Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 81Soru →

A financial enterprise is expanding its online payment fraud detection infrastructure across several regional Google Cloud projects. The team plans to deploy multiple Compute Engine N2 compute clusters in a newly added Google Cloud region (`us-east5`) next month. To ensure successful resource deployment without operational interruptions, adhere to least-privilege governance, and control unexpected cloud spend, which TWO actions should the Lead Cloud Architect implement?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Submit a quota increase request for N2 CPUs in the target region (`us-east5`) via the Google Cloud Console or Service Quotas API prior to launching the migration scripts.; Export Cloud Billing data to BigQuery and set up automated Cloud Monitoring budget alerts tied to Pub/Sub notifications for proactive spending management.

Cevap

Submit a quota increase request for N2 CPUs in the target region ('us-east5') in advance, and export Cloud Billing data to BigQuery while setting up Cloud Monitoring budget alerts with Pub/Sub notifications.
Proactively requesting regional quota increases in `us-east5` guarantees compute capacity is available prior to provisioning. Combining BigQuery billing exports with Pub/Sub budget alerts allows real-time cost tracking and automated governance.

Adım Adım Çözüm

1
Assess quota requirements for new regional deployments
Identified that N2 CPU regional quotas must be requested proactively before starting deployments in `us-east5`.
Default quota limits per region can cause deployment failures if not increased ahead of large compute expansions.
2
Implement governance and financial alerting controls
Configured BigQuery billing exports for cost analysis and set up Pub/Sub-driven Cloud Billing budget notifications.
Enables granular cost monitoring and automated governance without granting overly permissive IAM roles.

Anahtar Kavram

Managing Resource Quotas, Hierarchies, and Cost Optimization
Soru 82Soru →

A global supply chain management platform runs its core transactional fulfillment service on Compute Engine Managed Instance Groups (MIGs) and Cloud SQL for PostgreSQL in us-central1 as the primary region, with a cross-region read replica in us-east4 for disaster recovery. To meet compliance standards, the organization must regularly validate its business continuity and disaster recovery (DR) procedures. The business requires a Recovery Point Objective (RPO) of under 1 minute, a Recovery Time Objective (RTO) of under 15 minutes, and zero disruption to live customer traffic during validation drills. Which validation procedure should the Cloud Architect implement?

Cevabı ve açıklamayı göster

Cevap: Pre-verify compute and IP quota allocations in us-east4, promote a temporary isolated clone of the us-east4 read replica to test data integrity against recent transactions, and simulate application load against the cloned environment without switching live DNS records.

Cevap

Pre-verify compute and IP quota allocations in us-east4, promote a temporary isolated clone of the us-east4 read replica to test data integrity against recent transactions, and simulate application load against the cloned environment without switching live DNS records.
The optimal DR validation procedure verifies regional quotas in advance to avoid capacity errors during failover and uses isolated database cloning to validate data replication integrity and RTO boot times without disrupting live production users or breaking continuous replication.

Adım Adım Çözüm

1
Assess quota and resource capacity in the target disaster recovery region (us-east4).
Ensures that Compute Engine CPU, memory, and IP quotas can accommodate production failover scale prior to running DR drills.
Quota requests require approval and cannot be dynamically increased during an emergency or failover drill.
2
Create an isolated clone of the secondary Cloud SQL read replica.
Produces a point-in-time test database with near-zero replication lag while keeping the active cross-region replication stream uninterrupted.
Cloning avoids impacting the primary database or breaking the continuous sync required for sub-minute RPO.
3
Execute functional validation and synthetic load tests on the cloned DR environment.
Verifies data integrity, RPO synchronization, and RTO application boot times without shifting live production DNS traffic.
Satisfies compliance validation requirements with zero operational downtime for end users.

Anahtar Kavram

Disaster Recovery Validation and Pre-Failover Capacity Verification
Soru 83Soru →

An organization is deploying an analytics microservice in Project A on Google Cloud Compute Engine that must query sensitive BigQuery datasets located in Project B. To comply with strict internal security policies, long-lived service account key export is explicitly forbidden, and privilege escalation risks must be minimized. The microservice needs to securely call BigQuery APIs under the identity of a designated workload service account created in Project B. Which configuration strategy fulfills these operational and security requirements while adhering to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Grant the service account attached to the Compute Engine instance in Project A the Service Account Token Creator role directly on the target workload service account in Project B, allowing it to generate short-lived OAuth2 access tokens via service account impersonation.

Cevap

Grant the service account attached to the Compute Engine instance in Project A the Service Account Token Creator role directly on the target workload service account in Project B, allowing it to generate short-lived OAuth2 access tokens via service account impersonation.
The solution that grants the Service Account Token Creator role directly on the specific target service account enables keyless cross-project impersonation. It allows the microservice to obtain short-lived OAuth2 tokens securely while strictly honoring least privilege and avoiding service account key creation.

Adım Adım Çözüm

1
Identify key policy constraints
Long-lived service account key exports are prohibited, cross-project access is required, and minimal privilege must be enforced.
Security governance strictly demands short-lived token generation without static key management.
2
Evaluate GCP identity delegation mechanics
Service account impersonation allows an identity to mint short-lived tokens for another service account without holding key files.
IAM supports short-lived credential creation via the `roles/iam.serviceAccountTokenCreator` role.
3
Apply least privilege scoping
Bound the `roles/iam.serviceAccountTokenCreator` role directly to the target service account resource in Project B, rather than granting project-wide administrative or primitive roles.
Resource-level role binding ensures the calling service account can only impersonate the specific designated workload identity.

Anahtar Kavram

Cross-Project Service Account Impersonation and Token Creation
Soru 84Soru →

A digital publishing platform is transitioning from a conceptual cloud design to a physical architecture on Google Cloud. The logical architecture requires an event-driven ingestion endpoint for webhooks, a fully managed stateless processing tier to sanitize and transform JSON content, a standard regional relational database for content metadata, and a perimeter security mechanism to prevent data exfiltration to unauthorized external storage. Which physical GCP architecture accurately implements these logical requirements while minimizing operational overhead and unnecessary cost?

Cevabı ve açıklamayı göster

Cevap: Incorporate Cloud Pub/Sub for event ingestion, Cloud Run for stateless payload transformation, Cloud SQL for PostgreSQL for regional metadata storage, and VPC Service Controls to enclose the resources within a security perimeter.

Cevap

The optimal physical architecture uses Cloud Pub/Sub for event ingestion, Cloud Run for serverless processing, Cloud SQL for regional relational storage, and VPC Service Controls for exfiltration protection.
The solution that combines Cloud Pub/Sub, Cloud Run, Cloud SQL, and VPC Service Controls correctly translates every logical architectural tier into its minimal, fully managed physical GCP equivalent while enforcing exfiltration boundaries.

Adım Adım Çözüm

1
Analyze logical ingestion and processing requirements
Identify that simple stateless event processing maps best to Cloud Run to eliminate cluster management overhead.
Cloud Run scales automatically from zero for stateless transformation tasks without infrastructure configuration.
2
Evaluate data storage tier requirements
Map the standard regional relational requirement to Cloud SQL rather than Cloud Spanner.
Cloud SQL meets regional relational needs without the high cost and global scaling complexity of Cloud Spanner.
3
Evaluate security perimeter constraints
Select VPC Service Controls to establish exfiltration boundaries.
IAM permissions govern user authorization but cannot prevent authorized identities from copying data to external unmanaged storage buckets unless protected by a VPC Service Controls perimeter.

Anahtar Kavram

Translating Logical Architecture to Physical GCP Component Specifications
Soru 85Soru →

An enterprise cloud infrastructure team is provisioning a Virtual Private Cloud (VPC) network to host internal database workloads across two regions (`us-east1` and `us-west1`). The database instances are deployed on Compute Engine virtual machines (VMs) that do not have external IP addresses assigned. The architecture requires that these private instances securely download software patches from public internet repositories and send automated backups to Google Cloud Storage endpoints, while remaining completely inaccessible to inbound traffic from the public internet. Which TWO configuration steps should the cloud architect implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable Private Google Access on the subnets where the Compute Engine instances reside.; Configure Cloud Routers and Cloud NAT gateways in both us-east1 and us-west1 regions.

Cevap

The correct configurations are to enable Private Google Access on the subnets housing the private VM instances and to deploy Cloud Routers with Cloud NAT gateways in both regions.
To allow private Compute Engine VMs without public IP addresses to securely communicate with Google APIs (such as Cloud Storage), Private Google Access must be enabled at the subnet level. To allow these same private VMs to initiate outbound connectivity to external internet repositories for software updates without allowing inbound public connections, Cloud NAT must be deployed alongside Cloud Router in each region.

Adım Adım Çözüm

1
Identify the requirement for private Compute Engine VMs (no external IPs) to access Cloud Storage.
Enable Private Google Access on the relevant VPC subnets.
Private Google Access grants instances with internal-only IP addresses the ability to reach default Google APIs and storage services over internal routing.
2
Identify the requirement for private Compute Engine VMs to fetch external software patches securely.
Provision Cloud Routers and Cloud NAT instances in both us-east1 and us-west1.
Cloud NAT provides regional, managed outbound Network Address Translation, enabling internet egress for package downloads without exposing private instances to inbound public traffic.

Anahtar Kavram

Subnet-level Private Google Access and Cloud NAT configuration for private VPC topology egress
Tahmini Süre:1m 30s
Soru 86Soru →

A French biotechnology enterprise is migrating its genomic clinical trial pipeline to Google Cloud. To satisfy strict EU data sovereignty mandates and data governance requirements, the solution must meet three specific criteria:
1. Cryptographic keys used for data at rest must be managed within Cloud KMS hosted in a specified EU region.
2. Google Cloud personnel must obtain explicit customer authorization before accessing data during support operations.
3. Authenticated identities must be prevented from exfiltrating sensitive genomic datasets to external, unauthorized Google Cloud storage resources.

Which combination of Google Cloud security controls satisfies these compliance and governance requirements?

Cevabı ve açıklamayı göster

Cevap: Configure Customer-Managed Encryption Keys (CMEK) with key rings hosted in the target EU region, enable Access Approval for operator access, and establish a VPC Service Controls perimeter around project resources.

Cevap

Configure Customer-Managed Encryption Keys (CMEK) with key rings hosted in the target EU region, enable Access Approval for operator access, and establish a VPC Service Controls perimeter around project resources.
The correct choice fulfills all three regulatory requirements. Customer-Managed Encryption Keys (CMEK) constrained to an EU Cloud KMS key ring satisfies data sovereignty encryption rules. Access Approval ensures Google Cloud personnel require explicit customer consent before accessing resources. VPC Service Controls provides perimeter security to prevent data exfiltration by authorized identities.

Adım Adım Çözüm

1
Address key management and regional sovereignty requirements.
Using Customer-Managed Encryption Keys (CMEK) with key rings located in the specified EU region ensures compliance with regional data encryption governance without taking on raw CSEK key management burdens.
CMEK allows key lifecycle control while keeping key rings strictly constrained to approved geographic regions.
2
Address operator access governance requirements.
Enabling Access Approval ensures Google support engineers cannot access data or configuration without prior customer consent.
Access Approval enforces administrative approval workflows for Google Cloud support interactions.
3
Address data exfiltration prevention requirements.
Deploying VPC Service Controls isolates storage and compute resources within a perimeter, preventing authorized users from copying data to external resources.
IAM permissions govern access, but VPC Service Controls enforces network-level boundary protection against exfiltration.

Anahtar Kavram

Combining CMEK, Access Approval, and VPC Service Controls for regulatory compliance and data sovereignty
Soru 87Soru →

An enterprise microservice running on an on-premises Kubernetes cluster must programmatically access Google Cloud Storage and Cloud Spanner APIs. Enterprise compliance policies strictly prohibit downloading, exporting, or storing long-lived service account JSON key files anywhere on-premises or within deployment manifests. Furthermore, administrative scripts running in automated CI/CD pipelines via the gcloud CLI must execute operations as a targeted service account without managing key files. Which TWO implementation steps must you configure to satisfy these programmatic authentication and CLI requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Workload Identity Federation to exchange Kubernetes service account OIDC tokens for short-lived Google Cloud federated credentials for the application SDK.; Configure the gcloud CLI in the CI/CD pipeline using the --impersonate-service-account flag to execute administrative commands via short-lived service account tokens.

Cevap

Workload Identity Federation should be configured for the on-premises Kubernetes cluster to allow programmatic SDK authentication using short-lived OIDC tokens. For the gcloud CLI automation in CI/CD, service account impersonation should be enabled via the --impersonate-service-account flag.
Combining Workload Identity Federation for containerized SDK workloads with gcloud service account impersonation for automated scripts establishes a completely keyless programmatic interaction model. Workload Identity Federation exchanges external OIDC tokens for short-lived Google Cloud credentials, while gcloud impersonation generates short-lived tokens on the fly without storing long-lived service account JSON keys.

Adım Adım Çözüm

1
Establish keyless identity federation for the application SDK
Configure Workload Identity Federation using an Workload Identity Pool and Provider mapped to the on-premises Kubernetes cluster's OIDC issuer.
This avoids downloading long-lived service account JSON keys while allowing Application Default Credentials (ADC) to exchange OIDC tokens for Google OAuth2 access tokens.
2
Configure short-lived gcloud CLI access in automation pipelines
Execute gcloud commands using service account impersonation by specifying the target service account email with the --impersonate-service-account flag or setting the auth/impersonate_service_account gcloud property.
This generates temporary tokens for gcloud execution without creating or storing key files.

Anahtar Kavram

Programmatic GCP Interaction via Keyless Authentication and Service Account Impersonation
Soru 88Soru →

An online gaming platform's architecture review reveals significant technical debt accumulated during rapid initial scaling on Google Cloud. The audit identifies two major operational and security risks: engineering teams maintain infrastructure using unversioned local Terraform state files stored on developer laptops, and backend service accounts have been granted the primitive Owner role across all GCP projects to simplify component interaction. Which TWO actions should you take to mitigate this technical debt and align with GCP architectural best practices?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Migrate Terraform state management to a centralized Cloud Storage backend with object versioning and state locking enabled.; Audit service account usage and replace primitive Owner roles with least-privilege predefined or custom IAM roles.

Cevap

To mitigate technical debt, configure a centralized Cloud Storage backend with object versioning and state locking for Terraform state management, and audit service accounts to replace primitive roles with targeted predefined or custom IAM roles.
Configuring remote Cloud Storage state backends with object versioning and state locking eliminates state drift and concurrency risks. Replacing broad primitive Owner roles on service accounts with targeted predefined or custom roles re-establishes governance and least-privilege security controls.

Adım Adım Çözüm

1
Evaluate the Infrastructure as Code (IaC) state management debt.
Local state files create risk of state drift, loss, and race conditions during simultaneous infrastructure updates.
Centralizing state in a remote Cloud Storage bucket with locking and versioning resolves state drift and prevents concurrency corruption.
2
Evaluate the IAM security debt across projects.
Primitive roles like Owner grant excessive permissions, broadening the blast radius in the event of credential compromise.
Replacing primitive roles with fine-grained predefined or custom roles reduces security vulnerability while retaining required operational capabilities.

Anahtar Kavram

Mitigating technical debt by modernizing IaC state persistence and remediating over-privileged IAM access.
Tahmini Süre:1m 30s
Soru 89Soru →

A multinational financial services enterprise hosts its core payment authorization pipeline across two Google Cloud regions (primary in us-central1, secondary in us-east4). The enterprise requires a quarterly Business Continuity and Disaster Recovery (BCP/DR) drill to validate cross-region failover efficiency under an RPO target of under 1 minute and an RTO target of under 15 minutes. As the Lead Cloud Architect, you must sequence the technical steps for executing and verifying this DR validation exercise without causing unintended data loss or unexpected service failure. Arrange the operational steps below in the correct execution sequence from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct execution order is: 1) Audit compute quota limits and capacity reservations in us-east4; 2) Check Cloud Monitoring cross-region replication lag; 3) Promote standby database in us-east4 and update Cloud DNS routing policies; 4) Run automated synthetic transaction suites in us-east4 to verify integrity and RTO; 5) Configure reverse replication from us-east4 back to us-central1.
The proper DR validation sequence starts with pre-flight checks (confirming compute quotas and capacity reservations, followed by checking replication lag against RPO metrics). Next, the failover is executed by promoting the DR database and updating DNS routing. Afterwards, functional integrity and RTO metrics are validated using synthetic transaction tests. Finally, reverse replication is established back to the primary region to prepare for clean failback without data loss.

Adım Adım Çözüm

1
Pre-flight resource availability verification
Confirmed sufficient regional quotas and reserved compute capacity in the DR target region (us-east4).
Failing to check compute quotas beforehand can cause Compute Engine instance creation to fail during switchover.
2
RPO compliance verification
Verified replication lag is within the required 1-minute window.
Initiating failover when replication lag is high violates RPO objectives and leads to unrecoverable data loss.
3
Failover execution and traffic redirection
Secondary database promoted to write mode and active network traffic redirected to us-east4.
Database promotion and DNS record updates transition the secondary site to active primary status.
4
Failover validation and RTO timing verification
Synthetic transaction suite executed cleanly and total failover time measured against RTO SLA.
Post-failover validation ensures the secondary environment operates reliably under real transaction conditions.
5
Failback preparation and reverse synchronization
Reverse replication initialized from us-east4 back to us-central1.
Re-establishing reverse replication preserves data written to us-east4 during the validation drill before returning primary operations to us-central1.

Anahtar Kavram

Developing Procedures for Business Continuity and Disaster Recovery Validation
Tahmini Süre:2m 30s
Soru 90Soru →

An enterprise organization is setting up a managed relational database infrastructure on Google Cloud for a regional internal application. The system requires full ACID compliance, automated backup capabilities with point-in-time recovery, and compliance with strict data governance mandates requiring customer key management control via Cloud KMS without requiring the operations team to handle raw encryption key material directly. Which database deployment and encryption configuration best fulfills these requirements while avoiding unnecessary cost and operational complexity?

Cevabı ve açıklamayı göster

Cevap: Provision a Cloud SQL for PostgreSQL instance configured with regional High Availability (HA) and encrypted with Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS.

Cevap

Provision a Cloud SQL for PostgreSQL instance configured with regional High Availability (HA) and encrypted with Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS.
Provisioning a Cloud SQL instance with regional High Availability and Customer-Managed Encryption Keys (CMEK) via Cloud KMS delivers a fully managed ACID-compliant relational database with automated backups and point-in-time recovery. CMEK allows the customer to control key lifecycle policies without the operational burden of storing and supplying raw key material.

Adım Adım Çözüm

1
Evaluate the database workload requirements
Identified the need for a regional, ACID-compliant relational database with point-in-time recovery capabilities.
Cloud SQL fits regional relational database workloads without the high multi-region cost of Cloud Spanner.
2
Determine the encryption and key governance model
Selected Customer-Managed Encryption Keys (CMEK) using Cloud KMS.
CMEK enables organizations to generate, rotate, and manage key encryption keys in Cloud KMS without managing raw secret key files directly.
3
Select the optimal provisioned architecture
Combined regional Cloud SQL HA deployment with Cloud KMS CMEK.
This meets all architectural, recovery, and security compliance constraints efficiently.

Anahtar Kavram

Provisioning Relational Databases and Key Governance
Tahmini Süre:1m 30s
Soru 91Soru →

An enterprise energy grid operator is designing a smart meter telemetry and analytics platform on Google Cloud. The conceptual architecture defines three main tiers: a real-time ingestion tier for 10 million smart meters, a streaming processing tier for time-series anomaly detection, and a secure storage tier for time-series analytics that prevents data exfiltration. Which TWO physical Google Cloud service and security configuration choices correctly translate these logical requirements into an optimal physical architecture? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision Cloud Pub/Sub for high-throughput event ingestion, Cloud Dataflow for stream processing, and Cloud Bigtable for scalable time-series data storage.; Configure VPC Service Controls perimeter encompassing the project resources to isolate managed storage and compute services from unauthorized data exfiltration.

Cevap

The optimal physical architecture pairs Cloud Pub/Sub, Cloud Dataflow, and Cloud Bigtable for high-scale time-series telemetry ingestion, processing, and storage, while leveraging VPC Service Controls to prevent data exfiltration beyond the security perimeter.
Combining Cloud Pub/Sub, Cloud Dataflow, and Cloud Bigtable maps the logical streaming architecture directly to GCP native services optimized for heavy time-series workloads. Adding VPC Service Controls establishes an effective physical boundary against data exfiltration across managed services.

Adım Adım Çözüm

1
Analyze high-throughput time-series requirements
Identify Pub/Sub, Dataflow, and Bigtable as the native GCP physical stack for streaming IoT and telemetry workloads.
10 million smart meters generate continuous high-frequency metrics requiring low-latency writes and time-series key design.
2
Evaluate perimeter security constraints
Select VPC Service Controls to enclose managed services.
Conceptual exfiltration prevention requirements cannot be satisfied by IAM alone; network-level service perimeters are required.

Anahtar Kavram

Translating Conceptual Telemetry and Security Requirements to GCP Managed Physical Resources
Soru 92Soru →

A biotechnology firm migrated its genomic research data pipelines to Google Cloud by manually creating Compute Engine instances and Cloud Storage buckets via the Google Cloud Console. To accelerate initial experimentation, development teams were granted primitive Owner roles across all GCP projects. A recent technical audit revealed significant operational risk due to untracked configuration drift and excessive user permissions. Which strategy should a Cloud Architect recommend to systematically assess and mitigate this technical debt?

Cevabı ve açıklamayı göster

Cevap: Import existing cloud resources into Infrastructure as Code (IaC) management, replace primitive roles with fine-grained predefined or custom IAM roles following least privilege, and enforce future changes exclusively through automated CI/CD pipelines.

Cevap

Import existing cloud resources into Infrastructure as Code (IaC) management, replace primitive roles with fine-grained predefined or custom IAM roles following least privilege, and enforce future changes exclusively through automated CI/CD pipelines.
The optimal solution to remediate technical debt from ad-hoc console provisioning and excessive access is to codify existing infrastructure into Infrastructure as Code (IaC), establish least-privilege IAM roles (predefined or custom), and mandate CI/CD deployment pipelines to block manual console modifications and configuration drift.

Adım Adım Çözüm

1
Identify and capture current cloud resource state
Discovered untracked manually provisioned Compute Engine instances and Cloud Storage buckets.
Before eliminating technical debt, all unmanaged assets must be cataloged and brought into declarative IaC (such as Terraform state).
2
Remediate IAM security debt by transitioning from primitive to least-privilege roles
Overly broad Owner roles are replaced with specific predefined roles (e.g., Storage Object Viewer, Compute Viewer) or custom roles.
Primitive roles grant excessive administrative privileges across entire projects, creating severe compliance and security risks.
3
Establish automated deployment governance via CI/CD pipelines
Direct console modifications are restricted, and all infrastructure updates require version-controlled IaC code reviews.
Automating deployments prevents manual out-of-band changes and eliminates future configuration drift.

Anahtar Kavram

Assessing and Mitigating Infrastructure Configuration Drift and IAM Technical Debt
Soru 93Soru →

A South African telecommunications provider is building a data analytics platform on Google Cloud to process customer billing records and location telemetry. National regulations require that data must remain strictly within specified geographic boundaries and be protected against exfiltration, even by authenticated users with broad identity permissions. Additionally, encryption keys must be managed through Google Cloud services while respecting regional placement boundaries. Which two architectural controls should you implement to satisfy these compliance and data governance requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a VPC Service Controls perimeter around the projects hosting BigQuery and Cloud Storage to prevent data exfiltration to unauthorized Google Cloud resources outside the perimeter.; Enforce the Resource Locations Organization Policy constraint (constraints/gcp.resourceLocations) and utilize Customer-Managed Encryption Keys (CMEK) housed in regional Cloud KMS key rings.

Cevap

Implement VPC Service Controls around the analytical storage resources to prevent data exfiltration, and enforce the Resource Locations organization policy constraint combined with localized Customer-Managed Encryption Keys (CMEK).
Combining VPC Service Controls with Resource Location organization policies and CMEK addresses both data exfiltration risks and geographic sovereignty mandates. VPC Service Controls constrain data movement at the network perimeter, while CMEK with location constraints ensures keys and encrypted data reside exclusively within approved geographic regions.

Adım Adım Çözüm

1
Address data exfiltration risks beyond traditional IAM.
Deploy VPC Service Controls around projects containing BigQuery and Cloud Storage datasets.
VPC Service Controls create a security perimeter preventing data transfers to resources outside the project, counteracting exfiltration by compromised credentials or insider threats.
2
Enforce geographic data residency and key management compliance.
Apply the Resource Locations organization policy constraint and configure CMEK in localized Cloud KMS key rings.
The Resource Locations constraint restricts resource creation to permitted regions, while CMEK allows centralized control of cryptographic keys in compliance-approved locations.

Anahtar Kavram

Data Sovereignty and Perimeter Security
Tahmini Süre:2m 0s
Soru 94Soru →

A digital banking platform on Google Cloud operates a real-time Wire Transfer API and a Monthly Account Statement Generation service. During peak trading hours, minor response delays in the Wire Transfer API lead to contractual financial penalties due to missed settlement windows, yet operations receives no proactive alerts. Meanwhile, scheduled database maintenance routinely triggers critical page alerts for the background statement generator, consuming on-call resources even though statement delivery deadlines are not at risk. Which TWO actions should the Cloud Architect take to align technical Service Level Indicators (SLIs) and Service Level Objectives (SLOs) with business impact?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define the Wire Transfer API's SLI based on customer-facing latency measured at the Cloud Load Balancing ingress, and set a strict SLO backed by error budget burn-rate alerting.; Decouple the statement generation service's alert triggers from infrastructure-level spikes, establishing an SLO based on business throughput over a multi-hour rolling window.

Cevap

The correct architecture decisions are to define customer-facing latency SLIs with burn-rate alerting for the high-impact Wire Transfer API, and to evaluate the background statement generation service against multi-hour throughput SLO windows rather than short-lived infrastructure alerts.
Aligning technical service level objectives with business impact requires treating real-time, financially sensitive services differently from background batch tasks. Establishing SLIs at the ingress load balancer for the critical API directly measures user experience, and using error budget burn-rate alerts ensures proactive intervention before SLA breach. For non-critical batch workloads, evaluating SLOs over wider completion windows prevents operational alert fatigue during routine maintenance.

Adım Adım Çözüm

1
Analyze business impact for each workload
Identified that Wire Transfer API delays cause immediate financial penalties, while statement generation delays are acceptable within a multi-hour window.
Technical SLOs must directly reflect the financial and operational consequences of service degradation.
2
Select appropriate SLIs and alerting strategies for synchronous real-time flows
Selected Cloud Load Balancer latency SLIs and error budget burn-rate alerts for the Wire Transfer API.
Burn-rate alerts catch fast error consumption early to protect contractual SLAs without generating spurious pages.
3
Adjust batch workload SLOs to prevent alert fatigue
Configured a multi-hour throughput SLO window for statement generation.
Batch processing relies on eventual completion within business deadlines rather than instant sub-second uptime.

Anahtar Kavram

Aligning SLOs/SLIs with business impact requires tailoring measurement points and error budget policies to workload criticality, differentiating synchronous user transactions from asynchronous batch processing.
Soru 95Soru →

A fintech company operates an algorithmic trading platform on Google Cloud across multiple environments. The architecture consists of steady-state transaction microservices with predictable 24/7 resource utilization on Compute Engine, alongside analytical data pipelines in BigQuery that experience heavy, unpredictable query spikes during market opening hours. The leadership team mandates establishing a FinOps governance framework that optimizes cloud spend while maintaining performance and enabling precise cost attribution per business unit. Which strategy should the Lead Cloud Architect recommend?

Cevabı ve açıklamayı göster

Cevap: Purchase Flexible Committed Use Discounts (CUDs) to cover the steady-state Compute Engine baseline, configure BigQuery Enterprise edition with capacity autoscaling to handle query spikes within budget caps, and enforce resource labeling integrated with Cloud Billing export for unit-cost attribution.

Cevap

The Lead Cloud Architect should recommend purchasing Flexible Committed Use Discounts (CUDs) for steady-state baseline compute, implementing BigQuery Enterprise edition capacity autoscaling for bursty analytics, and enforcing resource labeling with Cloud Billing export for cost attribution.
Combining Flexible Committed Use Discounts for predictable baseline compute with BigQuery Enterprise edition capacity autoscaling ensures maximum cost savings on steady workloads while placing guardrails on bursty analytical queries. Integrating resource labeling with Cloud Billing export provides the unit-cost visibility required for effective FinOps governance.

Adım Adım Çözüm

1
Analyze compute workload profiles to select the optimal discount commitment model.
Steady-state 24/7 Compute Engine utilization benefits from spend-based or Flexible CUDs, providing predictable cost reduction without over-committing to peak variable capacity.
Standard CUDs sized to peak demand result in unutilized commitment costs during off-peak hours.
2
Evaluate BigQuery query behavior and cost governance controls.
Using BigQuery Enterprise edition with reservation capacity autoscaling allows workloads to burst during market open while enforcing strict budget caps.
Uncapped on-demand pricing during high-volume spikes exposes the organization to unpredictable cost overruns.
3
Establish FinOps visibility and governance mechanisms.
Enforcing mandatory resource labels combined with BigQuery billing export allows FinOps teams to measure cost-per-trade and attribute spend directly to business units.
Cost optimization requires granular operational feedback loops and precise unit-economic tracking.

Anahtar Kavram

FinOps process optimization balancing Committed Use Discounts, BigQuery slot reservations, and granular labeling governance.
Tahmini Süre:2m 0s
Soru 96Soru →

An online streaming catalog platform migrated its metadata ingestion services to Google Cloud using a rapid lift-and-shift strategy. A post-migration architecture review reveals significant operational technical debt: cloud infrastructure is currently managed through unversioned local state files leading to release friction, manual Console changes have introduced configuration drift, and service accounts retain primitive Owner roles across environments. Which TWO actions should the Cloud Architect execute to mitigate this technical debt according to Google Cloud recommended practices? (Select TWO answers.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Import existing Cloud resources into Infrastructure as Code (IaC) and migrate state management to a Cloud Storage remote backend configured with object versioning and state locking.; Audit service account permissions and replace primitive Owner roles with fine-grained predefined or custom roles following the principle of least privilege.

Cevap

The Cloud Architect should import existing infrastructure into Infrastructure as Code with a versioned and locked remote Cloud Storage backend, and replace primitive IAM roles on service accounts with fine-grained, least-privilege predefined or custom roles.
Remediating technical debt following GCP best practices requires standardizing infrastructure management using Infrastructure as Code (IaC) with a remote, versioned, and locked backend (Cloud Storage) to eliminate drift, while simultaneously replacing high-risk primitive IAM roles with fine-grained least-privilege permissions.

Adım Adım Çözüm

1
Assess Infrastructure Management and State Governance Debt
Identified that managing resources manually or with unversioned local state files creates deployment instability and configuration drift.
Centralizing IaC state into a Cloud Storage backend with object versioning and state locking ensures team synchronization, prevents drift, and enables rollbacks.
2
Assess Security and Access Governance Technical Debt
Identified that service accounts using primitive Owner roles violate security policy and create high risk exposure.
Replacing primitive roles with specific predefined or fine-grained custom roles satisfies compliance and enforces least privilege access.

Anahtar Kavram

Assessing and Mitigating Technical Debt in Cloud Architectures
Soru 97Soru →

A global healthcare genomics enterprise processes petabytes of sequencing data across 45 Google Cloud projects managed under a single Cloud Billing Account. The workload profile consists of steady-state web portals running continuously, unpredictable burst compute clusters processing genomic batches, and massive archival raw sample storage. The organization wants to establish an automated FinOps cost optimization and financial governance strategy without compromising application performance or operational security. Which of the following architectural actions should the enterprise implement? (Select THREE).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Purchase Flexible Committed Use Discounts (CUDs) at the billing account level to cover baseline compute spend across multiple machine series and regions.; Export detailed Cloud Billing data to a centralized BigQuery dataset and configure custom Cloud Budgets with Pub/Sub notification topics for automated governance actions.; Configure Cloud Storage Object Lifecycle Management rules to automatically transition raw sequencing objects from Standard to Nearline and Coldline storage based on object age.

Cevap

The correct recommendations are purchasing Flexible Committed Use Discounts for baseline compute across projects, exporting billing data to BigQuery with Pub/Sub programmatic budget alerts, and defining Cloud Storage Object Lifecycle Management policies for data tiering.
Flexible Committed Use Discounts deliver spend-based savings across varied machine types and regions for steady-state workloads. Centralized Cloud Billing export to BigQuery paired with Pub/Sub programmatic budget notifications facilitates deep cost visibility and automated governance. Automated Cloud Storage Object Lifecycle Management efficiently shifts historical data to lower-cost storage tiers over time.

Adım Adım Çözüm

1
Differentiate steady-state baseline spend from bursty compute demands.
Apply spend-based Flexible Committed Use Discounts (CUDs) across the billing account.
Flexible CUDs cover baseline usage across different VM families and regions without locking the organization into unused capacity during off-peak periods.
2
Implement centralized financial oversight and automated alerting.
Stream billing data into BigQuery and integrate Cloud Budgets with Pub/Sub.
BigQuery exports provide in-depth cost monitoring, and Pub/Sub budget notifications enable event-driven programmatic governance.
3
Optimize long-term data storage costs.
Define Object Lifecycle Management rules on Cloud Storage buckets.
Automating object transitions to cooler storage tiers reduces storage expenditure for infrequently accessed historical genomic files.

Anahtar Kavram

Enterprise FinOps governance through flexible commitments, automated billing data analytics, and storage lifecycle management.
Soru 98Soru →

An enterprise security architect is designing an automated credential rotation workflow for a PostgreSQL database. The database credentials must be stored in Google Cloud Secret Manager, encrypted using a Customer-Managed Encryption Key (CMEK) stored in Cloud KMS, and automatically rotated every 30 days using a dedicated Cloud Run rotation service triggered by Pub/Sub notifications. You must establish the secure lifecycle configurations and IAM bindings following the principle of least privilege. What is the correct sequence of steps to configure this automated secret rotation workflow?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps begins by granting the Secret Manager Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the CMEK key. Next, create the rotation Pub/Sub topic and the Secret Manager secret configured with CMEK. Third, grant the Secret Manager Service Agent the Pub/Sub Publisher role on the topic. Fourth, deploy the Cloud Run rotation service bound to a service account with the Secret Manager Secret Version Manager role. Finally, set the 30-day automatic rotation schedule on the secret.
The lifecycle of automated Secret Manager rotation with CMEK requires precise prerequisite sequencing. First, the Secret Manager Service Agent must have `cloudkms.cryptoKeyEncrypterDecrypter` permissions on the Cloud KMS key to allow secret creation and version encryption. Second, the secret can be created using CMEK alongside the designated Pub/Sub topic reference. Third, the Secret Manager Service Agent must be granted `pubsub.publisher` on the Pub/Sub topic so rotation events can be sent. Fourth, the Cloud Run rotation handler service must be deployed with a service account possessing `roles/secretmanager.secretVersionManager` to handle payload generation and updating credentials. Finally, applying the rotation schedule on the secret activates the end-to-end automated workflow without execution errors.

Adım Adım Çözüm

1
Authorize Secret Manager to access Cloud KMS
Secret Manager Service Agent receives cloudkms.cryptoKeyEncrypterDecrypter on the CMEK key.
Secret Manager cannot write or wrap secrets using CMEK until its system-generated service agent has explicit encryption and decryption permissions.
2
Provision Pub/Sub topic and CMEK-encrypted Secret
The Pub/Sub notification channel and CMEK-encrypted secret object exist in Secret Manager.
Creating the secret object requires active KMS access and specifies the topic where rotation events will be published.
3
Authorize Secret Manager to publish Pub/Sub events
Secret Manager Service Agent receives pubsub.publisher on the topic.
Secret Manager must be granted publishing rights so that rotation schedule events can reach the Pub/Sub topic.
4
Deploy rotation service with appropriate IAM identity
Cloud Run service is deployed using a custom service account with secretmanager.secretVersionManager.
The compute worker performing credential rotation needs permissions to read secret versions, write new versions, and update database passwords.
5
Activate automatic rotation schedule
The secret's rotation schedule is set to 30 days.
Enabling rotation on the secret initiates automated lifecycle events, which depend on all underlying IAM permissions and endpoints being fully configured.

Anahtar Kavram

Secret Manager Automated Rotation Lifecycle with CMEK and Service Accounts
Soru 99Soru →

A smart utility company operates a real-time smart grid monitoring platform on Google Cloud. The architecture uses a GKE cluster and a multi-region Cloud Bigtable instance deployed across a primary region (us-east4) and a secondary DR region (us-west1) to support a strict Recovery Point Objective (RPO) of under 1 minute and a Recovery Time Objective (RTO) of under 15 minutes. The team is developing an automated Disaster Recovery (DR) validation procedure to periodically test failover capabilities without disrupting active operations. Which two procedures should the cloud architect include in the DR validation workflow? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Audit regional resource quota limits in us-west1 and pre-request necessary quota increases well in advance of scheduled failover simulations.; Run automated synthetic transaction tests against the replicated secondary data store and compute pods before shifting production DNS traffic.

Cevap

The DR validation procedure must include auditing regional resource quotas in the target region prior to failover testing, as well as executing synthetic validation tests on the secondary cluster before switching live traffic.
Validating DR readiness requires both proactive infrastructure checks and post-failover, pre-traffic verification. Pre-requesting and auditing resource quotas ensures the secondary region has sufficient capacity to handle failover scale. Executing synthetic transaction tests verifies system health and data consistency in the secondary region before updating DNS or traffic routing.

Adım Adım Çözüm

1
Evaluate pre-requisite resource capacity requirements
Identify target region quotas for GKE nodes, persistent disks, and IP allocations
Requesting quota adjustments ahead of time prevents resource allocation failures when scaling up secondary capacity during a drill.
2
Verify database continuous replication status and secondary readiness
Ensure replication lag between us-east4 and us-west1 complies with the RPO target (<1 min)
Maintaining continuous stream replication is essential to meet near-zero data loss requirements.
3
Execute synthetic health and data integrity validation
Confirm endpoints in us-west1 process queries accurately without errors
Synthetic testing verifies functionality before live user traffic is directed to the secondary region.

Anahtar Kavram

Disaster Recovery Validation and Pre-Failover Readiness Procedures
Soru 100Soru →

An online retail enterprise processes customer transaction data using backend microservices running on Google Cloud, storing the raw logs in BigQuery. The security team mandates two critical protections: first, authorized application service accounts must be strictly prevented from copying or exfiltrating BigQuery data to external, unauthorized Google Cloud projects; second, the public HTTPS entry point must be guarded against web application attacks, such as SQL injection, and volumetric rate abuses. Which TWO architectural controls should the Cloud Architect implement to satisfy these security requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a VPC Service Controls service perimeter that encompasses both the application and BigQuery projects, specifying the BigQuery API as a restricted service.; Deploy Cloud Armor security policies configured with preconfigured WAF rule sets and rate limiting attached to the Global External HTTP(S) Load Balancer backend services.

Cevap

The correct controls are establishing a VPC Service Controls service perimeter enclosing the application and BigQuery projects, and deploying Cloud Armor security policies on the Global External HTTP(S) Load Balancer backend services.
The solution requires a combination of perimeter data exfiltration defense and edge application filtering. Enclosing the application and BigQuery projects within a VPC Service Controls perimeter prevents data exfiltration across boundaries to unauthorized Google Cloud resources. Concurrently, Cloud Armor policies attached to the external HTTP(S) load balancer provide web application firewall capabilities and rate limiting against Layer 7 attacks.

Adım Adım Çözüm

1
Evaluate data exfiltration prevention requirements for Google Cloud APIs (BigQuery).
Identify that IAM permissions alone cannot prevent data movement to external projects, requiring network-level service perimeters.
VPC Service Controls blocks requests to restricted services (like BigQuery API) if the communication crosses the perimeter boundary, mitigating data exfiltration risks.
2
Evaluate Layer 7 web security and DDoS/rate-limiting requirements for the public endpoint.
Select Google Cloud Armor integrated with the Global External HTTP(S) Load Balancer.
Cloud Armor operates at the Google Cloud network edge, filtering malicious Layer 7 traffic and enforcing rate limits before requests hit backend application resources.
3
Analyze why alternate networking options fail.
Reject VPC Network Peering for routing API traffic through central appliances due to non-transitivity, and reject primitive IAM roles as insecure.
VPC Network Peering does not forward packets beyond the direct peer link (no transitivity), and primitive roles grant excess permissions.

Anahtar Kavram

Perimeter security using VPC Service Controls for exfiltration prevention and Cloud Armor edge policies for Layer 7 load balancer protection.
ÖncekiSayfa 5 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin