Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 1001Soru →

An enterprise architecture team is designing an automated CI/CD pipeline on Google Cloud using Cloud Build to provision infrastructure via Terraform across multiple landing zone projects. The governance team mandates three strict security and operational constraints:
1. Build execution and state management must occur within an isolated network perimeter to prevent arbitrary internet access and exfiltration of state data.
2. Terraform state must be protected against concurrency conflicts and inadvertent corruption during parallel pipeline executions.
3. Developers triggering pipeline runs must be able to initiate deployments without being granted administrative access over the execution service accounts or direct write permissions on target project resources.

Which TWO architectural decisions and IAM security controls should the architect implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Run build steps using Cloud Build Private Pools peered with a private VPC enclosed inside a VPC Service Controls perimeter, and configure the Terraform backend using Cloud Storage with Object Versioning and state locking enabled.; Assign the Service Account User role (roles/iam.serviceAccountUser) on the dedicated deployment service account to the Cloud Build service agent, while granting developers only the Cloud Build Build Editor role to submit triggers.

Cevap

The architect should configure Cloud Build Private Pools inside a VPC Service Controls perimeter paired with a Cloud Storage backend leveraging state locking and object versioning, and grant the Service Account User role on the execution identity specifically to the Cloud Build service identity while granting developers only Cloud Build trigger execution roles.
Secure deployment pipeline design on Google Cloud requires separating developer execution privileges from resource management privileges, isolating worker infrastructure, and ensuring state integrity. Utilizing Cloud Build Private Pools peered to a VPC within a VPC Service Controls perimeter satisfies network isolation and prevents exfiltration of sensitive infrastructure code and state data. Remote state stored in Cloud Storage with Object Versioning and state locking guarantees protection against concurrent mutation. Using service account impersonation by granting `roles/iam.serviceAccountUser` to the Cloud Build service agent ensures developers only trigger builds without direct rights to target resources or service account management.

Adım Adım Çözüm

1
Evaluate network isolation and exfiltration controls for build runners.
Identify that default Cloud Build public worker pools cannot connect to private VPC networks without Private Pools. Enclosing Private Pools inside a VPC Service Controls perimeter enforces strict network boundaries against data exfiltration.
Meets the first requirement for isolated network build execution.
2
Establish secure Infrastructure as Code (IaC) state backend governance.
Configure Cloud Storage with Object Versioning and state locking enabled for the Terraform backend.
Prevents race conditions, state file corruption from simultaneous applies, and enables rollback to previous state versions if needed.
3
Configure least-privilege IAM access control for developer triggers and service account impersonation.
Grant developers minimal roles (Cloud Build Build Editor) to execute pipeline triggers. Grant `roles/iam.serviceAccountUser` on the target deployment service account to the Cloud Build service agent.
Allows Cloud Build to impersonate the deployment identity securely without granting developers direct administrative privileges over service accounts or target infrastructure.

Anahtar Kavram

Enterprise CI/CD Security with Cloud Build Private Pools, Remote Terraform State Locking, and IAM Service Account Impersonation
Soru 1002Soru →

A enterprise financial institution requires a centralized logging and observability architecture across all Google Cloud projects within its Organization hierarchy. The architecture must automatically aggregate logs from all present and future projects under the organization folder without manual project-level configuration. Compliance rules require that Administrative Activity audit logs be retained for seven years in an immutable state resistant to deletion, while application and operational logs must be available for real-time querying in BigQuery for 90 days. Furthermore, all log routing destinations must be protected against data exfiltration across perimeter boundaries. Which architectural strategy best satisfies these operational reliability, compliance, and security requirements?

Cevabı ve açıklamayı göster

Cevap: Configure an Organization-level aggregated Log Router sink with an inclusion filter targeting a Pub/Sub topic in a central Security project within a VPC Service Controls perimeter; stream logs from Pub/Sub to BigQuery for real-time analysis and to a Cloud Storage bucket with a locked Bucket Lock Retention Policy for 7-year audit retention.

Cevap

Configure an Organization-level aggregated Log Router sink targeting Pub/Sub in a dedicated security project enclosed within a VPC Service Controls perimeter, streaming to BigQuery for 90-day analytics and to Cloud Storage with a locked Retention Policy for 7-year immutable audit storage.
The solution utilizing an Organization-level aggregated Log Router sink ensures all child projects (present and future) are captured automatically. Streaming through Pub/Sub allows fan-out ingestion into BigQuery for 90-day real-time analytics and into Cloud Storage with Bucket Lock for 7-year immutable compliance storage. Protecting the security project with a VPC Service Controls perimeter satisfies security requirements against data exfiltration.

Adım Adım Çözüm

1
Evaluate organization-wide capture requirement
Identify that an Organization-level aggregated Log Router sink (using `includeChildren = true`) is required to automatically capture logs from all current and future projects.
Project-level sinks require manual setup for each new project, failing automated governance requirements.
2
Evaluate long-term audit immutability compliance
Select Cloud Storage with Bucket Lock enabled for 7-year retention.
Bucket Lock enforces retention policies that prevent deletion or modification of objects, satisfying regulatory compliance.
3
Evaluate real-time analytics and security perimeter controls
Route logs through Pub/Sub into BigQuery within a VPC Service Controls perimeter.
Pub/Sub buffers data for multi-destination streaming (BigQuery and Cloud Storage), while VPC Service Controls prevents unauthorized data exfiltration across project boundaries.

Anahtar Kavram

Organization-level aggregated log sinks paired with Pub/Sub, BigQuery, immutable Cloud Storage retention policies, and VPC Service Controls perimeters.
Tahmini Süre:3m 0s
Soru 1003Soru →

A healthcare software company is deploying a patient portal microservice on Google Kubernetes Engine (GKE) and storing build images in Artifact Registry. The security architecture team must implement automated security controls to satisfy two key governance requirements: (1) prevent the deployment of container images into the GKE cluster if they contain unresolved critical vulnerabilities, and (2) detect runtime security threats within running containers—such as reverse shells or unexpected binary executions—without installing custom third-party agent software on the underlying GKE node instances. Which Google Cloud solution meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Enable Container Analysis vulnerability scanning with Binary Authorization policies to enforce image deployment rules, and activate Security Command Center Premium Container Threat Detection for agentless runtime monitoring.

Cevap

Enable Container Analysis vulnerability scanning with Binary Authorization policies to enforce image deployment rules, and activate Security Command Center Premium Container Threat Detection for agentless runtime monitoring.
The combination of Container Analysis and Binary Authorization ensures that images uploaded to Artifact Registry are automatically scanned for vulnerabilities and blocked at deployment time if policy constraints are violated. Meanwhile, Security Command Center (SCC) Premium Container Threat Detection monitors GKE workloads natively without requiring third-party agents, meeting the requirement for agentless runtime threat detection.

Adım Adım Çözüm

1
Identify the mechanism for container vulnerability scanning and deployment gatekeeping.
Container Analysis automatically scans images stored in Artifact Registry, and Binary Authorization validates image metadata and vulnerability attestations before allowing deployment to GKE.
This guarantees that non-compliant images containing critical vulnerabilities are blocked prior to pod creation.
2
Identify the mechanism for agentless container runtime threat detection.
Security Command Center (SCC) Premium Container Threat Detection analyzes GKE container runtime events without requiring host-level agents.
It detects threats such as reverse shells, unauthorized binaries, and suspicious executions directly at the platform/kernel level.

Anahtar Kavram

Container Security Pipeline & Runtime Threat Detection
Tahmini Süre:1m 30s
Soru 1004Soru →

An enterprise financial application hosted on Compute Engine Regional Managed Instance Groups (MIGs) serves global production traffic behind a Global External Application Load Balancer. The platform engineering team uses an automated CI/CD pipeline to perform blue-green deployments for zero-downtime application updates. The application relies on a Cloud Spanner database whose schema was updated prior to the release using additive, backward-compatible migrations. During the execution of the pipeline, the deployment halts in the provisioning phase while creating the green MIG in the `us-central1` region—before any production traffic is shifted—because instance creation exceeds allowed limits. Which root cause explains why the green environment provisioning failed, and what is the architecturally sound remediation strategy to successfully execute the deployment?

Cevabı ve açıklamayı göster

Cevap: The deployment failed because provisioning a full-capacity green environment alongside the active blue environment requires 200% regional compute resources, exceeding project quota limits. The team must request a regional Compute Engine CPU quota increase in advance of blue-green releases.

Cevap

The deployment failed because provisioning a full-capacity green environment alongside the active blue environment requires 200% regional compute resources, exceeding project quota limits. The team must request a regional Compute Engine CPU quota increase in advance of blue-green releases.
Executing a true blue-green deployment strategy requires deploying a complete, fully scaled green environment alongside the active blue environment prior to traffic cutover. This creates a temporary requirement for 200% of standard production capacity. If regional quotas for Compute Engine CPUs, memory, or external IP addresses are strictly sized for single-environment capacity, provisioning the green instance group will fail due to quota limits (`err_gcp_pca_provision_quota_increase_delay`). Requesting regional quota increases in advance resolves this constraint.

Adım Adım Çözüm

1
Analyze the blue-green deployment capacity requirements.
Blue-green releases demand running two full production environments simultaneously (100% capacity for Blue + 100% capacity for Green = 200% total regional footprint) until traffic cutover and teardown are complete.
Understanding total peak resource demand during release windows prevents infrastructure provisioning failures.
2
Identify the cause of the provisioning failure during green MIG instantiation.
The failure occurs at the Compute Engine instance allocation layer before traffic cutover due to insufficient regional quota (e.g., `CPUS` or `IN_USE_ADDRESSES`).
GCP projects enforce regional quotas to prevent accidental over-provisioning; 200% capacity bursts must be accounted for in quota planning.
3
Select the correct remediation strategy.
Request regional Compute Engine quota increases in `us-central1` prior to executing full-scale blue-green deployments.
Proactive quota management ensures the green environment can scale to 100% capacity before shifting load from blue.

Anahtar Kavram

Regional Quota Management for Parallel Deployment Strategies
Tahmini Süre:3m 0s
Soru 1005Soru →

An engineering team is designing a local development and integration testing workflow for microservices that interact with Google Cloud services. Which of the following statements describe valid practices for implementing Google Cloud emulators in development and testing environments? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Export designated emulator host environment variables (such as SPANNER_EMULATOR_HOST or PUBSUB_EMULATOR_HOST) so client libraries automatically route API requests to the local emulator.; Launch emulator components using gcloud command-line tools or containerize them for execution within automated CI/CD test suites.

Cevap

Exporting specific emulator host environment variables and launching emulators via gcloud commands or containerized environments are the correct practices for local development and testing.
The correct practices are configuring emulator-specific host environment variables (which redirect client library calls to local ports) and running emulators via gcloud CLI commands or Docker containers (which provides a lightweight and consistent execution environment across developer machines and automated CI/CD pipelines).

Adım Adım Çözüm

1
Identify the purpose of Google Cloud emulators
Emulators simulate GCP services locally without contacting live GCP endpoints or requiring live authentication.
Understanding emulator mechanics helps determine appropriate startup procedures and credential requirements.
2
Evaluate environment configuration requirements
Configuring specific environment variables like SPANNER_EMULATOR_HOST or PUBSUB_EMULATOR_HOST instructs client SDKs to talk to the local port.
Client libraries rely on standardized environment variables to bypass cloud endpoints.
3
Determine execution methods for local and CI workflows
Using gcloud emulator commands or Docker containers allows seamless execution on local developer workstations and isolated CI pipelines.
Containerizing or using local CLI tools keeps test environments lightweight, fast, and repeatable.

Anahtar Kavram

Local Cloud Emulator Setup and Client SDK Integration
Tahmini Süre:1m 0s
Soru 1006Soru →

A Software-as-a-Service (SaaS) provider is preparing to launch a large-scale data analytics benchmark across multiple regional projects structured under a production folder hierarchy in Google Cloud. The deployment requires provisioning thousands of N2 standard vCPUs across target regions using an automated Infrastructure as Code (IaC) pipeline. Which TWO administrative and governance actions should the Cloud Architect perform to ensure seamless deployment and mitigate operational risks? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Submit proactive regional quota increase requests for N2 vCPUs in the target regions via the Google Cloud Console or Quotas API prior to executing the IaC deployment.; Configure the Terraform backend to use a remote Cloud Storage bucket with object versioning and state locking enabled to maintain deployment state integrity.

Cevap

The Cloud Architect must submit proactive regional quota increase requests prior to deployment and configure the IaC backend to use a remote Cloud Storage bucket with state locking and object versioning.
Proactively requesting quota increases ensures compute resources are available before provisioning, while using a remote Cloud Storage bucket with object versioning and locking safeguards IaC state integrity across automated runs.

Adım Adım Çözüm

1
Assess quota requirements for N2 vCPUs across target regions.
Identified that baseline regional quotas are insufficient for the scale of the benchmark.
Requesting quota increases proactively prevents resource allocation errors during automated provisioning.
2
Establish secure and robust state management for the automated IaC pipeline.
Configured a remote Cloud Storage backend for Terraform state with object versioning and state locking.
Prevents state corruption and concurrency issues during multi-region infrastructure provisioning.

Anahtar Kavram

Managing Resource Quotas, Hierarchies, and Cost Optimization
Soru 1007Soru →

A smart grid energy utility operates on Google Cloud across 30 projects under a single Cloud Billing account. Their architecture includes baseline regional Compute Engine pools for grid management microservices, unpredictable batch grid load simulation models that run periodically, long-term telemetry analytics on BigQuery, and low-traffic internal portal applications. Recent billing audits show rising operational expenses due to unoptimized resource commitments and unconstrained BigQuery querying. As the Lead Cloud Architect, which TWO cost optimization and FinOps governance strategies should you recommend to minimize expenditure while maintaining operational reliability? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Purchase Spend-Based Flexible Committed Use Discounts (CUDs) to cover baseline compute expenditure across services, and utilize Spot VMs for fault-tolerant batch grid simulation workloads.; Establish BigQuery edition slot reservations with autoscaling slots for analytical workloads, and configure Cloud Billing budgets with programmatic Pub/Sub notifications for automated spend governance.

Cevap

The optimal solution requires purchasing Spend-Based Flexible Committed Use Discounts alongside Spot VMs for batch workloads, while implementing BigQuery slot capacity controls combined with Cloud Billing budget alerts via Pub/Sub.
The combination of spend-based Flexible Committed Use Discounts and Spot VMs effectively lowers compute expenses by aligning commitment flexibility with workload tolerance, while BigQuery edition slot reservations and automated Pub/Sub billing budget alerts provide financial predictability and real-time governance across enterprise GCP projects.

Adım Adım Çözüm

1
Analyze compute workload profiles to separate baseline continuous utilization from bursty, fault-tolerant batch processing.
Baseline services qualify for Flexible CUDs across compute products, while batch simulations leverage Spot VMs for maximum cost reduction.
Standard resource commitments for peak variable workloads incur wasted spend during off-peak hours.
2
Evaluate analytics cost governance and query optimization.
Transitioning BigQuery from unconstrained on-demand querying to edition slot reservations with autoscaling sets a predictable cost ceiling.
BigQuery slots cap hourly processing expenditure while supporting analytical demand spikes.
3
Implement enterprise-wide FinOps budget tracking and alerting controls.
Cloud Billing budget alerts connected to Pub/Sub enable automated cost governance triggers across all organizational projects.
Programmatic billing notifications allow proactive response to budget burn rate spikes before billing cycles close.

Anahtar Kavram

FinOps Compute & Analytics Cost Optimization Strategy
Soru 1008Soru →

An enterprise logistics company is designing an automated Continuous Integration and Continuous Delivery (CI/CD) pipeline using Cloud Build and Terraform to provision infrastructure across separate Google Cloud projects for staging and production. The security architecture mandates strict least-privilege enforcement, zero static service account keys in the pipeline, and protection against Terraform state corruption or concurrent execution conflicts across environments. Which CI/CD architecture design meets all technical and security requirements?

Cevabı ve açıklamayı göster

Cevap: Configure Cloud Build triggers to impersonate dedicated environment-specific service accounts using short-lived credentials via IAM role impersonation, store Terraform state remotely in Cloud Storage buckets with Object Versioning enabled, and grant Cloud Build permissions to generate short-lived tokens.

Cevap

Configure Cloud Build triggers to impersonate dedicated environment-specific service accounts using short-lived credentials via IAM role impersonation, store Terraform state remotely in Cloud Storage buckets with Object Versioning enabled, and grant Cloud Build permissions to generate short-lived tokens.
The optimal design pattern for Google Cloud CI/CD infrastructure pipelines uses short-lived credentials via IAM service account impersonation combined with remote state storage in Cloud Storage. Object Versioning and native GCS state locking prevent state file corruption during concurrent builds while upholding least-privilege security standards.

Adım Adım Çözüm

1
Analyze security credential requirements for automated CI/CD infrastructure pipelines.
Avoid exporting static JSON service account keys or assigning broad primitive roles (such as Owner or Editor). Instead, use short-lived token impersonation (`roles/iam.serviceAccountTokenCreator`).
Short-lived credentials minimize blast radius and eliminate long-term credential leakage risks in build logs or storage.
2
Evaluate backend state storage design for multi-project Terraform deployments.
Configure Cloud Storage backends for Terraform remote state with Object Versioning and state locking enabled.
Remote state backends prevent concurrent pipeline executions from corrupting infrastructure state and allow rollback if state file corruption occurs.
3
Synthesize optimal toolchain integration.
Combine Cloud Build with environment-specific service account impersonation and version-controlled GCS state backends.
This guarantees zero static credentials, strict environment isolation, and reliable automated release execution.

Anahtar Kavram

Secure CI/CD IaC Pipeline Architecture with Service Account Impersonation and Remote State Backend Locking
Soru 1009Soru →

An enterprise is setting up access control for an automated auditing service account that must inspect resource configurations and IAM policies across all current and future projects inside a department folder. The service account needs to read security configurations without being granted access to view sensitive underlying data inside Cloud Storage buckets or modify any cloud resources. Which strategy fulfills these requirements while adhering to Google Cloud best practices and the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Grant the Security Reviewer role (roles/securityReviewer) to the service account at the department folder level.

Cevap

Grant the Security Reviewer role (roles/securityReviewer) to the service account at the department folder level.
Granting the Security Reviewer role (`roles/securityReviewer`) at the department folder level ensures that the automated auditing service account inherits read-only permissions for security configurations and IAM policies across all child projects. It strictly avoids granting access to data payloads inside Cloud Storage buckets, perfectly satisfying least privilege and automated resource hierarchy inheritance.

Adım Adım Çözüm

1
Identify the required level of access and hierarchy scope.
The auditing service account requires read access to security and IAM metadata for all projects in a department folder, inherited by future projects, without data access.
Applying the role at the folder level enables IAM permission inheritance for all child projects automatically.
2
Select the predefined role matching least privilege for security auditing.
The `roles/securityReviewer` role provides read-only access to security-related settings and IAM policies without exposing payload data.
Primitive roles like Viewer grant excessive read access to actual data objects, whereas Security Reviewer is specifically tailored for security audit compliance.

Anahtar Kavram

Resource Hierarchy IAM Inheritance and Predefined Security Roles
Tahmini Süre:1m 30s
Soru 1010Soru →

A data engineering team is deploying a Go microservice to Cloud Run that programmatically streams high-volume event data into Google Cloud BigQuery using the official Google Cloud Client Libraries. During traffic spikes, the microservice experiences intermittent HTTP 429 Too Many Requests status codes due to API quota rate limits. The application must process these events reliably without losing data, exceeding API quota limits, or risking credential exposure. How should the application architecture and SDK client configuration be implemented to handle these API interactions efficiently?

Cevabı ve açıklamayı göster

Cevap: Configure the SDK client to reuse a long-lived singleton client instance across requests and leverage built-in exponential backoff with randomized jitter under a least-privilege service account.

Cevap

Configure the SDK client to reuse a long-lived singleton client instance across requests and leverage built-in exponential backoff with randomized jitter under a least-privilege service account.
The correct approach reuses a long-lived SDK client instance to take advantage of built-in connection pooling and automated retry algorithms. Google Cloud Client Libraries naturally implement exponential backoff with randomized jitter on retriable errors such as HTTP 429 (Too Many Requests), ensuring resilience under load while maintaining security via Application Default Credentials (ADC) and least-privilege IAM roles.

Adım Adım Çözüm

1
Analyze authentication and client lifecycle best practices
Cloud Run automatically injects credentials via Application Default Credentials (ADC). Reusing a single SDK client instance allows HTTP connection pooling and effective rate-limit tracking.
Creating SDK client instances per request adds unnecessary latency, memory overhead, and breaks internal backoff state logic.
2
Evaluate API rate limiting and retry handling mechanisms
Official Google Cloud Client Libraries contain native retry policies configured for retriable HTTP errors (429, 503). Exponential backoff with randomized jitter prevents thundering herd problems against GCP API endpoints.
Automated exponential backoff ensures transient quota spikes are smoothed out without dropping requests.
3
Verify security and identity controls
The Cloud Run service should run under a dedicated service account assigned minimal predefined IAM roles (e.g., BigQuery Data Editor) rather than primitive roles or hardcoded key files.
Adhering to least privilege reduces the blast radius while preventing credential leak risks associated with downloadable keys.

Anahtar Kavram

Programmatic GCP SDK Client Lifecycle and Rate Limiting Retry Strategies
Soru 1011Soru →

An enterprise architecture team is establishing an observability framework for custom applications running on Google Cloud Compute Engine instances across multiple production projects. They need to collect both system metrics and application logs, and aggregate critical logs into a centralized log repository in a dedicated security project. Which TWO actions should you take to meet these requirements using Google Cloud recommended practices? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Install and configure the Ops Agent on the Compute Engine instances to collect and transmit system metrics and application logs to Cloud Logging and Cloud Monitoring.; Configure an aggregated Log Router sink at the organization or folder level to route log entries from all production projects to a central Cloud Logging log bucket.

Cevap

The two correct actions are to install the Ops Agent on the Compute Engine instances to collect metrics and logs, and to set up an aggregated Log Router sink at the organization level to direct logs to a central log bucket.
Installing the Ops Agent ensures complete telemetry ingestion (system metrics and application logs) from Compute Engine instances. Using an aggregated Log Router sink at the organization or folder level efficiently collects and centralizes logs across multiple projects into a designated security log bucket.

Adım Adım Çözüm

1
Deploy telemetry collection agent on workloads
Install the Ops Agent on VM instances to capture host-level metrics and application log streams.
The Ops Agent combines logging and monitoring telemetry into a single efficient agent optimized for Compute Engine.
2
Configure multi-project log aggregation
Create an aggregated Log Router sink targeting a central log bucket in the security project.
Aggregated sinks provide enterprise-wide centralization of audit and operational logs without needing manual project-by-project sink configurations.

Anahtar Kavram

Centralized observability integration using the Google Cloud Ops Agent and Aggregated Log Router sinks.
Soru 1012Soru →

A media streaming company hosts user profile data in Cloud SQL for PostgreSQL and media assets in Cloud Storage. The security team mandates that all data at rest must be encrypted using customer-managed keys hosted in a Hardware Security Module (HSM) with automated key rotation enabled. Additionally, access to key operations must strictly follow the principle of least privilege. Which of the following actions should you perform? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a key in Cloud KMS using the HSM protection level and grant the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Cloud SQL and Cloud Storage Service Agents.; Configure an automated rotation schedule on the Cloud KMS key so that new key versions are periodically generated without requiring manual re-encryption of existing stored data.

Cevap

Create an HSM-backed key in Cloud KMS (CMEK) with the Cloud KMS CryptoKey Encrypter/Decrypter role granted to service agents, and configure an automated rotation schedule on the Cloud KMS key.
Using Cloud KMS keys backed by Cloud HSM fulfills regulatory mandates for hardware-based key management (CMEK) while granting the Cloud KMS CryptoKey Encrypter/Decrypter role to service agents enforces least privilege. Configuring automated key rotation ensures ongoing key security compliance without disrupting access to existing encrypted data.

Adım Adım Çözüm

1
Identify key management requirements
Requirements specify HSM protection, automated key rotation, and least privilege service access for Cloud SQL and Cloud Storage.
Choosing CMEK via Cloud KMS satisfies HSM requirements and enables automated key lifecycle management.
2
Configure key protection and IAM roles
Provision a Cloud KMS key with HSM protection level and grant 'roles/cloudkms.cryptoKeyEncrypterDecrypter' to the GCP service agents for Cloud SQL and Cloud Storage.
GCP service agents require granular key access permissions rather than broad primitive roles to encrypt and decrypt data.
3
Establish key rotation policy
Set an automated rotation period on the Cloud KMS CryptoKey.
Cloud KMS handles rotating key versions automatically while retaining older key versions for existing ciphertexts.

Anahtar Kavram

Customer-Managed Encryption Keys (CMEK) with Cloud HSM and IAM Least Privilege
Soru 1013Soru →

An enterprise software company is designing an automated testing and validation procedure to verify cloud infrastructure readiness before deploying microservices into newly provisioned private Google Kubernetes Engine (GKE) clusters across multiple GCP projects. The validation procedures must run automatically within a central CI/CD pipeline located in an administrative VPC and fulfill three key requirements: (1) prevent deployment failures caused by regional resource limits, (2) enable central CI/CD runners to perform health-check validation on private cluster control planes, and (3) prevent state corruption during concurrent pipeline executions. Which testing and validation strategy should the Cloud Architect implement?

Cevabı ve açıklamayı göster

Cevap: Implement automated pre-flight pipeline checks using the Cloud Quotas API to verify regional resource limits prior to provisioning, configure Terraform to use a Cloud Storage backend with object locking and versioning enabled, and add the CI/CD pipeline administrative VPC IP ranges to the GKE control plane authorized networks.

Cevap

The correct strategy requires implementing automated pre-flight checks against the Cloud Quotas API before triggering IaC pipelines, utilizing remote Cloud Storage backends with state locking and versioning for Terraform state management, and configuring GKE control plane authorized networks to allow access from the administrative CI/CD VPC IP range.
A robust technical testing and validation procedure must verify environmental prerequisites before applying infrastructure changes and establish secure, lock-safe validation access. Using the Cloud Quotas API for pre-flight validation guarantees that required CPU, IP, and instance quotas exist before provisioning starts. Configuring Cloud Storage with object locking ensures that concurrent pipeline runs cannot corrupt the IaC state. Finally, authorizing the administrative VPC IP ranges in GKE control plane authorized networks allows CI/CD runner nodes to perform private endpoint validation tests without exposing the master to the public internet.

Adım Adım Çözüm

1
Implement Pre-Flight Quota Validation
Pipeline checks regional quotas via Cloud Quotas API before executing deployment tasks, avoiding mid-provisioning failures.
Requesting quota limit increases reactively causes pipeline blockages due to non-instantaneous quota approval lead times.
2
Configure Centralized Remote State Lock Management
Terraform state stored in GCS bucket with state locking prevents concurrent deployment state corruption.
Ephemeral local state storage or un-locked remote storage causes race conditions when multiple deployment pipelines run in parallel.
3
Enable Secure Control Plane Endpoint Access
GKE private cluster control plane authorized networks permit traffic from the administrative VPC CIDR ranges.
Private GKE control plane endpoints block unauthorized access by default; explicit IP authorization allows automated validation runners to execute cluster readiness checks securely without exposing public endpoints.

Anahtar Kavram

Developing Procedures to Test and Validate Technical Solutions
Tahmini Süre:2m 0s
Soru 1014Soru →

A multinational genomics research institute processes sensitive sequencing data on Google Cloud across multiple projects. Project-Compute hosts a private Google Kubernetes Engine (GKE) cluster that runs analytical workloads, while Project-Data stores raw genomic files in Cloud Storage buckets. The security policy mandates that: 1) On-premises analyst workstations connected via Dedicated Interconnect must securely administer the GKE cluster master, 2) GKE workloads must read objects from Project-Data without routing over the public internet, and 3) Data exfiltration to external Cloud Storage buckets outside the organization must be strictly blocked, even if a compromised service account has IAM Storage Admin permissions. Which architectural design fulfills all of these security requirements?

Cevabı ve açıklamayı göster

Cevap: Place Project-Compute and Project-Data within a single VPC Service Controls perimeter, enforce GKE control plane authorized networks restricted to the on-premises subnet CIDR over Dedicated Interconnect, and use Private Service Connect endpoints for Cloud Storage access.

Cevap

Place Project-Compute and Project-Data within a single VPC Service Controls perimeter, enforce GKE control plane authorized networks restricted to the on-premises subnet CIDR over Dedicated Interconnect, and use Private Service Connect endpoints for Cloud Storage access.
Placing both the compute and data projects inside a unified VPC Service Controls service perimeter prevents data exfiltration to external storage locations even if credentials are compromised. Restricting GKE control plane access via Authorized Networks ensures that cluster management can only occur over the Dedicated Interconnect from specified on-premises subnets.

Adım Adım Çözüm

1
Analyze data exfiltration requirements
Identified that IAM permissions alone cannot prevent data egress to external Google Cloud projects.
VPC Service Controls perimeters are required to isolate Google API resources and block exfiltration even for privileged IAM identities.
2
Evaluate private connectivity and GKE administration controls
Determined that GKE Control Plane Authorized Networks combined with Private Service Connect or Private Google Access via Interconnect satisfies private cluster management constraints.
Control plane authorized networks block unauthorized external IP ranges from reaching the GKE control plane endpoint, ensuring access is restricted to the on-premises CIDR over Dedicated Interconnect.
3
Synthesize perimeter security architecture
Combining both projects within a unified VPC Service Controls service perimeter alongside Private Service Connect and GKE Authorized Networks satisfies all security constraints.
This guarantees secure private access, restricted management routes, and perimeter-level exfiltration protection.

Anahtar Kavram

VPC Service Controls and Perimeter Access Security
Soru 1015Soru →

An enterprise architecture team needs to aggregate Cloud Audit Logs across all Google Cloud projects within an organization folder into a central BigQuery dataset for long-term security analysis, while also streaming high-severity security events to a central Pub/Sub topic for real-time alerting. The solution must minimize administrative overhead and avoid creating individual log sinks in every project. Which Cloud Logging architecture should the team implement?

Cevabı ve açıklamayı göster

Cevap: Create an aggregated Log Router sink at the organization folder level using an inclusion filter for Cloud Audit Logs, set BigQuery and Pub/Sub as targets, and grant the sink's writer identity appropriate access on the destinations.

Cevap

Create an aggregated Log Router sink at the organization folder level using an inclusion filter for Cloud Audit Logs, set BigQuery and Pub/Sub as targets, and grant the sink's writer identity appropriate access on the destinations.
Creating an aggregated sink at the folder level automatically collects logs from all child projects under that folder. By specifying inclusion filters for Cloud Audit Logs and setting BigQuery and Pub/Sub as sink destinations, logs are securely routed in real time without per-project configuration.

Adım Adım Çözüm

1
Identify the architectural requirement for multi-project log aggregation.
Realize that managing log sinks individually across projects creates overhead, whereas an aggregated sink at the folder level automatically captures logs from all current and future child projects.
Aggregated sinks streamline management and ensure compliance across resource hierarchies.
2
Determine the proper mechanism for routing logs to external systems.
Configure Log Router sinks with inclusion filters targeting BigQuery for analytical storage and Pub/Sub for real-time streaming.
Log Router sinks natively support multiple destinations while ensuring reliable delivery and authorization via writer identities.

Anahtar Kavram

Aggregated Log Router Sinks
Tahmini Süre:1m 30s
Soru 1016Soru →

A financial analytics firm is designing an automated CI/CD pipeline on Google Cloud to build container images and deploy microservices to Google Kubernetes Engine (GKE). The security team requires that only cryptographically verified build artifacts can be deployed, and that build execution environments are strictly isolated from the public internet to prevent data exfiltration. Which TWO design controls should you implement to satisfy these security requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable Binary Authorization on the GKE cluster and require attestations generated by Cloud Build and signed using Cloud KMS keys during the image creation phase.; Run Cloud Build tasks inside private worker pools connected to a VPC network enclosed within a VPC Service Controls security perimeter.

Cevap

The pipeline should combine Binary Authorization with Cloud KMS attestation signing and utilize Cloud Build private worker pools within a VPC Service Controls perimeter.
Enforcing Binary Authorization policies tied to Cloud KMS attestation signatures ensures that only validated images are deployed to GKE. Utilizing Cloud Build private worker pools peered to private VPCs within a VPC Service Controls perimeter secures network traffic and blocks data exfiltration during execution.

Adım Adım Çözüm

1
Configure software supply chain integrity using Binary Authorization
Container images built by Cloud Build are signed with Cloud KMS, and GKE blocks any unsigned container deployment.
This guarantees that unverified or unauthorized container binaries cannot run in the production GKE cluster.
2
Isolate pipeline build execution environments using Cloud Build private worker pools
Build workloads execute inside private VPC subnets protected by VPC Service Controls.
Private worker pools isolate build traffic from public internet exposure and prevent illicit data exfiltration during build steps.

Anahtar Kavram

Secure CI/CD Pipeline Design with Binary Authorization and Private Build Environments
Soru 1017Soru →

An enterprise financial organization runs microservice workloads across multiple Google Cloud projects in an organization. The security operations team requires all Data Access Audit Logs and application error logs to be streamed in real-time to a centralized security telemetry project for compliance auditing and threat detection. However, high-volume HTTP request logs and operational INFO logs must be excluded to prevent excessive Cloud Logging ingestion costs. The lead architect creates an organization-level Log Router sink targeting a Pub/Sub topic in the central project. How should the architect configure the Log Router sink and permissions to fulfill these requirements securely without dropping essential security logs?

Cevabı ve açıklamayı göster

Cevap: Configure an inclusion filter matching logName containing 'cloudaudit.googleapis.com/data_access' OR severity >= ERROR, and grant the Log Router unique service account the roles/pubsub.publisher role on the target Pub/Sub topic.

Cevap

Configure an inclusion filter matching logName containing 'cloudaudit.googleapis.com/data_access' OR severity >= ERROR, and grant the Log Router unique service account the roles/pubsub.publisher role on the target Pub/Sub topic.
The correct approach uses explicit inclusion filters to capture specific audit log types (Data Access Audit Logs) along with high-severity application errors (severity >= ERROR). This prevents low-severity noise from being ingested while ensuring audit records (which may have NOTICE or DEFAULT severity) are retained. Additionally, granting the predefined Pub/Sub Publisher role to the sink's dedicated service account adheres strictly to the principle of least privilege.

Adım Adım Çözüm

1
Define inclusion filter criteria for centralized log routing.
Specifying precise log names ('cloudaudit.googleapis.com/data_access') alongside explicit severity thresholds (severity >= ERROR) ensures only mandatory compliance and incident management logs are ingested.
Cloud Audit Logs often carry DEFAULT or NOTICE severity levels. Using an inclusion filter targeted specifically at log types avoids dropping mandatory non-error audit records.
2
Configure identity and access management for cross-project log sinks.
Granting `roles/pubsub.publisher` directly to the writer identity (service account) generated by the organization-level sink on the destination Pub/Sub topic enables secure cross-project ingestion.
Least privilege principles dictate granting resource-specific predefined roles rather than primitive project-level roles such as Owner or Editor.

Anahtar Kavram

Organization Log Router Sinks and Cloud Audit Logging Ingestion Optimization
Tahmini Süre:2m 0s
Soru 1018Soru →

An enterprise plans to migrate an on-premises legacy relational database to Google Cloud. The workload consists of standard single-region transactional processing and does not require global scale or multi-region synchronous replication. To minimize ongoing technical debt, operational complexity, and unnecessary costs, which Google Cloud service should the cloud architect recommend?

Cevabı ve açıklamayı göster

Cevap: Cloud SQL

Cevap

Cloud SQL is the recommended solution because it fulfills standard relational database requirements in a fully managed service, avoiding the cost and complexity of over-engineered database platforms.
Cloud SQL provides a fully managed relational database service (supporting MySQL, PostgreSQL, and SQL Server) optimized for standard regional applications. Implementing Cloud SQL meets all legacy data migration requirements while minimizing operational maintenance and cloud overhead.

Adım Adım Çözüm

1
Analyze the technical requirements of the legacy application
The application requires a standard relational database operating within a single region without needing global multi-region consistency.
Matching technical requirements to the appropriate managed service tier prevents over-provisioning.
2
Evaluate target GCP database services against operational constraints
Cloud SQL handles standard regional transactional workloads natively with minimal operational overhead.
Choosing fully managed services suited to the workload scale reduces long-term technology debt.

Anahtar Kavram

Selecting right-sized managed database services during legacy migration to minimize technical debt
Soru 1019Soru →

An enterprise cloud architect is establishing a defense-in-depth perimeter security baseline for a financial enterprise migrating to Google Cloud. Match each security requirement to its corresponding GCP perimeter control mechanism.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Mitigate Layer 7 web application attacks (such as SQL injection and Cross-Site Scripting) and apply rate limiting at the external HTTP(S) Load Balancer edge.
Prevent authorized internal identities from copying sensitive BigQuery datasets to unauthorized external Google Cloud storage locations.
Enforce mandatory, non-overrideable network access rules globally across all projects in the organization hierarchy using fine-grained resource tagging.
Provide secure, private endpoint connectivity to Google APIs and third-party SaaS services from an isolated VPC without exposing public IPs or requiring transitive VPC peering.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct alignment pairs each specific security requirement with its dedicated Google Cloud perimeter mechanism: Layer 7 WAF edge defense maps to Cloud Armor; API-level data exfiltration prevention maps to VPC Service Controls; mandatory organization-wide rule enforcement with secure tags maps to Hierarchical Firewall Policies; and private service consumption without transitive peering maps to Private Service Connect.
Each requirement targets a distinct security layer in Google Cloud: Cloud Armor inspects HTTP(S) traffic at Layer 7 for WAF and rate limiting; VPC Service Controls prevents exfiltration across Google API boundaries by controlling network context; Hierarchical Firewall Policies enforce global security baselines with secure tags across project hierarchies; and Private Service Connect establishes private, local VPC endpoints for services without public internet or transitive peering.

Adım Adım Çözüm

1
Analyze the request for Layer 7 web attack mitigation and rate limiting at the load balancer.
Identify Cloud Armor as the native GCP WAF solution integrated with Google Cloud External HTTP(S) Load Balancing.
Cloud Armor inspects incoming HTTP(S) requests against OWASP preconfigured rules before traffic reaches compute backends.
2
Analyze the requirement to block data exfiltration from managed services like BigQuery.
Identify VPC Service Controls as the security perimeter mechanism governing Google API boundaries.
IAM controls WHO can access data, but VPC Service Controls restricts WHERE data can be read from or written to, neutralizing exfiltration risks.
3
Analyze the need for organization-wide mandatory firewall rules using tag-based control.
Identify Hierarchical Firewall Policies paired with secure tags.
Hierarchical policies are enforced at the organization or folder level and cannot be overridden by project-level firewall rules.
4
Analyze the requirement for private connectivity to managed services without public IPs or transitive VPC peering.
Identify Private Service Connect (PSC).
PSC project endpoints instantiate private IP addresses inside the consumer VPC to access published services or Google APIs.

Anahtar Kavram

Multi-layered GCP network perimeter defense integrating WAF, API Service Perimeters, Hierarchical Firewalls, and Private Endpoint Routing.
Soru 1020Soru →

A fintech enterprise specializing in real-time transaction reconciliation recently completed a technical debt assessment of its Google Cloud environment following an expedited cloud migration. The audit identified two critical architecture issues: infrastructure deployment state files are stored locally on developer workstations, and the CI/CD deployment service account is assigned the primitive Project Owner role to simplify deployment permissions. Which strategy best mitigates these technical debt findings in accordance with Google Cloud recommended practices?

Cevabı ve açıklamayı göster

Cevap: Migrate the infrastructure state to a central Cloud Storage bucket configured with object versioning and state locking, and replace the primitive Owner role with fine-grained predefined roles enforcing least privilege on the deployment service account.

Cevap

Migrate the infrastructure state to a central Cloud Storage bucket configured with object versioning and state locking, and replace the primitive Owner role with fine-grained predefined roles enforcing least privilege on the deployment service account.
The correct strategy addresses both technical debt findings directly using native Google Cloud best practices: storing IaC state in Cloud Storage provides encrypted, locking, and versioned state storage, while replacing primitive roles with fine-grained predefined roles restores least-privilege security controls.

Adım Adım Çözüm

1
Assess IaC state management technical debt
Identified that local state storage creates risks of configuration drift, concurrent write collisions, and loss of state history.
Google Cloud recommends Cloud Storage with state locking and object versioning for secure, multi-user IaC deployment.
2
Assess IAM security technical debt
Identified that granting primitive Owner roles to service accounts creates severe security risks.
Least privilege mandates using specific predefined or custom roles tailored only to required resource actions.
3
Synthesize optimal mitigation strategy
Combine Cloud Storage state backend implementation with targeted IAM role assignment.
This directly remediates both identified architectural anti-patterns using standard, cost-effective GCP capabilities.

Anahtar Kavram

Mitigating Technical Debt in Cloud Security and Infrastructure Automation
ÖncekiSayfa 51 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin