Examkin

Tüm alıştırma soruları

174 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 81Soru →

An enterprise logistics company is refactoring its automated software supply chain on Google Cloud. The architecture team requires a zero-trust CI/CD pipeline where deployment to Google Kubernetes Engine (GKE) is strictly gated by vulnerability analysis and cryptographic attestations via Binary Authorization. Arrange the pipeline stages in the correct execution order from initial source repository trigger to final cluster deployment.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct pipeline sequence begins with Cloud Build compiling and pushing the container image to Artifact Registry, followed by Container Analysis vulnerability scanning, followed by Cloud KMS attestation generation via Binary Authorization attestor credentials, and concludes with Cloud Deploy pushing to GKE where Binary Authorization enforces signature verification.
The proper end-to-end SDLC order follows the logical security boundary of building, scanning, signing, and deploying. First, code build creates an image digest in Artifact Registry. Second, Container Analysis evaluates the stored digest. Third, an attestor signs the validation result via Cloud KMS. Fourth, Cloud Deploy and GKE Binary Authorization validate the signature at admission time.

Adım Adım Çözüm

1
Identify the artifact creation phase
Cloud Build receives the repository trigger, builds the application container image, and pushes it to Artifact Registry to create an immutable image reference.
Security analysis and deployment targets require a central, immutable container digest stored in Artifact Registry before any validation can take place.
2
Analyze security compliance and vulnerability scanning
Container Analysis scans the image digest stored in Artifact Registry for CVEs and vulnerability compliance.
Attestations cannot be generated until the image is scanned and verified clean of blocking vulnerabilities.
3
Generate cryptographic attestation
Cloud Build uses an authorized attestor service account to sign an attestation payload using a Cloud KMS asymmetric key.
Attestations serve as digital signatures certifying that the build and scan pipeline stages completed successfully.
4
Enforce deployment policy gating
Cloud Deploy initiates deployment to GKE, where the GKE Binary Authorization admission controller verifies the cryptographic attestation signature before allowing pod creation.
Enforcement occurs at runtime admission; GKE blocks any container image deployment lacking valid attestations signed by the designated Cloud KMS key.

Anahtar Kavram

Software Supply Chain Security & CI/CD Gating with Binary Authorization
Soru 82Soru →

An organization wants to configure Workload Identity Federation to allow an on-premises application to access Google Cloud resources without using long-lived service account keys. In what sequence should the administrator perform the configuration steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins by establishing trust via the Workload Identity Pool and Provider, followed by provisioning the target Google Cloud service account with minimal IAM permissions. Next, grant the external workload identity permission to impersonate the service account using the Workload Identity User role, and finally configure the application to execute dynamic short-lived token exchange.
The proper administrative order follows standard identity federation setup: establish trust infrastructure first (Pool/Provider), create the destination GCP service account with least privilege permissions second, attach the impersonation binding (`roles/iam.workloadIdentityUser`) third, and lastly update application code to perform short-lived token exchanges.

Adım Adım Çözüm

1
Establish federation trust
Workload Identity Pool and Provider are created in Google Cloud.
Google Cloud must know how to validate tokens issued by the external identity provider before any authentication can take place.
2
Provision target identity
Dedicated Google Cloud service account created with least-privilege IAM roles.
Google Cloud resources require a native GCP identity (service account) to execute authorized API operations.
3
Grant impersonation rights
External workload identity granted roles/iam.workloadIdentityUser on the service account.
The external workload identity must explicitly receive permission to assume the identity of the GCP service account.
4
Configure application runtime token exchange
Application receives short-lived GCP access tokens dynamically.
The external application calls the Security Token Service (STS) to swap its local IDP token for a GCP credentials token.

Anahtar Kavram

Workload Identity Federation lifecycle configuration steps
Soru 83Soru →

An enterprise cloud architecture team is establishing a formal procedure to validate the scalability and performance of a critical Google Cloud workload prior to launch. Arrange the following steps of the technical solution testing procedure in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for testing and validating the technical solution is: 1. Define target SLOs and baseline performance metrics, 2. Provision an isolated non-production testing environment, 3. Execute synthetic load tests while monitoring metrics and quota utilization, and 4. Analyze test results against defined SLOs and optimize parameters.
A complete technical solution validation procedure requires defining measurable success criteria (SLOs) first, establishing an isolated test environment second, conducting load testing while monitoring telemetry third, and evaluating results to optimize configurations fourth.

Adım Adım Çözüm

1
Establish SLOs and performance baseline requirements.
Provides clear metric thresholds (e.g., p99 latency, throughput) to validate system behavior.
Validation cannot occur without knowing the success criteria upfront.
2
Deploy a mirrored non-production staging environment.
Produces a safe, isolated infrastructure that mimics production setup.
Prevents testing stress activities from interrupting live systems or altering production state.
3
Run synthetic stress and load tests while capturing telemetric data.
Reveals system bottlenecks, scaling behaviors, and regional GCP quota constraints under load.
Simulating real-world traffic reveals system constraints under stress.
4
Compare gathered telemetry against SLOs and apply remediations.
Ensures auto-scaling thresholds, resource sizing, and GCP quota limits meet readiness standards.
Closing the testing feedback loop verifies production readiness before actual deployment.

Anahtar Kavram

Structured Technical Solution Testing and Validation Procedures
Soru 84Soru →

An enterprise media streaming provider is executing a scheduled, non-disruptive disaster recovery (DR) validation procedure for its mission-critical workload hosted on Google Cloud. The application relies on Cloud Spanner for globally consistent state storage, Compute Engine Managed Instance Groups (MIGs) deployed across primary (`us-central1`) and failover (`us-east4`) regions, and Cloud DNS for global traffic routing. To ensure business continuity and satisfy compliance mandates without risking primary production operations, in what sequence should the cloud operations team execute the DR validation procedure steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct execution order for DR validation is: 1) Verify regional compute quotas in the failover region, 2) Validate Cloud Spanner cross-region replication against RPO targets, 3) Deploy isolated application test instances in the failover region, 4) Update Cloud DNS routing policies to measure RTO performance, and 5) Revert Cloud DNS routing to the primary region and tear down DR test resources.
A structured DR validation procedure follows a logical sequence: pre-flight resource/quota checks, data replication and RPO validation, isolated workload instantiation, traffic redirection for RTO assessment, and final failback cleanup. Requesting quotas first ensures target capacity exists. Validating RPO metrics prevents loss of data integrity. Running isolated test workloads protects production data. Updating DNS tests routing under test conditions, and restoring DNS followed by resource teardown concludes the procedure safely.

Adım Adım Çözüm

1
Pre-verify quota availability in target DR region.
Ensures secondary region target resources can scale to match primary production demand.
Quota increases in GCP require time for approval; failing to check quota beforehand causes catastrophic scaling failures during actual or simulated failover.
2
Inspect storage replication lag and confirm RPO thresholds.
Guarantees data loss bounds remain within business limits prior to state transitions.
Cloud Spanner replication metrics must be healthy before cutting over service traffic.
3
Provision isolated test workloads in secondary region.
Validates infrastructure-as-code scripts, environment configurations, and startup scripts.
Isolation prevents test traffic from corrupting active production databases.
4
Update Cloud DNS and monitor RTO.
Measures real end-to-end failover time.
Routing updates evaluate global resolution propagation speeds against target business RTO metrics.
5
Revert traffic routing and clean up temporary test artifacts.
Restores primary baseline operation and avoids lingering resource costs.
Failback validation closes out the simulation loop safely.

Anahtar Kavram

Disaster Recovery Validation Procedures
Soru 85Soru →

An enterprise architecture team needs to provision a mission-critical Cloud Bigtable instance to store real-time IoT telemetry data. The regulatory compliance framework requires that persistent data be encrypted using Customer-Managed Encryption Keys (CMEK) and that all database traffic remain isolated within the private network via Private Services Access (PSA). What is the correct sequence of steps to provision this storage infrastructure securely?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with creating the Cloud KMS key and granting the Encrypter/Decrypter role to the Cloud Bigtable Service Agent. Next, allocate an internal IP range and establish the Private Services Access VPC peering connection. Then, create the Cloud Bigtable instance referencing the CMEK key URI. Finally, configure and provision the cluster within the instance attached to the private network topology.
Provisioning database resources with custom encryption and private networking requires strict ordering of security and infrastructure dependencies. First, key access must be granted to the service agent so encryption verification succeeds during storage creation. Second, Private Services Access must be established so private IP addresses can be assigned to the instance nodes. Third, the instance is created referencing the CMEK key. Finally, the cluster is provisioned within the created instance and connected to the private network topology.

Adım Adım Çözüm

1
Configure CMEK and IAM permissions
Cloud Bigtable Service Agent possesses necessary permissions to access the KMS CryptoKey.
GCP service APIs reject storage resource provisioning if the service account cannot access the specified CMEK key.
2
Establish Private Services Access (PSA)
IP allocation and Service Networking VPC peering connection created between VPC and Google producer network.
Private connectivity requires pre-allocated CIDR blocks to avoid address collisions when provisioning cluster endpoints.
3
Provision the Cloud Bigtable instance using CMEK
Bigtable instance created with persistent disks bound to the KMS key.
Instance creation references the pre-configured CMEK key URI established in Step 1.
4
Deploy and finalize cluster parameters
Cluster initialized with target node count and storage type inside the private VPC network.
Cluster topology deployment relies on both the active instance shell and established Private Services Access network.

Anahtar Kavram

Dependency ordering for GCP database provisioning with CMEK encryption and Private Services Access
Soru 86Soru →

A global smart grid utility provider hosts its real-time telemetry processing platform on Google Cloud. The primary production environment runs in us-central1, with us-east4 designated as the disaster recovery (DR) region. The enterprise requires a non-disruptive, periodic DR validation exercise to verify that Recovery Point Objective (RPO < 15 minutes) and Recovery Time Objective (RTO < 1 hour) are met. In what correct sequential order should the Cloud Architect execute the DR validation procedure?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct procedural order is: (1) Verify regional resource quotas in us-east4, (2) Provision Compute Engine capacity reservations in us-east4, (3) Create an isolated testing VPC and promote read-only database replicas, (4) Execute synthetic workload smoke tests to validate RPO and RTO metrics, and (5) Tear down test infrastructure and document validation metrics.
A structured disaster recovery validation procedure must follow a strict dependency order. First, cloud quota prerequisites must be verified and adjusted because quota increases require administrative processing time. Second, capacity reservations must be created in the target region to guarantee that hardware is available. Third, an isolated environment (VPC and database snapshots/replicas) must be established so that testing does not impact live operations. Fourth, synthetic tests are run within the sandbox to measure RPO/RTO against target objectives. Finally, test infrastructure is dismantled to prevent unnecessary spend, and audit logs are archived.

Adım Adım Çözüm

1
Audit and request regional quota increases in the target DR region.
Ensures the project has sufficient quota headroom for compute, networking, and storage resources.
Quota adjustments may take time to process; attempting to provision resources without sufficient quota will fail.
2
Acquire Compute Engine capacity reservations in the DR region.
Guarantees compute capacity is reserved in target zones regardless of regional demand.
Without reservations, resource availability cannot be guaranteed during regional outages or large-scale DR drills.
3
Set up an isolated sandbox network and populate it with test data replicas/snapshots.
Creates a safe environment mirroring production state up to the target RPO.
Isolation prevents test traffic or data writes from corrupting primary production systems.
4
Run validation tests and measure RTO/RPO metrics.
Empirically verifies that failover automation meets recovery requirements.
Provides actual metrics on startup duration, database sync integrity, and service availability.
5
Decommission test resources and log exercise evidence.
Optimizes costs by removing temporary infrastructure and satisfies enterprise compliance requirements.
Temporary test resources should be cleaned up immediately following test completion.

Anahtar Kavram

Disaster Recovery Validation Sequence and Non-Disruptive Testing Procedures
Soru 87Soru →

A healthcare enterprise is establishing an automated, zero-trust software delivery pipeline on Google Cloud. The architecture must automatically build, scan, certify, and deploy microservice container updates to a production Google Kubernetes Engine (GKE) cluster. In what sequential order should the CI/CD pipeline execute these operational stages from code check-in to production deployment?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with Cloud Build constructing the container image, followed by Artifact Analysis performing vulnerability scans, storing the image and signing an attestation in Artifact Registry, enforcing security policies through Binary Authorization, and concluding with Cloud Deploy releasing the image to GKE.
The sequence reflects Google Cloud secure software supply chain best practices: first, Cloud Build packages the application; second, Artifact Analysis performs vulnerability scanning; third, the artifact is stored in Artifact Registry with a signed attestation; fourth, Binary Authorization verifies the attestation signature against organizational policy; and fifth, Cloud Deploy delivers the image to production GKE.

Adım Adım Çözüm

1
Trigger continuous integration and build artifact
Cloud Build compiles source code into a runnable container image.
The source code must be packaged into a container artifact before security scanning can begin.
2
Execute automated security vulnerability analysis
Artifact Analysis scans the container layers for known vulnerabilities.
Security scanning must occur before certifying that an image is safe for environment promotion.
3
Persist image artifact and sign cryptographic attestation
Container image is pushed to Artifact Registry alongside a KMS-signed attestation.
Attestations provide tamper-proof proof that security compliance gates were passed.
4
Enforce container deployment policies
Binary Authorization verifies that valid attestations exist before allowing deployment.
Policy enforcement prevents unsigned or non-compliant images from reaching GKE cluster nodes.
5
Execute progressive release pipeline
Cloud Deploy manages the canary rollout to the production GKE cluster.
Actual deployment execution is the final step in the continuous delivery pipeline.

Anahtar Kavram

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines
Soru 88Soru →

An enterprise cloud architecture team at a global aviation safety oversight agency is developing a regulatory compliance analytics platform. Place the architectural design phases in the correct sequential order, starting from the highest conceptual abstraction down to concrete Google Cloud infrastructure deployment.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with defining conceptual business domain entities and compliance rules, followed by designing logical service boundaries and technology-agnostic data flows, then mapping logical components to specific Google Cloud products, and finally specifying detailed physical IaC parameters like subnets, IAM bindings, and CMEK settings.
The standard enterprise architecture lifecycle progresses hierarchically from Conceptual (defining business entities, governance goals, and regulatory boundaries) to Logical (defining functional data flows, service boundaries, and security domains independent of technology choices), followed by Physical Product Mapping (matching logical blocks to GCP offerings like Pub/Sub, Dataflow, and BigQuery), and concluding with Physical Configuration Specification (specifying exact IaC code, subnets, IAM, and encryption keys).

Adım Adım Çözüm

1
Identify the Conceptual Architecture phase
Established business rules, domain data definitions, and compliance requirements without technical or vendor commitments.
Architecture planning must begin by capturing business intent and governance boundaries before determining technical design.
2
Identify the Logical Architecture phase
Created component boundaries, data processing flows, and security zones independently of cloud providers.
Logical modeling structures functional capabilities and relationships without tying the design to specific physical services.
3
Identify the Physical Resource Selection phase
Selected concrete GCP services (Pub/Sub, Dataflow, BigQuery) matching logical requirements.
Physical design translates vendor-agnostic functional blocks into actual target cloud service implementations.
4
Identify the Physical Infrastructure Provisioning phase
Formulated IaC manifests containing specific VPC subnets, IAM permissions, and CMEK encryption keys.
Detailed physical configuration parameters are required for deployment automation, operational management, and security enforcement.

Anahtar Kavram

Sequential Translation from Conceptual to Logical and Physical Architectures
Tahmini Süre:1m 30s
Soru 89Soru →

An enterprise security team is establishing access governance for a new Google Cloud deployment. In what top-down order should an administrator perform these steps to implement resource hierarchy and IAM permissions according to Google Cloud best practices?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence configures governance top-down starting at the Organization node, establishing Folders for structural grouping, creating Projects within those folders, and finally applying granular least-privilege IAM bindings at the Project or Resource level.
Google Cloud access governance flows down the resource hierarchy: Organization → Folders → Projects → Resources. Defining baseline controls at the Organization level ensures global policy enforcement. Creating Folders allows environment-level grouping. Provisioning Projects provides the compute/storage containers. Finally, assigning granular IAM roles at the Project or Resource level achieves least privilege.

Adım Adım Çözüm

1
Configure top-level policy constraints and organization-wide IAM policies at the Organization node.
Establishes baseline security boundaries that inherit across all descendant resources.
Governance best practices require establishing high-level security controls before workload resources are created.
2
Construct environment or department Folders under the Organization node.
Organizes projects into manageable administrative units.
Folders allow applying common IAM roles and organization policies to groups of projects.
3
Deploy individual GCP Projects inside the folder hierarchy.
Provides discrete containers for hosting GCP services and resources.
Projects must exist within folders before service APIs can be enabled and workloads deployed.
4
Assign fine-grained predefined or custom IAM roles at the Project or specific Resource level.
Enforces least-privilege access control tailored to workload needs.
Specific permissions should be granted at the most targeted resource boundary to prevent overly broad privilege propagation.

Anahtar Kavram

Google Cloud Resource Hierarchy and IAM Inheritance Governance
Soru 90Soru →

An enterprise platform engineering team is preparing an automated pipeline to deploy a secure Cloud SQL for PostgreSQL database instance. The solution must strictly enforce network isolation using Private Service Access and enforce data encryption at rest using a Customer-Managed Encryption Key (CMEK). In what sequence should the cloud architect arrange the implementation steps to provision this infrastructure successfully without service dependency failures?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct provisioning order requires setting up security and network dependencies prior to resource creation: first create and authorize the KMS key, second allocate private IP peering via Private Service Access, third provision the Cloud SQL instance referencing the key and network, and finally create internal databases and user credentials.
The correct sequence respects resource dependencies in Google Cloud. Configuring the Cloud KMS key and granting necessary IAM permissions to the Cloud SQL Service Agent is required first so the API can validate key access. Establishing Private Services Access (VPC peering and private IP allocation) is required second so the private IP interface can be bound. Provisioning the Cloud SQL instance referencing both the network and the CMEK key comes third. Finally, creating logical database schemas and application users inside the instance comes last because these resources depend on the active instance engine.

Adım Adım Çözüm

1
Configure encryption infrastructure and IAM permissions
Cloud KMS CryptoKey is created and the Cloud SQL Service Agent ([email protected]) has permissions to encrypt and decrypt.
Cloud SQL API calls specify the CMEK key during creation; if the service agent lacks permissions at creation time, deployment fails immediately.
2
Set up private networking infrastructure
Internal IP block is reserved in the VPC and VPC Network Peering is established with Google's Service Networking tenant project.
Private Service Access must exist for Cloud SQL to assign a private IP address from the designated range.
3
Execute Cloud SQL instance creation
Cloud SQL instance is created in a private subnet, encrypted with CMEK.
Both prerequisites (network peering and KMS permissions) are satisfied, allowing the instance resource to instantiate.
4
Configure databases and application users
PostgreSQL database schemas and user identities are configured.
Logical database structures exist inside the database instance and can only be created on a running instance.

Anahtar Kavram

Dependency-Ordered Cloud Provisioning for CMEK and Private Service Access
Soru 91Soru →

A national utility enterprise operates a mission-critical automated smart power grid monitoring system on Google Cloud. The primary workload runs in region us-central1 with a warm standby deployment in us-east4. To satisfy regulatory compliance, you are designing a periodic disaster recovery (DR) validation procedure to test regional failover while ensuring zero impact to live production telemetry and verifying adherence to strict Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets. What is the correct sequential order of steps required to execute this DR validation drill safely and effectively?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins by verifying regional quotas and capacity reservations in us-east4, followed by isolating test data with a database clone, promoting the standby database in the test environment, routing synthetic traffic to the secondary region endpoints, and finally running automated validation suites to measure RTO and RPO compliance.
A structured DR validation procedure requires verifying resource availability (quotas and capacity reservations) in the target region first, establishing isolated data environments to prevent production corruption second, promoting secondary database resources third, steering synthetic validation traffic fourth, and evaluating actual RTO/RPO metrics fifth.

Adım Adım Çözüm

1
Verify target region quotas and compute capacity reservations
Guarantees that us-east4 has sufficient quota and instance capacity available before initiating failover operations.
Failing to check quotas beforehand can result in quota exhaustion or insufficient instance capacity during DR execution.
2
Establish an isolated test environment with cloned state
Decouples validation activities from production data streams.
Prevents accidental data overwrites or production corruption during validation testing.
3
Promote the standby database instance in the isolated test environment
Simulates primary database failover and enables precise measurement of replication lag.
Validates failover automation logic and provides empirical RPO measurements.
4
Reconfigure network routing to direct synthetic traffic to the failover target
Directs synthetic workloads through Cloud Load Balancing and Cloud DNS to the promoted endpoints.
Tests end-to-end networking, DNS propagation, and load balancing configurations under load.
5
Execute end-to-end validation test suites and record RTO/RPO metrics
Confirms system functionality and verifies compliance with recovery metrics.
Provides official verification that the DR plan meets business continuity requirements.

Anahtar Kavram

Disaster Recovery Validation Procedures and Sequencing in Google Cloud
Soru 92Soru →

An enterprise healthcare provider hosts its telemedicine platform on Google Cloud across a primary region (us-central1) and a disaster recovery region (us-east4). You are developing a formal procedure for routine disaster recovery validation to ensure business continuity goals are met without disrupting live operations. What is the correct sequence of steps to conduct this non-disruptive validation test?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with verifying secondary region quotas and capacity reservations, followed by configuring an isolated test environment, executing the synthetic failover, validating RPO/RTO metrics against SLOs, and finally cleaning up test resources and recording audit logs.
A robust DR validation procedure starts by ensuring hardware capacity and quota availability in the target region. Next, an isolated environment is created to avoid impacting live operations. Once isolated, the synthetic failover is executed, performance metrics (RPO/RTO) are verified against business SLOs, and finally, resources are cleaned up and compliance logs are recorded.

Adım Adım Çözüm

1
Verify regional quota limits and pre-reserve compute capacity in us-east4.
Guarantees that the secondary region has sufficient capacity and quota to support failover workloads during testing.
Failing to check quota and capacity reservations first leads to unexpected provisioning failures during failover testing.
2
Establish network isolation and non-production state boundaries for validation.
Prevents synthetic test transactions from contaminating live patient data or altering production traffic flows.
DR validation procedures for live platforms must strictly segregate validation activity from production systems.
3
Trigger automated failover processes for synthetic test workloads to us-east4.
Simulates real-world failure conditions and measures automated failover response.
Failover execution requires an isolated and pre-provisioned environment.
4
Evaluate RPO, RTO, and data integrity metrics against business continuity SLOs.
Confirms whether the DR procedure satisfies corporate SLA/SLO requirements under failover conditions.
Metrics verification can only occur while the system operates under failover conditions.
5
Decommission validation infrastructure, restore initial configuration, and publish BCP compliance logs.
Returns infrastructure to standard state and records compliance evidence.
Cleanup and documentation naturally conclude the disaster recovery validation workflow.

Anahtar Kavram

Disaster Recovery Validation & Failover Execution Sequence
Soru 93Soru →

Place the standard stages of a Google Cloud native CI/CD deployment pipeline for containerized applications in the correct sequential order, starting from the developer code commit to the final application deployment.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequential flow for a GCP containerized CI/CD pipeline is: 1) A developer commits code changes to trigger Cloud Build; 2) Cloud Build compiles source code and builds the container image; 3) Cloud Build pushes the container image to Artifact Registry; 4) Cloud Deploy deploys the container image to the target GKE cluster.
The standard sequence follows continuous integration to continuous delivery practices: source repository updates trigger Cloud Build to compile and test code, the resulting artifact is registered in Artifact Registry, and Cloud Deploy manages release promotion to the target compute environment.

Adım Adım Çözüm

1
Identify the event that initiates the CI/CD pipeline
Code commitment to the repository acts as the entry trigger.
CI/CD automation begins with source code changes.
2
Determine the artifact build and testing phase
Cloud Build executes compilation, testing, and container packaging.
Source code must be converted into a runnable container image.
3
Identify artifact storage management
The compiled container image is uploaded to Artifact Registry.
Deployment services require a centralized, versioned registry to pull deployment images.
4
Determine the release deployment phase
Cloud Deploy orchestrates rolling out the stored image to GKE.
The final stage of CD is runtime deployment to operational infrastructure.

Anahtar Kavram

Google Cloud CI/CD Pipeline Execution Flow
Tahmini Süre:1m 0s
Soru 94Soru →

Your organization is establishing a secure SDLC pipeline on Google Cloud to ensure that only verified, vulnerability-scanned container images are deployed to Google Kubernetes Engine (GKE). Place the following CI/CD pipeline stages in the correct execution sequence from initial code build to production container deployment.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct pipeline sequence begins with Cloud Build compiling code and building the image using a least-privilege custom service account, followed by pushing the image to Artifact Registry to trigger Container Analysis. Next, an attestation authority validates scan results and cryptographically signs a Binary Authorization attestation. Finally, Cloud Deploy triggers GKE deployment, where Binary Authorization verifies the attestation before container pods launch.
The standard secure CI/CD delivery pipeline follows a precise lifecycle sequence: 1) Source compilation and container image generation using custom least-privilege service accounts. 2) Artifact registration in Artifact Registry with automated vulnerability scanning via Container Analysis. 3) Attestation generation by signing the image digest once vulnerability checks pass. 4) Deployment triggering via Cloud Deploy with Binary Authorization enforcement on the target GKE cluster.

Adım Adım Çözüm

1
Build container artifact
Container image created via Cloud Build using a dedicated least-privilege service account
Source code must be compiled and packaged before scanning or attestation.
2
Store and scan container image
Image stored in Artifact Registry with Container Analysis scanning enabled
Artifact Registry provides secure storage and automatically executes vulnerability scans on new image digests.
3
Generate security attestation
Binary Authorization attestation signed by an attestor key pair
Security governance requires cryptographic verification of scan compliance prior to deployment.
4
Enforce admission policy at deployment
GKE admission controller validates attestation before Pod execution
Binary Authorization blocks unsigned or unverified container images from running in production.

Anahtar Kavram

Software Supply Chain Security & CI/CD Pipeline Order
Soru 95Soru →

An enterprise cloud architecture team for a global satellite imagery provider is designing a new cloud solution architecture on Google Cloud to ingest, process, store, and distribute petabyte-scale earth observation data. To ensure alignment with enterprise architecture standards, the team must translate business requirements progressively through conceptual, logical, and physical architecture design phases. Arrange the architectural design activities in the correct sequential order from initial conceptual abstraction down to physical infrastructure enforcement.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with defining high-level business capabilities and domains (conceptual architecture), followed by mapping capabilities into vendor-agnostic logical tiers and data flows (logical architecture), then selecting specific concrete Google Cloud services (physical architecture selection), and finally authoring Infrastructure as Code templates to configure detailed networks, IAM, CMEK, and security perimeters (physical implementation).
Enterprise cloud architecture design strictly flows top-down: Conceptual Architecture (defining business capabilities and domains without technology dependencies) -> Logical Architecture (structuring data flows, component boundaries, and security trust zones) -> Physical Architecture Selection (mapping logical tiers to specific Google Cloud services like GKE, BigQuery, Cloud Storage) -> Physical Implementation (authoring IaC code for exact subnets, CMEK, IAM, and VPC Service Control perimeters).

Adım Adım Çözüm

1
Identify the Conceptual Architecture step
Defining high-level business capabilities, functional domains, and technology-agnostic boundaries forms the initial conceptual blueprint.
Conceptual architectures establish 'what' the business system does independent of implementation details or vendor choices.
2
Identify the Logical Architecture step
Mapping conceptual capabilities into logical service tiers, decoupled data flows, and trust zones establishes the logical design.
Logical architectures define structural relationships, data flow models, and component boundaries prior to selecting specific technologies.
3
Identify the Physical Component Selection step
Selecting specific Google Cloud managed services (e.g., Cloud Storage, Pub/Sub, GKE Autopilot, BigQuery) translates logical tiers into physical technology choices.
Physical architecture translates logical constructs into specific cloud products, resource configurations, and vendor technologies.
4
Identify the Physical Implementation & Guardrails step
Authoring IaC scripts to provision subnets, private Service Connect endpoints, CMEK keys, and VPC Service Control perimeters completes the physical instantiation.
Detailed deployment artifacts and security perimeters represent the final executable state of physical architecture.

Anahtar Kavram

Progressive Architectural Abstraction: Conceptual to Logical to Physical Architecture
Soru 96Soru →

An enterprise cloud security architect is documenting how Google Cloud IAM calculates effective access permissions when a service account attempts to read an object stored in a Cloud Storage bucket. Arrange the steps of the IAM policy evaluation process in the correct chronological order from initial API request submission to the final access determination.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence evaluates IAM permissions top-down along the resource hierarchy: Request initiation -> Organization root evaluation -> Folder hierarchy evaluation -> Project level evaluation -> Resource policy evaluation and final union calculation.
Google Cloud IAM evaluates permissions top-down starting from the API request receipt, proceeding from the Organization root down through Folders, Project, and finally Resource-level policies. Effective access is determined by combining all permissions granted along the hierarchy path.

Adım Adım Çözüm

1
Submit API Request
The API call containing identity context and desired permission is received by Google Cloud services.
Evaluation begins only after an authenticated call specifies a target operation.
2
Evaluate Organization Root Policies
Permissions granted at the top-level Organization node are gathered.
GCP IAM permission inheritance starts at the top ancestor of the resource tree.
3
Evaluate Folder Nodes
Permissions granted across parent folders and sub-folders are gathered.
Permissions inherit down through intermediate folder nodes in the resource hierarchy.
4
Evaluate Project Node
Permissions granted at the Project level are gathered.
Project-level policy bindings apply to all resources residing within that project.
5
Evaluate Resource Policies & Determine Access
Effective permissions across all levels are combined to make an allow or deny authorization decision.
IAM permissions are additive down the hierarchy, with explicit deny policies taking precedence.

Anahtar Kavram

GCP IAM Resource Hierarchy Evaluation and Permission Inheritance
Soru 97Soru →

An enterprise security architecture team needs to establish automated rotation for a database password stored in Google Cloud Secret Manager. The workflow must use Cloud Pub/Sub and a Cloud Function to automatically generate, test, and store new password versions every 90 days according to least privilege principles. In what order should the administrative steps be performed to configure this automated rotation pipeline?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The sequence of administrative steps must be: First, grant the Secret Manager Service Agent the Pub/Sub Publisher role on the notification topic. Second, deploy the rotator Cloud Function with a dedicated user-managed service account. Third, grant the rotator service account Secret Manager Secret Version Adder and Secret Accessor roles on the secret. Fourth, configure the rotation schedule and Pub/Sub topic on the target Secret Manager secret.
Configuring automated rotation in Secret Manager requires enabling infrastructure permissions prior to activating schedules. First, the Google-managed Secret Manager service agent requires `roles/pubsub.publisher` on the target Pub/Sub topic so rotation events can be emitted. Second, the rotation worker code (Cloud Function) and its dedicated service account must be deployed. Third, that dedicated service account must be granted least privilege permissions (`roles/secretmanager.secretVersionAdder` and `roles/secretmanager.secretAccessor`) on the secret resource. Finally, attaching the rotation schedule and Pub/Sub topic to the secret starts the timer and completes the pipeline.

Adım Adım Çözüm

1
Authorize Secret Manager Service Agent for Pub/Sub notification publishing
Secret Manager has permission to emit rotation topics.
Secret Manager uses a Google-managed service agent to send event notifications when rotation periods elapse.
2
Deploy the rotation Cloud Function with a custom service account identity
Rotator endpoint and identity are provisioned.
The function logic handles generating new database credentials and executing rotation tests.
3
Assign least privilege IAM roles to the rotator service account
Rotator function identity can add new secret versions without administrative privileges.
Applying specific Secret Manager roles ensures the function can fetch existing secrets and write newly rotated payload versions.
4
Attach rotation period and Pub/Sub topic parameters to Secret Manager secret metadata
Automated 90-day rotation trigger is active.
Configuring the secret schedule is the final step once target topics and execution workers are fully authorized.

Anahtar Kavram

Secret Manager Automated Rotation Architecture and IAM Authorization Lifecycle
Soru 98Soru →

You need to configure your local development environment to authenticate programmatic interactions with Google Cloud APIs using Application Default Credentials (ADC) via service account impersonation, avoiding the use of long-lived downloaded service account keys. In what sequence should you execute these configuration steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins by authenticating your user identity (`gcloud auth login`), granting your identity the Service Account Token Creator role on the service account, and finally generating Application Default Credentials configured with service account impersonation (`gcloud auth application-default login --impersonate-service-account`).
To establish secure local programmatic access using Application Default Credentials without downloading long-lived keys, you must first authenticate your user identity, ensure your identity holds the Service Account Token Creator role on the target service account, and then generate ADC with the impersonation flag active.

Adım Adım Çözüm

1
Authenticate user identity.
Establishes active user credentials in the local Google Cloud CLI context.
Impersonation requires an existing authenticated primary principal to initiate token requests.
2
Assign the Service Account Token Creator IAM role.
Grants permission for the user identity to generate short-lived tokens for the service account.
Without `roles/iam.serviceAccountTokenCreator`, API calls requesting impersonated credentials will fail authorization checks.
3
Generate Application Default Credentials (ADC) with impersonation.
Writes a local ADC credentials file configured to mint temporary service account access tokens automatically.
This allows client SDKs using ADC to authenticate securely as the service account without exposing static JSON key files.

Anahtar Kavram

Programmatic GCP SDK Authentication using Application Default Credentials (ADC) and Service Account Impersonation
Soru 99Soru →

A cloud platform team needs to deploy a Cloud SQL for PostgreSQL database instance with Private Services Access (PSA) and Customer-Managed Encryption Keys (CMEK). Arrange the operational steps in the correct order to provision this infrastructure successfully.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with establishing Private Services Access, followed by granting IAM permissions for Cloud KMS to the Cloud SQL service agent, provisioning the CMEK-encrypted database instance over private IP, and concluding with database connectivity verification.
Provisioning database infrastructure with Private Services Access (PSA) and Customer-Managed Encryption Keys (CMEK) follows strict prerequisite ordering: network connectivity and IAM key permissions must exist before creating the dependent database instance, with post-provisioning connectivity checks executed last.

Adım Adım Çözüm

1
Allocate IP address ranges and configure Private Services Access VPC peering.
The VPC network is connected to Google service networking infrastructure.
Cloud SQL requires Private Services Access peering to assign private IP addresses within the VPC.
2
Assign roles/cloudkms.cryptoKeyEncrypterDecrypter to the Cloud SQL service account.
Cloud SQL service identity gains access rights to encrypt and decrypt using the specified Cloud KMS key.
Attempting to create a CMEK-enabled instance will fail at creation time if the service agent lacks KMS permissions.
3
Create the Cloud SQL instance specifying the private network connection and CMEK key URI.
The database instance is provisioned with customer-managed encryption and private IP networking.
This step relies on the pre-existing private network peering and encryption identity rights.
4
Verify database endpoint accessibility from authorized client instances in the VPC.
Operational readiness and network security controls are validated.
Testing private connectivity is the final validation phase of database provisioning.

Anahtar Kavram

Cloud SQL Provisioning Dependency Ordering with PSA and CMEK
Soru 100Soru →

A cloud architect is establishing a standard operating procedure for validating disaster recovery (DR) failover from a primary GCP region (us-central1) to a secondary region (us-east4) for an enterprise application. In what sequence should the architect execute the following steps to perform a safe and successful DR failover test?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence for DR failover validation is: 1) Verify quota availability in the secondary region, 2) Validate data replication and promote the secondary database replica, 3) Reconfigure load balancing and DNS to route traffic to the secondary region, and 4) Run synthetic end-to-end integration tests to confirm operational readiness.
The proper disaster recovery validation sequence follows a dependency-driven path: first, pre-flight capacity and quota checks ensure the target environment can host the workload. Next, data integrity is verified and storage replicas are promoted to primary read-write status. Once the application backend and database are fully operational, network load balancing and DNS routing are updated to shift live traffic. Finally, synthetic end-to-end tests validate system health and compliance with RTO/RPO objectives.

Adım Adım Çözüm

1
Pre-verify Compute Engine quota limits and resource reservations in the DR region (us-east4).
Confirms that target region capacity is guaranteed before initiating failover procedures.
Attempting failover without verified quota risks instance spin-up failures during critical migration steps.
2
Check database replication lag and promote the us-east4 replica to a standalone read-write primary instance.
Establishes an active, writable persistence layer in the secondary region.
Application services cannot process stateful transactions until the underlying database is promoted and ready.
3
Modify Cloud DNS routing records and update Cloud Load Balancing backend services to target us-east4 instance groups.
Inbound user traffic is successfully redirected to the secondary region.
Traffic cutover must only occur after compute and data layers in the target region are fully operational.
4
Run synthetic user workflows and automated integration test suites to measure application performance against established RTO and RPO targets.
Validates business continuity objectives and confirms system stability under live workload.
Post-cutover verification is essential to verify that the DR environment meets business SLAs.

Anahtar Kavram

Disaster Recovery Validation Procedures and Operational Execution Order
ÖncekiSayfa 5 / 9Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin