Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 961Soru →

A fintech organization is deploying compliance-critical payment processing microservices to Google Kubernetes Engine (GKE). The enterprise security team requires a zero-trust delivery pipeline that enforces container vulnerability scanning, cryptographic build provenance verification, binary authorization policy gates, and automated progressive rollout to prevent unvetted code from reaching production. Place the automated pipeline execution stages in the correct chronological sequence from source commit to production deployment.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with Cloud Build building and pushing the container image to Artifact Registry, followed by Container Analysis vulnerability scanning and signing attestations via Cloud KMS, followed by Binary Authorization policy validation during release creation, and concludes with Cloud Deploy executing progressive canary rollout to GKE targets.
The pipeline flow strictly follows the software supply chain security lifecycle: code compilation and container build with Cloud Build pushing to Artifact Registry, vulnerability scanning with Container Analysis to produce KMS-signed attestations, pre-deployment policy verification via Binary Authorization, and finally progressive canary release management using Cloud Deploy.

Adım Adım Çözüm

1
Build and Artifact Storage
Container image created and stored in private Artifact Registry.
Source code compilation and container image creation must precede security auditing and deployment stages.
2
Vulnerability Scanning and Attestation
Container Analysis scans the image and signs an attestation using Cloud KMS keys.
Cryptographic attestations must be generated based on successful security scanning results before admission control policies can be evaluated.
3
Admission Control Gate Enforcement
Binary Authorization verifies required signatures and grants release creation.
Policy validation must occur prior to rendering delivery manifests or deploying workloads to Kubernetes clusters.
4
Progressive CD Delivery Execution
Cloud Deploy manages canary deployment and automated promotion to production GKE clusters.
Progressive traffic allocation and target deployments represent the final operational phase of the pipeline.

Anahtar Kavram

Secure CI/CD Pipeline Design with Container Attestations, Binary Authorization, and Cloud Deploy
Soru 962Soru →

A Google Cloud Security Architect is documenting how IAM permissions are evaluated for a principal requesting access to a Cloud Storage bucket inside a multi-tier folder environment. Arrange the resource hierarchy levels in the correct order of policy evaluation and inheritance, starting from the root parent node down to the individual target resource.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of IAM policy evaluation across the Google Cloud resource hierarchy starts at the Organization node, descends through the Folder node, proceeds to the Project node, and finishes at the Resource-level (Cloud Storage bucket).
In Google Cloud, IAM access policy evaluation follows the strict top-down structure of the resource hierarchy: Organization -> Folder -> Project -> Resource. Permissions granted at higher nodes inherit downward and accumulate, determining the effective access granted to a principal.

Adım Adım Çözüm

1
Identify the top root level of the resource hierarchy.
The Organization node is evaluated first.
IAM policy inheritance flows downwards starting from the Organization node at the top of the hierarchy.
2
Evaluate policies attached to grouping containers below the organization.
Parent Folder nodes are evaluated second.
Folders inherit permissions from the Organization and pass accumulated permissions to nested folders and projects.
3
Evaluate policies at the main service container level.
The Project node policy is evaluated third.
Projects reside inside folders and inherit all permissions assigned at higher levels.
4
Evaluate policies directly bound to the target resource.
The Cloud Storage bucket policy is evaluated last.
Resource-level policies provide fine-grained control directly on the target resource within the project.

Anahtar Kavram

Google Cloud IAM permissions are inherited down the resource hierarchy (Organization -> Folder -> Project -> Resource). Permissions are additive, meaning access granted at a higher level cannot be denied or restricted at a lower child level.
Soru 963Soru →

A cloud architect is establishing a standard operating procedure for validating disaster recovery (DR) failover of a mission-critical workload from a primary GCP region to a secondary target region. What is the correct sequence of steps to safely execute and validate this DR drill without impacting live production systems?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with auditing regional resource quotas, followed by creating isolated database clones, provisioning compute infrastructure via IaC, running synthetic validation tests, and concluding with environment teardown and metric logging.
Validating a DR environment safely requires a structured sequence: first ensuring GCP resource quotas in the target region are sufficient, isolating test data via point-in-time database cloning, deploying compute infrastructure via automated IaC templates, conducting synthetic transaction testing to verify RTO/RPO metrics, and finally cleaning up test resources while recording compliance results.

Adım Adım Çözüm

1
Audit and request regional quota increases in the DR target region.
Guarantees target region capacity can host failover workloads without encountering quota limits.
Quota pre-checking avoids capacity failure during DR testing or actual failover.
2
Generate point-in-time database clones in the DR region.
Establishes a sandbox copy of production data for testing.
Prevents validation tests from modifying live database replicas or interrupting replication streams.
3
Deploy compute instances using Infrastructure as Code connected to the clone.
Establishes a functioning application tier in the DR region.
Ensures reproducible environment configuration aligned with production specifications.
4
Execute synthetic workload transactions and measure baseline metrics.
Confirms application functionality and validates compliance with RPO and RTO SLAs.
Synthetic testing verifies system readiness under simulated operational conditions.
5
Deprovision test infrastructure and record compliance logs.
Cleans up resources to avoid unnecessary cloud costs and records validation evidence.
Completes the validation lifecycle securely and cleanly.

Anahtar Kavram

Disaster Recovery Validation Procedures
Tahmini Süre:1m 30s
Soru 964Soru →

A cloud administrator at a media streaming enterprise discovers that a security analyst manually modified a Compute Engine firewall rule using the Google Cloud Console during an emergency incident response. The environment's infrastructure is managed using Terraform. Which action should the administrator take to align the actual infrastructure state with the source-controlled configuration code?

Cevabı ve açıklamayı göster

Cevap: Run terraform plan to identify the configuration drift, and then execute terraform apply to revert the manual changes back to the defined code state.

Cevap

Run terraform plan to identify the configuration drift, and then execute terraform apply to revert the manual changes back to the defined code state.
Terraform maintains resource states declaratively. When manual modifications occur in Google Cloud outside of the IaC workflow, running `terraform plan` compares the real-world infrastructure against the configuration code to highlight the drift. Running `terraform apply` overwrites the out-of-band console changes and restores the firewall rule to match the declared source code.

Adım Adım Çözüm

1
Detect configuration drift between cloud infrastructure and declared code
Running terraform plan displays the differences introduced by the manual Cloud Console modification
Terraform reads the current state of real-world resources and compares them against the configuration files
2
Apply the declarative configuration code
Running terraform apply updates the firewall rule back to its declared specification
Terraform enforces declarative infrastructure by aligning actual GCP resources with source code

Anahtar Kavram

Infrastructure as Code Drift Remediation
Soru 965Soru →

A healthcare analytics company is migrating its deployment workflow to Google Cloud. The development team currently manages infrastructure using Terraform from local workstations and uses long-lived JSON service account keys stored on developer machines. During recent testing, concurrent developer deployments caused conflicting infrastructure state changes and overwrites. You need to advise the operations and development teams on an architecture that provides secure, concurrent Infrastructure as Code (IaC) state management and eliminates service account key export risks, while adhering to least privilege and minimizing operational overhead. Which solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: Configure a Cloud Storage bucket with object versioning as the remote backend for Terraform state locking, and establish Workload Identity Federation for keyless authentication from the CI/CD pipeline using granular IAM roles.

Cevap

The optimal architecture recommendation is to configure a Cloud Storage bucket with object versioning as the remote backend for Terraform state locking, and establish Workload Identity Federation for keyless CI/CD authentication using fine-grained IAM roles.
Recommending a Cloud Storage bucket backend with object versioning provides automated state locking for Terraform, preventing concurrent executions from corrupting infrastructure state. Combining this with Workload Identity Federation enables external pipeline runners to authenticate securely without downloading long-lived service account keys, fulfilling security and least-privilege requirements with minimal management effort.

Adım Adım Çözüm

1
Analyze state management requirements for team collaboration
Identified that local state storage leads to concurrency collisions and overwrites.
Remote state backends like Google Cloud Storage support automatic state locking via Cloud Storage object generation checks, preventing simultaneous operations.
2
Evaluate authentication and credential security best practices
Identified that exported service account JSON keys pose high security risks.
Workload Identity Federation allows external CI/CD platforms or environment runners to authenticate to GCP keylessly using short-lived tokens.
3
Synthesize recommendations according to architectural constraints
Selected Cloud Storage remote backend coupled with Workload Identity Federation and least-privilege IAM roles.
This combination achieves zero service account key exposure, automatic state locking, and operational overhead minimization.

Anahtar Kavram

Best practices for advising teams on secure IaC state management and keyless pipeline authentication in GCP.
Soru 966Soru →

Match each data security governance requirement to the appropriate Google Cloud data encryption and key management mechanism.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Strict regulatory mandate requiring encryption keys to reside physically in an on-premises Hardware Security Module (HSM) outside of Google Cloud infrastructure while protecting cloud data.
Enterprise requirement for customer control over key lifecycles, access policies, and automated rotation schedules directly within GCP using service account IAM roles.
Workload requirement to supply raw AES-256 keys dynamically in API request headers, ensuring keys exist only in transient memory and are never persisted to Google Cloud key storage.
Standard operational baseline requiring transparent data encryption at rest across all Google Cloud services without manual key configuration or operational maintenance.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Cloud EKM corresponds to on-premises key residency mandates; Customer-Managed Encryption Keys (CMEK) corresponds to GCP-managed key control and automated rotation; Customer-Supplied Encryption Keys (CSEK) corresponds to per-request raw key passing without storage; Google-default Encryption corresponds to baseline zero-overhead encryption.
The matching pairs correctly reflect the boundaries of responsibility and control across Google Cloud's data encryption offerings. Cloud EKM satisfies stringent external key control requirements. CMEK balances customer control over key rotation and access policies with native GCP service integration. CSEK ensures raw key material is never stored within GCP key management tools. Google-default Encryption provides invisible, zero-maintenance baseline security for all stored assets.

Adım Adım Çözüm

1
Analyze key storage location requirements.
External key control requiring physical on-premises HSM retention maps directly to Cloud EKM.
Cloud EKM ensures cryptographic keys never leave the external key management infrastructure.
2
Evaluate in-cloud key governance and lifecycle capabilities.
Customer control over keys within GCP using IAM policy bindings and rotation policies maps to CMEK via Cloud KMS.
CMEK allows granular IAM permissioning (Encrypter/Decrypter) and automated rotation inside Google Cloud KMS.
3
Identify key delivery methods for transient processing.
Passing raw AES-256 keys directly within API request headers maps to CSEK.
CSEK guarantees Google does not retain or store key material on disk or within Cloud KMS.
4
Determine default platform security baseline.
Automatic platform-wide encryption without user configuration maps to Google-default Encryption.
Google encrypts all customer data at rest by default using Google-managed service keys.

Anahtar Kavram

Google Cloud Data Encryption Spectrum and Key Management Responsibilities
Tahmini Süre:1m 30s
Soru 967Soru →

An operations team is tasked with reducing Cloud Logging ingestion costs for a fleet of Compute Engine instances running production workloads. To reduce log volume, an administrator created an exclusion filter on the `_Default` log sink using the expression `resource.type="gce_instance"`. Shortly after, the operational alerting system failed to trigger alerts during an application outage. Which architectural misconfiguration caused the missing alerts?

Cevabı ve açıklamayı göster

Cevap: The exclusion filter broadly matches all Compute Engine log entries, discarding high-severity error logs before ingestion and preventing Cloud Monitoring from evaluating alerting metrics.

Cevap

The exclusion filter broadly matches all Compute Engine log entries, discarding high-severity error logs before ingestion and preventing Cloud Monitoring from evaluating alerting metrics.
The correct solution correctly identifies that an exclusion filter specifying `resource.type="gce_instance"` matches every log emitted by GCE instances. Because Log Router exclusion filters drop matching logs before ingestion, all error and crash logs are discarded, preventing Cloud Monitoring from detecting incidents or triggering alerting policies.

Adım Adım Çözüm

1
Analyze the log exclusion filter expression used by the administrator.
The expression `resource.type="gce_instance"` selects all log entries emitted by Compute Engine instances regardless of log level or severity.
Log Router exclusion filters prevent matching entries from being ingested into the destination bucket.
2
Determine the impact of dropping matching logs at the Log Router level.
High-severity application errors, system crashes, and audit events are discarded before reaching Cloud Logging storage or metric evaluation engines.
Cloud Monitoring alerting policies relying on log-based metrics or log ingestion cannot trigger if the underlying log records are excluded.
3
Identify the proper observability design pattern.
Exclusion filters should specify non-critical log levels (such as severity < NOTICE or DEBUG logs) rather than filtering entire resource types.
This preserves critical operational visibility and alerting capabilities while optimizing ingestion costs.

Anahtar Kavram

Cloud Logging Exclusion Filters and Log Router Ingestion
Tahmini Süre:1m 0s
Soru 968Soru →

Your Cloud Operations team is preparing to execute a blue-green release strategy for an application update on Google Cloud that includes a database schema change. To ensure zero downtime and maintain backward compatibility throughout the release, in what sequence should you perform the following operational steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: first, apply backward-compatible database schema migrations; second, deploy the updated application revision to the Green environment; third, update Cloud Load Balancing to route traffic to the Green environment; and fourth, decommission the legacy Blue environment infrastructure after stability confirmation.
In a zero-downtime blue-green deployment involving a shared database, schema changes must always be executed first and designed to be backward-compatible. This ensures that the active Blue environment remains fully functional. Once the schema supports both releases, the new code can be safely deployed into the Green environment for validation. After passing health checks, load balancer routing is updated to direct traffic to Green. Finally, after a period of stable monitoring, the legacy Blue infrastructure is safely decommissioned.

Adım Adım Çözüm

1
Execute additive, backward-compatible database migrations on the existing database instance.
The database schema supports both old and new application code versions concurrently.
Applying non-breaking schema updates first prevents downtime or database exceptions on the live Blue instances.
2
Provision and deploy the new application code release into the inactive Green environment.
The Green environment is fully staged and ready for internal testing.
Isolating the new version allows automated integration and health checks without affecting live users.
3
Reconfigure Cloud Load Balancing backend service settings to shift 100% of user traffic to the Green backend.
Production traffic instantly flows to the Green application release.
Load balancer traffic shifting enables an instantaneous cutover with quick rollback capability if errors spike.
4
Monitor operational metrics and decommission the original Blue environment resource group once stability is verified.
Legacy resources are cleaned up, leaving only the active Green environment.
Teardown of legacy resources completes the deployment process and avoids unnecessary cloud infrastructure costs.

Anahtar Kavram

Zero-Downtime Blue-Green Deployment Lifecycle with Database Migration Coordination
Soru 969Soru →

An enterprise financial technology platform requires a highly secure, automated continuous integration and deployment pipeline for containerized microservices running on Google Kubernetes Engine (GKE). The security policy strictly dictates that all artifacts must pass automated container scanning, have a Cryptographic Build Attestation signed by Cloud KMS, pass Binary Authorization policy checks, and follow a controlled canary release pattern using Cloud Deploy with automated metric validation. In what chronological sequence must the pipeline execute these operations from source code push to full release?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct end-to-end pipeline ordering is: (1) Image build, Artifact Registry push, and vulnerability scanning, (2) Cryptographic Binary Authorization attestation signing via Cloud KMS, (3) Cloud Deploy release to staging with Binary Authorization signature verification, (4) Cloud Deploy canary rollout in production with telemetry monitoring, and (5) Promotion to 100% production traffic.
The proper secure CI/CD pipeline progression establishes software supply chain security first (building, vulnerability scanning, and signing attestations via Cloud KMS), followed by environment delivery execution (Binary Authorization verification during deployment via Cloud Deploy to staging), and concludes with controlled progressive deployment (canary traffic split and monitoring evaluation prior to 100% promotion).

Adım Adım Çözüm

1
Build container image and complete vulnerability scan in Artifact Registry.
Immutable container digest is generated and verified clear of critical security vulnerabilities.
Container digest immobilizes code state, which is mandatory before cryptographically attesting security compliance.
2
Generate and sign Binary Authorization attestation with Cloud KMS.
Container digest is linked to a signed security attestation stored in Container Analysis.
Attestations prove build integrity and scan compliance prior to target cluster deployment authorization.
3
Deploy release candidate to Staging environment using Cloud Deploy.
GKE Binary Authorization admission controller verifies KMS signature before allowing container creation.
Enforcing policy on staging guarantees that unvetted binaries are rejected before entering release pipelines.
4
Initiate Canary deployment phase to Production GKE environment via Cloud Deploy.
A controlled fraction of live user traffic reaches the new container while Cloud Monitoring evaluates SLO metrics.
Canary progression isolates potential runtime defects without risking complete service outage.
5
Promote release to 100% production traffic.
Full production environment updated successfully.
Final promotion completes the continuous delivery pipeline after empirical runtime telemetry validation.

Anahtar Kavram

Secure Software Supply Chain & Automated Release Pipeline Integration
Soru 970Soru →

An enterprise organization is designing a Continuous Integration and Continuous Delivery (CI/CD) pipeline on Google Cloud to deploy microservices to Google Kubernetes Engine (GKE). Security governance mandates that build jobs must execute strictly within non-public network perimeters, and pipeline processes must authenticate to GCP resources without storing static, long-lived credentials or service account key files in code repositories. Which architecture strategy should the cloud architect choose to meet these security and pipeline requirements?

Cevabı ve açıklamayı göster

Cevap: Configure Cloud Build triggers using private worker pools peered with your VPC network, and authenticate the build execution using short-lived credentials managed via Workload Identity Federation and least-privilege IAM service accounts.

Cevap

Configure Cloud Build triggers using private worker pools peered with your VPC network, and authenticate the build execution using short-lived credentials managed via Workload Identity Federation and least-privilege IAM service accounts.
The correct strategy uses Cloud Build private worker pools peered with a VPC to satisfy private network perimeter constraints, combined with short-lived credentials via Workload Identity Federation or dedicated service accounts to avoid embedding permanent credentials or service account keys in repositories.

Adım Adım Çözüm

1
Analyze network isolation requirements for the CI/CD pipeline environment.
Cloud Build default workers run in a shared multi-tenant environment with internet access. Private worker pools must be specified to run build jobs inside a private VPC environment.
Security policy explicitly requires build processes to execute within non-public network perimeters.
2
Evaluate authentication mechanism for build execution.
Workload Identity Federation or attached service accounts generate dynamic, short-lived tokens without requiring static key files.
Static JSON service account key files stored in code repositories pose significant security risks if leaked.
3
Select fine-grained IAM permissions for deployment tasks.
Assign predefined, least-privilege roles to the build service account rather than primitive roles or full service account management roles.
Ensures adherence to security governance and the principle of least privilege.

Anahtar Kavram

Secure CI/CD Pipeline Architecture with Cloud Build Private Pools and Workload Identity
Soru 971Soru →

A global media organization is establishing a centralized CI/CD pipeline using Cloud Build, Artifact Registry, and Cloud Deploy to deliver microservices to GKE clusters. The enterprise security policy enforces two strict constraints: first, build workers must operate without public internet exposure and be prevented from exfiltrating source code or build artifacts to external Google Cloud projects; second, build and deployment execution identities must adhere to strict least-privilege principles without administrative rights over IAM service accounts. Which pipeline architecture and security configuration satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: Execute build jobs using Cloud Build Private Pools enclosed within a VPC Service Controls perimeter, establish separate dedicated service accounts for Cloud Build and Cloud Deploy pipelines, and grant the Cloud Deploy worker service account the Service Account User role (roles/iam.serviceAccountUser) on the target GKE runtime service account.

Cevap

Execute build jobs using Cloud Build Private Pools enclosed within a VPC Service Controls perimeter, establish separate dedicated service accounts for Cloud Build and Cloud Deploy pipelines, and grant the Cloud Deploy worker service account the Service Account User role (roles/iam.serviceAccountUser) on the target GKE runtime service account.
Designing secure cloud native CI/CD pipelines on GCP requires combining VPC Service Controls with private build infrastructure and fine-grained IAM controls. Cloud Build Private Pools run inside a private VPC network within a VPC Service Controls boundary, preventing unauthorized exfiltration of intellectual property and source code. Additionally, decoupling CI and CD service account identities and assigning the Service Account User role (roles/iam.serviceAccountUser) to the deployment runner provides exact workload impersonation rights without granting dangerous administrative IAM permissions.

Adım Adım Çözüm

1
Analyze build worker network isolation and data exfiltration controls.
Identify that default Cloud Build pools execute in a shared Google-managed network, requiring Cloud Build Private Pools peered to a custom VPC inside a VPC Service Controls security perimeter to restrict egress and exfiltration.
VPC Service Controls protect sensitive assets by preventing API-based exfiltration to unauthorized Google Cloud resources.
2
Evaluate IAM least-privilege identity model for pipeline runners.
Separate the build identity (Cloud Build SA) from the delivery identity (Cloud Deploy SA) and restrict permissions to targeted roles.
Separation of duties prevents a compromise in the build phase from compromising cluster release operations.
3
Determine correct service account delegation role for deployment.
Grant `roles/iam.serviceAccountUser` on specific runtime service accounts rather than primitive roles or `roles/iam.serviceAccountAdmin`.
The Service Account User role allows a runner to impersonate or attach a runtime identity without providing administrative rights to alter IAM policies or delete service accounts.

Anahtar Kavram

Secure CI/CD Pipeline Design with Private Pools, VPC Service Controls, and IAM Least Privilege
Soru 972Soru →

A global gaming enterprise structures its Google Cloud resource hierarchy using an Organization node with a dedicated parent folder named 'Game-Backend-Services'. Multiple child projects beneath this folder host Google Kubernetes Engine (GKE) clusters for microservice workloads. A central deployment service account requires permissions to deploy updated containerized workloads to all GKE clusters within this folder structure. The security team requires strict adherence to the principle of least privilege while avoiding repetitive per-project access management. Which IAM configuration should the cloud security architect recommend?

Cevabı ve açıklamayı göster

Cevap: Grant the Kubernetes Engine Developer role (roles/container.developer) to the service account at the 'Game-Backend-Services' folder level.

Cevap

Granting the predefined Kubernetes Engine Developer role (roles/container.developer) at the 'Game-Backend-Services' folder level is the optimal IAM configuration.
In Google Cloud IAM, policy bindings set on parent resources (such as Folders) are inherited downstream by all child nodes (Projects and Resources). Granting the predefined 'roles/container.developer' role at the 'Game-Backend-Services' folder level satisfies the least privilege requirement by providing cluster deployment access without administrative rights, while eliminating the operational overhead of configuring separate bindings for every child project.

Adım Adım Çözüm

1
Identify resource scope and inheritance model
Permissions granted at a parent folder level are inherited automatically by all current and future child projects under that folder.
Assigning access at the folder level fulfills the requirement to minimize administrative overhead across multiple workload projects.
2
Evaluate least privilege role requirements
The Kubernetes Engine Developer role (roles/container.developer) provides fine-grained permissions to create and manage application workloads inside GKE clusters without full cluster administration capabilities.
Predefined fine-grained roles avoid over-granting permissions compared to primitive roles or full administrative roles.

Anahtar Kavram

Resource Hierarchy IAM Policy Inheritance and Least Privilege
Soru 973Soru →

An enterprise operates a real-time connected vehicle telemetry ingestion platform on Google Cloud. The core architecture uses Google Kubernetes Engine (GKE) and Cloud Spanner deployed in a primary region (us-central1). The organization requires quarterly Disaster Recovery (DR) validation to ensure failover capability to a secondary region (us-east4) under a strict Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 15 minutes. The validation procedure must not disrupt active production traffic in us-central1. Which procedure should the cloud architect mandate to validate DR readiness effectively?

Cevabı ve açıklamayı göster

Cevap: Pre-request and continuously audit compute and database quotas in us-east4, deploy non-production workload pipelines via automated IaC templates into an isolated testing VPC in us-east4, and perform synthetic workload testing against a regional database clone.

Cevap

Pre-request and continuously audit compute and database quotas in us-east4, deploy non-production workload pipelines via automated IaC templates into an isolated testing VPC in us-east4, and perform synthetic workload testing against a regional database clone.
The correct procedure mandates checking resource quotas in the secondary region ahead of time, using automated Infrastructure as Code to deploy validation infrastructure into an isolated VPC, and performing synthetic testing against database clones. This guarantees DR operational readiness without causing downtime or risk to live production telemetry pipelines.

Adım Adım Çözüm

1
Evaluate RPO and RTO constraints against potential DR validation strategies.
Near-zero RPO (< 5 seconds) and low RTO (< 15 minutes) require warm/active-passive or multi-region replication rather than cold backup/restore mechanisms.
Cold backup restores take hours and result in significant data loss windows that violate the required metrics.
2
Ensure target region resource availability prior to failover drills.
Audit regional CPU, IP address, and GKE quotas in us-east4 to ensure the region can absorb full production workloads immediately.
Unrequested quota limits in secondary regions are a primary root cause of DR failover failures.
3
Validate failover execution safely without impacting active production users.
Provision isolated environments using IaC scripts and run synthetic data validation tests against a cloned dataset.
Using isolated testing environments prevents accidental corruption or disruption of production vehicle telemetry traffic.

Anahtar Kavram

Developing Procedures for Business Continuity and Disaster Recovery Validation
Soru 974Soru →

A media streaming company runs an unpredictable, high-volume batch video processing workload alongside a steady-state REST API service on Google Cloud. The finance and platform engineering teams need to establish a FinOps governance framework to reduce cloud expenditures while maintaining automated budget tracking across multiple projects. Which of the following strategies should a Cloud Architect recommend? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Utilize Spot VMs for the batch video processing workloads and purchase flexible Committed Use Discounts (CUDs) to cover baseline compute spend.; Export detailed Cloud Billing data to BigQuery and configure programmatic budget notifications using Pub/Sub to trigger automated cost-control actions.

Cevap

The correct recommendations are to utilize Spot VMs for batch video processing alongside flexible Committed Use Discounts (CUDs) for baseline spend, and to export Cloud Billing data to BigQuery with Pub/Sub budget alerts for automated governance.
Combining Spot VMs for interruption-tolerant batch processing with flexible spend-based CUDs ensures maximum savings across both variable and steady-state compute. Concurrently, exporting billing metrics to BigQuery and integrating Pub/Sub budget alerts creates a robust FinOps control loop capable of programmatic remediation.

Adım Adım Çözüm

1
Analyze workload compute characteristics for cost optimization.
Identified batch processing as stateless/fault-tolerant (ideal for Spot VMs) and identified general compute baseline as suitable for flexible CUD coverage.
Matching compute pricing models to workload variability yields maximum cost savings without performance degradation.
2
Establish FinOps visibility and automated governance mechanisms.
Configured BigQuery Cloud Billing export for analytical querying and Pub/Sub notifications on budget alerts for automated remediation.
FinOps frameworks require real-time visibility and automated guardrails to enforce organizational budget compliance.

Anahtar Kavram

FinOps Cost Optimization and Governance in GCP
Soru 975Soru →

An enterprise media organization is establishing an automated testing and validation procedure to verify infrastructure readiness for a mission-critical global streaming pipeline on Google Cloud. The pipeline relies on Infrastructure as Code (IaC) via Terraform for automated environment provisioning, Private GKE clusters for container execution, and strict network perimeters. During pre-deployment dry-run validation tests, execution pipelines intermittently fail due to state synchronization locks during concurrent test runs, compute provision failures during stress testing, and an inability of external CI/CD test runners to reach the private GKE control plane endpoint. Which testing and validation procedure should the cloud architect implement to ensure deployment readiness and prevent pipeline failures?

Cevabı ve açıklamayı göster

Cevap: Integrate automated pre-flight quota checks before IaC execution, store Terraform state in a Cloud Storage backend with object versioning enabled, and configure GKE control plane authorized networks to permit designated CI/CD runner IP ranges.

Cevap

Integrate automated pre-flight quota checks before IaC execution, store Terraform state in a Cloud Storage backend with object versioning enabled, and configure GKE control plane authorized networks to permit designated CI/CD runner IP ranges.
A comprehensive testing and validation procedure for Google Cloud technical solutions must address pre-deployment readiness (quota verification), state integrity (remote versioned Terraform state storage), and security boundary compliance (GKE control plane authorized networks). Combining these controls guarantees that automated test suites can safely provision and validate infrastructure without encountering state conflicts, security policy breaches, or quota exhaustion.

Adım Adım Çözüm

1
Implement pre-flight quota validation procedures
Identifies potential resource limit bottlenecks across target GCP regions before applying Terraform configurations.
Prevents catastrophic failure of stress testing pipelines caused by missing regional compute or storage quotas.
2
Configure remote Cloud Storage backend with object versioning for Terraform state
Ensures centralized, locked, and recoverable state management during concurrent automated validation runs.
Prevents state corruption and concurrency conflicts associated with unversioned or local state files.
3
Restrict GKE master access using control plane authorized networks
Allows automated validation runners from specific source IPs to perform post-provisioning cluster checks securely.
Maintains strict security perimeter compliance while satisfying operational visibility and testing needs.

Anahtar Kavram

Developing Procedures to Test and Validate Technical Solutions
Tahmini Süre:2m 0s
Soru 976Soru →

A healthcare enterprise operates a multi-tenant Telehealth Video Consultation platform on Google Cloud. The system consists of two primary services: a synchronous Video Signaling API that directly manages real-time patient-doctor video sessions, and an asynchronous EHR Audit Log Archival service that exports patient interaction logs to BigQuery for regulatory compliance. Currently, transient network spikes trigger low-priority alerts that escalate into system-wide automated failovers, causing unnecessary operational overhead. As a Cloud Architect, you are tasked with aligning the technical Service Level Objectives (SLOs) with business impact to optimize reliability and reduce engineer fatigue. Which TWO SRE practices should you implement to achieve this alignment?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define a high-stringency availability and latency SLO for the Video Signaling API using successful request ratios as the SLI, and configure multi-window burn-rate alerts against its error budget.; Establish a throughput and data freshness SLO evaluated over a rolling 30-day window for the EHR Audit Log Archival service, allowing transient failures during peak hours to be absorbed by its error budget.

Cevap

The correct practices are to define a high-stringency availability and latency SLO for the Video Signaling API using successful request ratios as the SLI backed by multi-window burn-rate alerts, and to establish a data freshness SLO over a rolling 30-day window for the asynchronous EHR Audit Log Archival service.
The correct decisions appropriately differentiate between synchronous user-facing impact and asynchronous backend tolerance. Measuring real-time successful request ratios as the SLI for the Video Signaling API and alerting based on error budget burn rate ensures that paging occurs only when critical user experience is threatened. Meanwhile, establishing a longer rolling window (30 days) for the asynchronous audit log archival workload allows transient delays to consume error budget without triggering false-alarm incidents.

Adım Adım Çözüm

1
Analyze business criticality for both workloads
Identify that the Video Signaling API is synchronous and critical to real-time revenue and patient care, whereas the EHR Audit Log Archival service is asynchronous and tolerates latency.
Business impact determines the strictness of SLOs, appropriate window lengths, and alert severity.
2
Differentiate SLIs from SLOs and error budget alerting strategies
SLIs measure specific performance metrics (e.g., successful request ratio), while SLOs set target threshold goals. Error budget burn rates should drive alerts rather than static thresholds.
Prevents mistaking target objectives for current metric values and avoids alert fatigue from transient blips.
3
Align technical measurement with business tolerance
Apply multi-window burn-rate alerts to the synchronous API, and evaluate the asynchronous archival job over a wider rolling window (30 days).
Ensures high-priority alerting only occurs when business-critical error budgets are genuinely at risk.

Anahtar Kavram

Aligning SLOs/SLIs and Error Budgets with Workload Criticality
Soru 977Soru →

A enterprise media streaming company enforces strict data exfiltration controls by placing its core analytical datasets in BigQuery inside a restricted VPC Service Controls perimeter in Project-Data. Data scientists access BigQuery programmatically from compute instances located in a separate management VPC network in Project-Workloads via a Private Service Connect (PSC) endpoint. Despite assigning the required IAM BigQuery Data Viewer roles to the service account, queries routed through the PSC endpoint fail with a VPC Service Controls perimeter violation error. How should the principal cloud architect resolve this issue while maintaining perimeter security boundaries?

Cevabı ve açıklamayı göster

Cevap: Configure an ingress rule on the VPC Service Controls perimeter in Project-Data specifying the identity of the service account and the source project context of Project-Workloads.

Cevap

Configure an ingress rule on the VPC Service Controls perimeter specifying the service account identity and source project context.
VPC Service Controls protect GCP APIs within a defined security perimeter. When requests originate from outside the perimeter—even when routed over a Private Service Connect endpoint—VPC Service Controls block the request by default unless an ingress policy is configured. Creating an ingress rule that specifies the caller service account and source project context permits access for that authorized workflow without disabling exfiltration protection.

Adım Adım Çözüm

1
Identify the cause of access failure across project boundaries.
The failure occurs because BigQuery resides inside a VPC Service Controls perimeter in Project-Data, while API calls originate from Project-Workloads across a Private Service Connect endpoint.
VPC Service Controls enforce perimeter boundaries at the GCP API layer regardless of whether traffic arrives over public endpoints or Private Service Connect.
2
Evaluate perimeter cross-boundary access requirements.
To allow external clients to access perimeter-protected services, VPC Service Controls ingress rules must explicitly define authorized attributes.
Ingress rules define allowed caller identities (service accounts/users), source projects/networks, and target services without compromising perimeter isolation for unauthorized clients.
3
Select the appropriate security policy configuration.
An ingress rule referencing the service account identity and source project context allows private access securely.
This maintains data exfiltration protections while enabling authorized cross-perimeter API requests.

Anahtar Kavram

VPC Service Controls Ingress/Egress Rules for Private Service Connect
Soru 978Soru →

An enterprise application deployed on Compute Engine instances in Project A requires secure access to a PostgreSQL database password stored in Secret Manager in Project B. The secret is encrypted with a Customer-Managed Encryption Key (CMEK) managed in Cloud KMS within Project B. Corporate policy strictly forbids the generation of downloadable service account keys and requires adhering strictly to the principle of least privilege for cross-project access and secret decryption. Which configuration strategy should a Cloud Architect implement?

Cevabı ve açıklamayı göster

Cevap: Attach a custom service account to the Compute Engine instances in Project A. Grant this service account the Secret Manager Secret Accessor role on the target secret and the Cloud KMS CryptoKey Decrypter role on the specific CMEK key in Project B.

Cevap

Attach a custom service account to the Compute Engine instances in Project A. Grant this service account the Secret Manager Secret Accessor role on the target secret and the Cloud KMS CryptoKey Decrypter role on the specific CMEK key in Project B.
Attaching a custom service account to the compute workload and granting the specific predefined roles (`roles/secretmanager.secretAccessor` and `roles/cloudkms.cryptoKeyDecrypter`) directly on the target secret and key resources satisfies cross-project security, avoids static credential management, and adheres strictly to least privilege.

Adım Adım Çözüm

1
Identify identity management best practices for Compute Engine
Avoid downloading JSON service account keys; use Application Default Credentials via an attached custom service account.
Eliminates static key leakage risks and complies with corporate security policy against downloading keys.
2
Configure cross-project IAM permissions for Secret Manager
Grant `roles/secretmanager.secretAccessor` on the specific secret resource in Project B to the Project A service account.
Allows reading secret payloads without granting project-level administrative access.
3
Configure CMEK decryption permissions in Cloud KMS
Grant `roles/cloudkms.cryptoKeyDecrypter` on the KMS key in Project B to the Project A service account.
Enables Secret Manager to decrypt the secret payload on behalf of the accessing identity using the CMEK key.

Anahtar Kavram

Cross-Project Least-Privilege IAM for Secret Manager and Cloud KMS CMEK Decryption
Soru 979Soru →

An online gaming studio is defining the cloud architecture for a global multiplayer leaderboard and user session state service. The conceptual architecture specifies three functional tiers: 1) a high-throughput event ingestion tier for real-time match telemetry, 2) a stateless microservices container execution tier for game session management, and 3) a relational database tier for persistent player profiles restricted to a single geographic region. Additionally, security governance requires network-level data exfiltration prevention around cloud storage endpoints holding game assets. Which combination of Google Cloud services correctly maps this logical design to a physical GCP architecture while adhering to operational cost and security best practices?

Cevabı ve açıklamayı göster

Cevap: Use Cloud Pub/Sub for telemetry ingestion, Cloud Run for microservices execution, Cloud SQL for PostgreSQL for relational player profiles, and VPC Service Controls around storage resources.

Cevap

The optimal architecture utilizes Cloud Pub/Sub for telemetry ingestion, Cloud Run for stateless containerized microservices, Cloud SQL for PostgreSQL for single-region relational storage, and VPC Service Controls to enforce exfiltration boundaries.
The correct solution maps each logical requirement to its most cost-effective and secure GCP physical counterpart: Pub/Sub for ingestion, Cloud Run for serverless container microservices, Cloud SQL for regional relational storage, and VPC Service Controls for exfiltration perimeter defense.

Adım Adım Çözüm

1
Evaluate the ingestion tier requirements.
Cloud Pub/Sub provides scalable, managed event ingestion for real-time telemetry.
Pub/Sub handles asynchronous high-throughput event streaming effortlessly.
2
Evaluate compute execution requirements for stateless microservices.
Cloud Run is selected over GKE Standard.
Cloud Run automatically scales stateless containers to zero without cluster management overhead or baseline infrastructure cost.
3
Select database resource for single-region relational data.
Cloud SQL is selected over Cloud Spanner.
Cloud Spanner is designed for globally distributed multi-region databases. Cloud SQL meets single-region relational database needs efficiently and cost-effectively.
4
Determine exfiltration prevention security control.
VPC Service Controls are selected to complement IAM.
VPC Service Controls create security perimeters around GCP APIs to prevent authorized identities from copying data outside authorized networks.

Anahtar Kavram

Mapping logical architecture requirements to physical GCP services based on workload scope, management overhead, cost efficiency, and security perimeters.
Soru 980Soru →

An enterprise organization is setting up a Shared VPC network architecture in Google Cloud to centralize network administration while enabling standalone service projects to deploy workloads. Compute Engine instances deployed in a service project subnet need to privately access Google Cloud services (such as Cloud Storage and BigQuery) without public IP addresses, and all general internet egress traffic from these instances must be routed securely through a centralized NAT solution. Which TWO network configuration steps must be performed in the Host Project to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable Private Google Access on the subnets within the Shared VPC host project where the service project workloads are attached.; Configure Cloud NAT on a Cloud Router created in the Shared VPC host project for the region hosting the service workloads.

Cevap

The correct configuration steps are enabling Private Google Access on the subnets in the Shared VPC host project and configuring Cloud NAT on a Cloud Router in the host project for the relevant region.
In a Shared VPC topology, network resources such as subnets, Cloud Routers, and Cloud NAT gateways are provisioned and managed centrally in the Host Project. Enabling Private Google Access on the host project's subnets grants internal-only VMs in attached service projects access to Google APIs. Creating a Cloud Router with Cloud NAT in the host project provides controlled, managed outbound internet egress for workloads in those shared subnets.

Adım Adım Çözüm

1
Identify the required network configuration for private Google API access.
Enabling Private Google Access on the host project subnet allows VMs with internal IP addresses only to reach Google API endpoints via default routes.
Service project instances reside on subnets managed centrally within the Shared VPC Host Project.
2
Identify the centralized internet egress mechanism.
Configuring Cloud NAT on a Cloud Router in the host project for the specified region provides outbound internet connectivity for all instances in that region's host subnets.
Cloud NAT operates at the VPC subnet level in the host project, managing outbound translation without allocating public IPs to individual VMs.

Anahtar Kavram

Shared VPC Centralized Network Provisioning with Private Google Access and Cloud NAT
ÖncekiSayfa 49 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin