Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 1401Soru →

A mobile gaming platform team is advising feature development teams on standardizing automated CI/CD deployment pipelines and Infrastructure as Code (IaC) practices on Google Cloud. The feature teams run workflows via GitHub Actions and manage GCP resources using Terraform. The architect must recommend a configuration that strictly adheres to Google Cloud security best practices by eliminating long-lived credentials and preventing state file corruption. Which TWO architectural recommendations should the platform team provide? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Workload Identity Federation to allow GitHub Actions workflows to authenticate to Google Cloud using short-lived OIDC tokens instead of exported service account keys.; Store Terraform state files in a Google Cloud Storage bucket configured with Object Versioning enabled and uniform bucket-level access.

Cevap

The platform team should advise using Workload Identity Federation for keyless authentication from GitHub Actions and leveraging Cloud Storage with Object Versioning as the remote backend for Terraform state files.
Advising teams on GCP implementation requires promoting keyless authentication and remote IaC state governance. Workload Identity Federation allows GitHub Actions runners to exchange OIDC tokens for short-lived GCP credentials without downloading service account JSON keys. Storing Terraform state in a Cloud Storage bucket with Object Versioning guarantees centralized state locking, concurrency safety, and point-in-time recovery.

Adım Adım Çözüm

1
Evaluate authentication strategy for external CI/CD pipelines
Workload Identity Federation provides keyless authentication using short-lived tokens, eliminating service account key management overhead and risk.
Security best practices require eliminating long-lived service account JSON keys.
2
Evaluate remote state management for Infrastructure as Code
Cloud Storage backends provide state locking and Object Versioning to safeguard IaC state across team deployments.
Local or Git-based state storage introduces concurrency conflicts and state file exposure.

Anahtar Kavram

Advising Development and Operation Teams on Keyless Authentication and IaC State Governance
Soru 1402Soru →

A regional renewable energy grid management enterprise is modernizing its central smart-meter telemetry and billing engine by migrating to Google Cloud. Executive leadership demands strict adherence to regulatory compliance, zero operational downtime during cutover, and high security. However, internal engineering and operations teams have raised concerns regarding their lack of familiarity with Google Cloud Identity and Access Management (IAM) and potential delays caused by cloud provisioning workflows. As the lead Professional Cloud Architect, which TWO technical and change management strategies should you implement to align stakeholder requirements and ensure operational readiness? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Perform a comprehensive quota assessment across all targeted Google Cloud regions early in the planning phase and submit capacity quota increase requests well before migration testing begins.; Establish a structured cloud skills enablement program paired with defined least-privilege IAM roles and governance guardrails to build internal operational competence.

Cevap

The correct strategies are to perform early regional quota assessment and proactive quota increase requests, alongside establishing a structured cloud enablement program with role-based IAM governance.
The combination of requesting regional quota increases in advance and implementing structured cloud training aligned with least-privilege IAM guardrails effectively addresses both technical execution risks and organizational change management needs.

Adım Adım Çözüm

1
Assess technical readiness and resource availability
Identified potential provisioning bottlenecks related to default regional quota limits for compute and storage resources.
Requesting quota increases early ensures capacity is available when testing and migration commence without delaying stakeholders.
2
Evaluate organizational change and security governance requirements
Determined that technical teams require enablement without compromising regulatory access controls.
A structured enablement program using predefined or custom least-privilege IAM roles builds long-term competency while satisfying security policies.

Anahtar Kavram

Analyzing Business Stakeholder Requirements and Managing Organizational Change
Soru 1403Soru →

A financial SaaS company hosts a transactional service on Google Cloud using a warm standby disaster recovery topology. The compute layer uses Compute Engine Managed Instance Groups (MIGs) deployed in primary region `us-central1` and secondary region `us-east4`. The database layer relies on Cloud SQL for PostgreSQL in `us-central1` with a cross-region read replica in `us-east4`. During an unexpected total outage of `us-central1`, the disaster recovery plan mandates achieving a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 1 minute. When executing the emergency failover, the operations team observes that attempting to scale out the secondary MIG in `us-east4` fails due to regional CPU quota exhaustion, while application traffic is still attempting to connect to `us-central1`. Which sequence of execution steps should the cloud architect mandate to successfully complete the disaster recovery failover within the target metrics?

Cevabı ve açıklamayı göster

Cevap: Promote the cross-region Cloud SQL read replica in `us-east4` to a standalone primary database instance, utilize pre-committed or reserved compute capacity in `us-east4` while requesting an emergency quota increase, and update Cloud DNS records with a low TTL to route traffic to the `us-east4` load balancer.

Cevap

Promote the cross-region Cloud SQL read replica in us-east4 to a standalone primary database instance, utilize pre-committed or reserved compute capacity in us-east4 while requesting an emergency quota increase, and update Cloud DNS records with a low TTL to route traffic to the us-east4 load balancer.
Executing a successful DR failover within tight RTO (< 15 min) and RPO (< 1 min) metrics requires promoting existing cross-region database replicas, leveraging pre-reserved compute resources to overcome regional quota bottlenecks, and shifting traffic via DNS updates.

Adım Adım Çözüm

1
Evaluate data replication status and promote the secondary database
Cloud SQL cross-region read replica in us-east4 is promoted to a standalone read-write primary instance, preserving data written right up to the outage (RPO < 1 minute).
Promoting an asynchronous/semi-synchronous cross-region replica is the standard GCP pattern for achieving minimal data loss without rebuilding the database.
2
Address compute capacity limits in the secondary region
Application workloads run on pre-reserved VM capacity in us-east4 while an emergency regional quota request is processed to handle additional burst traffic.
Relying purely on dynamic autoscaling during a regional disaster can fail if regional quotas or resource availability in the failover region are constrained.
3
Execute traffic switchover via DNS routing
Client connections shift from us-central1 endpoints to the us-east4 load balancer.
Updating DNS records with low Time-To-Live (TTL) or using Cloud DNS routing policies allows external clients to quickly resolve to the new operational regional ingress point.

Anahtar Kavram

Disaster Recovery Execution for Relational Databases and Compute Capacity Management
Soru 1404Soru →

An organization deploys a stateless microservice on Cloud Run in Project A. The application requires access to a database credential stored securely in Secret Manager within Project B. Corporate compliance policies mandate the strict elimination of long-lived service account key files and enforcement of least privilege access across project boundaries. Which architecture should you implement to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Attach a custom service account to the Cloud Run service in Project A, and grant that service account the Secret Manager Secret Accessor role specifically on the target secret in Project B.

Cevap

Attach a custom service account to the Cloud Run service in Project A, and grant that service account the Secret Manager Secret Accessor role specifically on the target secret in Project B.
Attaching a custom service account to the Cloud Run service in Project A enables keyless authentication using Application Default Credentials. Granting that service account the Secret Manager Secret Accessor role directly on the secret resource in Project B ensures cross-project access is constrained strictly to the required payload, fulfilling both zero-key security guidelines and least privilege requirements.

Adım Adım Çözüm

1
Identify identity management best practices for Google Cloud compute workloads.
Using runtime service accounts eliminates the need for long-lived service account JSON key files.
Cloud Run allows attaching a custom service account directly to the service instance.
2
Determine the required IAM role and scope for Secret Manager across project boundaries.
Granting `roles/secretmanager.secretAccessor` directly on the specific secret resource in Project B grants minimum necessary permissions.
Resource-level IAM bindings adhere to the principle of least privilege without granting project-wide access.

Anahtar Kavram

Cross-Project Secret Access and Service Account IAM Governance
Soru 1405Soru →

A telecommunications enterprise is onboarding manually provisioned core network billing resources—including custom VPC subnetworks, firewall rules, and Cloud SQL database instances—into a managed Infrastructure as Code (IaC) workflow using Terraform. The cloud architecture team must safely import these brownfield Google Cloud resources into a remote Cloud Storage (GCS) backend while ensuring zero downtime and preventing state corruption. What is the correct chronological sequence of operational steps to safely import and govern these existing resources using Terraform?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with writing matching HCL resource blocks and backend configuration, running `terraform init` to configure plugins and backend storage, executing `terraform import` to map live GCP resource IDs to state addresses, running `terraform plan` to confirm zero drift, and finally committing the verified configuration code to version control.
Safely bringing existing brownfield Google Cloud infrastructure into Terraform requires establishing matching HCL definitions and backend configuration first, initializing backend storage and provider plugins (`init`), mapping live GCP resource IDs into state metadata (`import`), verifying configuration alignment to ensure zero unexpected modifications (`plan`), and committing verified configuration files to Git.

Adım Adım Çözüm

1
Construct matching HCL resource declarations and define the GCS backend block.
Target resource schemas and remote state storage mechanisms are declared.
Terraform requires existing HCL declarations and backend configurations before state binding can take place.
2
Run `terraform init` in the root module directory.
Provider binaries are retrieved and GCS state locking is established.
Workspace initialization is mandatory for Terraform to load provider schemas and connect to state backends.
3
Execute `terraform import` for each live GCP resource.
Live resource attributes are populated into the state file without disrupting live services.
Import binds physical cloud resource unique identifiers to declared HCL state objects.
4
Run `terraform plan` to evaluate configuration alignment.
Plan output validates zero pending changes or unexpected resource replacements.
Verification ensures the manually written HCL matches all imported live infrastructure properties.
5
Commit code and lockfiles to version control.
Baseline IaC governance and CI/CD versioning are established.
Version controlling validated HCL configurations prevents state divergence across engineering teams.

Anahtar Kavram

Brownfield Resource Import and IaC State Governance
Soru 1406Soru →

A logistics enterprise hosts its core shipment-tracking application on Compute Engine Managed Instance Groups (MIGs) behind a Regional External Application Load Balancer. The application connects to a Cloud SQL for PostgreSQL database. The engineering team is planning a major application update that includes breaking changes to the database schema. The updates must be deployed with zero downtime, and the team must maintain the ability to immediately roll back traffic to the existing environment if errors occur. Which deployment and database strategy should the architect recommend?

Cevabı ve açıklamayı göster

Cevap: Implement an expand-contract database pattern by making backward-compatible schema changes first, deploy the new application version to a separate target MIG, switch load balancer traffic to the new MIG, and remove legacy database columns after validation.

Cevap

Implement an expand-contract database pattern by making backward-compatible schema changes first, deploy the new application version to a separate target MIG, switch load balancer traffic to the new MIG, and remove legacy database columns after validation.
The correct option correctly pairs a blue-green Compute Engine MIG strategy with the expand-contract database pattern. By ensuring database changes are backward-compatible before shifting traffic via the Regional External Application Load Balancer, both old and new instances can coexist safely, enabling zero-downtime cutover and instant rollback.

Adım Adım Çözüm

1
Analyze deployment constraints
Identified requirements for zero downtime, immediate rollback capabilities, and breaking database schema modifications.
Blue-green deployment with a dual-version compatible database layer is required to satisfy zero downtime and instant rollback.
2
Apply the Expand-Contract database pattern
Database additions (new columns/tables) are deployed in a backward-compatible manner so the legacy (blue) application continues functioning while the new (green) code is introduced.
Prevents database schema changes from breaking legacy instances during traffic transition.
3
Execute blue-green traffic switch and cleanup
Provision green MIG, validate health, update load balancer backend service weights, and contract (remove old schema elements) only after successful release.
Ensures full operational stability and seamless rollback capability throughout the release cycle.

Anahtar Kavram

Blue-Green Deployment with Expand-Contract Database Pattern
Soru 1407Soru →

An enterprise enterprise architecture team needs to establish a centralized log aggregation strategy across all Google Cloud projects under their organization node. The security and operational teams require high-priority audit logs and application error events to be ingested into a central BigQuery dataset for long-term compliance analysis, while minimizing log ingestion costs by dropping low-priority telemetry. Which logging configuration should the Cloud Architect implement to satisfy these requirements with minimal management effort?

Cevabı ve açıklamayı göster

Cevap: Create an aggregated log sink at the organization level targeting the central BigQuery dataset, configuring an inclusion filter for audit logs and high-severity error events while using exclusion filters for verbose debug logs.

Cevap

Create an aggregated log sink at the organization level targeting the central BigQuery dataset, configuring an inclusion filter for audit logs and high-severity error events while using exclusion filters for verbose debug logs.
The solution using an organization-level aggregated log sink with targeted inclusion and exclusion filters satisfies central compliance requirements with zero custom maintenance. It automatically captures logs across all projects and exports them to BigQuery while controlling ingestion cost.

Adım Adım Çözüm

1
Identify the architectural requirement for multi-project log aggregation.
Recognize that managing individual project sinks scales poorly, whereas an organization-level aggregated sink automatically captures logs across all present and future projects.
Organization-level sinks streamline administration and ensure non-repudiable log collection across the entire resource hierarchy.
2
Determine the appropriate filtering strategy to balance compliance and cost.
Use inclusion filters for high-severity error and audit logs to guarantee critical ingestion into BigQuery, while setting exclusion filters for non-essential debug telemetry.
Exclusion filters prevent costly ingestion of low-value logs without discarding vital security and error records.

Anahtar Kavram

Centralized Log Aggregation and Log Router Filtering
Soru 1408Soru →

An enterprise e-commerce platform processes asynchronous order validation events using Cloud Pub/Sub and a Managed Instance Group (MIG) of Compute Engine worker instances. During major promotional events, message ingestion rates spike abruptly, resulting in severe processing backlogs. The worker workload is primarily I/O-bound due to database validation calls, causing default CPU-based autoscaling to react too slowly. Additionally, during a recent peak event, scale-out attempts failed because the project hit the regional compute engine vCPU quota. Which TWO architectural and operational strategy changes should the Cloud Architect implement to ensure autoscaling reliability and sufficient operational capacity during peak traffic? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Managed Instance Group autoscaling policy to use a custom Cloud Monitoring metric tracking Cloud Pub/Sub unacknowledged message queue depth per instance, and combine it with predictive scaling or scheduled capacity rules.; Proactively analyze historical peak demand and submit regional vCPU and resource quota increase requests well in advance of anticipated promotional events.

Cevap

The architect should configure the Managed Instance Group autoscaler using a custom Cloud Monitoring metric tracking Cloud Pub/Sub queue depth (combined with scheduled/predictive scaling) and proactively request regional vCPU quota increases prior to expected traffic events.
The correct solution addresses both the metric responsiveness issue and the hard infrastructure boundary. Scaling based on Pub/Sub unacknowledged message depth accurately measures work backlog for I/O-bound tasks, while scheduled/predictive scaling pre-provisions baseline capacity for known events. Concurrently, submitting regional vCPU quota increases beforehand guarantees that GCP infrastructure has allocated sufficient capacity ceiling to allow the Managed Instance Group to scale out when traffic peaks.

Adım Adım Çözüm

1
Identify the performance bottleneck and metric misalignment
Recognize that I/O-bound tasks waiting on external services exhibit low CPU utilization, making CPU metrics ineffective for triggering timely scale-out events.
Autoscaling metrics must reflect actual work backlog; for message-driven microservices, queue depth or message age metrics directly correlate with required processing capacity.
2
Select appropriate queue-based and predictive autoscaling policies
Implement custom metric autoscaling based on Pub/Sub `num_undelivered_messages` target per instance, supplemented with scheduled autoscaling for planned events.
Queue-based metrics scale instances proportional to work waiting to be done, preventing backlog spikes and SLA breaches.
3
Perform capacity planning and quota verification
Calculate maximum required instance count during peak events and submit quota increase requests for regional vCPUs ahead of time.
GCP compute quotas are enforced at runtime; failing to secure sufficient quota beforehand causes instance creation failures regardless of autoscaler policies.

Anahtar Kavram

Queue-Based Autoscaling and Proactive Regional Quota Management
Soru 1409Soru →

An SRE team plans to execute a canary release for a critical service deployed on Google Kubernetes Engine (GKE) to safely introduce a new application revision. Order the following operational steps in the correct sequence from start to finish.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for conducting a canary release is to first deploy the new workload revision alongside the stable baseline, route a small fraction of traffic to it, monitor observability metrics for reliability, and finally shift 100% of traffic to the new revision while decommissioning old resources.
A standard canary release follows a structured progression: provision the new revision, split a small percentage of live traffic to test real-world behavior, evaluate telemetry against SLO performance standards, and finally promote the release to 100% traffic while terminating the old workload.

Adım Adım Çözüm

1
Deploy the new container revision to GKE without routing production traffic to it yet.
The canary workload is running independently next to the production workload.
Allows verification of basic health checks before exposing any real user requests.
2
Update traffic splitting rules at the load balancer/ingress level to route 5% of traffic to the canary revision.
A controlled subset of users hits the new application code.
Limits exposure and potential business impact in case hidden defects exist.
3
Analyze error rates, latency distribution, and CPU/memory utilization using Cloud Monitoring and Logging.
Metrics confirm the canary revision meets defined SLOs without consuming excessive error budget.
Empirical verification of reliability is required before proceeding with full deployment.
4
Promote the canary revision to receive 100% of production traffic and scale down old pods.
Deployment is complete and resource utilization is optimized.
Finalizes the release lifecycle safely.

Anahtar Kavram

Canary Deployment Workflow and Traffic Splitting
Soru 1410Soru →

Your Site Reliability Engineering (SRE) team is designing an end-to-end automated incident response and escalation workflow on Google Cloud to handle severe latency spikes in an enterprise web application. Place the operational steps in the correct chronological sequence from initial fault detection to incident resolution.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with Cloud Monitoring evaluating the SLI burn rate threshold, followed by publishing an alert payload to Pub/Sub, triggering a Cloud Function to execute automated remediation, and concluding with Cloud Monitoring verifying metric recovery to auto-resolve the incident.
The workflow follows a standard event-driven incident lifecycle: Detection (evaluating SLI burn rate) -> Notification (publishing to Pub/Sub) -> Action (executing programmatic remediation via Cloud Function) -> Verification & Resolution (monitoring SLI stabilization and closing the alert).

Adım Adım Çözüm

1
Detect metric anomaly
Cloud Monitoring identifies an SLO burn rate condition breach over the specified evaluation window.
Alerting policies continuously monitor SLI metrics before triggering notification mechanisms.
2
Trigger notification channel
An incident payload is pushed to a Pub/Sub topic dedicated to operational automation.
Pub/Sub decouples alert detection from programmatic downstream remediation logic.
3
Execute automated mitigation
A Cloud Function processes the alert payload and dynamically updates infrastructure configurations.
Event-driven serverless functions provide immediate, hands-free self-healing capabilities.
4
Verify recovery and resolve
Metric values stabilize below the alert threshold, marking the incident state as resolved.
Cloud Monitoring validates that the remediation successfully restored service health before closing the alert.

Anahtar Kavram

Automated Incident Remediation and Alert Escalation Workflow
Soru 1411Soru →

A global logistics provider operates its tracking and route-optimization infrastructure on Google Cloud. The workload environment includes a 24/7 steady-state compute footprint for order tracking services, highly unpredictable batch processing for peak route calculations that runs intermittently for 2–3 hours, and an enterprise BigQuery data warehouse where ad-hoc analytical queries by business analysts frequently cause budget overruns. The FinOps team must establish cost optimization governance that reduces compute spend and caps analytical query costs without degrading operational performance. Which TWO architectural and governance strategies should the team implement? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply 3-year Flexible Committed Use Discounts (CUDs) for the 24/7 steady-state compute baseline, and utilize Spot VMs with autoscaling for the unpredictable batch route calculation workloads.; Configure BigQuery custom cost controls by enforcing daily quota limits on bytes processed per user and project, combined with slot reservations for critical operational analytics workloads.

Cevap

The team should apply Flexible Committed Use Discounts to cover the 24/7 steady-state compute baseline while leveraging Spot VMs for intermittent batch jobs, and establish BigQuery custom cost controls using daily query byte limits alongside slot reservations for reporting.
Combining Flexible Committed Use Discounts for steady 24/7 baseline compute with Spot VMs for fault-tolerant intermittent batch workloads delivers maximum compute savings. Enforcing BigQuery daily query byte quotas directly prevents budget overruns from unoptimized ad-hoc SQL queries while slot reservations cap reporting costs.

Adım Adım Çözüm

1
Analyze compute workload profiles for cost-efficiency
Identified steady 24/7 footprint suited for CUDs and intermittent batch jobs suited for Spot VMs
Matching workload predictability with the correct financial model (CUD vs Spot) maximizes savings without incurring unutilized commitment costs.
2
Establish governance over BigQuery ad-hoc query execution and reporting costs
Configured per-user/per-project daily query byte quotas and slot reservations
Setting byte quotas prevents accidental or runaway query execution costs, while slot reservations provide cost predictability for key business reports.

Anahtar Kavram

FinOps Cost Optimization and Compute/Data Governance in GCP
Soru 1412Soru →

A enterprise healthcare provider is migrating a legacy patient management platform from an on-premises data center to Google Cloud. The system consists of a monolithic application server tier coupled to an on-premises 15 TB MySQL database. The business requirement dictates a strict maximum downtime window of 2 hours during final cutover. Additionally, the application suffers from significant technical debt, specifically direct IP-based service addressing and hardcoded database endpoints.

To successfully mitigate the technical debt while meeting the strict downtime constraint, which TWO migration and operational strategies should the Cloud Architect recommend? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish continuous binary log (binlog) CDC replication to Cloud SQL for MySQL using Database Migration Service for initial seed and online sync prior to cutover.; Implement Cloud DNS Private Zones to replace hardcoded IP addresses with internal domain names across application configurations prior to cutover.

Cevap

The correct strategies are establishing continuous binary log replication to Cloud SQL using Database Migration Service and replacing hardcoded IP addresses with Cloud DNS Private Zones before cutover.
Continuous Change Data Capture (CDC) via binlog replication with Database Migration Service enables online synchronization of the 15 TB dataset, reducing the cutover process to a quick replication catch-up and primary promotion well under the 2-hour threshold. Concurrently, introducing Cloud DNS Private Zones remediates legacy networking technical debt by replacing static IP dependencies with manageable DNS records.

Adım Adım Çözüm

1
Analyze database migration downtime constraints
A 15 TB database cannot be migrated within a 2-hour window using offline import or one-time cold copy; continuous CDC replication is required.
Database Migration Service (DMS) leverages MySQL binlog replication to continuously sync deltas while the source remains active, allowing a near-zero downtime cutover.
2
Remediate networking technical debt
Decouple application configuration from physical host IP addresses using Cloud DNS Private Zones.
Hardcoded IP addresses prevent smooth DNS-based switchover and failover. Establishing private DNS endpoints resolves technical debt prior to shifting application instances.
3
Evaluate and eliminate non-viable architectural patterns
Reject Cloud Spanner migration and Transfer Appliance offline shipping.
Cloud Spanner introduces schema and query incompatibility for standard MySQL stored procedures, while Transfer Appliance cannot support continuous delta synchronization for a tight 2-hour cutover window.

Anahtar Kavram

Legacy Cloud Migration and Technical Debt Mitigation
Tahmini Süre:2m 30s
Soru 1413Soru →

A satellite earth observation enterprise processes high-resolution imagery stored in Google Cloud Storage buckets and BigQuery datasets located within a dedicated project named proj-geo-data. Internal analytics applications run on Compute Engine instances within a private Virtual Private Cloud (VPC). The security architecture team requires that even if a valid user identity or service account credential is compromised, data cannot be copied or exfiltrated to external Cloud Storage buckets outside the organizational boundary. Additionally, authorized on-premises analysts must access these storage and database services through private network paths without traversing the public internet. Which solution architecture satisfies these security and access requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a VPC Service Controls service perimeter that encloses proj-geo-data with Cloud Storage and BigQuery configured as restricted services, and set up Private Service Connect endpoints with the Restricted VIP to route on-premises traffic internally to Google APIs.

Cevap

The correct architecture is to establish a VPC Service Controls service perimeter enclosing the project with Cloud Storage and BigQuery as restricted services, combined with Private Service Connect or Restricted VIP routing for private on-premises API connectivity.
Establishing a VPC Service Controls perimeter around the project housing Cloud Storage and BigQuery guarantees that API requests to restricted services are validated against perimeter boundaries. Even if a user has valid IAM read permissions, VPC Service Controls prevents reading data from inside the perimeter and copying it to a Cloud Storage bucket outside the perimeter. Using Private Service Connect endpoints or the Restricted VIP ensures that on-premises users reach Google services over private Interconnect/VPN tunnels without using public IP addresses.

Adım Adım Çözüm

1
Analyze the exfiltration prevention requirement
Identified that IAM controls access but does not restrict destination targets for API calls.
VPC Service Controls is specifically designed to create a network-level boundary around GCP services like Cloud Storage and BigQuery to prevent data exfiltration to resources outside the perimeter.
2
Analyze the private network connectivity requirement for on-premises analysts
Identified that accessing Google APIs privately from on-premises requires Private Google Access or Private Service Connect.
Configuring Private Service Connect or the Restricted VIP (199.36.153.4/30) allows hybrid networks to resolve *.googleapis.com to private IP endpoints, keeping traffic off the public internet and remaining compliant with the VPC Service Controls perimeter.

Anahtar Kavram

VPC Service Controls and Private Access Mechanisms
Soru 1414Soru →

A Cloud Operations Engineer manages administrative operations across development, staging, and production Google Cloud projects from a centralized management instance. The engineer runs bash scripts that utilize the gcloud CLI to query and manage cloud resources. Currently, switching between environments relies on globally updating the default project using 'gcloud config set project <PROJECT_ID>', which recently resulted in a staging configuration script executing against the production environment. Which approach should the engineer adopt to prevent cross-environment misconfigurations during programmatic gcloud CLI executions?

Cevabı ve açıklamayı göster

Cevap: Create named gcloud configurations for each environment and activate them as needed, or override the active configuration per script execution using the CLOUDSDK_CORE_PROJECT environment variable.

Cevap

Create named gcloud configurations for each environment and activate them as needed, or override the active configuration per script execution using the CLOUDSDK_CORE_PROJECT environment variable.
The correct option leverages native gcloud CLI configuration management mechanisms. Named configurations ('gcloud config configurations create') allow storing separate defaults for account, project, and region across different deployment environments. In automated scripts, setting the CLOUDSDK_CORE_PROJECT environment variable or specifying the --project flag provides explicit, non-destructive scoping per execution.

Adım Adım Çözüm

1
Identify the cause of cross-environment execution errors when using gcloud CLI.
Global state changes made via 'gcloud config set project' affect all concurrent or subsequent shell sessions using the default profile.
Global CLI property mutations create race conditions and human error risks when managing multiple environments.
2
Evaluate Google Cloud programmatic CLI configuration management features.
Named configurations ('gcloud config configurations') isolate account, project, and compute parameters per profile.
Dedicated configurations allow deterministic switching between environment profiles.
3
Apply environment-level isolation techniques for automated execution.
Setting 'CLOUDSDK_CORE_PROJECT' or passing the '--project' flag directly limits the scope of the command execution to the intended project.
Environment variables and command flags override global default configurations atomically without side effects.

Anahtar Kavram

gcloud CLI Named Configurations and Environment Variable Overrides
Soru 1415Soru →

An enterprise financial technology platform processes high-throughput asynchronous ledger events via a pipeline powered by Google Cloud Pub/Sub, Cloud Run microservices, and Cloud Spanner. The Site Reliability Engineering (SRE) team defines a Service Level Objective (SLO) requiring 99.9%99.9\% of event processing requests to succeed over a 30-day rolling window. The team needs to implement an alerting strategy that reliably detects severe outages exhausting the monthly error budget rapidly while suppressing false-positive alerts caused by brief, self-correcting transient spikes. Which alerting policy should the Cloud Architect recommend?

Cevabı ve açıklamayı göster

Cevap: Implement multi-window, multi-burn-rate alerts based on error budget consumption, triggering critical notifications when 2%2\% of the 30-day budget is burned within a 1-hour window.

Cevap

Implement multi-window, multi-burn-rate alerts based on error budget consumption, triggering critical notifications when 2%2\% of the 30-day budget is burned within a 1-hour window.
According to Google SRE principles and GCP Cloud Monitoring standards, multi-window multi-burn-rate alerting is the recommended pattern for SLO management. A 1-hour window detecting 2%2\% budget consumption represents a 14.4×14.4\times burn rate. Using multiple windows (e.g., 1-hour short window and 6-hour long window) ensures alerts trigger only when significant budget is actively being spent, providing high precision and recall.

Adım Adım Çözüm

1
Analyze the operational objective
The system requires an alerting strategy aligned with SRE best practices to protect a 99.9%99.9\% 30-day availability SLO without generating false positives.
Alerting directly on error budget consumption rate prevents both alert fatigue and delayed incident response.
2
Evaluate alerting mechanism choices against SRE error budget principles
Multi-window, multi-burn-rate alerts measure consumption rate (e.g., 14.4×14.4\times burn rate over 1 hour consuming 2%2\% of budget) across short and long lookback windows.
This guarantees that high burn rates trigger immediate escalations while smaller, self-healing events reset without paging on-call engineers.
3
Eliminate flawed alerting practices
Static metric thresholds, resource saturation metrics (CPU/RAM), and instantaneous target checks fail to measure cumulative budget consumption accurately.
Resource metrics monitor capacity rather than reliability, and static thresholds do not adapt to multi-day SLO budget windows.

Anahtar Kavram

Error Budget Burn-Rate Alerting
Soru 1416Soru →

An enterprise team is preparing to launch a high-throughput data processing application on Google Compute Engine that requires hundreds of new VM instances in a specific region. To ensure the automated scaling policies will execute reliably without running into infrastructure restriction failures during peak demand, which capacity planning action should the Cloud Architect perform prior to deployment?

Cevabı ve açıklamayı göster

Cevap: Verify regional resource limits and submit a request for regional Compute Engine quota increases in advance.

Cevap

Verify regional resource limits and submit a request for regional Compute Engine quota increases in advance.
Proactive quota management is a fundamental requirement of capacity planning in Google Cloud. Verifying and requesting necessary regional resource quota increases in advance guarantees that Managed Instance Groups and autoscalers can provision required instances without hitting API or quota caps during peak scaling events.

Adım Adım Çözüm

1
Assess workload scaling ceiling
Identify peak instance counts needed during traffic bursts.
Capacity planning requires knowing the maximum potential resource footprint.
2
Check project quotas
Compare required instance/CPU counts against existing Google Cloud regional quotas.
Exceeding project limits prevents Managed Instance Groups from provisioning additional VMs.
3
Request quota adjustment
Submit quota increases ahead of peak demand events.
Proactive quota management guarantees infrastructure availability when auto-scaling triggers.

Anahtar Kavram

Proactive Quota Request and Capacity Planning
Soru 1417Soru →

An enterprise SaaS platform deployed across Google Kubernetes Engine (GKE) clusters uses an Application Load Balancer to route user traffic. During a scheduled database maintenance window, the database experienced transient latency spikes, causing the Application Load Balancer to mark all backend pods as unhealthy and leading to a complete service outage. Subsequent analysis showed that the load balancer health checks were executing deep SQL queries against the database, and static CPU utilization alerts failed to warn the Site Reliability Engineering (SRE) team before the error budget was completely consumed. Which TWO architectural and alerting strategies should the SRE team implement to prevent cascading service failures and establish effective automated incident management?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Reconfigure the load balancer health check to query a shallow endpoint on the application that returns HTTP 200 OK without evaluating deep database dependencies.; Implement multi-window, multi-burn-rate alerting in Cloud Monitoring based on HTTP 5xx error rates and latency SLIs to trigger incidents before error budgets are exhausted.

Cevap

The SRE team should reconfigure the load balancer health checks to use a shallow application endpoint that does not query downstream databases, and establish multi-window error budget burn-rate alerts based on user-facing latency and HTTP 5xx SLIs in Cloud Monitoring.
To prevent cascading failures during database latency events, load balancer health checks should hit a shallow endpoint that confirms the container process is running without performing deep database operations. Additionally, configuring multi-window error budget burn-rate alerts in Cloud Monitoring ensures SRE teams receive timely alerts based on actual SLI impact (latency and 5xx errors) before the error budget is depleted.

Adım Adım Çözüm

1
Analyze the cause of the cascading health check failure.
Identified that deep health check probes querying the database caused healthy web pods to be marked dead when the database experienced transient latency.
Health checks for load balancers must only verify local application process health (shallow health check) to avoid removing valid backends during upstream dependency degradation.
2
Evaluate the alerting requirement for proactive incident response.
Determined that static CPU thresholds failed to alert SREs about user-impacting outages caused by database latency.
SRE best practices recommend multi-window, multi-burn-rate alerting on Service Level Indicators (SLIs) like request latency and error rates to detect rapid error budget depletion.

Anahtar Kavram

Shallow Health Checks and Multi-Window Error Budget Burn-Rate Alerting
Soru 1418Soru →

A security architect needs to configure secure, keyless developer access to GCP Secret Manager across Google Cloud projects. The compliance policy strictly prohibits generating or downloading external JSON service account keys. Place the steps required to establish secure service account impersonation for short-lived credential generation in the correct logical sequence.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins by defining the target service account identity, configuring least-privilege access permissions on Secret Manager resources, assigning the Service Account Token Creator role to developer user principals, and finally configuring application client tools to impersonate the service account via short-lived credentials.
The valid sequence establishes infrastructure identity first (target service account creation), applies least-privilege authorization to the Secret Manager resources next, assigns short-lived token generation permissions (Token Creator role) on the service account identity to user groups, and lastly configures the local developer execution environment to request impersonated credentials.

Adım Adım Çözüm

1
Provision the target workload identity
A dedicated service account exists in the project containing the target secrets.
Security best practices mandate establishing a distinct service account principal dedicated to specific resource access.
2
Assign resource-level access permissions
The target service account is granted secretaccessor privileges on Secret Manager resources.
Enforcing the principle of least privilege ensures the service account can only perform allowed API actions on designated secrets.
3
Delegate impersonation permissions to user principals
Developer user identities are granted roles/iam.serviceAccountTokenCreator on the target service account resource.
Impersonation requires explicit IAM authorization allowing the user identity to mint short-lived credentials for the target service account.
4
Initialize client context for impersonated API calls
Developers run API calls using short-lived tokens generated on-the-fly without static key downloads.
Configuring client tooling to use impersonation flags seamlessly redirects request authorization through the IAM Credentials API.

Anahtar Kavram

Service Account Impersonation and Short-Lived Credentials Lifecycle Security
Soru 1419Soru →

A logistics company utilizes an external GitHub Actions CI/CD runner to deploy microservices to Google Cloud. The deployment pipeline requires access to sensitive environment parameters stored in Secret Manager. Company security policy strictly forbids generating, downloading, or storing long-lived service account JSON keys. Which TWO architectural recommendations should you implement to satisfy these requirements securely while adhering to least privilege? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Workload Identity Federation using OpenID Connect (OIDC) to exchange short-lived external GitHub tokens for Google Cloud service account federated credentials.; Grant the target service account the Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) bound specifically to the required secret resources.

Cevap

The correct architecture requires setting up Workload Identity Federation using OpenID Connect (OIDC) to exchange short-lived tokens and granting the target service account the Secret Manager Secret Accessor role bound specifically to the required secret resources.
To secure external CI/CD pipelines without exposing long-lived credentials, Google Cloud recommends using Workload Identity Federation with OpenID Connect (OIDC). This configuration allows the external runner to present short-lived identity tokens in exchange for federated GCP service account access tokens. Additionally, adhering to the principle of least privilege requires granting fine-grained roles—specifically Secret Manager Secret Accessor—directly on the required secret objects rather than applying broad project-level permissions.

Adım Adım Çözüm

1
Establish keyless authentication between the external CI/CD system and Google Cloud.
Workload Identity Federation authenticates GitHub Actions via short-lived OIDC tokens without requiring static JSON service account keys.
Eliminates the risk of long-lived credential leakage in external systems.
2
Apply fine-grained IAM permissions to the target service account.
The Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) is granted only on the specific secret resources needed by the pipeline.
Ensures the service account has only the permissions required to read secret payloads without project-wide or administrative access.

Anahtar Kavram

Keyless authentication with Workload Identity Federation combined with resource-level IAM roles for secrets management.
Soru 1420Soru →

An enterprise online reservation platform hosts its core booking microservice on Google Kubernetes Engine (GKE) backed by a Cloud SQL for PostgreSQL database. The platform team needs to execute a zero-downtime release featuring a major application update and a breaking database schema migration. What is the correct sequence of steps to safely execute this blue-green deployment without service disruption or data corruption?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: 1) Execute the expand database migration to add new schema elements without breaking existing logic, 2) Deploy the Green microservice revision to GKE while keeping live traffic on Blue, 3) Update the HTTPRoute resource to shift traffic to Green, and 4) Execute the contract database migration to clean up legacy schema objects once Green stability is confirmed.
Executing a zero-downtime release with breaking database schema changes requires decoupled, backwards-compatible deployment phases. First, the database schema must be expanded by adding new columns as nullable or with defaults, allowing the running Blue version to operate uninterrupted. Next, the Green workload is deployed in parallel on GKE to verify its readiness. Traffic is then shifted instantly using GKE routing controls. Finally, after validating the Green release and draining Blue connections, a contract migration safely removes the legacy database columns.

Adım Adım Çözüm

1
Expand Database Schema
Database supports both old and new application versions simultaneously.
Prevents database exceptions in the currently active Blue deployment when new database structures are introduced.
2
Deploy Green Environment
Green application version is running and healthy in GKE, isolated from user traffic.
Allows verification of new container pods without exposing live end-users to unverified pods.
3
Shift Traffic to Green
100% of production traffic is processed by the new Green application release.
Executes a zero-downtime cutover at the networking layer.
4
Contract Database Schema
Legacy schema columns and unused database objects are safely purged.
Completes the schema evolution lifecycle once rollback to the Blue version is no longer required.

Anahtar Kavram

Expand-Contract Database Migration Pattern in Blue-Green Deployments
ÖncekiSayfa 71 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin