limits that are not automatically elevated by autoscaling policies.
2
Establish continuous monitoring for data synchronization metrics.
Confirm that the cross-region database replication delta remains under 5 seconds.
Continuous validation of replication lag is required to guarantee compliance with an RPO of less than 5 seconds.
3
Execute non-disruptive validation using synthetic load.
Synthesize traffic against staging endpoints in the secondary region to verify RTO without altering production DNS or impacting live users.
Synthetic testing verifies system performance and failover automation within the RTO budget of 15 minutes.

Anahtar Kavram

Disaster Recovery Validation and RPO/RTO Capacity Planning
Soru 872Soru →

An enterprise architecture team is configuring network connectivity between an on-premises data center, a Shared VPC host project acting as a consumer network, and an isolated producer VPC network hosting an internal microservices application. On-premises systems connected via Dedicated Interconnect and Compute Engine workloads residing in service projects attached to the Shared VPC must securely access the producer application. Transitive network routing must not be configured, and overlapping IP ranges between the producer and consumer networks must be tolerated. Which TWO configuration steps should the cloud architect implement to fulfill these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision a Private Service Connect (PSC) endpoint in the consumer Shared VPC that references a Service Attachment created in the producer VPC network.; Configure custom BGP route advertisements on the consumer Shared VPC Cloud Router to advertise the Private Service Connect endpoint IP address range to the on-premises router over Cloud Interconnect.

Cevap

The correct architecture requires provisioning a Private Service Connect (PSC) endpoint in the consumer Shared VPC linked to the producer Service Attachment, and configuring custom BGP route advertisements on the consumer Cloud Router to announce the PSC endpoint IP range to on-premises networks.
Private Service Connect (PSC) allows private access to producer services without VPC Peering, avoiding transitive routing constraints and accommodating overlapping CIDR ranges. To allow on-premises systems connected via Dedicated Interconnect to access the PSC endpoint in the consumer VPC, the Cloud Router in the consumer VPC must advertise the PSC endpoint's IP address range via BGP custom route advertisements.

Adım Adım Çözüm

1
Select Private Service Connect for cross-VPC service publishing without peering transitivity
Establishes unilateral private access to the producer service using an internal consumer IP address while preventing full network exposure and resolving overlapping IP constraints via NAT.
VPC Network Peering is non-transitive and cannot forward on-premises traffic through peering links.
2
Configure custom BGP route advertisement on the Cloud Router managing Dedicated Interconnect BGP sessions
Advertises the IP address of the PSC endpoint to the on-premises router over BGP.
By default, Cloud Router advertises subnet IP ranges; explicit custom route advertisements are required so on-premises networks learn the path to PSC endpoint IPs.

Anahtar Kavram

Private Service Connect and Hybrid Route Advertisements
Soru 873Soru →

An enterprise automotive manufacturer is finalizing the cloud architecture for a global connected vehicle diagnostic platform. The conceptual architecture defines four primary logical requirements: (1) asynchronous ingestion of high-volume telemetry from millions of vehicles, (2) low-latency read/write access for time-series vehicle health metrics, (3) cost-effective long-term archival of raw diagnostic logs for safety compliance, and (4) perimeter isolation to prevent authorized users from exfiltrating data to external Google Cloud projects. Which set of Google Cloud physical services correctly implements this logical design?

Cevabı ve açıklamayı göster

Cevap: Cloud Pub/Sub for telemetry ingestion, Cloud Bigtable for time-series health metrics, Cloud Storage for raw diagnostic log archival, and VPC Service Controls for perimeter exfiltration protection.

Cevap

The physical architecture utilizing Cloud Pub/Sub for ingestion, Cloud Bigtable for time-series metrics, Cloud Storage for archival, and VPC Service Controls for perimeter protection correctly satisfies all conceptual and logical requirements.
The solution accurately maps each logical requirement to its optimal physical service: Cloud Pub/Sub for streaming ingestion, Cloud Bigtable for time-series telemetry metrics, Cloud Storage for compliance archives, and VPC Service Controls to prevent exfiltration across perimeter boundaries.

Adım Adım Çözüm

1
Map ingestion and time-series operational tier requirements to physical services
Cloud Pub/Sub provides scalable serverless message ingestion. Cloud Bigtable delivers low-latency, high-throughput time-series storage optimized for vehicle metrics.
Matching logical data access patterns to specialized native GCP storage engines minimizes latency and operational complexity.
2
Identify the long-term compliance log storage component
Cloud Storage provides durable, cost-effective object storage classes suitable for raw diagnostic payload archives.
Archival data requires high durability and flexible storage tiers without requiring database indexing.
3
Select security components to satisfy exfiltration boundary limits
VPC Service Controls restricts service communication and data movement across perimeter boundaries, preventing unauthorized data copy actions even by valid IAM identities.
Logical security boundaries aiming to block data exfiltration require network/service perimeters in addition to identity permissions.

Anahtar Kavram

Mapping logical architecture requirements to GCP physical services and security controls
Tahmini Süre:1m 30s
Soru 874Soru →

A multinational financial technology enterprise headquartered in Brazil is migrating its core payment processing platform to Google Cloud. To comply with local regulatory mandates and strict data sovereignty laws, the cloud solution architecture must satisfy three mandatory requirements:
1. All Cloud Storage buckets and BigQuery datasets storing sensitive customer data must strictly be restricted to provisioning in the `southamerica-east1` (São Paulo) region.
2. All stored data must be encrypted at rest using keys where the organization maintains administrative control over key management, access policies, and rotation schedules in Cloud KMS.
3. Authorized IAM users and service accounts inside the environment must be prevented from exfiltrating data to external Google Cloud projects or non-approved resources.

Which combination of Google Cloud architectural controls satisfies all of these compliance and data sovereignty requirements?

Cevabı ve açıklamayı göster

Cevap: Enforce the gcp.resourceLocations organization policy constraint restricted to southamerica-east1, configure Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS in southamerica-east1 for Cloud Storage and BigQuery, and define a VPC Service Controls security perimeter around the resources.

Cevap

Enforce the gcp.resourceLocations organization policy constraint restricted to southamerica-east1, configure Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS in southamerica-east1 for Cloud Storage and BigQuery, and define a VPC Service Controls security perimeter around the resources.
The correct solution combines the `gcp.resourceLocations` organization policy constraint to enforce geographic location boundaries, Customer-Managed Encryption Keys (CMEK) in Cloud KMS to maintain key management governance over at-rest encryption, and VPC Service Controls to form a perimeter preventing data exfiltration outside the defined environment.

Adım Adım Çözüm

1
Enforce Geographic Data Residency
Applying the `gcp.resourceLocations` organization policy constraint at the project or folder level strictly restricts resource creation to the specified region (`southamerica-east1`).
Regulatory compliance requires guaranteed physical placement of data storage and compute resources within specific national boundaries.
2
Implement Key Governance via CMEK
Configuring Customer-Managed Encryption Keys (CMEK) allows the enterprise to retain key lifecycle management, rotation, and revocation control within Cloud KMS without managing raw encryption keys on-premises.
CMEK integrates natively with Cloud Storage and BigQuery to fulfill regulatory cryptographic control requirements.
3
Prevent Data Exfiltration with VPC Service Controls
Constructing a VPC Service Controls security perimeter isolates Google Cloud services and prevents authorized IAM identities from copying data to resources outside the designated perimeter.
IAM controls authorization for identities, but VPC Service Controls restricts service-level data movement and exfiltration channels.

Anahtar Kavram

Data Sovereignty and Exfiltration Prevention in GCP
Soru 875Soru →

A financial enterprise is establishing a secure CI/CD pipeline using external GitHub Actions runners to deploy infrastructure and retrieve application configuration secrets stored in Google Cloud Secret Manager. The security team mandates a zero-trust model that completely eliminates downloadable long-lived service account keys, enforces strict credential scoping to specific Git repositories, and adheres to the principle of least privilege. Which TWO actions should you incorporate into the architecture to satisfy these security requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Workload Identity Federation with attribute conditions mapped to the GitHub repository identity, allowing the pipeline to exchange OIDC tokens for short-lived Google Cloud credentials.; Grant the Workload Identity Federation principal set the Workload Identity User role on the targeted deployment Service Account rather than assigning project-level primitive roles.

Cevap

The correct architecture requires configuring Workload Identity Federation with attribute conditions for external OIDC token exchange, and granting the Workload Identity User role specifically on the target deployment service account.
Securing external non-GCP workloads without long-lived keys requires Workload Identity Federation. By configuring attribute conditions (e.g., assertion.repository == 'org/repo') and binding the Workload Identity User role directly on the deployment service account, external pipelines obtain short-lived access with strict repository scoping and minimal privileges.

Adım Adım Çözüm

1
Eliminate static service account keys using Workload Identity Federation.
External CI/CD workflows authenticate via short-lived OpenID Connect (OIDC) tokens mapped to a Workload Identity Pool.
Prevents secret exposure and management overhead associated with downloadable service account key files.
2
Restrict identity mapping with attribute conditions.
Only OIDC tokens issued to the exact repository and build environment are allowed to exchange tokens.
Prevents unauthorized repositories in the same organization from impersonating deployment credentials.
3
Apply fine-grained IAM impersonation permissions.
The external principal set receives the roles/iam.workloadIdentityUser binding strictly on the designated service account.
Adheres to the principle of least privilege by scope-limiting impersonation rights.

Anahtar Kavram

Workload Identity Federation and Service Account Lifecycle Security
Soru 876Soru →

Your organization is establishing a secure SDLC pipeline on Google Cloud to ensure that only verified, vulnerability-scanned container images are deployed to Google Kubernetes Engine (GKE). Place the following CI/CD pipeline stages in the correct execution sequence from initial code build to production container deployment.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct pipeline sequence begins with Cloud Build compiling code and building the image using a least-privilege custom service account, followed by pushing the image to Artifact Registry to trigger Container Analysis. Next, an attestation authority validates scan results and cryptographically signs a Binary Authorization attestation. Finally, Cloud Deploy triggers GKE deployment, where Binary Authorization verifies the attestation before container pods launch.
The standard secure CI/CD delivery pipeline follows a precise lifecycle sequence: 1) Source compilation and container image generation using custom least-privilege service accounts. 2) Artifact registration in Artifact Registry with automated vulnerability scanning via Container Analysis. 3) Attestation generation by signing the image digest once vulnerability checks pass. 4) Deployment triggering via Cloud Deploy with Binary Authorization enforcement on the target GKE cluster.

Adım Adım Çözüm

1
Build container artifact
Container image created via Cloud Build using a dedicated least-privilege service account
Source code must be compiled and packaged before scanning or attestation.
2
Store and scan container image
Image stored in Artifact Registry with Container Analysis scanning enabled
Artifact Registry provides secure storage and automatically executes vulnerability scans on new image digests.
3
Generate security attestation
Binary Authorization attestation signed by an attestor key pair
Security governance requires cryptographic verification of scan compliance prior to deployment.
4
Enforce admission policy at deployment
GKE admission controller validates attestation before Pod execution
Binary Authorization blocks unsigned or unverified container images from running in production.

Anahtar Kavram

Software Supply Chain Security & CI/CD Pipeline Order
Soru 877Soru →

An application deployed on a Compute Engine virtual machine (VM) needs to read objects from a Cloud Storage bucket programmatically using the Google Cloud SDK. Which approach is the most secure and recommended method to handle authentication for this application?

Cevabı ve açıklamayı göster

Cevap: Attach a custom service account with specific Cloud Storage roles to the VM and authenticate using Application Default Credentials (ADC).

Cevap

Attach a custom service account with specific Cloud Storage roles to the VM and authenticate using Application Default Credentials (ADC).
Attaching a custom service account to a Compute Engine VM enables the Google Cloud SDK and client libraries to automatically retrieve short-lived OAuth 2.0 access tokens from the instance metadata server via Application Default Credentials (ADC). This eliminates the management and security risks associated with storing or rotating long-lived service account key files.

Adım Adım Çözüm

1
Determine the optimal identity mechanism for workloads running on Google Cloud.
Identify that Compute Engine instances can inherit identity from attached service accounts.
This allows applications to use Application Default Credentials (ADC) seamlessly.
2
Apply Google Cloud security best practices.
Grant only the fine-grained IAM roles needed for Cloud Storage object access to the service account.
Enforces the principle of least privilege and avoids managing static JSON key files.

Anahtar Kavram

Application Default Credentials (ADC) and Service Account Attachments
Soru 878Soru →

An enterprise cloud architecture team for a global satellite imagery provider is designing a new cloud solution architecture on Google Cloud to ingest, process, store, and distribute petabyte-scale earth observation data. To ensure alignment with enterprise architecture standards, the team must translate business requirements progressively through conceptual, logical, and physical architecture design phases. Arrange the architectural design activities in the correct sequential order from initial conceptual abstraction down to physical infrastructure enforcement.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with defining high-level business capabilities and domains (conceptual architecture), followed by mapping capabilities into vendor-agnostic logical tiers and data flows (logical architecture), then selecting specific concrete Google Cloud services (physical architecture selection), and finally authoring Infrastructure as Code templates to configure detailed networks, IAM, CMEK, and security perimeters (physical implementation).
Enterprise cloud architecture design strictly flows top-down: Conceptual Architecture (defining business capabilities and domains without technology dependencies) -> Logical Architecture (structuring data flows, component boundaries, and security trust zones) -> Physical Architecture Selection (mapping logical tiers to specific Google Cloud services like GKE, BigQuery, Cloud Storage) -> Physical Implementation (authoring IaC code for exact subnets, CMEK, IAM, and VPC Service Control perimeters).

Adım Adım Çözüm

1
Identify the Conceptual Architecture step
Defining high-level business capabilities, functional domains, and technology-agnostic boundaries forms the initial conceptual blueprint.
Conceptual architectures establish 'what' the business system does independent of implementation details or vendor choices.
2
Identify the Logical Architecture step
Mapping conceptual capabilities into logical service tiers, decoupled data flows, and trust zones establishes the logical design.
Logical architectures define structural relationships, data flow models, and component boundaries prior to selecting specific technologies.
3
Identify the Physical Component Selection step
Selecting specific Google Cloud managed services (e.g., Cloud Storage, Pub/Sub, GKE Autopilot, BigQuery) translates logical tiers into physical technology choices.
Physical architecture translates logical constructs into specific cloud products, resource configurations, and vendor technologies.
4
Identify the Physical Implementation & Guardrails step
Authoring IaC scripts to provision subnets, private Service Connect endpoints, CMEK keys, and VPC Service Control perimeters completes the physical instantiation.
Detailed deployment artifacts and security perimeters represent the final executable state of physical architecture.

Anahtar Kavram

Progressive Architectural Abstraction: Conceptual to Logical to Physical Architecture
Soru 879Soru →

A multinational organization operates a hybrid cloud network using a single Google Cloud Virtual Private Cloud (VPC) with subnets in us-central1 and europe-west1. The organization maintains a Dedicated Interconnect connection at a colocation facility in Frankfurt, which connects to a Cloud Router in europe-west1. Administrators observe that on-premises systems in Europe can successfully communicate with Compute Engine instances in europe-west1, but cannot reach instances located in us-central1. How should the Cloud Architect resolve this connectivity issue?

Cevabı ve açıklamayı göster

Cevap: Change the VPC network dynamic routing mode from Regional to Global.

Cevap

Change the VPC network dynamic routing mode from Regional to Global.
In Google Cloud VPC networks, dynamic routing mode can be set to Regional or Global. Under Regional dynamic routing, a Cloud Router only advertises subnets located in its local region. By changing the dynamic routing mode to Global, the Cloud Router in europe-west1 will advertise all subnets in the VPC—including us-central1—to the on-premises BGP peer over the Dedicated Interconnect.

Adım Adım Çözüm

1
Analyze the current Cloud Router and VPC network routing behavior.
By default, VPC networks often use Regional Dynamic Routing, where Cloud Routers only advertise subnets in their local region to BGP peers.
Understanding why the Cloud Router in europe-west1 is only advertising the local europe-west1 subnet range to the on-premises router.
2
Evaluate the requirement for cross-region hybrid network accessibility.
The requirement states that on-premises systems connected via Interconnect in Europe must reach resources in us-central1.
Global Dynamic Routing enables Cloud Routers in one region to advertise all subnets across the entire VPC to on-premises peers.
3
Modify the VPC dynamic routing configuration.
Updating dynamic routing mode to Global ensures seamless multi-region reachability without deploying extra network infrastructure.
This provides high-availability inter-region routing managed automatically by Google Cloud's software-defined network.

Anahtar Kavram

Cloud Router Global Dynamic Routing Mode
Tahmini Süre:1m 30s
Soru 880Soru →

An international commercial airline hosts its mission-critical flight scheduling and crew dispatch platform on Google Cloud, operating primarily out of us-central1 with a secondary disaster recovery deployment in us-east4. The system is designed to meet a Recovery Point Objective (RPO) of under 5 minutes and a Recovery Time Objective (RTO) of under 30 minutes. During a scheduled disaster recovery validation drill simulating a total loss of us-central1, database failover completed within RPO target limits and Cloud DNS failover routing was initiated. However, the secondary region failed to meet the target RTO because Compute Engine instance groups in us-east4 could not scale up to handle production traffic due to unrequested regional vCPU quota limits. Which procedure should the Cloud Architect implement to ensure future disaster recovery validation drills and actual failovers successfully meet business continuity objectives?

Cevabı ve açıklamayı göster

Cevap: Implement automated pre-drill verification procedures to audit regional vCPU quota limits and maintain active Compute Engine capacity reservations in the disaster recovery region.

Cevap

Establish automated pre-drill verification procedures that audit regional quotas and maintain Compute Engine capacity reservations in the disaster recovery region.
The correct option establishes pre-drill automated verification of regional vCPU quotas and utilizes Compute Engine capacity reservations in the secondary region. Disaster recovery validation procedures must ensure that target regions not only have correct configuration states, but also sufficient quota limits and reserved compute capacity to handle full production traffic within specified RTO constraints.

Adım Adım Çözüm

1
Analyze the root cause of the disaster recovery RTO failure.
Identified that compute instances in the secondary region (us-east4) failed to scale up due to hitting regional Compute Engine vCPU quota limits during failover execution.
GCP resource quotas are enforced at a regional level and must be requested and verified prior to requiring large compute scale-outs.
2
Evaluate validation procedure requirements for business continuity and disaster recovery.
Determined that robust DR validation procedures must verify resource availability, quotas, and baseline infrastructure state in the target region ahead of simulated or real failovers.
Preventive automated pre-checks and compute capacity reservations guarantee that the secondary region has sufficient guaranteed headroom to accommodate workload failover within RTO parameters.
3
Formulate the optimal architectural validation procedure.
Combine pre-drill automated quota auditing with Compute Engine capacity reservations in us-east4.
This guarantees required capacity and quota compliance before traffic diversion occurs.

Anahtar Kavram

Disaster Recovery Validation Procedures and Regional Resource Quota Management
ÖncekiSayfa 44 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin