Tüm alıştırma soruları

A digital gaming studio is analyzing its continuous delivery pipeline on Google Cloud. The automated pipeline uses Cloud Build to execute Terraform manifests that provision compute clusters and database resources for new game instances. During an operational review, the team observes two major issues: concurrent pipeline runs occasionally overwrite each other's infrastructure changes causing state corruption, and the pipeline runs under an over-privileged security context. Which combination of architectural changes should the team implement to secure the pipeline and ensure infrastructure state integrity?

An enterprise plan involves migrating a legacy batch-processing platform requiring 500 high-capacity Compute Engine Virtual Machines to a single target GCP region within a strict maintenance window. Prior to executing the migration script, which proactive capacity planning step must the cloud architect take to prevent deployment failure due to resource limits?

A financial enterprise is designing a perimeter security architecture on Google Cloud for a payment processing platform deployed across multiple projects. The architectural requirements specify that workload instances must privately access Google APIs (such as Cloud Storage and BigQuery) without internet egress, while strictly preventing data exfiltration to external GCP organizations. Additionally, network administrators require centralized, non-bypassable firewall rules across all projects, and the design must adhere to GCP constraints prohibiting transitive routing across peered VPCs. Which TWO design choices should the Cloud Architect implement to satisfy these security and network requirements?

An enterprise digital publishing platform hosts its core services in us-central1 and maintains a secondary disaster recovery environment in us-east4 on Google Cloud. The infrastructure utilizes Compute Engine Managed Instance Groups (MIGs), Cloud SQL cross-region read replicas, and Cloud Storage. During an upcoming business continuity validation drill, the architecture team must test regional failover procedures while ensuring continuous replication remains undisturbed and preventing resource allocation failures. Which TWO validation procedures should the team include in their disaster recovery test plan? (Select TWO.)

An enterprise cloud security architect is documenting how Google Cloud IAM calculates effective access permissions when a service account attempts to read an object stored in a Cloud Storage bucket. Arrange the steps of the IAM policy evaluation process in the correct chronological order from initial API request submission to the final access determination.

A retail enterprise is provisioning a regional relational database infrastructure on Google Cloud using Terraform. Multiple cloud engineers will execute concurrent deployments, and compliance guidelines require protecting the infrastructure configuration state against state corruption, concurrent executions, and accidental state destruction. Which strategy should be implemented to securely provision and manage the infrastructure state?

An enterprise security architecture team needs to establish automated rotation for a database password stored in Google Cloud Secret Manager. The workflow must use Cloud Pub/Sub and a Cloud Function to automatically generate, test, and store new password versions every 90 days according to least privilege principles. In what order should the administrative steps be performed to configure this automated rotation pipeline?

A financial services organization is storing sensitive transactional data in Cloud Spanner. Compliance regulations mandate that data at rest must be encrypted using encryption keys managed in Google Cloud KMS by a centralized security team, completely separated from database administrators. Additionally, automated key rotation must be configured without requiring application code changes or manually re-encrypting existing data. Which key management strategy should the cloud architect recommend?

You need to configure your local development environment to authenticate programmatic interactions with Google Cloud APIs using Application Default Credentials (ADC) via service account impersonation, avoiding the use of long-lived downloaded service account keys. In what sequence should you execute these configuration steps?

A Switzerland-based aerospace defense contractor is migrating its telemetry and aircraft design repository to Google Cloud. Compliance mandates dictate that all data at rest must remain strictly confined to the europe-west6 (Zurich) region and protected against unauthorized cloud provider personnel access during administrative support. Furthermore, you must prevent authorized internal users from exfiltrating sensitive datasets to external Google Cloud storage locations outside the enterprise network boundary. Which TWO architectural controls should you implement to satisfy these regulatory compliance and data sovereignty requirements?

An enterprise hybrid application written in Python needs to programmatically manage infrastructure resources across multiple Google Cloud projects via Google Cloud Client Libraries. The application runs simultaneously on on-premises virtual machines and Google Kubernetes Engine (GKE) clusters. Company security compliance strictly prohibits the creation and storage of downloadable, long-lived service account JSON key files anywhere in the deployment pipeline. Furthermore, the application must interact with APIs across target projects without delegating broad administrative permissions to the workload identity directly. How should you design the programmatic authentication and authorization architecture to satisfy these requirements?

An insurance enterprise processes policyholder claims on Google Cloud using two primary components: a synchronous Claim Submission API that impacts immediate customer satisfaction, and an asynchronous Document Archival worker pipeline that processes claims for long-term auditing within a 24-hour window. Executive leadership wants to align operational reliability alerting with business impact while avoiding alert fatigue. Which TWO actions should the Cloud Architect recommend to achieve this alignment?

An online retail enterprise is preparing for an upcoming annual mega-sale expected to drive a projected $10\times$ surge in peak user traffic over a 48-hour window. Their primary application architecture consists of a stateless HTTP API tier deployed on Compute Engine Managed Instance Groups (MIGs) and a Cloud SQL PostgreSQL backend database. During previous smaller sales, sudden traffic spikes caused temporary latency spikes because MIG reactive autoscaling took several minutes to spin up new virtual machine instances, and the Cloud SQL backend suffered from connection exhaustion. Furthermore, the architecture team needs to ensure infrastructure scaling will not fail due to cloud platform limitations during the event. Which capacity planning and workload scaling optimization strategy should the Cloud Architect recommend?

A cloud engineering team is configuring an automated CI/CD deployment pipeline using Cloud Build to deploy containerized microservices to a Google Kubernetes Engine (GKE) cluster. To comply with organizational security governance and the principle of least privilege, the team needs to assign permissions to the Cloud Build service account. Which configuration represents the optimal approach for granting Cloud Build access to deploy workloads to the cluster?

A SaaS logistics company operating on Google Cloud provides two core features: a real-time fleet GPS tracking API and an end-of-month regulatory compliance report generator. The business incurs financial penalties if the real-time tracking API availability drops below $99.9\%$, whereas compliance report generation allows a 24-hour delivery window without penalty. Currently, the engineering team applies a single composite availability goal of $99.99\%$ across the entire platform, causing frequent false-alarm pages and unnecessary over-engineering costs. Which approach should the Cloud Architect recommend to properly align technical SLOs and SLIs with business impact?

A financial technology enterprise processes high-throughput transaction streams using Google Kubernetes Engine (GKE) and Cloud Spanner. During quarterly settlement windows, incoming event volume surges suddenly by $20\times$ baseline load within a 3-minute window. During recent events, the platform experienced packet drops and elevated latency because the GKE Horizontal Pod Autoscaler (HPA) reacted too slowly to CPU load, and worker node scaling was constrained by regional Compute Engine quota limits. Which TWO capacity planning and workload scaling optimization strategies should you implement to resolve these performance bottlenecks? (Select TWO.)

An enterprise development team is deploying an automated Python application inside a Google Kubernetes Engine (GKE) Pod. The application needs to programmatically upload archived files to a Cloud Storage bucket using the official Google Cloud Python Client Library. Which TWO actions should the team take to securely authenticate and execute these API calls? (Select TWO)

A cloud platform team needs to deploy a Cloud SQL for PostgreSQL database instance with Private Services Access (PSA) and Customer-Managed Encryption Keys (CMEK). Arrange the operational steps in the correct order to provision this infrastructure successfully.

A developer is building a Node.js microservice deployed to Cloud Run that needs to programmatically publish telemetry messages to a Google Cloud Pub/Sub topic. Which authentication approach should the developer use to allow the Google Cloud Client Library to interact with Pub/Sub securely?

A healthcare organization is migrating an operational telemetry application to Google Cloud. The architecture uses Compute Engine persistent disks for temporary cache storage and Cloud Storage for long-term log archiving. Security compliance mandates that all data at rest be encrypted using keys generated and protected inside FIPS 140-2 Level 3 validated Hardware Security Modules (HSMs) in Google Cloud, while supporting automated key rotation. Furthermore, key access control must strictly adhere to the principle of least privilege without relying on broad administrative roles. Which TWO configuration steps should the security architect implement to meet these requirements? (Select TWO.)