Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 121Soru →

A global media organization recently completed a rapid cloud migration to Google Cloud, resulting in accrued technical debt across their operations. An architectural audit revealed two critical anti-patterns: infrastructure deployment engineers manage environment changes by executing automated Terraform scripts locally using unversioned state files, leading to frequent state corruption; additionally, application service accounts running stateless workloads on Compute Engine were assigned primitive Owner roles to circumvent deployment permission blockers. Which TWO mitigations should the Cloud Architect implement to resolve this technical debt while following Google Cloud recommended practices? (Select TWO answers.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Migrate Terraform state management to a centralized Google Cloud Storage backend configured with object versioning and state locking, and mandate execution via automated CI/CD pipelines.; Audit application permission usage to replace primitive Owner roles with least-privilege predefined or custom IAM roles attached directly to application service accounts.

Cevap

The Cloud Architect should centralize Terraform state management in a Cloud Storage remote backend with object versioning and state locking integrated into CI/CD pipelines, and replace primitive Owner roles on application service accounts with least-privilege predefined or custom IAM roles.
The correct mitigations address the core technical debt directly. Moving Terraform state management to a Cloud Storage remote backend with versioning and object locking ensures operational state consistency and enables automated pipeline deployments. Concurrently, auditing service account usage and replacing broad primitive Owner roles with minimal predefined or custom IAM roles establishes robust security governance without adding unnecessary infrastructure complexity.

Adım Adım Çözüm

1
Analyze the technical debt identified in the infrastructure audit
Two distinct technical debt domains are present: operational IaC state management debt (local unversioned state) and security governance debt (primitive IAM Owner roles).
Resolving technical debt requires targeting root causes across operational governance and security identity architecture.
2
Evaluate IaC remediation options against GCP architecture standards
Migrating Terraform state to Cloud Storage remote backends with object versioning, object locking, and CI/CD automation solves state corruption and drift.
Remote state backends provide consistency, concurrency locking, and auditability for infrastructure as code.
3
Evaluate IAM governance remediation options against GCP security standards
Auditing active permissions and replacing primitive Owner roles with least-privilege predefined or custom roles mitigates unauthorized access risks.
Primitive roles grant excessive project-wide permissions that violate security compliance and principle of least privilege.

Anahtar Kavram

Mitigating Technical Debt in Infrastructure as Code and IAM Security Governance
Soru 122Soru →

A financial enterprise processes high-volume trade settlement requests using Google Cloud Pub/Sub, Dataflow, and Cloud Spanner. The business operations team determines that any settlement request taking longer than 500 ms500\text{ ms} to complete creates regulatory non-compliance exposure, but the business can tolerate up to 0.05%0.05\% of monthly transactions exceeding this threshold before financial penalties occur. As a Cloud Architect aligning technical operations with business risk, how should you structure the service level metrics for this pipeline?

Cevabı ve açıklamayı göster

Cevap: Define the SLI as the proportion of settlement requests completed in under 500 ms500\text{ ms} divided by total valid requests, and set the SLO target at 99.95%99.95\% over a rolling 30-day window.

Cevap

The Service Level Indicator (SLI) should be defined as the ratio of settlement requests completed within 500 ms500\text{ ms} over total valid settlement requests, with the Service Level Objective (SLO) set at 99.95%99.95\% over a rolling 30-day window.
The correct approach defines a Service Level Indicator (SLI) as the empirical ratio of successful latency events (≤500 ms\le 500\text{ ms}) over total requests, and pairs it with a Service Level Objective (SLO) of 99.95%99.95\% over 30 days. This directly reflects the business risk tolerance (0.05%0.05\% maximum non-compliant trades) while using standard SRE metric practices.

Adım Adım Çözüm

1
Identify the core business requirement and risk threshold.
Processing latency >500 ms> 500\text{ ms} causes compliance issues; allowable failure rate is 0.05%0.05\% per month (100%−0.05%=99.95%100\% - 0.05\% = 99.95\% target).
SLOs must directly align with business tolerance limits to protect revenue and regulatory status.
2
Formulate the Service Level Indicator (SLI).
SLI=Good EventsTotal Events=Settlement requests completed in ≤500 msTotal valid settlement requests\text{SLI} = \frac{\text{Good Events}}{\text{Total Events}} = \frac{\text{Settlement requests completed in } \le 500\text{ ms}}{\text{Total valid settlement requests}}.
An SLI is a quantified, empirical ratio measuring actual service performance against a specific user-centric or business metric.
3
Set the Service Level Objective (SLO) target over a compliance window.
Set the SLO at ≥99.95%\ge 99.95\% evaluated over a rolling 30-day period.
The SLO establishes the target threshold for the SLI that technical teams maintain to remain within the business risk envelope.

Anahtar Kavram

Aligning technical SLIs and SLOs with business impact
Soru 123Soru →

A digital entertainment platform hosts high-throughput microservices in Google Kubernetes Engine (GKE) and stores build artifacts in Artifact Registry. The security operations team requires a Google Cloud-native security architecture that automatically inspects container images for known software vulnerabilities upon repository upload, and continuously monitors runtime container behavior and cloud audit logs for compromised workloads or reverse shells without requiring third-party agent installations. Which TWO security capabilities should the cloud architect recommend? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable Container Analysis vulnerability scanning in Artifact Registry to automatically scan container images for known CVEs when pushed.; Enable Security Command Center Threat Detection services, specifically Container Threat Detection and Event Threat Detection, for agentless runtime and log monitoring.

Cevap

The cloud architect should enable Container Analysis vulnerability scanning in Artifact Registry to continuously inspect container images for known CVEs, and enable Security Command Center Container Threat Detection and Event Threat Detection to provide agentless runtime threat monitoring.
Enabling Container Analysis vulnerability scanning ensures that container images stored in Artifact Registry are automatically scanned for known vulnerabilities upon upload. Furthermore, enabling Security Command Center services (Container Threat Detection and Event Threat Detection) provides native, agentless runtime security monitoring across container environments and cloud logs without needing guest agents installed in each pod.

Adım Adım Çözüm

1
Evaluate container vulnerability scanning requirements for artifacts stored in Artifact Registry.
Container Analysis provides native, automated vulnerability scanning for container images stored in Artifact Registry upon upload.
It detects known CVEs in OS packages and language-specific dependencies without external tooling.
2
Evaluate runtime threat detection requirements for GKE microservices and cloud logs without installing agents.
Security Command Center Container Threat Detection inspects GKE node hypervisor logs agentlessly, while Event Threat Detection monitors Cloud Logging in real time.
This detects threats like reverse shells, suspicious binaries, and compromised credentials without performance overhead on pods.
3
Filter out non-compliant distractors related to IAM and network perimeters.
Primitive IAM roles break least privilege, and VPC Service Controls enforce perimeter security rather than image layer vulnerability analysis.
Security controls must match their specific architectural domain.

Anahtar Kavram

Vulnerability Scanning, Container Security, and Threat Detection
Soru 124Soru →

A global logistics organization is migrating its core route-optimization platform from an on-premises data center to Google Cloud. The executive leadership team has mandated a strict cutover deadline, but internal operations teams are showing resistance to change due to unfamiliarity with cloud governance, Infrastructure as Code (IaC), and security frameworks. Technically, the architecture requires large-scale Compute Engine instance provisioning across two regions during peak operations and processes sensitive supply-chain data subject to strict data exfiltration prevention policies. Which TWO actions should the Lead Cloud Architect recommend to address stakeholder requirements, manage organizational change, and satisfy technical constraints? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Develop a role-based enablement program with hands-on Google Cloud and Terraform workshops for operations teams, while submitting regional Compute Engine resource quota increase requests well in advance of migration phases.; Implement fine-grained predefined IAM roles alongside VPC Service Controls perimeters, combined with structured deployment validation gates aligned with business readiness milestones.

Cevap

The Lead Cloud Architect should establish a structured enablement program accompanied by early regional quota requests, and implement fine-grained IAM roles with VPC Service Controls and business-aligned deployment gates.
Successful cloud adoption requires balancing technical governance with organizational enablement. Providing structured training labs and submitting early regional compute quota requests addresses team resistance and long-lead operational dependencies. Concurrently, using fine-grained IAM roles alongside VPC Service Controls satisfies strict data exfiltration prevention mandates, while phased validation gates maintain stakeholder alignment.

Adım Adım Çözüm

1
Assess organizational readiness and operational constraints
Identified skill gaps in operations teams regarding cloud governance/IaC and identified long-lead requirements for regional compute quotas.
Technical migrations fail when team capability and resource allocations are not prepared ahead of execution.
2
Structure stakeholder change management and capacity planning
Formulated a role-based training strategy using hands-on Terraform/GCP labs and initiated early quota request tickets for target regions.
Hands-on training reduces friction and change resistance, while early quota planning prevents last-minute deployment blockers.
3
Design security controls and business-aligned release governance
Enforced fine-grained IAM roles, configured VPC Service Controls perimeters against data exfiltration, and tied migration phases to business readiness gates.
VPC Service Controls protect against data exfiltration beyond basic IAM, and phased validation gates ensure stakeholder alignment.

Anahtar Kavram

Analyzing Business Stakeholder Requirements and Managing Organizational Change
Tahmini Süre:3m 0s
Soru 125Soru →

An online gaming platform headquartered in Sweden is deploying a new telemetry and payment processing pipeline on Google Cloud. To satisfy strict European regulatory compliance and data sovereignty mandates, the platform must guarantee that all data assets remain physically located within European infrastructure and that Google administrative access to underlying data is logged and requires prior time-bound authorization. Which TWO architectural controls should you implement to satisfy these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enforce the Resource Locations (gcp.resourceLocations) organization policy constraint to restrict resource deployment exclusively to European regions.; Configure Access Approval combined with Access Transparency to receive notifications and explicitly authorize Google support access requests to customer data.

Cevap

The correct controls are enforcing the Resource Locations organization policy constraint to restrict resource creation to European locations and configuring Access Approval along with Access Transparency for Google personnel access oversight.
The combination of the Resource Locations organization policy constraint (gcp.resourceLocations) and Access Approval/Access Transparency directly addresses both strict data residency constraints and administrative data access governance requirements. The resource locations constraint guarantees data assets remain in European regions, while Access Approval ensures Google personnel must obtain explicit permission before accessing customer data.

Adım Adım Çözüm

1
Address data sovereignty and location boundary requirements
Enforce the gcp.resourceLocations Organization Policy constraint to restrict resource provisioning exclusively to European regions.
Organization policies provide centralized policy enforcement to prevent users from creating resources in unapproved geographic regions.
2
Address administrative access control and auditing mandates
Enable Access Transparency for audit logs and Access Approval for explicit customer authorization of Google support accesses.
Access Approval ensures Google support engineers cannot access customer content without explicit time-bound approval, and Access Transparency generates verifiable audit trails.

Anahtar Kavram

Data sovereignty controls using Organization Policy Resource Locations, Access Approval, and Access Transparency in Google Cloud
Soru 126Soru →

A financial analytics firm structures its Google Cloud environment with a top-level folder named `FinTech-Analytics`. Within this folder, a project named `fraud-detection-prod` runs automated risk-scoring microservices on Compute Engine. The microservices run under a dedicated application service account and must read transaction audit logs stored in a Cloud Storage bucket located inside a separate project named `compliance-data-prod` under the same folder. Furthermore, the developer team requires access to deploy and manage virtual machine instances within `fraud-detection-prod`, but must not be able to modify IAM access policies across the resource hierarchy. Which two IAM configuration steps should you take to adhere to the principle of least privilege? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the application service account the Storage Object Viewer role (roles/storage.objectViewer) scoped directly to the audit log bucket in compliance-data-prod.; Grant the developer team the Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) on the fraud-detection-prod project.

Cevap

The correct architecture requires granting the Storage Object Viewer role to the application service account directly on the targeted Cloud Storage bucket in compliance-data-prod, and granting the Compute Instance Admin (v1) role to the developer team at the fraud-detection-prod project scope.
To satisfy least privilege requirements, access must be scoped to the narrowest resource boundary with predefined roles. Applying the Storage Object Viewer role directly to the specific Cloud Storage bucket in the compliance project enables cross-project object access without opening access to other resources. Assigning Compute Instance Admin (v1) at the compute project level allows developers to perform VM management without modifying IAM policies or accessing folder-level resources.

Adım Adım Çözüm

1
Determine least privilege storage access for cross-project data reading
Identify that roles/storage.objectViewer scoped to the specific Cloud Storage bucket in compliance-data-prod grants read access to objects without exposing other project resources.
IAM permissions inherit downward. Applying granular roles at the lowest resource level (bucket) prevents over-privileging across the project or folder.
2
Evaluate compute management permissions for developers
Identify that roles/compute.instanceAdmin.v1 on fraud-detection-prod provides instance lifecycle management capabilities without granting security policy or project administration permissions.
Predefined workload roles limit administrative capability to compute management rather than security control plane management.
3
Reject broad primitive roles and excessive service account administrative permissions
Avoid granting primitive roles (Editor) or administrative identity roles (Service Account Admin) when fine-grained compute administration and service account usage roles suffice.
Using primitive roles or granting Service Account Admin creates privilege escalation risks.

Anahtar Kavram

Fine-Grained Predefined IAM Roles and Resource Hierarchy Scoping
Soru 127Soru →

An enterprise energy management company is auditing its continuous integration and continuous delivery (CI/CD) pipelines used to deploy infrastructure and microservices on Google Cloud. The automated pipeline executes Terraform via Cloud Build. An audit reveals that the build pipeline currently stores Terraform state files locally inside the transient Cloud Build workspace container, and the Cloud Build service account is assigned the primitive Project Editor role (`roles/editor`). The architecture team must optimize the pipeline to ensure state persistence, prevent state corruption from concurrent runs, and align with least-privilege security standards. Which combination of architectural changes should the team implement?

Cevabı ve açıklamayı göster

Cevap: Configure a Google Cloud Storage bucket with object versioning and state locking as the Terraform remote backend, and replace the primitive Editor role on the Cloud Build service account with granular predefined IAM roles for the targeted GCP resources.

Cevap

Configure a Google Cloud Storage bucket with object versioning and state locking as the Terraform remote backend, and replace the primitive Editor role on the Cloud Build service account with granular predefined IAM roles for the targeted GCP resources.
The solution properly resolves both pipeline deficiencies identified during the audit. Storing Terraform state in a Cloud Storage bucket configured with object versioning and state locking prevents state corruption and loss during parallel CI/CD runs. Replacing the primitive Editor role with fine-grained predefined roles ensures the Cloud Build service account operates strictly within least-privilege security boundaries.

Adım Adım Çözüm

1
Analyze IaC State Management Requirements
Local state files in transient CI/CD execution environments cause state loss and concurrency conflicts.
Terraform requires a centralized remote backend like Google Cloud Storage with state locking enabled to handle state safely in automated pipelines.
2
Analyze Pipeline IAM Security Requirements
Primitive roles like Editor or Owner provide broad, unmonitored permissions across the entire project.
Security best practices require replacing primitive roles with least-privilege predefined or custom IAM roles scoped strictly to the resources being provisioned.
3
Synthesize Optimal Architecture Solution
Combine Cloud Storage backend configuration with scoped predefined IAM roles for the Cloud Build service account.
This dual change resolves operational risks around state corruption while satisfying corporate compliance and security requirements.

Anahtar Kavram

CI/CD Pipeline Optimization and Infrastructure as Code State & Security Management
Soru 128Soru →

A financial technology company stores analytical datasets containing sensitive customer transaction records in Google BigQuery. Corporate security policy mandates the use of Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS. To strictly enforce separation of duties and least privilege, security administrators must manage the key lifecycle without having permissions to query BigQuery dataset contents, while data analysts must run queries without holding permissions to manage or directly invoke Cloud KMS key operations. Furthermore, the BigQuery service must perform encryption and decryption operations automatically on behalf of the analysts. Which architecture and IAM configuration correctly meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) specifically to the BigQuery Service Agent, restrict Cloud KMS administrative roles to the security team, and grant BigQuery Data Viewer and Job User roles to the data analysts without Cloud KMS permissions.

Cevap

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) to the BigQuery Service Agent, keep Cloud KMS administration restricted to security administrators, and grant data analysts BigQuery query/viewer access without key permissions.
The correct solution grants the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) directly to the BigQuery Service Agent. This allows BigQuery to handle transparent data encryption and decryption during query execution. Security administrators retain key management permissions, and data analysts receive standard BigQuery data viewer and job user permissions, achieving strict separation of duties and least privilege.

Adım Adım Çözüm

1
Identify the service account executing CMEK encryption/decryption operations for BigQuery.
Determine that the Google-managed BigQuery Service Agent ([email protected]) requires permission to use the Cloud KMS key.
When configuring CMEK, GCP services encrypt and decrypt data using their dedicated service agents on behalf of users.
2
Apply the principle of least privilege to Cloud KMS permissions.
Grant roles/cloudkms.cryptoKeyEncrypterDecrypter to the BigQuery Service Agent on the target key.
This provides the service agent with minimal necessary permissions to protect and unprotect data blocks.
3
Establish separation of duties for human users.
Assign Cloud KMS Admin roles exclusively to security administrators and assign BigQuery Data Viewer / Job User roles to analysts.
Prevents analysts from managing or directly reading encryption key material, while preventing security personnel from accessing sensitive analytical data within BigQuery datasets.

Anahtar Kavram

Data Encryption at Rest, in Transit, and Key Management (KMS/CMEK/CSEK)
Soru 129Soru →

A video streaming provider operates a high-throughput live event broadcasting service on Google Cloud. Executive leadership wants to ensure that technical reliability targets directly reflect subscriber retention while avoiding unnecessary operational over-engineering. The product and SRE teams are defining Service Level Indicators (SLIs), Service Level Objectives (SLOs), and error budget policies for the video chunk serving pipeline. Which TWO engineering practices effectively align technical service level metrics with business impact? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define the Service Level Indicator (SLI) as the proportion of video chunk requests served within 200 milliseconds, and calibrate the SLO target based on customer churn thresholds.; Establish an error budget policy that automatically freezes non-critical feature deployments when the multi-window burn rate indicates budget depletion before major live events.

Cevap

To align technical metrics with business impact, the team should define the Service Level Indicator (SLI) as the proportion of video chunk requests served within 200 milliseconds calibrated against customer churn thresholds, and establish an error budget policy that freezes non-critical deployments when burn rates indicate impending budget depletion before peak events.
Defining an SLI based on user-perceived latency (video chunk requests served within 200 ms) directly measures user experience, and calibrating the corresponding SLO target against customer churn ensures business alignment. Furthermore, implementing an error budget policy based on multi-window burn rate allows product teams to protect critical business events by pausing non-essential releases when reliability is at risk.

Adım Adım Çözüm

1
Identify metrics measuring user-perceived performance rather than internal infrastructure metrics.
Selected the proportion of successful low-latency requests as the SLI.
SLIs must reflect actual user experience (latency of video chunks) tied to business goals (subscriber retention).
2
Establish governance policies that connect technical reliability to release cadence.
Implemented burn-rate based error budget policies to pause deployments.
Error budget consumption controls feature release velocity to protect high-stakes business events.

Anahtar Kavram

Aligning technical service level metrics (SLIs/SLOs) and error budgets with business objectives and customer experience.
Soru 130Soru →

A multinational logistics company runs mission-critical workloads on Google Kubernetes Engine (GKE). The security team requires a centralized container posture enforcement mechanism that automatically prevents unauthorized image deployments in GKE clusters, scans build artifacts for known vulnerabilities in Artifact Registry, and detects runtime compromise attempts such as reverse shells or cryptocurrency mining at the node and hypervisor level via Security Command Center (SCC) Premium. Which combination of Google Cloud security controls satisfies these security requirements with minimal operational overhead?

Cevabı ve açıklamayı göster

Cevap: Configure Artifact Registry container vulnerability scanning, enforce image signature validation via Binary Authorization policies integrated with Cloud KMS and Cloud Build, and enable Security Command Center Premium Event Threat Detection and Container Threat Detection.

Cevap

Configure Artifact Registry container vulnerability scanning, enforce image signature validation via Binary Authorization policies integrated with Cloud KMS and Cloud Build, and enable Security Command Center Premium Event Threat Detection and Container Threat Detection.
The combination of Artifact Registry vulnerability scanning, Binary Authorization for deploy-time policy enforcement, and Security Command Center (SCC) Premium for runtime container and event threat detection provides comprehensive, native end-to-end security across the build, deploy, and runtime phases with minimal operational overhead.

Adım Adım Çözüm

1
Analyze build-time and storage security requirements
Artifact Registry automated vulnerability scanning continually checks container images for CVEs upon push.
Ensures software dependencies are audited early in the CI/CD pipeline.
2
Identify deploy-time governance mechanism
Binary Authorization validates digital signatures (attestations) created during Cloud Build before allowing image deployment on GKE.
Prevents unauthorized or unverified images from running in production GKE clusters.
3
Select runtime threat detection capability
Security Command Center Premium (Container Threat Detection and Event Threat Detection) analyzes kernel logs and GCP audit logs.
Detects container breaches, reverse shells, and malicious behavior at runtime without needing heavy third-party agent management.

Anahtar Kavram

End-to-End GCP Container Security Architecture (Binary Authorization, Container Analysis, SCC Premium)
Soru 131Soru →

An e-commerce platform headquartered in Japan is expanding operations into South Korea. To comply with local regulatory compliance and data sovereignty laws, all customer personally identifiable information (PII) must be stored and processed strictly within South Korean territory. Additionally, cloud service provider personnel must be prevented from accessing customer data without explicit, auditable authorization. As a Cloud Architect, which solution should you implement to satisfy these compliance and governance requirements?

Cevabı ve açıklamayı göster

Cevap: Enforce the gcp.resourceLocations Organization Policy constraint restricted to asia-northeast3 (Seoul), configure Customer-Managed Encryption Keys (CMEK) using key rings located in asia-northeast3, and enable Access Approval for the project.

Cevap

Enforce the gcp.resourceLocations Organization Policy constraint set to asia-northeast3, configure Customer-Managed Encryption Keys (CMEK) hosted in asia-northeast3, and enable Access Approval.
Combining the gcp.resourceLocations Organization Policy constraint, regional CMEK key rings in asia-northeast3, and Access Approval provides a complete compliance architecture. It locks resource creation to South Korea, guarantees customer-managed encryption within the region, and requires manual consent before Google engineers can access system data.

Adım Adım Çözüm

1
Enforce deployment location boundaries
Prevents resources from being provisioned outside the target geographical jurisdiction.
Applying the gcp.resourceLocations Organization Policy constraint locked to asia-northeast3 guarantees that storage and compute assets remain strictly in South Korea.
2
Configure regional encryption key management
Maintains localized cryptographic control over data at rest.
Using Cloud KMS with CMEK stored in regional key rings in asia-northeast3 fulfills sovereignty needs without the burden of self-managing raw key infrastructure.
3
Implement administrative access controls for provider personnel
Requires prior permission before Google support engineers can access customer data.
Enabling Access Approval enforces an explicit approval workflow for any cloud provider support interventions, fulfilling strict administrative compliance requirements.

Anahtar Kavram

Regulatory Compliance, Data Sovereignty, and Data Governance
Soru 132Soru →

A global video streaming provider is designing hybrid network connectivity between its primary on-premises data center and a Google Cloud VPC hosting low-latency rendering engines. The technical specification demands a minimum throughput of 20 Gbps and a strict 99.99% availability Service Level Agreement (SLA) using direct physical infrastructure. Which TWO architecture steps must the cloud architect execute to satisfy these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision four Dedicated Interconnect circuits distributed across two distinct edge availability domains in two separate Google Cloud regions.; Configure Cloud Routers in each target region and establish dynamic BGP sessions over VLAN attachments linked to each Dedicated Interconnect connection.

Cevap

To achieve 99.99% availability and high throughput (20 Gbps) without relying on public internet transit, the architect must provision four Dedicated Interconnect connections across two edge availability domains in two Google Cloud regions and configure Cloud Routers in each region with dynamic BGP routing across all VLAN attachments.
Achieving a 99.99% SLA and high bandwidth (20 Gbps) requires provisioning four Dedicated Interconnect connections across two edge availability domains in two separate Google Cloud regions, combined with Cloud Routers in each region to manage dynamic BGP route propagation over VLAN attachments.

Adım Adım Çözüm

1
Select Dedicated Interconnect topology for high throughput and high availability
Provides direct physical 10 Gbps / 100 Gbps circuits capable of reaching 99.99% SLA when configured across 2 edge availability domains (metros) and 2 GCP regions.
Cloud VPN relies on public internet transit and cannot guarantee 20 Gbps dedicated throughput or enterprise physical SLAs.
2
Configure Cloud Routers and dynamic BGP routing
Establishes dynamic route exchange and automated failover between on-premises routers and Google Cloud VPCs across all VLAN attachments.
Dynamic BGP routing managed by Cloud Router is mandatory for resilient Dedicated Interconnect failover.

Anahtar Kavram

Configuring 99.99% SLA Dedicated Interconnect with multi-region Cloud Router dynamic BGP routing
Soru 133Soru →

A financial institution is configuring its Google Cloud VPC infrastructure to provide private, secure access to a third-party SaaS provider hosted on GCP. The workload instances reside in private subnets across multiple regions within a single consumer VPC network, and on-premises operators access this VPC via a Dedicated Interconnect connection. The networking design must allow both Google Cloud Compute Engine instances and on-premises clients to access the vendor's service attachment privately without exposing traffic to the public internet or establishing direct VPC Network Peering with the vendor network. Which TWO configuration steps should the network architect implement?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision a Private Service Connect (PSC) consumer endpoint using an internal IP address from a subnet within the consumer VPC network.; Configure custom route advertisements on the Cloud Router associated with the Dedicated Interconnect to announce the PSC endpoint IP address range to the on-premises network.

Cevap

Provision a Private Service Connect (PSC) consumer endpoint using an internal IP address within the consumer VPC network, and configure custom route advertisements on the Cloud Router associated with the Dedicated Interconnect to announce the PSC endpoint IP address to the on-premises network.
Private Service Connect (PSC) allows the consumer VPC to allocate an internal IP address endpoint that targets a producer's published service attachment without establishing VPC Peering. To extend reachability to on-premises environments connected via Dedicated Interconnect, the Cloud Router managing the Interconnect BGP session must be configured with custom route advertisements for the PSC endpoint IP address.

Adım Adım Çözüm

1
Identify the private service publishing mechanism that avoids direct VPC Peering.
Private Service Connect (PSC) allows consumers to access published services privately using internal IP addresses within their own VPC without network peering.
PSC endpoints insulate network topologies and prevent overlapping IP address space conflicts between consumer and producer networks.
2
Determine how on-premises clients reach the published service endpoint over Dedicated Interconnect.
Configure custom route advertisements on the Cloud Router BGP session to explicitly advertise the PSC endpoint IP address or subnet to on-premises routers.
By default, Cloud Router advertises subnet primary and secondary ranges, but PSC endpoint IP rules require explicit custom route advertisement to be reachable across Cloud Interconnect.

Anahtar Kavram

Private Service Connect Endpoint Integration with On-Premises Networks via Cloud Router Custom Route Advertisement
Soru 134Soru →

An enterprise freight logistics company hosts its core real-time container tracking application on Google Cloud. The primary workload operates out of `us-central1`, with a secondary disaster recovery (DR) environment prepared in `us-east4` to satisfy a recovery point objective (RPO) of near-zero and a recovery time objective (RTO) of 15 minutes. The architecture team is designing an automated validation procedure for an upcoming unannounced DR simulation drill. The objective is to validate full regional failover capabilities, end-to-end network path integrity, and database readiness while minimizing risk to live production operations. Which TWO operational procedures must be incorporated into the DR validation framework to achieve this goal? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Programmatically verify and reserve required Compute Engine capacity and regional quota limits in us-east4 prior to executing the failover drill.; Inject synthetic transactions carrying dedicated test headers into the us-east4 failover endpoint to validate data ingestion and routing prior to updating production DNS records.

Cevap

The validation framework must include programmatically verifying and reserving regional Compute Engine quotas and capacity in the DR region prior to execution, as well as injecting synthetic test transactions into the failover endpoint to validate data ingestion and network routing before modifying production DNS entries.
A robust DR validation procedure requires pre-verifying regional resource quotas and capacity reservations in the failover region to avoid provisioning delays during failover. Additionally, injecting synthetic transactions into the DR environment validates complete application and network functionality prior to updating production DNS records.

Adım Adım Çözüm

1
Evaluate compute resource readiness and quota limits in the target disaster recovery region.
Ensure that the DR region (us-east4) has active capacity reservations and adequate API quota limits to instantiate required compute instances dynamically during failover.
Failing to pre-check regional quotas and capacity reservations can cause infrastructure provisioning failures during DR execution under load.
2
Establish synthetic testing mechanisms for traffic and data path verification.
Execute end-to-end transaction validation against the failover regional endpoint using synthetic telemetry tagged with test headers.
Synthetic validation confirms operational readiness of network routes, application services, and database writes in the failover region without impacting live production user sessions.

Anahtar Kavram

Developing Procedures for Business Continuity and Disaster Recovery Validation
Soru 135Soru →

A retail enterprise manages its workloads using a Google Cloud resource hierarchy structured with an Organization node and separate parent folders named Non-Production and Production. The Non-Production folder contains multiple projects dedicated to software development and automated testing. An external CI/CD deployment pipeline requires permissions to create, modify, and delete Compute Engine virtual machine instances and attached persistent disks across all current and future projects under the Non-Production folder. The security team requires that the solution minimizes management overhead while enforcing the principle of least privilege. Which IAM role assignment strategy should a Cloud Architect recommend?

Cevabı ve açıklamayı göster

Cevap: Grant the predefined Compute Instance Admin (v1) role to the deployment pipeline service account at the Non-Production folder level.

Cevap

Granting the predefined Compute Instance Admin (v1) role to the deployment pipeline service account at the Non-Production folder level satisfies least privilege and scales across all child projects automatically.
Granting the predefined Compute Instance Admin (v1) role at the Non-Production folder level relies on Google Cloud resource hierarchy inheritance. Any present or future project created under the Non-Production folder inherits this binding automatically, reducing administrative overhead. Additionally, using a predefined compute role rather than a primitive role ensures the service account receives only the permissions needed to manage Compute Engine resources.

Adım Adım Çözüm

1
Analyze resource scope and inheritance requirements.
The permissions must apply across all current and future projects located within the Non-Production folder tree.
IAM permissions assigned at a parent folder level are inherited down the resource hierarchy to all descendant child projects, minimizing maintenance effort.
2
Select the appropriate IAM role type adhering to least privilege.
The predefined Compute Instance Admin (v1) role (`roles/compute.instanceAdmin.v1`) provides full control over Compute Engine instances and disks without granting unrelated administrative permissions across other GCP services.
Predefined roles are preferred over primitive roles (Owner, Editor, Viewer) to prevent unnecessary administrative access.
3
Combine resource hierarchy scoping with predefined role binding.
Binding `roles/compute.instanceAdmin.v1` to the service account at the Non-Production folder level achieves automated inheritance and operational efficiency.
This avoids per-project manual configuration while keeping permissions restricted exclusively to non-production compute resources.

Anahtar Kavram

IAM Resource Hierarchy Inheritance and Predefined Role Scoping
Soru 136Soru →

A digital banking organization operates a hybrid event-driven microservices platform across Google Kubernetes Engine (GKE) and Cloud Functions. The cloud operations team must establish an end-to-end observability and telemetry architecture to trace multi-service payment transactions in real time, aggregate critical logs, and protect against loss of high-severity application errors while managing costs. Which TWO architectural decisions should the cloud architect implement to fulfill these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Instrument microservices using OpenTelemetry SDKs to propagate trace context across GKE pods and Cloud Functions, exporting trace spans directly to Cloud Trace.; Establish folder-level Log Router sinks with explicit inclusion filters to continuously stream high-priority application telemetry and error logs to Pub/Sub and BigQuery.

Cevap

The optimal solution combines OpenTelemetry context propagation to Cloud Trace for distributed transaction tracing across GKE and Cloud Functions, along with folder-level Log Router sinks using explicit inclusion filters to route critical log entries to BigQuery and Pub/Sub.
Implementing OpenTelemetry SDKs ensures trace context is seamlessly passed between GKE microservices and Cloud Functions, enabling Cloud Trace to map end-to-end request latency. Combining this with folder-level Log Router sinks using explicit inclusion filters allows the organization to reliably capture high-severity operational logs into BigQuery and Pub/Sub for auditing and real-time alerts.

Adım Adım Çözüm

1
Analyze trace propagation requirements for multi-service environments
Identify OpenTelemetry as the GCP-recommended open standard for distributed context propagation across GKE and serverless platforms to enable end-to-end latency analysis in Cloud Trace.
Tracing asynchronous calls across GKE microservices and serverless Cloud Functions requires standardized context propagation headers.
2
Design central log aggregation and routing rules
Configure folder-level Log Router sinks using targeted inclusion filters rather than broad exclusion filters.
Inclusion filters guarantee that critical and error severity logs are reliably captured into analytical sinks like BigQuery without accidental dropped logs.

Anahtar Kavram

Unified Google Cloud Observability integration through OpenTelemetry distributed tracing and structured Log Router ingestion filtering.
Soru 137Soru →

An automotive manufacturer is establishing a cloud architecture on Google Cloud to handle real-time telemetry and high-definition map updates for a connected fleet of autonomous vehicles. The conceptual architecture defines three logical tiers: high-throughput regional data ingestion, real-time time-series processing for operational status lookups, and long-term analytical reporting for fleet performance metrics. Which TWO physical GCP component choices correctly translate these logical requirements into Google Cloud resources while maintaining architectural efficiency? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision Cloud Pub/Sub for regional telemetry ingestion coupled with Cloud Bigtable for low-latency time-series storage and high-throughput operational status lookups.; Deploy Cloud Dataflow for unified stream processing to aggregate telemetry and load transformed historical data into BigQuery for fleet-wide analytical reporting.

Cevap

The optimal architecture combines Cloud Pub/Sub and Cloud Bigtable for high-throughput streaming ingestion and low-latency operational time-series data, along with Cloud Dataflow and BigQuery for stream processing and analytical data warehousing.
Translating the conceptual architecture into concrete GCP physical resources requires matching workload characteristics to optimal services. High-velocity streaming ingestion requires Cloud Pub/Sub, operational low-latency time-series queries require Cloud Bigtable, and real-time transformation into an analytical data warehouse requires Cloud Dataflow combined with BigQuery.

Adım Adım Çözüm

1
Map the conceptual ingestion tier requirement to physical GCP services.
Cloud Pub/Sub handles scalable regional streaming ingestion from autonomous vehicle fleets.
Decouples data producers from downstream consumers and handles massive influx of telemetry payloads.
2
Map the operational time-series status lookup tier requirement.
Cloud Bigtable provides low-latency key-value and time-series reads and writes.
Bigtable scales seamlessly for high-frequency write operations and rapid index-based telemetry lookups.
3
Map the long-term processing and analytics tier requirement.
Cloud Dataflow transforms stream data and loads historical metrics into BigQuery.
Dataflow executes stream windowing and pipeline transformations, enabling BigQuery to serve as the analytical warehouse.

Anahtar Kavram

Translating Conceptual and Logical Tiering to GCP Physical Resources
Soru 138Soru →

A telemetry platform company manages multiple environment folders (`Production`, `Development`) under a single Google Cloud Organization node. The security team needs to grant a deployment service account residing in a dedicated `Tools` project the exact permissions required to attach a workload-specific service account located in the `Production` project to newly created Compute Engine instances. The security team must enforce the principle of least privilege and ensure the deployment service account cannot modify IAM policies or create keys for the target service account. Which configuration should the security architect recommend?

Cevabı ve açıklamayı göster

Cevap: Grant the Service Account User role (`roles/iam.serviceAccountUser`) to the deployment service account directly on the target workload service account resource in the Production project.

Cevap

Grant the Service Account User role (`roles/iam.serviceAccountUser`) to the deployment service account directly on the target workload service account resource in the Production project.
Granting `roles/iam.serviceAccountUser` specifically on the target workload service account resource allows the deployment service account to attach the service account to Compute Engine instances without granting any permissions over other service accounts or broader project resources.

Adım Adım Çözüm

1
Identify the minimal permission needed for attaching a service account to a compute instance.
The necessary IAM permission is `iam.serviceAccounts.actAs`, which is included in the `roles/iam.serviceAccountUser` predefined role.
Compute Engine instances require the deploying identity to possess `actAs` permission on the service account assigned to the instance.
2
Determine the optimal resource hierarchy level for binding the IAM role.
Binding the role directly on the individual service account resource rather than at the project, folder, or organization level limits access strictly to the intended target.
IAM permissions inherit down the resource hierarchy; applying access at the resource level enforces the principle of least privilege.
3
Verify that administrative capabilities are excluded.
The `Service Account User` role does not permit modifying IAM policies or creating service account keys, fulfilling the operational requirements.
Administrative rights over service accounts require separate roles such as `roles/iam.serviceAccountAdmin` or `roles/iam.serviceAccountKeyAdmin`.

Anahtar Kavram

Identity and Access Management (IAM) Service Account Impersonation and Resource Hierarchy Scope
Tahmini Süre:1m 30s
Soru 139Soru →

An enterprise e-commerce platform hosts its core transaction services on Google Cloud Compute Engine instances and Cloud Run services. The cloud operations team notices escalating Google Cloud Logging ingestion costs driven by high-volume informational and debug logs. During a recent system outage, post-incident analysis revealed that critical error logs were missing because a broad exclusion filter was applied across all log entries. The lead cloud architect must reduce logging ingestion costs while ensuring that all high-severity error logs are retained in Cloud Logging for real-time operational alerting, and audit logs are archived to Cloud Storage for compliance. Which configuration strategy should the architect implement?

Cevabı ve açıklamayı göster

Cevap: Configure an exclusion filter on the _Default log bucket sink with the expression 'severity < ERROR' to exclude low-severity logs from ingestion into Cloud Logging, and create a separate log sink to export audit logs to Cloud Storage.

Cevap

The architect should configure an exclusion filter on the _Default log bucket sink with the filter expression 'severity < ERROR' to prevent low-severity logs from being ingested into Cloud Logging, while maintaining a dedicated sink for exporting audit logs to Cloud Storage.
Configuring an exclusion filter on the _Default sink with 'severity < ERROR' prevents low-severity logs (DEBUG, INFO, NOTICE) from being ingested into the log bucket, directly addressing high storage costs. Because the filter only excludes logs below ERROR severity, all high-severity logs (ERROR, CRITICAL, ALERT, EMERGENCY) are retained for real-time observability and incident response. Creating a separate sink for Cloud Storage ensures compliance log retention goals are met independently.

Adım Adım Çözüm

1
Analyze the logging requirements and cost drivers.
Informational and debug logs (severity below ERROR) drive up Cloud Logging ingestion costs, whereas logs with severity ERROR or higher are required for operational alerting.
Cloud Logging charges based on the volume of logs ingested into log buckets.
2
Determine the correct Cloud Logging exclusion filter logic.
Using 'severity < ERROR' as an exclusion filter on the _Default sink drops DEBUG, INFO, and NOTICE logs before ingestion, while allowing ERROR, CRITICAL, ALERT, and EMERGENCY logs to be stored in the bucket.
Exclusion filters prevent matching log entries from being ingested into specific sinks/buckets, directly controlling storage and ingestion costs.
3
Configure compliance routing for audit logs.
A dedicated log sink routes audit logs directly to Cloud Storage independently of log bucket exclusion filters.
Log Router sinks evaluate incoming logs prior to bucket ingestion, allowing parallel exports to Cloud Storage targets for long-term retention.

Anahtar Kavram

Cloud Logging Log Router Exclusion Filters and Sink Routing
Soru 140Soru →

An enterprise operations team needs to establish a centralized observability strategy across multiple Google Cloud projects. They must securely aggregate Cloud Audit Logs into BigQuery for security analytics while ensuring key operational alerts are triggered without exposing telemetry data to exfiltration risks. Which TWO configurations should the team implement to achieve these observability requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an aggregated Log Router sink at the organization level with a BigQuery dataset destination and a filter targeting Cloud Audit Logs.; Grant fine-grained predefined roles such as Logging Admin and Monitoring Notification Channel Editor to operational service accounts instead of primitive roles.

Cevap

The team should configure an aggregated Log Router sink at the organization level targeting BigQuery for audit logs and grant fine-grained predefined IAM roles to operational service accounts.
Configuring an aggregated Log Router sink at the organization level allows central streaming of Cloud Audit Logs to BigQuery across all constituent projects. Complementing this with fine-grained predefined IAM roles ensures service accounts possess only necessary permissions for operational monitoring and log routing without over-privilege.

Adım Adım Çözüm

1
Identify the proper GCP observability feature for centralized log aggregation across multi-project organizations.
An organization-level aggregated Log Router sink configured with a BigQuery destination and appropriate log filtering meets audit logging and analytical querying requirements efficiently.
Aggregated sinks collect log entries from child projects centrally without requiring manual per-project sink setup.
2
Select the appropriate access management posture for operational logging and monitoring service accounts.
Assign predefined, minimal-permission roles such as Logging Admin and Monitoring Notification Channel Editor.
Predefined roles align with IAM best practices by avoiding over-privileged primitive roles while enabling complete monitoring automation.

Anahtar Kavram

Centralized Log Aggregation and Observability IAM Least Privilege
ÖncekiSayfa 7 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin