Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 1421Soru →

A cloud architecture team needs to establish a standard Terraform workflow to manage Google Cloud infrastructure with remote state management. What is the correct sequence of steps to configure and execute this Infrastructure as Code workflow from start to finish?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of operations begins with creating the GCS remote state bucket, followed by configuring the backend in Terraform code, initializing the directory with `terraform init`, generating an execution plan with `terraform plan`, and finally applying the configuration with `terraform apply`.
The standard Terraform deployment sequence requires establishing backend state storage before initialization, initializing the working directory before planning changes, and reviewing an execution plan before applying infrastructure modifications to Google Cloud.

Adım Adım Çözüm

1
Provision remote state storage infrastructure
A Cloud Storage bucket with versioning is ready to serve as the backend.
Terraform requires an existing storage location before it can bind its state remotely.
2
Configure the Terraform backend code block
The Terraform code points to the created Cloud Storage bucket.
Declarative backend configuration establishes the connection parameters for remote state tracking.
3
Run initialization command
Provider plugins are downloaded and the backend state storage connection is initialized.
`terraform init` must be executed before planning or applying infrastructure.
4
Run speculative plan preview
An execution plan is generated detailing resource additions, modifications, or deletions.
`terraform plan` ensures safety and operational predictability prior to resource mutation.
5
Apply infrastructure changes
GCP resources are created or modified and state is locked and updated in Cloud Storage.
`terraform apply` executes the planned actions against the live Google Cloud environment.

Anahtar Kavram

Terraform Remote State Workflow Lifecycle
Soru 1422Soru →

An enterprise organization is designing an observability and log management strategy for its microservices application on Google Cloud. The operations team needs to minimize Cloud Logging storage costs for routine operational telemetry while ensuring that all high-severity application errors and security audit logs are reliably exported to BigQuery for long-term compliance analysis. Which TWO configuration steps should the Cloud Architect implement to satisfy these requirements? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Log Router exclusion filters on the _Default log sink to filter out DEBUG and INFO level logs before ingestion into Log Storage.; Create a Log Router sink with an inclusion filter for severity>=ERROR and audit logs, setting a BigQuery dataset as the destination.

Cevap

The optimal solution requires creating a Log Router sink targeting BigQuery with an inclusion filter for high-severity and audit logs, along with defining exclusion filters on the _Default sink to drop low-severity DEBUG and INFO logs.
To achieve cost optimization while satisfying compliance requirements, low-value logs (DEBUG and INFO) should be excluded from ingestion via _Default sink exclusion filters, while high-value log events (severity >= ERROR and security audit logs) must be routed to BigQuery using a dedicated Log Router sink.

Adım Adım Çözüm

1
Analyze cost optimization requirements for Cloud Logging telemetry.
Identified that routine DEBUG and INFO logs contribute heavily to ingestion costs without adding long-term compliance value.
Exclusion filters on the default sink prevent ingestion into log buckets while keeping necessary operational logs.
2
Configure destination routing for compliance audit and error logs.
Created a dedicated Log Router sink pointing to BigQuery using an inclusion filter matching severity >= ERROR and audit logs.
Ensures critical security and failure telemetry is stored in BigQuery for long-term retention and analytical query capability.

Anahtar Kavram

Cloud Logging Log Router Sinks and Exclusion Filters
Soru 1423Soru →

An enterprise logistics corporation is modernizing an aging on-premises inventory tracking system to resolve severe technical debt. The current workload consists of a legacy monolithic web application running on custom-configured Linux virtual machines (VMs) and a single-region 15 TB15\text{ TB} PostgreSQL database. Over years of operation, manual server configurations have caused severe configuration drift, while custom deployment scripts frequently break during release cycles.

The leadership team wants to migrate the system to Google Cloud over an upcoming weekend maintenance window. The primary objectives are to minimize ongoing server maintenance overhead, avoid unnecessary infrastructure costs, and prevent data exfiltration from staging storage buckets by authorized users. The organization already operates an active 10 Gbps10\text{ Gbps} Partner Interconnect link to Google Cloud with abundant available bandwidth.

Which TWO architectural patterns should the Cloud Architect recommend to address the technical debt and fulfill the migration requirements? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Migrate the relational workload to Cloud SQL for PostgreSQL and establish continuous data replication using Database Migration Service (DMS) prior to final cutover.; Refactor the application into lightweight container images deployed to Cloud Run, and enforce a VPC Service Controls perimeter around Cloud Storage data landing buckets.

Cevap

The architect should select Cloud SQL for PostgreSQL with Database Migration Service for database migration, and deploy containerized application workloads to Cloud Run guarded by VPC Service Controls for storage perimeter protection.
Migrating to Cloud SQL for PostgreSQL via Database Migration Service (DMS) enables continuous online database replication over the existing 10 Gbps10\text{ Gbps} Interconnect, minimizing cutover downtime while removing self-managed VM database technical debt. Simultaneously, containerizing the application onto serverless Cloud Run eliminates VM configuration drift, while VPC Service Controls protect Cloud Storage landing buckets against data exfiltration by enforcing security boundaries that IAM alone cannot guarantee.

Adım Adım Çözüm

1
Analyze database migration strategy based on database size, network capacity, and target managed service.
A 15 TB15\text{ TB} dataset over a 10 Gbps10\text{ Gbps} dedicated line takes approximately 3.5 to 5 hours to transfer online. Database Migration Service (DMS) to Cloud SQL for PostgreSQL is the optimal managed approach.
Cloud SQL eliminates relational VM infrastructure management debt, while DMS enables initial online snapshot migration followed by low-downtime continuous replication.
2
Evaluate compute modernization strategy to address manual VM configuration drift.
Containerizing stateless web endpoints and hosting them on Cloud Run removes OS maintenance and infrastructure overhead without needing Kubernetes management.
Cloud Run provides serverless container execution that directly resolves manual configuration drift and reduces operational overhead.
3
Evaluate security controls against data exfiltration risks.
VPC Service Controls must be implemented around Cloud Storage landing buckets.
IAM roles control resource access permissions, but only VPC Service Controls establish network perimeters that prevent authorized users from exfiltrating data outside approved Google Cloud project boundaries.

Anahtar Kavram

Managing cloud migration debt by balancing serverless/managed service adoption (Cloud Run and Cloud SQL) against operational overhead and over-engineering anti-patterns.
Soru 1424Soru →

A multinational financial processing enterprise is designing perimeter controls for its multi-tenant workload architecture on Google Cloud. Match each specific network security requirement on the left with the most appropriate Google Cloud perimeter control mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Prevent data exfiltration from managed analytics services like BigQuery and Cloud Storage to unauthorized external resources, even when authenticated with valid IAM credentials.
Inspect incoming HTTPS traffic at the edge of Google Cloud External HTTP(S) Load Balancers to mitigate Layer 7 SQL injection and cross-site scripting (XSS) attacks.
Enforce mandatory baseline egress network firewall rules across all VPC networks across all folders in the GCP organization without allowing project administrators to override them.
Enable private, unidirectionally exposed access to a third-party SaaS partner application hosted in an external VPC without establishing full VPC Network Peering.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Data exfiltration prevention matches VPC Service Controls; Layer 7 HTTPS threat protection matches Cloud Armor Security Policies; Organization-level enforced network security rules match Hierarchical Firewall Policies; Private third-party service access without peering matches Private Service Connect.
Each perimeter control satisfies a distinct security layer in Google Cloud: VPC Service Controls protect API and storage service boundaries against data exfiltration; Cloud Armor provides Layer 7 WAF protections at the load balancer edge; Hierarchical Firewall Policies mandate organization-level network restrictions across the resource hierarchy; Private Service Connect provides secure, isolated service access across networks without establishing network peering.

Adım Adım Çözüm

1
Analyze data exfiltration prevention requirement for managed GCP services.
Identified that IAM alone cannot prevent unauthorized egress of data to external buckets; VPC Service Controls establish explicit perimeter boundaries.
VPC Service Controls block network-level access to API resources from outside the designated perimeter.
2
Evaluate web application security requirements at the load balancer edge.
Identified Cloud Armor as the WAF filter operating at the HTTP(S) load balancer level for Layer 7 protection.
Cloud Armor evaluates pre-configured WAF rules (SQLi, XSS) before traffic reaches compute backends.
3
Identify resource hierarchy control for enterprise-wide firewall governance.
Selected Hierarchical Firewall Policies attached at the Organization or Folder node.
Hierarchical firewall rules delegate or enforce rules top-down, taking precedence over project-level firewall rules.
4
Evaluate private cross-VPC service access mechanisms.
Selected Private Service Connect for publishing and consuming endpoints privately across administrative boundaries.
Private Service Connect avoids overlapping IP spaces and transitive routing risks inherent in traditional VPC Peering.

Anahtar Kavram

Google Cloud Perimeter Security & Network Isolation Controls
Soru 1425Soru →

A global telecommunications enterprise is migrating its legacy billing and subscription management platform from an on-premises data center to Google Cloud. The architecture consists of a 12 TB single-region PostgreSQL relational database with historical technical debt and a set of simple, stateless HTTP web services that process customer subscription requests.

The organization mandates a phased migration strategy with zero data loss and minimal operational maintenance after migration. The existing on-premises network link is a low-bandwidth Cloud VPN connection that cannot sustain continuous database replication alongside daily production traffic.

Which combination of Google Cloud services and migration patterns best addresses the technical debt, network bandwidth constraints, and operational goals?

Cevabı ve açıklamayı göster

Cevap: Provision a Dedicated Interconnect connection, use Database Migration Service (DMS) for continuous Change Data Capture (CDC) to Cloud SQL for PostgreSQL, and deploy the stateless HTTP microservices to Cloud Run.

Cevap

Provision a Dedicated Interconnect connection, use Database Migration Service (DMS) for continuous Change Data Capture (CDC) to Cloud SQL for PostgreSQL, and deploy the stateless HTTP microservices to Cloud Run.
The solution effectively resolves technical debt and migration constraints by establishing a Dedicated Interconnect for reliable high-speed data transfer, utilizing Database Migration Service (DMS) for continuous CDC to Cloud SQL for PostgreSQL to achieve zero-downtime migration, and deploying stateless microservices to Cloud Run to eliminate cluster management overhead.

Adım Adım Çözüm

1
Analyze database migration and replication requirements
Database Migration Service (DMS) with continuous CDC allows minimal-downtime migration of a PostgreSQL instance to Cloud SQL PostgreSQL without requiring global multi-region database refactoring.
Cloud SQL maintains relational operational compatibility while eliminating database infrastructure maintenance debt. Cloud Spanner is unnecessary for single-region relational needs.
2
Evaluate hybrid connectivity and bandwidth constraints
Dedicated Interconnect provides high-bandwidth, reliable private connectivity required to transport bulk database snapshots and handle continuous CDC replication without overwhelming existing low-bandwidth VPN links.
Physical Transfer Appliance shipping cannot support continuous online CDC replication needed for zero-downtime cutover.
3
Select appropriate compute platform for legacy stateless HTTP services
Cloud Run provides fully managed serverless execution for stateless containerized web services with automatic scaling and zero infrastructure management.
Using GKE for basic stateless microservices adds management overhead and baseline cluster costs, representing infrastructure technical debt.

Anahtar Kavram

Managing Technology Debt and Legacy Cloud Migrations
Soru 1426Soru →

A security team is reviewing a Python administrative automation service running on a Compute Engine instance. The service programmatically manages Cloud Storage resources across multiple production Google Cloud projects. Currently, the service authenticates using static JSON service account keys stored on the local instance disk, violating enterprise compliance policies. The architecture team needs a solution that eliminates long-lived credentials while enabling secure programmatic interaction across project boundaries. Which approach should be implemented to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Authenticate using Application Default Credentials (ADC) associated with the VM's attached service account, and use short-lived service account impersonation to interact with target projects.

Cevap

The application should authenticate using Application Default Credentials (ADC) provided by the compute platform's metadata server and utilize service account impersonation with short-lived tokens for cross-project access.
Utilizing Application Default Credentials (ADC) allows Google Cloud SDKs to dynamically retrieve short-lived OAuth 2.0 access tokens from the Compute Engine metadata server. When combined with service account impersonation (`roles/iam.serviceAccountTokenCreator`), the application can securely generate short-lived tokens to access resources across project boundaries without creating or storing long-lived service account JSON key files.

Adım Adım Çözüm

1
Identify the credential security requirement
Recognize that downloading and storing long-lived service account JSON key files on disk must be eliminated.
Static keys pose significant exfiltration and governance risks.
2
Select native authentication mechanisms for GCP compute resources
Attach a custom service account to the Compute Engine instance and leverage Application Default Credentials (ADC).
ADC fetches short-lived identity tokens directly from the internal compute metadata server.
3
Enable cross-project authorization
Grant the attached service account the ability to impersonate target service accounts in destination projects.
Impersonation yields short-lived OAuth 2.0 access tokens on demand without needing key files.

Anahtar Kavram

Programmatic Authentication via Application Default Credentials (ADC) and Service Account Impersonation
Soru 1427Soru →

A DevOps team uses Terraform to provision and maintain their Google Cloud environments. To ensure operational reliability and prevent state corruption caused by concurrent deployments, the team needs to configure a central backend for storing Terraform state files. Which configuration approach aligns with Google Cloud best practices for managing Infrastructure as Code state?

Cevabı ve açıklamayı göster

Cevap: Store the Terraform state file in a Google Cloud Storage bucket configured as a remote backend with object versioning enabled.

Cevap

Store the Terraform state file in a Google Cloud Storage bucket configured as a remote backend with object versioning enabled.
Using a Google Cloud Storage bucket as a remote backend for Terraform is the Google Cloud standard for managing Infrastructure as Code state. GCS remote backends natively support automatic state locking during execution and allow enabling object versioning to recover state in case of accidental corruption or invalid changes.

Adım Adım Çözüm

1
Identify the requirement for managing Infrastructure as Code state safely across team members and automated pipelines.
Recognize that state files must be stored in a centralized, shared backend supporting concurrency locking and backup.
Local state files or version control commits do not provide locking mechanism during execution and risk race conditions.
2
Evaluate Google Cloud Storage features suitable for Infrastructure as Code state storage.
GCS natively supports state locking (via Terraform GCS backend) and Object Versioning to safeguard state history.
Enabling object versioning allows restoring past states if corruption occurs, ensuring environment provisioning reliability.

Anahtar Kavram

Terraform Remote State Backend Management in Google Cloud Storage
Soru 1428Soru →

An enterprise digital streaming platform hosts its microservices across multiple Google Kubernetes Engine (GKE) clusters and Compute Engine Virtual Machines in separate Google Cloud projects. The SRE team needs to establish a unified observability strategy that consolidates logs and operational metrics for real-time incident analysis, long-term compliance retention, and alerting. The solution must ensure that high-volume, non-critical debug logs do not incur continuous storage charges, while critical security audit and error logs are retained for 365 days and available for real-time alerting. Which architectural approach best fulfills these operational and cost-optimization requirements?

Cevabı ve açıklamayı göster

Cevap: Configure an Organization-level Log Router sink to route audit and error logs to a centralized Cloud Storage bucket with a 365-day retention policy, apply a Cloud Logging exclusion filter on the default log bucket to drop debug logs at ingestion, and establish a multi-project metrics scope in Cloud Monitoring for aggregated operational metrics.

Cevap

Configure an Organization-level Log Router sink to route audit and error logs to a centralized Cloud Storage bucket with a 365-day retention policy, apply a Cloud Logging exclusion filter on the default log bucket to drop debug logs at ingestion, and establish a multi-project metrics scope in Cloud Monitoring for aggregated operational metrics.
The optimal solution utilizes an Organization-level Log Router sink for compliance and audit log aggregation, leverages Cloud Logging exclusion filters to prevent expensive non-critical debug logs from being ingested into default storage buckets, and configures Cloud Monitoring multi-project metrics scoping for unified cross-project visibility.

Adım Adım Çözüm

1
Analyze log retention and cost optimization requirements.
High-volume debug logs should be excluded from Cloud Logging ingestion using exclusion filters to avoid unnecessary storage costs.
Exclusion filters prevent log entries from being stored in log buckets while allowing selective routing if needed.
2
Design centralized compliance log retention.
Use Organization-level Log Router sinks to aggregate audit and high-severity logs into a centralized Cloud Storage bucket with a 365-day lifecycle/retention policy.
Aggregated sinks at the organization level simplify multi-project compliance logging and ensure centralized governance.
3
Establish cross-project observability.
Set up a multi-project Metrics Scope in Cloud Monitoring.
Metrics Scoping enables SRE teams to monitor, visualize, and alert on metrics across multiple projects from a single workspace.

Anahtar Kavram

Centralized Log Router Sinks, Log Exclusion Filters, and Cloud Monitoring Multi-Project Metrics Scoping
Soru 1429Soru →

A financial technology enterprise operates an online payment processing service on Google Cloud. The infrastructure consists of a steady-state backend API running continuously 24/7 on Compute Engine instances, alongside an unpredictable nightly batch data reconciliation process that runs for 2 hours. The finance team requires a cost optimization governance strategy that lowers compute expenditure for baseline workloads while executing short-lived batch jobs cost-effectively without incurring commitments for unused capacity. Which strategy should the Cloud Architect recommend?

Cevabı ve açıklamayı göster

Cevap: Purchase Committed Use Discounts for the steady-state baseline capacity and use Spot VMs for the nightly batch reconciliation jobs.

Cevap

Purchasing Committed Use Discounts for the steady-state baseline capacity and leveraging Spot VMs for unpredictable nightly batch processing provides optimal cost savings while maintaining financial flexibility.
The solution properly aligns cloud pricing mechanisms with workload patterns: 24/7 steady-state API backends benefit from Committed Use Discounts, while transient, fault-tolerant batch workloads capitalize on the steep discounts of Spot VMs without long-term commitment risks.

Adım Adım Çözüm

1
Analyze the workload characteristics
Identify 24/7 backend instances as steady-state baseline capacity and nightly 2-hour reconciliation jobs as fault-tolerant, short-lived capacity.
FinOps cost optimization requires separating predictable baseline compute from variable/intermittent compute.
2
Select the appropriate discount model for steady-state resources
Apply Committed Use Discounts (CUDs) to the 24/7 baseline instances.
CUDs offer up to 57% or 70% savings over standard on-demand pricing in exchange for a 1-year or 3-year resource commitment.
3
Select the cost-effective model for intermittent batch processing
Deploy Spot VMs (or Preemptible VMs) for the batch reconciliation jobs.
Spot VMs provide discounts of 60–91% compared to standard on-demand rates for stateless or fault-tolerant workloads that do not require high availability.

Anahtar Kavram

Workload-driven pricing model selection combining Committed Use Discounts (CUDs) for baseline resources and Spot VMs for transient batch workloads.
Soru 1430Soru →

An enterprise healthcare logistics platform operates its primary inventory and ordering engine on Cloud SQL for MySQL in `europe-west1`, fronted by a Compute Engine Managed Instance Group (MIG). The architecture team must establish a disaster recovery (DR) execution plan to recover application operations in `europe-west4` during a catastrophic regional outage. Business continuity requirements specify a Recovery Point Objective (RPO) of ≤5 minutes\le 5\text{ minutes} and a Recovery Time Objective (RTO) of ≤15 minutes\le 15\text{ minutes}, while strictly minimizing idle infrastructure costs during standard operations. Which execution strategy meets all technical and business constraints?

Cevabı ve açıklamayı göster

Cevap: Maintain a cross-region asynchronous Cloud SQL read replica in `europe-west4`, pre-allocate regional compute quotas, and keep an unscaled MIG template ready. During failover, promote the replica to a primary database, scale out the MIG instance count, and update Cloud DNS routing.

Cevap

Maintain a cross-region asynchronous Cloud SQL read replica in the DR region with pre-allocated compute quotas and unscaled MIG instance templates. Upon disaster declaration, promote the replica, scale up the MIG, and update DNS routing.
The correct strategy uses a Cloud SQL cross-region read replica to continuously mirror state from `europe-west1` to `europe-west4`, satisfying the ≤5 minute\le 5\text{ minute} RPO. Pre-approved compute quota and automated MIG deployment templates allow compute capacity to scale on demand during a failover event within the 15-minute RTO, while keeping idle compute costs at near zero during normal operation.

Adım Adım Çözüm

1
Analyze RPO requirements against data replication patterns.
An RPO ≤5 minutes\le 5\text{ minutes} requires continuous cross-region data replication. Asynchronous Cloud SQL cross-region read replicas meet this requirement with near-zero replication lag without requiring multi-region database refactoring.
Periodic export dumps (e.g., hourly) result in up to 60 minutes of data loss, violating the RPO boundary.
2
Analyze RTO requirements and cost constraints against compute failover topologies.
A pilot light or warm standby compute pattern with zero baseline running instances minimizes compute costs while keeping MIG templates ready.
Maintaining dual active compute clusters incurs high unnecessary operational expenses, while requesting quota during an emergency introduces unpredictable provisioning delays.
3
Evaluate network transitivity and DR execution dependency constraints.
Ensure direct regional interconnect/VPN connectivity and avoid reliance on non-transitive VPC Peering paths.
VPC Peering does not support transitive routing across multiple peered VPC networks.

Anahtar Kavram

Disaster Recovery Strategy Execution (Warm Standby / Pilot Light with Cloud SQL Cross-Region Replication)
Soru 1431Soru →

A Site Reliability Engineering (SRE) team is implementing an end-to-end incident management and automated alerting workflow on Google Cloud to handle service level objective (SLO) breaches. In what sequence should the SRE team structure the automated detection, notification, triage, and human escalation pipeline? Arrange the steps in the correct chronological order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with defining the SLO and burn-rate alert policy in Cloud Monitoring, followed by attaching a Cloud Pub/Sub notification channel, executing automated diagnostic checks and alert muting via a Cloud Run subscriber, and finally escalating to the human on-call responder if manual intervention is required.
The correct workflow adheres to Google SRE best practices for incident response: establishing measurement baselines (SLO burn-rate alerting), publishing incident events asynchronously (Cloud Pub/Sub), executing automated triage and alert suppression (Cloud Run subscriber), and escalating remaining critical incidents to human responders.

Adım Adım Çözüm

1
Establish detection baselines
Cloud Monitoring multi-window burn-rate alert policy is configured.
SLO error budget depletion must be monitored before any downstream alerting or event processing can occur.
2
Configure event notification channels
Alert notifications are routed asynchronously to Cloud Pub/Sub.
Pub/Sub decouples metric detection from incident response actions, allowing multiple downstream subscribers to consume alert events.
3
Execute automated triage and alert suppression
Cloud Run subscriber ingests the incident payload, gathers logs, and suppresses noise.
Automated first-response scripts prevent alert storms and enrich incident context prior to paging human operators.
4
Escalate to human responders
On-call engineers receive enriched incident details on their paging system.
Human intervention should be reserved for unresolved or high-impact incidents requiring manual decision-making.

Anahtar Kavram

Automated Incident Management and Alert Escalation Lifecycle
Soru 1432Soru →

A global media streaming platform hosts its live session state and metadata processing engine on Google Cloud across two regions. The primary active region is us-west1 and the passive disaster recovery region is us-east1. The architecture utilizes Cloud Bigtable for high-throughput session state, Google Kubernetes Engine (GKE) for stateless microservices, and Cloud DNS routing policies for external traffic management. A catastrophic zone-wide power failure has disabled the us-west1 infrastructure. What is the correct sequence of steps to execute the regional failover runbook to restore full operational capacity in us-east1 while maintaining data consistency?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins by updating Cloud DNS to isolate ingress traffic from us-west1, followed by reconfiguring the Cloud Bigtable application profile to single-cluster routing in us-east1, then scaling GKE compute resources in us-east1 using capacity reservations, and finally validating SLIs before routing live production traffic to us-east1.
Executing a disaster recovery failover requires strict adherence to dependency order: first, isolate traffic to halt invalid writes to the primary region; second, reconfigure stateful database application profiles to target the standby region; third, scale compute resources using capacity reservations; fourth, verify monitoring health metrics before opening live traffic ingress to the secondary region.

Adım Adım Çözüm

1
Isolate the failing region by updating Cloud DNS routing policy.
Prevents ongoing transactions from failing or causing data inconsistency in us-west1.
Traffic isolation must precede failover actions to stop split-brain state creation.
2
Reconfigure Cloud Bigtable application profile for single-cluster routing to us-east1.
Ensures all incoming state updates target the healthy us-east1 Bigtable cluster.
Stateful data tier routing must be explicitly reconfigured before compute microservices attempt writes.
3
Scale the secondary GKE deployment in us-east1 to full production capacity.
Secondary compute nodes and pods expand to process 100% of production traffic.
Stateless compute capacity must be fully provisioned while the database tier is ready.
4
Verify service metrics in Cloud Monitoring and shift external load balancer ingress traffic.
Full production traffic is safely served out of us-east1 without downtime or data corruption.
Validation of health check endpoints and SLIs ensures the failover was successful before public traffic cutover.

Anahtar Kavram

Disaster Recovery Execution and Regional Failover Ordering
Soru 1433Soru →

An enterprise HR platform operates a critical payroll processing service deployed across Compute Engine Regional Managed Instance Groups (MIGs) behind an External HTTP(S) Load Balancer, backed by Cloud SQL for PostgreSQL. The engineering team must execute a major release containing breaking database schema alterations (column renaming) while maintaining zero downtime and ensuring immediate rollback capabilities if anomalies are detected. Which deployment and database migration approach should you recommend?

Cevabı ve açıklamayı göster

Cevap: Implement an expand-contract database schema migration strategy to maintain backward compatibility, and perform a blue-green application deployment by shifting traffic between MIG backend services at the load balancer level.

Cevap

Implement an expand-contract database schema migration strategy to maintain backward compatibility, and perform a blue-green application deployment by shifting traffic between MIG backend services at the load balancer level.
Executing a zero-downtime release with breaking database modifications requires combining the Expand-Contract database pattern with Blue-Green traffic routing. The expand-contract strategy ensures that both old and new application instances can read/write to the database concurrently during rollout. Utilizing Google Cloud's HTTP(S) Load Balancer to switch traffic between the Blue and Green backend services provides instantaneous cutover and immediate rollback capabilities without DNS caching delay.

Adım Adım Çözüm

1
Decouple database migration from application release using the Expand-Contract pattern.
Database changes are split into three phased migrations (Expand: add new column alongside old column; Transition: sync data and write to both; Contract: remove old column only after legacy version is decommissioned).
This guarantees that both old (Blue) and new (Green) application code paths can run concurrently against the database without errors.
2
Deploy the new application version to a separate (Green) Regional Managed Instance Group.
The green environment runs completely isolated alongside the production blue environment.
Creating isolated target environments enables full validation prior to routing live end-user traffic.
3
Configure the HTTP(S) Load Balancer to perform weighted traffic shifting between backend services.
Traffic cutover happens seamlessly at the load balancer layer, providing immediate rollback capabilities if health metrics degrade.
Load balancer backend switching provides instantaneous traffic migration without waiting for DNS TTL propagation.

Anahtar Kavram

Blue-Green Deployment and Expand-Contract Database Schema Migration
Soru 1434Soru →

A global enterprise runs a real-time order fulfillment service hosted on Google Kubernetes Engine (GKE) Autopilot backed by Cloud Spanner. The Site Reliability Engineering (SRE) team has set a Service Level Objective (SLO) requiring 99.9% of successful HTTP POST requests to complete with a latency under 200 ms over a 30-day rolling window. Recently, short network blips caused multiple false-positive emergency pages, while a persistent minor database regression consumed 60% of the error budget over two weeks before anyone was alerted. Which TWO operational practices should the SRE team implement to improve alerting precision and protect the service error budget? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure multi-window, multi-burn-rate alerts in Cloud Monitoring to page on fast error budget consumption over short windows and trigger tickets on slow consumption over longer windows.; Establish an automated policy that freezes non-emergency feature releases and redirects engineering resources to performance fixes whenever the 30-day error budget is fully exhausted.

Cevap

The SRE team should implement multi-window, multi-burn-rate alerting in Cloud Monitoring and enforce an error budget policy that halts feature deployments when the error budget is exhausted.
Implementing multi-window multi-burn-rate alerts accurately detects both fast and slow error budget consumption while preventing noise from transient network hiccups. Enforcing an explicit error budget policy ensures engineering capacity automatically shifts to reliability fixes when the error budget is depleted.

Adım Adım Çözüm

1
Analyze the existing alerting defect
Identified that static alerts and single-window thresholds produce false-positive pages for short spikes and miss low-rate long-duration budget leaks.
SRE principles advocate for measuring budget burn rate rather than static metric limits.
2
Select appropriate alerting strategy
Selected multi-window, multi-burn-rate alerts.
This strategy alerts based on how fast the error budget is being consumed (e.g., 14.4x burn rate over 1 hour for paging, 2x burn rate over 3 days for ticketing), avoiding page fatigue while catching sustained degradation.
3
Determine governance for error budget exhaustion
Adopted an explicit policy halting new feature deployments upon budget exhaustion.
Error budgets exist to balance innovation speed with reliability; when depleted, focus must shift to stabilizing the platform.

Anahtar Kavram

Multi-window, multi-burn-rate alerting and error budget governance policies
Soru 1435Soru →

An online payment processing company processes financial transactions on Google Kubernetes Engine (GKE) clusters and stores audit records in BigQuery datasets. The architecture uses an External HTTP(S) Load Balancer to ingress public API traffic. Security requirements mandate that: 1) Web Application Firewall (WAF) rules must filter out Layer 7 SQL injection threats before traffic reaches backend services, and 2) Authorized internal workloads must be restricted from copying sensitive audit data to external, non-company Cloud Storage buckets. Which TWO security controls should you implement to satisfy these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach a Cloud Armor security policy containing preconfigured SQL injection WAF rules to the Load Balancer backend service.; Configure a VPC Service Controls service perimeter around the projects hosting BigQuery and Cloud Storage.

Cevap

To meet both requirements, you must attach a Cloud Armor security policy with preconfigured SQL injection WAF rules to the Load Balancer backend service, and configure a VPC Service Controls perimeter around the BigQuery and Cloud Storage projects.
Attaching a Cloud Armor security policy to the External HTTP(S) Load Balancer backend service provides edge-level inspection and mitigation against Layer 7 exploits like SQL injection. Simultaneously, enforcing a VPC Service Controls perimeter around projects containing BigQuery and Cloud Storage isolates Google Cloud managed API access, blocking authorized identities from exfiltrating sensitive dataset contents to unauthorized external storage destinations.

Adım Adım Çözüm

1
Identify the mechanism required to block Layer 7 web attacks at the network edge.
Cloud Armor security policies with preconfigured WAF rules (such as SQLi protection) attach directly to the backend services of External HTTP(S) Load Balancers.
Cloud Armor inspects incoming HTTP/HTTPS traffic at the edge of Google's network before it hits application backends.
2
Identify the mechanism required to prevent data exfiltration from Google Cloud managed services.
VPC Service Controls define network perimeters around API endpoints for services like BigQuery and Cloud Storage.
VPC Service Controls restrict communication to and from managed services, preventing authorized credentials from writing data to resources located outside the perimeter.

Anahtar Kavram

Combining Cloud Armor for Layer 7 edge security and VPC Service Controls for perimeter data exfiltration prevention.
Tahmini Süre:1m 30s
Soru 1436Soru →

An agricultural technology enterprise operates a global IoT telemetry processing platform on Google Cloud. The infrastructure consists of a steady 24/7 baseline stream processing pipeline, unpredictable bursty batch processing jobs for sudden weather event analytics, and raw data storage used for analytical queries in BigQuery. The central FinOps team wants to optimize cloud expenditure without compromising processing performance or system security. Which TWO cost optimization strategies should the Cloud Architect recommend? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply Flexible Committed Use Discounts (Flex CUDs) to cover baseline compute resources, and utilize Spot VMs for the fault-tolerant, unpredictable weather batch processing jobs.; Implement Cloud Storage Lifecycle Management to transition raw telemetry logs to Nearline or Coldline storage classes after 30 days, and use BigQuery slot capacity management for predictable analytics workloads.

Cevap

The Cloud Architect should recommend purchasing Flexible Committed Use Discounts (Flex CUDs) for baseline compute combined with Spot VMs for bursty batch jobs, alongside setting Cloud Storage Lifecycle Management policies and BigQuery slot capacity controls.
Combining Flexible Committed Use Discounts (Flex CUDs) for baseline compute with Spot VMs for fault-tolerant batch workloads addresses compute cost efficiency across steady and bursty demands. Concurrently, automating Cloud Storage object lifecycle management transitions less frequently accessed telemetry data to colder storage tiers, while BigQuery slot reservations prevent unexpected query cost spikes.

Adım Adım Çözüm

1
Analyze compute workload profiles
Identify 24/7 stream processing as steady baseline and weather analytics as bursty and fault-tolerant.
Baseline workloads benefit from commitment discounts, whereas bursty, stateless workloads are ideal for low-cost Spot instances.
2
Evaluate storage and analytics cost optimization mechanisms
Apply lifecycle rules to move aging telemetry data to colder storage classes and control BigQuery querying costs with slot management.
Data access frequency decreases over time, making lifecycle automation a direct driver of storage cost reduction.
3
Identify and eliminate anti-patterns in distractors
Reject purchasing standard CUDs for peak capacity, migrating to Cloud Spanner, or granting Owner IAM roles.
These anti-patterns lead to wasted commitment spend, unnecessary architecture overhead, and security compliance violations.

Anahtar Kavram

FinOps multi-layered cost optimization utilizing flexible commitments, Spot instances, storage lifecycle automation, and slot governance.
Soru 1437Soru →

An enterprise digital publishing platform is preparing for a scheduled major global news event projected to surge traffic by 500% over a 3-hour period. The core application runs on Google Cloud using a Compute Engine Managed Instance Group (MIG) with CPU-based autoscaling. Capacity evaluation shows that scaling to the required 400 N2 virtual machines will exceed the project's current regional CPU quota. Which capacity planning strategy should the Cloud Architect implement to ensure the infrastructure successfully scales during the event?

Cevabı ve açıklamayı göster

Cevap: Submit a quota increase request for regional N2 CPUs in advance and create zonal capacity reservations for the required instance count.

Cevap

Submit a quota increase request for regional N2 CPUs in advance and create zonal capacity reservations for the required instance count.
Submitting an advance regional quota increase request ensures project limits allow the necessary N2 vCPU allocation. Combining quota increases with zonal capacity reservations guarantees that physical hardware remains available in specified zones during large-scale autoscaling.

Adım Adım Çözüm

1
Evaluate planned compute capacity against current project limits.
Identified that scaling to 400 N2 instances exceeds default regional vCPU quota bounds.
Compute Engine resource allocation in any region is governed by fixed project quotas.
2
Submit a quota increase request via GCP Service Quotas.
Ensures the project is approved to consume the required number of regional N2 vCPUs.
Quota increases require evaluation/approval and cannot be automatically granted during an automated scale-out event.
3
Establish zonal capacity reservations for the target instance properties.
Guarantees physical compute capacity availability in target zones when the MIG scales out.
Quota approval provides permission to consume resources but does not reserve physical hardware against zone-level resource contention.

Anahtar Kavram

Proactive capacity management through regional quota expansion and zonal compute reservations for predictable traffic spikes.
Soru 1438Soru →

An energy utility enterprise is modernizing a legacy asset monitoring platform by migrating it from an on-premises data center to Google Cloud. The environment contains a 2.5 PB historical sensor dataset residing on aging SAN storage, along with a batch analytics process comprised of lightweight, stateless microservices. The company's existing 1 Gbps Dedicated Interconnect is heavily saturated, running at 90% capacity to support real-time operational telemetry. Organizational policies require moving the 2.5 PB dataset into Cloud Storage within 45 days, containerizing the batch analytics with minimal operational management overhead, and enforcing strict perimeter controls to prevent data exfiltration by compromised or authorized identities.

Which architectural strategy best fulfills these technical and business requirements?

Cevabı ve açıklamayı göster

Cevap: Order a Google Cloud Transfer Appliance to perform an offline bulk data import to Cloud Storage, execute the stateless batch analytics microservices using Cloud Run, and enclose the cloud resources within a VPC Service Controls perimeter.

Cevap

Order a Google Cloud Transfer Appliance to perform an offline bulk data import to Cloud Storage, execute the stateless batch analytics microservices using Cloud Run, and enclose the cloud resources within a VPC Service Controls perimeter.
The correct strategy combines Transfer Appliance for offline petabyte data movement within the 45-day deadline, Cloud Run to run stateless microservice containers with zero cluster management overhead, and VPC Service Controls to establish a perimeter preventing data exfiltration.

Adım Adım Çözüm

1
Evaluate bulk data transfer constraints
Transferring 2.5 PB over a heavily utilized 1 Gbps link (with only ~100 Mbps available) would take over two years. Using an offline Transfer Appliance is required to complete the transfer within 45 days without saturating network bandwidth.
Large multi-petabyte datasets combined with constrained or shared network pipes necessitate offline physical appliance transfer.
2
Select the optimal compute abstraction for stateless batch microservices
Cloud Run allows containerized stateless services to run on a fully managed serverless infrastructure, minimizing operational management overhead compared to managing GKE clusters.
Choosing serverless container platforms avoids the infrastructure setup, upgrading, and cluster maintenance required by GKE.
3
Enforce security controls against data exfiltration
Define a VPC Service Controls perimeter around Cloud Storage and Cloud Run services to block unauthorized data egress, even from authenticated IAM identities.
IAM controls authorization but does not prevent authorized users from exfiltrating data to external Google Cloud resources outside the perimeter.

Anahtar Kavram

Managing legacy cloud migrations by combining offline appliance data transfer, serverless container modernization, and VPC Service Controls perimeters.
Soru 1439Soru →

A retail platform processes customer transactions using microservices running on Compute Engine instances located in a Google Cloud project named `prod-compute`. The application needs to retrieve database credentials stored securely in Secret Manager located within a central security project named `prod-security`. As a Cloud Architect, you must configure authentication and authorization between the microservices and Secret Manager in accordance with Google-recommended security best practices and the principle of least privilege, while avoiding service account keys. Which strategy should you implement?

Cevabı ve açıklamayı göster

Cevap: Create a dedicated service account in `prod-compute`, attach it to the Compute Engine instances, and grant that service account the Secret Manager Secret Accessor role on the specific database secret in `prod-security`.

Cevap

Create a dedicated service account in the compute project, attach it to the Compute Engine instances, and grant that service account the Secret Manager Secret Accessor role on the specific database secret in the security project.
The Google-recommended practice for accessing Secret Manager secrets across projects is to attach a dedicated custom service account to the compute workload and grant that service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) specifically on the target secret resource in the security project. Compute Engine workloads leverage Application Default Credentials (ADC) to obtain short-lived access tokens automatically without managing service account JSON key files.

Adım Adım Çözüm

1
Define compute workload identity
Create a dedicated, custom service account in `prod-compute` specifically for the transaction processing microservices.
Attaching a dedicated custom service account avoids using default service accounts with overly broad permissions.
2
Configure cross-project resource permission
Grant `roles/secretmanager.secretAccessor` on the specific secret resource in `prod-security` to the custom service account.
Enforces least privilege at the individual secret level without granting project-wide read permissions.
3
Authenticate workloads keylessly
Allow Compute Engine workloads to automatically acquire credentials via Application Default Credentials (ADC) using the attached service account.
Eliminates the risk of managing static service account JSON keys and long-lived credential leakage.

Anahtar Kavram

Cross-Project Secret Access with Least Privilege and Application Default Credentials
Soru 1440Soru →

An e-commerce platform hosted on Google Kubernetes Engine (GKE) backed by Cloud SQL for PostgreSQL is executing a zero-downtime release for its order processing microservice. The update introduces breaking database schema changes. To maintain service availability throughout the rollout, the engineering team must combine an Expand-Contract database migration pattern with a Blue-Green deployment strategy.

Which sequence represents the correct chronological order of steps from FIRST to LAST to safely execute this zero-downtime deployment?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: 1) Apply non-destructive additive database migrations (Expand phase); 2) Deploy the new application version (Green environment) on GKE; 3) Update Cloud Load Balancing to shift live traffic to the Green environment; 4) Execute destructive database cleanup operations (Contract phase).
Executing a zero-downtime release with breaking database schema changes requires an Expand-Contract pattern combined with Blue-Green deployment. First, the database is expanded with additive, backward-compatible schema modifications so both old and new code versions can run. Second, the new Green application version is deployed alongside the Blue version. Third, traffic is shifted at the Cloud Load Balancer level from Blue to Green. Fourth, once the Blue version is safely drained and stopped, destructive schema cleanups (Contract phase) remove deprecated database fields.

Adım Adım Çözüm

1
Apply additive schema migrations (Expand phase)
The database schema supports both the current schema columns/tables and the new required columns/tables simultaneously.
Applying database migrations additively ensures that currently running instances (Blue) do not fail when querying the database while the database is updated.
2
Deploy the Green application environment
The new version of the microservice runs on GKE in parallel with the Blue version without receiving live customer traffic.
Deploying Green instances in isolation allows internal health checks and smoke testing against the expanded database schema before user traffic is introduced.
3
Shift production traffic to the Green environment
Cloud Load Balancing routes all incoming user requests to the Green pods.
Switching traffic at the load balancer level instantly shifts user traffic to the validated Green version while keeping the Blue environment idle as an immediate rollback target if needed.
4
Execute destructive schema migrations (Contract phase)
Deprecated database columns and tables are removed, and the Blue application environment is decommissioned.
Removing deprecated columns can only occur after all dependencies on the old schema are removed and the old Blue application instances are turned off.

Anahtar Kavram

Expand-Contract Database Migration with Blue-Green Deployments
ÖncekiSayfa 72 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin