Tüm alıştırma soruları

An enterprise intermodal freight operator is designing a modernized fleet telemetry system on Google Cloud. As the Principal Cloud Architect, you must translate high-level business requirements into a production-ready solution following Google Cloud architecture framework best practices. Place the architectural design phases in the correct sequential order, starting from initial business abstraction down to physical infrastructure deployment.

A global media streaming conglomerate is executing a multi-stage migration of its high-throughput video rendering and distribution platform from an on-premises datacenter to Google Cloud. Executive leadership requires strict change governance, demanding zero disruption to active production release cadences while transitioning twelve legacy engineering squads. The platform security policy mandates strict data exfiltration prevention, and compute capacity planning indicates that rendering workloads will require high-count GPU host instances in specific regional zones. Which strategy should the Lead Cloud Architect recommend to align business stakeholder change requirements with Google Cloud technical and operational best practices?

An enterprise organization is migrating a transactional analytics workload to Google Cloud. The compliance team mandates that sensitive data stored in Cloud Storage and BigQuery must be encrypted at rest using Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS. Additionally, security policy dictates strict separation of duties between key management operations and data processing tasks. Which TWO architectural configuration steps should the cloud security architect perform to satisfy these requirements? (Select TWO.)

A digital publishing platform hosts its core services on Google Cloud Platform across multiple projects within an organizational hierarchy. The architecture includes steady-state core API services running continuously, unpredictable web traffic spikes during breaking news events, simple stateless web microservices, and standard relational database backends. The enterprise FinOps team requires a cost governance strategy that minimizes overall spend while maintaining operational performance and avoiding wasteful over-provisioning. Which architectural strategy should the Cloud Architect recommend?

An organization is migrating an on-premises deployment pipeline to interact with Google Cloud resources. The pipeline needs to fetch database credentials stored in Google Cloud Secret Manager to deploy application updates. Organization security governance strictly forbids the creation of exportable long-lived service account keys and mandates strict adherence to the principle of least privilege. Which solution should the cloud architect implement to meet these requirements securely?

An enterprise online video platform hosts its core subscriber session management service on Google Cloud across a primary region (us-east1) and a DR region (us-west1). The business has established a strict 15-minute Recovery Time Objective (RTO) and near-zero Recovery Point Objective (RPO). As part of developing standard Disaster Recovery (DR) validation procedures, the lead cloud architect needs to design a simulation process that verifies regional failover capability without risking live production traffic or encountering unexpected resource limits during an actual regional outage. Which validation procedure should the cloud architect implement?

A digital media organization is preparing to launch a globally televised live streaming event. The application architecture requires provisioning thousands of Compute Engine Virtual Machine instances across multiple target regions. To prevent infrastructure deployment failures and maintain strict governance over project resources, which TWO actions should the Cloud Architect perform prior to the event?

A regulatory authority requires a financial institution to store highly sensitive customer audit logs in BigQuery. The institution's strict governance policy dictates that the cryptographic root of trust must reside exclusively within an on-premises Hardware Security Module (HSM) outside Google Cloud, ensuring Google never holds raw key material at rest. Which architectural configuration meets these regulatory compliance requirements while adhering to Google Cloud security best practices?

A health-tech company hosts a data ingestion microservice on Google Cloud Compute Engine Managed Instance Groups (MIGs) in Project A. The microservice needs to access sensitive third-party API credentials stored in GCP Secret Manager located in a central security project (Project B). The security team mandates strict enforcement of least privilege, zero exposure of static service account key JSON files, and proper service account lifecycle controls. Which TWO actions should the Lead Cloud Architect recommend to establish a secure authentication and access pattern? (Select TWO)

An enterprise financial institution is modernizing its Google Cloud architecture to satisfy strict regulatory compliance and perimeter security mandates. The architecture team must evaluate and assign the appropriate network security control mechanism to meet four distinct security requirements across their multi-project environment.

Match each architectural security requirement with the corresponding Google Cloud network security mechanism that best satisfies it.

A global enterprise is establishing an automated Infrastructure as Code (IaC) pipeline to provision Cloud Spanner databases and Cloud Storage buckets across multiple operational regions. During automated CI/CD runs, concurrent pipeline executions occasionally attempt to modify the same environment simultaneously. The lead architect must ensure that remote Terraform state operations prevent race conditions and allow state recovery if accidental deletion occurs. Which provisioning approach best satisfies these requirements?

A Nordic shipping and maritime logistics company is migrating its container tracking system and customer data to Google Cloud. Regional regulations dictate that all stored data must physically reside within European Union boundaries, cloud service provider personnel access must require explicit administrative approval, and data exfiltration across network perimeters to external buckets must be blocked. Which TWO architectural actions should you implement to meet these governance and data sovereignty mandates? (Select TWO.)

An automotive IoT company structures its Google Cloud resource hierarchy with an Organization node containing an Autonomous Vehicles folder. Within this folder are two projects: telemetry-ingest, which hosts automated telemetry processing microservices on Compute Engine, and telemetry-storage, which contains a centralized Cloud Storage bucket for long-term diagnostic logs. The ingestion microservice requires read-only access to objects in the centralized bucket. Additionally, developer identity group members need to launch compute instances that execute as the ingestion service account without gaining administrative control over service accounts. Following Google-recommended security practices of least privilege and resource hierarchy management, which set of role assignments should you configure?

An organization is analyzing its automated software release process for a hybrid microservices platform deployed on Compute Engine Managed Instance Groups (MIGs). The CI/CD pipeline utilizes Cloud Build to build custom Golden Images using Packer and execute Terraform scripts to update instance templates. An SDLC architecture review identified two critical issues: the Cloud Build default service account uses the primitive Editor role across the project, and Terraform state files generated during execution are stored on local runner storage without locks, causing concurrency errors during parallel pipeline runs. Which TWO actions should the architecture team recommend to resolve these issues while following Google Cloud best practices? (Select TWO.)

An enterprise organization is restructuring its software delivery lifecycle to establish an end-to-end secure, automated CI/CD pipeline for deploying a critical microservice to Google Kubernetes Engine (GKE). The security policy mandates least-privilege access, container vulnerability scanning, cryptographic image attestation using Binary Authorization, Terraform state validation, and controlled canary traffic routing. Place the operational stages of this deployment pipeline in the correct chronological order from initial source submission to full production release.

A logistics organization is building an automated continuous deployment pipeline to manage multi-environment releases of a microservice application across Google Kubernetes Engine (GKE) clusters using Cloud Build and Cloud Deploy. The security and operations teams require that all Infrastructure as Code (IaC) updates executed during the release process maintain state integrity and concurrency locking, and that the execution service account follows the principle of least privilege when delegating compute workloads. Which deployment pipeline configuration fulfills these architectural requirements?

An Australian telecommunications enterprise is migrating its customer analytics platform to Google Cloud. To comply with national data sovereignty regulations and strict audit requirements, the architecture must ensure that customer personally identifiable information (PII) is stored and processed exclusively within Australian geographic boundaries, Google support engineers cannot access customer data without explicit loggable authorization, and authorized internal users are prevented from exfiltrating data to external resources outside the organization. Which TWO architectural controls should the Cloud Architect implement to meet these requirements?

An enterprise architecture team is designing an automated secret rotation pipeline in Google Cloud for database credentials stored in Secret Manager. The secret payload is encrypted using a Customer-Managed Encryption Key (CMEK) hosted in Cloud KMS. Rotation must occur automatically every 30 days via a Cloud Run microservice triggered by Secret Manager rotation notifications sent to Cloud Pub/Sub. Enterprise compliance policy strictly forbids long-lived service account JSON keys and mandates least-privilege access controls across all services. Which architectural configuration correctly satisfies these operational and security requirements?

A financial analytics company manages its cloud resources using Google Cloud folders to isolate production workloads. The security team mandates that no virtual machine (VM) instances created inside any project under the 'Analytics-Production' folder may be assigned public IP addresses. This security constraint must apply automatically to all existing and future projects created within this folder. Which approach should the Cloud Architect take to enforce this constraint centrally with minimal operational overhead?

A government-owned energy enterprise based in Denmark is migrating its critical smart-grid telemetry and customer billing datasets to Google Cloud. To comply with national data sovereignty regulations and European data protection mandates, the lead cloud architect must satisfy two primary compliance requirements: ensure that all newly provisioned data storage resources remain strictly within the Denmark/Nordic region, and prevent authorized project identity credentials from exfiltrating sensitive data to external Google Cloud resources outside the organization's control. Which TWO architectural controls should the architect implement to satisfy these requirements?