Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 921Soru →

Your engineering team is executing a blue-green deployment strategy for a stateless microservice on Google Kubernetes Engine (GKE) that relies on a Cloud SQL database. In what sequence should you execute these deployment steps to achieve a zero-downtime release?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for a zero-downtime blue-green deployment starts with applying backward-compatible database schema updates. Next, deploy the new green application version to GKE, followed by running internal smoke tests to validate its readiness. After successful validation, update Cloud Load Balancing to route user traffic to the green deployment. Finally, monitor service health and decommission the old blue deployment.
Applying backward-compatible database migrations first guarantees that active users on the blue environment experience no disruption. Deploying and validating the green application in isolation minimizes risk. Updating Cloud Load Balancing instantly shifts user traffic to the green release without dropping connections, and retaining the blue version during a brief soak period provides a quick rollback option before cleanup.

Adım Adım Çözüm

1
Execute backward-compatible database schema migrations.
The database supports both legacy and new application code models concurrently.
Prevents runtime database errors for users currently on the active blue version.
2
Provision the green workload on Google Kubernetes Engine.
The green pods launch in parallel without receiving public traffic.
Establishes the new application version in an isolated environment.
3
Validate the green environment using internal endpoints.
Functional readiness and health of the green application are confirmed.
Prevents routing end-user traffic to a broken or misconfigured release.
4
Reconfigure Cloud Load Balancing to target the green backend service.
All incoming user requests instantly switch to the green application.
Executes the instantaneous traffic cutover required for zero-downtime deployment.
5
Decommission the blue GKE deployment after a soak period.
Old cluster resources are deleted once stability is assured.
Preserves an instant rollback path during initial monitoring before freeing infrastructure resources.

Anahtar Kavram

Blue-Green Deployment Lifecycle & Database Schema Compatibility
Tahmini Süre:1m 15s
Soru 922Soru →

An enterprise is designing a multi-project CI/CD pipeline on Google Cloud to deploy containerized microservices across staging and production environments. The security team mandates that container images built by Cloud Build in a shared build project must be verified for compliance using Binary Authorization attestations before release. Additionally, deployments to target Google Kubernetes Engine (GKE) clusters must support automated progressive delivery pipelines with mandatory manual approval gates for production targets, while strictly avoiding granting broad administrative permissions to build execution accounts. Which architectural solution satisfies these security and deployment requirements?

Cevabı ve açıklamayı göster

Cevap: Publish container images to Artifact Registry, use Cloud Key Management Service (Cloud KMS) to sign image attestations within Cloud Build for Binary Authorization, and deploy using Google Cloud Deploy pipelines configured with approval requirements for production GKE target promotion.

Cevap

Publish container images to Artifact Registry, sign image attestations using Cloud KMS within Cloud Build for Binary Authorization validation, and orchestrate progressive release pipelines across GKE targets using Google Cloud Deploy with production approval gates.
The solution combining Artifact Registry for container management, Cloud KMS with Binary Authorization for supply chain security attestations, and Google Cloud Deploy for multi-target release management with approval gates fulfills all operational, security, and governance requirements under GCP architectural best practices.

Adım Adım Çözüm

1
Analyze container build and artifact storage requirements.
Cloud Build compiles container images and publishes them to a centralized Artifact Registry repository in the shared services project.
Centralizing build artifacts in Artifact Registry provides enterprise governance, vulnerability scanning, and access control.
2
Implement software supply chain security controls.
Configure Cloud Build to generate digital signatures using Cloud KMS keys and store attestations in Container Analysis for Binary Authorization enforcement upon GKE cluster deployment.
Binary Authorization ensures that only trusted, verified container images meeting organizational policies can run on target GKE clusters.
3
Establish release orchestration with security gates.
Leverage Google Cloud Deploy to define delivery pipelines across staging and production GKE targets, enforcing required approval steps prior to production rollout.
Cloud Deploy decouples build execution from deployment orchestration, providing native promotion workflows and audit logs while adhering to least-privilege IAM models.

Anahtar Kavram

Enterprise CI/CD Pipeline Architecture with Cloud Build, Artifact Registry, Binary Authorization, and Google Cloud Deploy
Soru 923Soru →

A multinational financial enterprise is modernizing its legacy payment-processing system by migrating to Google Cloud. During executive alignment sessions, business stakeholders express deep concerns that rapid architectural changes will disrupt critical quarterly financial reporting and exceed the operational capabilities of existing support teams. As the Lead Lead Cloud Architect, which strategy best aligns Google Cloud technical modernization with business stakeholder change management best practices?

Cevabı ve açıklamayı göster

Cevap: Establish a phased migration framework incorporating interactive sandbox enablement environments, structured skills development, and migration windows scheduled outside peak financial reporting cycles.

Cevap

Establish a phased migration framework incorporating interactive sandbox enablement environments, structured skills development, and migration windows scheduled outside peak financial reporting cycles.
The successful strategy integrates technical cloud architecture with organizational change management by providing structured enablement programs, hands-on training, and aligning deployment schedules with low-risk business windows.

Adım Adım Çözüm

1
Analyze business stakeholder requirements and operational constraints.
Identified critical dependencies: business disruption risks during reporting cycles and team skill gaps.
Organizational change management requires addressing both technical delivery and team readiness.
2
Evaluate organizational change management strategies alongside GCP technical governance.
Combining structured enablement with phased deployment mitigates business risk while building cloud competency.
Phased rollouts prevent operational overload and respect key business reporting timelines.

Anahtar Kavram

Analyzing Business Stakeholder Requirements and Managing Organizational Change
Soru 924Soru →

A media enterprise organizes its Google Cloud environment into a parent folder named 'Video-Streaming', which contains sub-folders for 'Transcoding' and 'Distribution'. An automated deployment pipeline using a dedicated service account needs to create and delete Compute Engine VM instances across all projects under both sub-folders. The pipeline must not be granted permissions to modify IAM security policies, manage service accounts, or alter VPC firewall rules. Which IAM role configuration meets these requirements while adhering to the principle of least privilege and minimizing maintenance overhead?

Cevabı ve açıklamayı göster

Cevap: Grant the Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) to the pipeline service account at the 'Video-Streaming' folder level.

Cevap

Grant the Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) to the pipeline service account at the 'Video-Streaming' folder level.
The correct option applies the predefined `roles/compute.instanceAdmin.v1` role at the parent folder node in the resource hierarchy. Google Cloud IAM permissions inherit down the resource tree, so binding the role at the parent folder grants the necessary VM lifecycle permissions across all child folders and projects while maintaining least privilege and reducing management complexity.

Adım Adım Çözüm

1
Identify the required operational capabilities for the service account.
The service account needs to manage Compute Engine VM instances (create and delete) without broader permissions over networking, IAM policies, or service account management.
Following the principle of least privilege requires selecting a fine-grained predefined role rather than broad administrative or primitive roles.
2
Evaluate the IAM role that aligns with the instance management requirements.
The predefined role `roles/compute.instanceAdmin.v1` allows full control of Compute Engine instances while omitting networking administration and IAM modification capabilities.
This predefined role grants exact permissions required for VM operations without security over-privilege.
3
Determine the resource hierarchy binding level to minimize administrative overhead.
Binding the role at the 'Video-Streaming' parent folder level automatically inherits permissions down to all projects in the 'Transcoding' and 'Distribution' sub-folders.
Resource hierarchy inheritance allows centralized access management at the parent container level instead of configuring redundant bindings on individual child projects.

Anahtar Kavram

GCP IAM Role Scoping and Resource Hierarchy Inheritance
Soru 925Soru →

A healthcare organization processes Electronic Health Records (EHR) stored in BigQuery and Cloud Storage inside a dedicated Google Cloud project named Project-Analytics. Authorized analysts access these services from an on-premises datacenter via a Dedicated Interconnect connection. To satisfy regulatory mandates, the security team must enforce two controls: 1) Authorized internal users with valid IAM permissions must be strictly prevented from copying datasets to unauthorized external Google Cloud storage locations or external projects. 2) An analytics service running in a separate VPC inside Project-App must securely query BigQuery in Project-Analytics using internal IP routing, without granting Project-App network visibility to all other resources in Project-Analytics. Which architectural design should you recommend?

Cevabı ve açıklamayı göster

Cevap: Configure a VPC Service Controls perimeter around Project-Analytics to restrict service API communication to authorized perimeter boundary rules. Create a Private Service Connect endpoint in Project-App to privately connect to BigQuery in Project-Analytics, and define VPC Service Controls ingress and egress rules to grant explicit cross-perimeter API access.

Cevap

Configure a VPC Service Controls perimeter around Project-Analytics to restrict service API egress, and use Private Service Connect endpoints with perimeter ingress/egress rules for private cross-project service access.
VPC Service Controls establishes a security boundary around GCP service APIs like Cloud Storage and BigQuery, preventing sensitive healthcare data from being copied or exfiltrated to external projects even by authorized users. Private Service Connect allows Project-App to privately access BigQuery endpoints in Project-Analytics without opening full VPC-to-VPC routing, while VPC Service Controls ingress and egress rules allow controlled cross-perimeter communication.

Adım Adım Çözüm

1
Identify data exfiltration prevention requirements
IAM permissions control authentication and authorization, but do not prevent authorized users from exfiltrating data to external GCP projects or storage locations.
A perimeter-based defense at the Google Cloud API layer is necessary to enforce resource boundary isolation.
2
Evaluate VPC Service Controls for perimeter security
Enclosing Project-Analytics within a VPC Service Controls perimeter prevents Google Cloud service APIs (BigQuery and Cloud Storage) from transferring data outside the boundary.
VPC SC enforces policy boundaries directly at the service endpoint layer.
3
Implement private service communication without full network peering
Deploying Private Service Connect (PSC) endpoints alongside VPC SC ingress and egress rules permits Project-App to query BigQuery securely while maintaining non-transitive, isolated network boundaries.
PSC enables explicit service-level connectivity over private IP addresses without peering entire VPC networks.

Anahtar Kavram

Data Exfiltration Prevention via VPC Service Controls and Private Service Connect
Soru 926Soru →

An international freight logistics enterprise operates its core container dispatch platform on Google Cloud using `europe-west1` as its primary region and `europe-west4` as a secondary disaster recovery (DR) region. Business operations mandate a Recovery Time Objective (RTO) of 30 minutes and a Recovery Point Objective (RPO) of under 5 minutes. During a scheduled DR validation drill, traffic was switched to `europe-west4`, but compute instance creation failed because the target project lacked sufficient N2 CPU regional quotas in `europe-west4`, breaching the RTO. Which procedure should the cloud architect incorporate into the business continuity and DR validation framework to prevent this failure in future drills?

Cevabı ve açıklamayı göster

Cevap: Implement automated pre-drill validation checks that audit secondary region resource quotas and pre-reserve compute capacity prior to executing failover procedures.

Cevap

Implement automated pre-drill validation checks that audit secondary region resource quotas and pre-reserve compute capacity prior to executing failover procedures.
Pre-verifying regional project quotas and establishing compute capacity reservations in the secondary region before executing DR drills ensures that required compute instances can launch immediately without hitting quota limits or capacity constraints, satisfying the 30-minute RTO requirement.

Adım Adım Çözüm

1
Analyze the root cause of the DR validation failure
The failover failed because compute resources could not be provisioned due to insufficient regional N2 CPU quota in `europe-west4`.
GCP resource quotas are region-specific and must be requested and verified before spinning up secondary workloads.
2
Evaluate DR requirements against potential resolution procedures
The enterprise mandates an RTO of 30 minutes and RPO under 5 minutes, requiring fast provisioning and guaranteed resource availability.
Reactive quota requests or cold-standby architectures introduce significant recovery delays that exceed the target RTO.
3
Select the correct validation procedure
Automating pre-drill quota validation and enforcing capacity reservations in `europe-west4` guarantees resource allocation during failover tests.
Pre-drill checks ensure all operational prerequisites, including quotas and compute capacity, are met prior to shifting traffic.

Anahtar Kavram

Developing Procedures for Business Continuity and Disaster Recovery Validation
Soru 927Soru →

A cloud engineering team is adopting Terraform to manage infrastructure deployments on Google Cloud. Multiple team members will be executing Terraform configurations simultaneously. Which deployment pattern is the Google Cloud recommended best practice for storing and managing the Terraform state file safely?

Cevabı ve açıklamayı göster

Cevap: Store the state file in a Google Cloud Storage (GCS) bucket configured as a remote backend with Object Versioning enabled.

Cevap

Store the state file in a Google Cloud Storage (GCS) bucket configured as a remote backend with Object Versioning enabled.
Configuring a Google Cloud Storage (GCS) bucket as the remote backend is the standard best practice for Terraform on GCP. GCS supports native state locking using Cloud Storage lock objects, ensuring that simultaneous executions do not corrupt the state. Enabling Object Versioning allows teams to rollback to previous state versions if needed.

Adım Adım Çözüm

1
Identify the multi-developer concurrency requirement for IaC management.
Recognize that local state storage cannot guarantee lock synchronization or state integrity across multiple operators.
Simultaneous runs against a un-locked state file cause state corruption.
2
Evaluate remote backend capabilities in Google Cloud.
Determine that Google Cloud Storage natively supports object locking and state locking via the GCS backend.
GCS backend automatically handles distributed locking to allow only one operator to modify state at a time.
3
Apply security and reliability best practices.
Enable GCS Object Versioning to allow state history recovery and restrict bucket access using minimal required IAM roles.
Object Versioning protects against accidental state destruction or invalid modifications.

Anahtar Kavram

Building and Managing Infrastructure as Code (IaC) Remote State Management
Soru 928Soru →

An enterprise organization is establishing a centralized governance and resource management framework across its Google Cloud folder hierarchy. The cloud architecture team must implement real-time cost visibility and ensure that large scheduled batch processing jobs run smoothly without hitting infrastructure limits. Which TWO actions should the team implement to satisfy these operational and billing requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Export Cloud Billing data to a centralized BigQuery dataset and configure Cloud Pub/Sub notification channels on Cloud Budgets to trigger programmatic cost controls.; Request regional resource quota increases proactively well in advance of executing high-volume batch workloads.

Cevap

The team should export Cloud Billing data to BigQuery with Pub/Sub budget alerts for automated cost monitoring, and proactively request regional resource quota increases prior to launching large batch jobs.
The correct strategy combines automated cost monitoring via BigQuery billing export and Pub/Sub budget notifications with proactive capacity planning through pre-requested regional resource quotas. Exporting detailed billing data allows deep FinOps analysis, while Pub/Sub alerts trigger automated functions to remediate budget overruns. Requesting regional quota limit increases ahead of planned spikes ensures workloads complete without hitting quota caps.

Adım Adım Çözüm

1
Analyze billing visibility and automation requirements.
Configuring Cloud Billing export to BigQuery enables long-term metric analysis, while Pub/Sub integration with Cloud Budgets allows event-driven serverless functions to automate cost caps.
Standard budgets only send email notifications by default; Pub/Sub integration is required for automated programmatic control.
2
Analyze quota management strategy for batch processing workloads.
Proactive regional quota increases ensure required Compute Engine or GKE resources are available prior to job execution.
Quota increases can take time to evaluate and process, making reactive requests during live execution unreliable.
3
Evaluate security and operational distractors against GCP best practices.
Avoid granting primitive Owner roles and avoid reactive quota requests after failure.
Primitive roles violate least-privilege governance, and reactive quota management leads to failed batch pipelines.

Anahtar Kavram

Managing Resource Quotas, Hierarchies, and Cost Optimization
Soru 929Soru →

A cloud security architect is defining data protection standards across several enterprise applications migrating to Google Cloud. Match each business or regulatory requirement to the appropriate Google Cloud key management or encryption model.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

The organization must generate and retain key material in an on-premises external key management system outside of GCP, authorizing GCP to request cryptographic operations over an API.
The organization requires key material to be stored in FIPS 140-2 Level 3 validated Hardware Security Modules hosted inside GCP, while maintaining customer control over key rotation schedules and IAM permissions.
Compliance demands that raw 256-bit AES encryption keys are provided directly in API calls for persistent disk encryption and discarded from GCP memory after use, without key persistence in GCP.
The system requires baseline data encryption at rest with zero administrative overhead, where Google automatically manages key generation, storage, and rotation.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Matching pairings: External key generation and retention outside GCP maps to Cloud External Key Manager (Cloud EKM); FIPS 140-2 Level 3 HSM hosted in GCP under customer control maps to Customer-Managed Encryption Keys (CMEK) via Cloud HSM; Transient per-request raw key delivery maps to Customer-Supplied Encryption Keys (CSEK); Zero-overhead automatic encryption by Google maps to Google-default Encryption.
Each requirement aligns directly with its underlying GCP cryptographic architecture: external key custody maps to Cloud EKM; Google-hosted FIPS 140-2 Level 3 hardware key management maps to CMEK with Cloud HSM; transient per-request key transmission maps to CSEK; and default automated protection maps to Google-default encryption.

Adım Adım Çözüm

1
Identify key location and custody requirements for external systems
Keys residing in on-premises/third-party HSMs outside GCP infrastructure correspond to Cloud External Key Manager (Cloud EKM).
Cloud EKM connects GCP services to external key management infrastructure via HTTPS endpoints.
2
Evaluate hardware security and administrative compliance levels inside GCP
Keys requiring FIPS 140-2 Level 3 hardware validation managed via Cloud KMS policies map to CMEK with Cloud HSM.
Cloud HSM is a Google-managed hardware security module service integrated into Cloud KMS.
3
Determine key handling for raw per-request key supply
Passing raw 256-bit AES keys directly in service API calls without storing keys in Cloud KMS maps to CSEK.
CSEK requires callers to supply the raw cryptographic key in header parameters for each storage or disk API call.
4
Assess baseline default encryption behavior
Default automatic encryption using internal Google key management systems maps to Google-default Encryption.
All GCP data at rest is encrypted by default using AES-256 without customer setup.

Anahtar Kavram

Selecting appropriate GCP encryption models (Google-default, CMEK, CSEK, Cloud EKM) based on operational, regulatory, and key custody requirements.
Soru 930Soru →

An organization is architecting a multi-tenant microservices platform hosted on Google Kubernetes Engine (GKE). Each microservice requires access to third-party API credentials stored in Secret Manager. To satisfy strict enterprise governance standards, all secret versions stored in Secret Manager must be encrypted using Customer-Managed Encryption Keys (CMEK) managed in a dedicated central KMS project, and pods must authenticate without using long-lived downloadable service account JSON keys. Which implementation design best meets these security requirements while enforcing least privilege?

Cevabı ve açıklamayı göster

Cevap: Configure GKE Workload Identity to map Kubernetes service accounts to dedicated GCP service accounts. Grant each GCP service account the Secret Manager Secret Accessor role on its respective secret, and grant the Secret Manager Service Agent in the application project the Cloud KMS CryptoKey Encrypter/Decrypter role on the CMEK key.

Cevap

Configure GKE Workload Identity to map Kubernetes service accounts to dedicated GCP service accounts, granting Secret Manager Secret Accessor to the workload service accounts and Cloud KMS CryptoKey Encrypter/Decrypter to the Secret Manager Service Agent.
The solution leveraging Workload Identity and proper IAM delegation satisfies all security requirements. Workload Identity allows Kubernetes service accounts to impersonate GCP service accounts without long-lived JSON keys. Granting the Secret Accessor role specifically to the workload service account enforces least privilege. Furthermore, because Secret Manager handles payload decryption transparently on behalf of authorized callers, granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Secret Manager Service Agent ensures secure CMEK operations without exposing key management permissions directly to the workload.

Adım Adım Çözüm

1
Establish secure identity without key files
Enable GKE Workload Identity to bind Kubernetes Service Accounts (KSAs) to Google Cloud Service Accounts (GSAs), eliminating long-lived service account key files.
Workload Identity provides short-lived OpenID Connect (OIDC) tokens natively trusted by Google Cloud APIs.
2
Enforce least privilege secret payload access
Grant `roles/secretmanager.secretAccessor` strictly on the target secret resource to the GSA mapped to the workload.
Prevents microservices from accessing secrets intended for other applications.
3
Configure CMEK permission delegation
Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the central KMS key to the Secret Manager Service Agent (`service-PROJECT_NUMBER@gcp-sa-secretmanager.iam.gserviceaccount.com`).
Secret Manager performs envelope encryption/decryption operations on behalf of authorized callers, so the service agent requires KMS access rather than the individual microservice workloads.

Anahtar Kavram

GKE Workload Identity & Secret Manager CMEK IAM Delegation
Tahmini Süre:2m 0s
Soru 931Soru →

A platform engineering team is establishing automated infrastructure provisioning routines for a regional order processing service on Google Cloud. The architecture requires a managed relational database instance and an object storage bucket for audit logs. Corporate security policies demand that all storage encryption keys remain under central organization management in Cloud KMS without developers handling raw key material, and infrastructure automation must prevent concurrent state modification and accidental state file corruption. Which TWO provisioning configurations should the engineering team implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Terraform remote backend to use a Google Cloud Storage bucket with Object Versioning enabled for managing state files.; Provision the Cloud SQL instance using a Customer-Managed Encryption Key (CMEK) hosted in Cloud Key Management Service (KMS).

Cevap

The team should configure the Terraform remote backend to use a Google Cloud Storage bucket with Object Versioning enabled and provision the Cloud SQL instance using a Customer-Managed Encryption Key (CMEK) in Cloud KMS.
Configuring a Cloud Storage remote backend with Object Versioning ensures Terraform state files are locked during concurrent execution and backed up against state corruption. Provisioning Cloud SQL with Customer-Managed Encryption Keys (CMEK) in Cloud KMS satisfies regulatory key-governance requirements without introducing raw key management risk.

Adım Adım Çözüm

1
Establish secure state storage for Infrastructure as Code
Configured a GCS backend with Object Versioning enabled.
Prevents race conditions through native GCS object locking and preserves historical state revisions for rollback in case of corruption.
2
Implement compliance-aligned database encryption
Provisioned Cloud SQL instance with CMEK referencing a key ring in Cloud KMS.
Allows central governance over key rotation and access policies while keeping cryptographic key handling within managed Google Cloud services.

Anahtar Kavram

Provisioning secure cloud database and storage resources via IaC requires robust remote state locking and compliance-driven KMS key integration.
Soru 932Soru →

A principal cloud architect is tasked with bringing an unmanaged, production Google Cloud environment containing critical Compute Engine and VPC resources under Terraform management. The solution must enforce remote state locking, prevent resource destruction, ensure zero downtime, and align with Google Cloud security best practices. What is the correct sequence of operational steps to safely import the infrastructure and establish managed IaC execution?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for adopting existing GCP resources into Terraform management is to first initialize a Cloud Storage remote backend with state locking, declare matching resource configurations, execute terraform import for existing resource IDs, run terraform plan to eliminate attribute drift, and finally commit the code to trigger a least-privilege CI/CD deployment pipeline.
Safely bringing existing live infrastructure under IaC management requires establishing a secure central backend first to maintain state integrity. Once initialized, target resource structures must be declared in code so `terraform import` can map live GCP resource IDs into state without destroying or replacing resources. A subsequent planning step is essential to reconcile discrepancies between code declarations and actual infrastructure attributes before handing off execution to an automated CI/CD pipeline configured with granular IAM permissions.

Adım Adım Çözüm

1
Initialize remote Cloud Storage backend with state locking enabled using `terraform init`.
Establishes a centralized, lock-protected state environment.
Prevents state file loss and race conditions during initial resource onboarding.
2
Draft matching resource HCL blocks in configuration files.
Creates valid resource targets for the state import engine.
Terraform import requires a declared resource address to map imported attributes.
3
Run `terraform import <resource_address> <gcp_resource_id>` for each target component.
Metadata and current state of live cloud resources are written into the remote state file.
Connects live GCP resource IDs to Terraform state without modifying running infrastructure.
4
Run `terraform plan` and update local code attributes until no infrastructure changes are indicated.
Achieves parity between code configuration, state file, and live infrastructure.
Prevents unintended replacement or modification of critical production resources.
5
Commit configurations to Git and enforce pipeline execution with least-privilege service accounts.
Establishes secure, automated IaC lifecycle governance.
Eliminates manual console/CLI execution and enforces strict auditing and IAM control.

Anahtar Kavram

Brownfield IaC Adoption and State Import Workflow
Soru 933Soru →

A healthcare enterprise is preparing to deploy a clinical data platform across multiple Google Cloud projects organized under a dedicated folder hierarchy. During pre-deployment load testing, the automation scripts failed because default project quota limits for regional Pub/Sub throughput and BigQuery streaming inserts were exceeded. The platform requires high availability and predictable scaling across two target regions. Which operational governance strategy should the Cloud Architect implement to prevent deployment failures while maintaining resource oversight?

Cevabı ve açıklamayı göster

Cevap: Identify required regional resource limits in advance, submit proactive quota increase requests for the target regions through the Google Cloud Console, and establish Cloud Monitoring quota utilization alerts.

Cevap

The architect should proactively request regional quota increases prior to deployment and set up Cloud Monitoring quota utilization alerts.
The correct strategy involves anticipating regional resource requirements ahead of provisioning, requesting quota increases proactively for target regions, and setting up monitoring alerts. Quota requests may require manual review by GCP engineering, so requesting them prior to deployment ensures that automated pipelines complete successfully without encountering resource limit errors.

Adım Adım Çözüm

1
Analyze expected workload scaling requirements and compute peak regional Pub/Sub and BigQuery quota demands.
Identified exact resource limits required beyond default project quotas.
Prevents automated deployment pipeline failures caused by quota exhaustion during provisioning.
2
Submit proactive quota increase requests for target regions in the Google Cloud Console.
Quotas are reviewed and raised to necessary thresholds prior to application rollout.
Quota increases are not instant and may require approval from Google Cloud support.
3
Configure Cloud Monitoring metric threshold alerts based on quota usage percentages.
Automated notifications trigger when consumption approaches operational limits.
Enables proactive governance and capacity planning before hard limits impact availability.

Anahtar Kavram

Proactive Service Quota Management and Resource Governance
Tahmini Süre:1m 30s
Soru 934Soru →

An enterprise organization is designing a secure CI/CD pipeline on Google Cloud to deploy microservices to Google Kubernetes Engine (GKE). The pipeline architecture must enforce automated container vulnerability scanning, software supply chain security using Binary Authorization attestations, and progressive delivery governance across staging and production environments. Sequence the steps required to execute a secure deployment from initial source code commit to final production rollout in the correct chronological order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for a secure Google Cloud CI/CD pipeline is: 1) Trigger Cloud Build to compile code and run unit tests; 2) Perform Container Analysis scanning and generate Binary Authorization attestations via Cloud KMS; 3) Publish the signed container image and attestation metadata to Artifact Registry; 4) Use Cloud Deploy to create a release and deploy to the Staging GKE cluster; 5) Obtain operational approval and execute a canary rollout to the Production GKE cluster via Cloud Deploy.
A secure end-to-end cloud release pipeline begins by triggering Cloud Build to compile code and execute unit tests. Following image compilation, Container Analysis performs vulnerability scanning and Cloud Build uses Cloud KMS to produce a Binary Authorization attestation. The container digest and signed attestation are then published to Artifact Registry. Cloud Deploy picks up the release to deploy it first into the Staging GKE cluster. Finally, upon explicit operational approval, Cloud Deploy executes a progressive canary deployment to the Production GKE cluster.

Adım Adım Çözüm

1
Trigger build and test execution in Continuous Integration tool
Cloud Build compiles the source code into a container artifact and validates logic using unit testing.
Building and testing source code is the entry point of any CI/CD pipeline before artifacts are evaluated or promoted.
2
Perform security scanning and Binary Authorization attestation signing
Container Analysis scans the image for vulnerabilities, and Cloud Build uses Cloud KMS to cryptographically sign a payload attesting security compliance.
Attestations must be produced at build time so Binary Authorization policy enforcers on GKE cluster admission controllers can evaluate compliance.
3
Publish immutable container digest and attestation metadata
Artifact Registry receives and stores the container image digest and associated attestation details.
Centralizing attested container images in Artifact Registry provides an immutable source of truth for deployment targets.
4
Initiate Cloud Deploy release to staging environment
Cloud Deploy creates a pipeline release using the Artifact Registry digest and deploys the workload to the Staging GKE cluster.
Deploying to pre-production staging environments allows automated end-to-end integration and smoke testing before production promotion.
5
Approve and execute progressive production delivery
After manual approval, Cloud Deploy executes a canary release strategy to shift production traffic incrementally to the new GKE deployment.
Production deployments require administrative approval gates and progressive delivery mechanisms (such as canary rollouts) to minimize blast radius.

Anahtar Kavram

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design
Tahmini Süre:2m 0s
Soru 935Soru →

An engineering team needs to migrate their local Terraform state file to a centralized Google Cloud Storage (GCS) bucket for collaborative management. Arrange the operational steps in the correct sequential order to complete this state migration.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational order begins with adding the `backend "gcs"` configuration block, executing `terraform init`, confirming the state transfer prompt, and finishing with `terraform plan` to verify remote state synchronization.
Safely migrating local Terraform state to a remote GCS backend requires defining the backend block in code, running `terraform init` to initiate migration, agreeing to transfer existing state data, and running `terraform plan` to confirm remote state integrity.

Adım Adım Çözüm

1
Declare the GCS backend in Terraform configuration
The Terraform project code now specifies the destination GCS bucket and state prefix.
Terraform must be informed of the new state backend target before any migration commands can run.
2
Run `terraform init`
Terraform detects the added backend block and triggers the migration routine.
The init command configures the backend plugins and prepares to transfer existing state to the new location.
3
Confirm the state copy prompt
The local state data is safely uploaded into the GCS bucket.
Explicit user approval ensures that local state is transferred rather than generating a fresh empty state.
4
Execute `terraform plan` for validation
Confirmation of zero unexpected infrastructure changes.
Running plan verifies that the remote state file is functioning properly and matches actual GCP resources.

Anahtar Kavram

Terraform Remote State Migration to Google Cloud Storage
Soru 936Soru →

Your organization is planning a blue-green deployment strategy for a critical application hosted on Google Cloud. You must ensure zero downtime during traffic cutover and preserve the ability to execute an instant rollback if issues arise. Which TWO architectural practices are required to safely support this deployment strategy? (Select TWO answers.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Ensure that any database schema changes introduced in the release remain fully backward-compatible with the active blue application version.; Pre-provision and validate full compute resource capacity for the green environment before shifting production traffic.

Cevap

The essential practices are maintaining backward-compatible database schemas so the existing active environment remains stable, and pre-provisioning green environment capacity to handle production traffic immediately.
Executing a zero-downtime blue-green deployment requires that both application versions remain fully operational against shared backends. Ensuring backward-compatible database schema changes guarantees that the running blue version is unaffected during testing and cutover. Additionally, fully pre-provisioning green capacity ensures the new target infrastructure is ready to ingest production traffic immediately without unexpected capacity bottlenecks.

Adım Adım Çözüm

1
Analyze datastore compatibility requirements for parallel environments.
Database schemas must support both old (blue) and new (green) versions simultaneously.
Since both versions interact with shared persistent stores during cutover, breaking schema changes would instantly break the blue application.
2
Evaluate infrastructure provisioning and capacity constraints.
Green environment resources must be provisioned and verified prior to traffic shifting.
Sudden traffic redirection without verified capacity and regional quota coverage risks service outage.

Anahtar Kavram

Blue-green deployments require backward-compatible datastore schema management and full infrastructure pre-provisioning to achieve zero-downtime cutovers and instant rollbacks.
Soru 937Soru →

An enterprise operations team is preparing to launch a multi-region application using Compute Engine managed instance groups across three Google Cloud regions via an automated Infrastructure as Code (IaC) CI/CD pipeline. During staging validation for a new target region, the pipeline failed mid-execution because the project reached its default regional compute instance quota. The team needs an operational strategy to prevent automated pipeline failures during future regional expansions while maintaining deployment reliability and security best practices. Which recommendation should you provide to the development and operations teams?

Cevabı ve açıklamayı göster

Cevap: Audit workload capacity requirements per region in advance, proactively request regional quota increases through the Google Cloud Console prior to deployment, and integrate pre-flight quota checks into the CI/CD pipeline.

Cevap

Audit workload capacity requirements per region in advance, proactively request regional quota increases through the Google Cloud Console prior to deployment, and integrate pre-flight quota checks into the CI/CD pipeline.
The correct strategy is to audit resource requirements ahead of time, request regional quota increases via Google Cloud prior to deployment, and incorporate automated pre-flight quota checks in the CI/CD pipeline. GCP quotas are strict boundaries that require administrative review and cannot be bypassed dynamically or by elevated permissions.

Adım Adım Çözüm

1
Analyze the operational failure cause
Identified that the deployment pipeline failed due to uncoordinated regional compute resource quotas in Google Cloud.
Automated IaC tools cannot overcome hard cloud quota limits without advance quota allocation.
2
Evaluate operational best practices for dev/ops teams
Determined that quota increases require planning, approval lead time, and proactive quota auditing prior to initiating automated infrastructure changes.
Google Cloud quotas are designed to prevent unexpected spending and protect system limits, requiring manual or API-based quota increase requests.
3
Formulate architectural guidance
Advised implementing pre-flight quota verification steps in CI/CD pipelines alongside pre-requested quota increases.
Ensures automated pipelines execute smoothly without mid-deployment failures or manual console workarounds.

Anahtar Kavram

Capacity Planning and Quota Management in Cloud Deployments
Soru 938Soru →

A financial technology enterprise structures its Google Cloud resource hierarchy using dedicated environment folders, including a parent folder named 'Payments-Prod'. The security auditing team requires read-only access to examine Cloud Logging log entries across all current and future projects located beneath the 'Payments-Prod' folder tree. Which IAM configuration adheres to Google Cloud recommended best practices for enforcing least privilege while minimizing administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Grant the Logs Viewer role (roles/logging.viewer) to the auditing team's Google Group at the 'Payments-Prod' folder level.

Cevap

Grant the Logs Viewer role (roles/logging.viewer) to the auditing team's Google Group at the 'Payments-Prod' folder level.
Granting the predefined Logs Viewer role at the folder level leverages IAM policy inheritance across the resource hierarchy. All current and future projects in the 'Payments-Prod' folder inherit this access automatically, satisfying least privilege without requiring primitive roles or operational overhead.

Adım Adım Çözüm

1
Identify the administrative scope requirement
Access must apply to all present and future projects under the 'Payments-Prod' folder.
Applying the role at the folder level leverages resource hierarchy IAM policy inheritance, avoiding per-project manual configuration.
2
Select the appropriate role matching least privilege
The Logs Viewer role (roles/logging.viewer) provides narrow read access specifically for Cloud Logging log entries.
Predefined roles restrict permissions to only the necessary service features, unlike primitive roles which grant broad resource access.

Anahtar Kavram

Resource Hierarchy IAM Policy Inheritance and Predefined Roles
Soru 939Soru →

An online media streaming enterprise hosts two key workloads on Google Cloud: a real-time Live Video Playback API supporting live high-profile sports broadcasts, and an asynchronous Recommendation Generation Pipeline that processes user viewing history overnight to update playlist recommendations. The Site Reliability Engineering (SRE) team needs to define service indicators and objectives that reflect business priorities without creating unnecessary operational overhead. Which TWO strategies should the team implement to align technical SLOs and error budgets with business impact? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define a strict availability and latency SLO based on successful HTTP responses for the Live Video Playback API, using its error budget to regulate release velocity during critical live events.; Define the SLI for the Recommendation Generation Pipeline as the percentage of batch jobs completed within a 12-hour completion window, allowing a more permissive SLO and larger error budget.

Cevap

The SRE team should define a strict availability and latency SLO for the real-time Live Video Playback API tied to release management error budgets, and measure the Recommendation Generation Pipeline using a batch job completion window SLI that allows a larger error budget.
Correctly aligning technical service objectives with business goals requires differentiating between user-facing, real-time services and background asynchronous processes. The Live Video Playback API directly impacts revenue during live events, justifying a strict SLO and using its error budget to govern release policy. Conversely, the Recommendation Generation Pipeline is a batch workload where user experience is preserved as long as jobs finish within a 12-hour window, warranting a flexible SLI definition and higher error tolerance.

Adım Adım Çözüm

1
Analyze business criticality of each workload
Live Video Playback API has immediate revenue impact requiring high availability; Recommendation Generation is asynchronous and tolerates moderate processing delays.
SLOs must reflect the business consequences of downtime or performance degradation.
2
Formulate appropriate SLI measurement windows and metrics
The real-time service uses immediate HTTP success rates, whereas the batch pipeline uses a multi-hour job completion threshold.
SLIs must measure user satisfaction metrics appropriate to the workload type (synchronous API vs asynchronous batch).
3
Establish error budgets aligned with business risk tolerance
Live streaming receives a tighter error budget used to gate deployments, while batch processing receives a looser budget to avoid operational overhead.
Error budgets act as a control mechanism between feature velocity and service reliability.

Anahtar Kavram

Aligning Service Level Objectives (SLOs) and Error Budgets with Business Impact
Soru 940Soru →

A biotechnology firm is setting up a secure, isolated environment for a genomic data analytics pipeline in Google Cloud. The lead cloud security architect must establish a resource hierarchy and grant access using custom IAM roles while maintaining minimal operational overhead and strict least-privilege access controls. Arrange the implementation steps in the correct chronological sequence from first to last to establish the resource hierarchy and role inheritance correctly.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order to establish the resource hierarchy and IAM role inheritance is: 1) Create the 'Genomics-Pipeline' folder under the Organization node, 2) Define the Custom IAM Role at the Organization level, 3) Bind the Custom IAM Role to the service account at the folder level, and 4) Provision the GCP Project inside the folder.
The correct implementation sequence establishes administrative containers first (Folder under Organization), centralizes privilege definitions (Organization-level Custom IAM Role), applies policy bindings to the folder container, and finally provisions child resources (GCP Project inside the Folder) that inherit the established policies. This adheres to Google Cloud recommended practices for least privilege and resource hierarchy inheritance.

Adım Adım Çözüm

1
Establish the resource hierarchy folder container.
The folder node exists under the Organization to act as an administrative boundary.
Creating the folder first defines the parent node where policy inheritance will be enforced.
2
Define the Custom IAM Role at the Organization level.
The role definition is centralized and accessible across the entire resource hierarchy.
Organization-level role definition enables broad reusability and centralized maintenance across folders and projects.
3
Attach the role binding to the target service account at the folder level.
IAM policy binding is associated with the folder node.
Applying the binding at the folder level allows all descendant projects to inherit the access control policy.
4
Create the GCP project within the folder.
The project inherits folder-level IAM policies immediately upon creation.
Placing the project inside the folder ensures resources inherit access policies without requiring manual per-project permission grants.

Anahtar Kavram

IAM Resource Hierarchy Inheritance and Organization-Level Custom Role Scoping
ÖncekiSayfa 47 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin