Tüm alıştırma soruları

1598 soru

Tüm türler1,598 Çoktan seçmeli815 Çoklu seçim537 Sayısal8 Eşleştirme64 Sıralama174

An automotive auction platform is establishing an automated testing procedure to validate new microservices infrastructure on Google Cloud before deploying to production. The automated pipeline provisions isolated, ephemeral staging environments using Terraform, executes automated stress and load tests, and tears down resources. During automated validation runs for major releases, test pipeline executions repeatedly fail due to API quota errors when attempting to launch high-density Compute Engine instances. Additionally, security audits revealed that the CI/CD service account was granted broad administrative privileges to manage service accounts. Which solution should the cloud architect implement to ensure reliable validation procedures while adhering to Google Cloud best practices?

Implement automated pre-flight checks in the validation pipeline to audit and request regional resource quotas prior to provisioning, and grant the deployment service account the Service Account User role (roles/iam.serviceAccountUser) on specific runtime service accounts.

Grant the deployment pipeline service account the Service Account Admin role across the organization to automatically bypass regional resource limits during automated load testing procedures.

Store Terraform state files on the local disk of the temporary CI/CD runner to avoid Cloud Storage quota limits and decrease environment creation times during stress test validation.

Remove fine-grained IAM permissions from the validation service account and rely exclusively on VPC Service Controls perimeters to prevent unauthorized resource provisioning during test execution.

Cevabı ve açıklamayı göster

Cevap: Implement automated pre-flight checks in the validation pipeline to audit and request regional resource quotas prior to provisioning, and grant the deployment service account the Service Account User role (roles/iam.serviceAccountUser) on specific runtime service accounts.

Cevap

The optimal solution is to implement automated pre-flight quota verification within the pipeline before provisioning ephemeral resources, while restricting the deployment pipeline service account permissions to the Service Account User role (roles/iam.serviceAccountUser).

Establishing automated pre-flight quota audits ensures that temporary test environments have sufficient compute capacity before starting validation runs, avoiding mid-test provision failures. Restricting permissions to roles/iam.serviceAccountUser enforces least privilege by granting only the rights necessary to attach service accounts to provisioned compute instances.

Adım Adım Çözüm

Analyze pipeline failure points and security audit findings.

Identified two core issues: regional compute resource quota constraints during load testing and over-privileged service account permissions.

Technical solution validation procedures must validate infrastructure capacity requirements without introducing security vulnerabilities.

Design pre-deployment validation procedures for resource availability.

Incorporating programmatic quota checks prior to executing terraform apply ensures that required instance limits are verified or requested in advance.

Prevents mid-deployment failures and incomplete stress testing runs caused by hitting default GCP project limits.

Apply least privilege IAM controls to the CI/CD pipeline deployment identity.

Replaced administrative permissions with roles/iam.serviceAccountUser, allowing the pipeline to attach service accounts to resources without full administrative access.

Aligns testing and deployment procedures with Google Cloud IAM security best practices.

Anahtar Kavram

Pre-flight Environment Validation and Least Privilege CI/CD Security

Soru 1442Soru →

An enterprise e-commerce company manages dozens of Google Cloud projects across multiple product engineering teams. The infrastructure consists of steady-state backend microservices running on Compute Engine alongside highly variable, fault-tolerant batch analytical jobs and ad-hoc data exploration. The centralized FinOps team needs to establish organizational cost governance, improve spending visibility, and reduce overall infrastructure expenditure without restricting developer velocity. Which of the following actions should the Cloud Architect recommend? (Select TWO.)

Geçerli olan tümünü seçin

Enable organization-level Cloud Billing data export to BigQuery and configure Cloud Billing Budgets with Pub/Sub notifications for automated spending alerts and governance.

Apply Committed Use Discounts (CUDs) to cover predictable, steady-state Compute Engine baseline workloads at the billing account level, and utilize Spot VMs for fault-tolerant batch workloads.

Purchase 3-year standard Committed Use Discounts (CUDs) to cover peak resource usage during unpredictable, bursty developer ad-hoc data analysis workloads.

Migrate simple stateless web microservices from Cloud Run to dedicated Google Kubernetes Engine (GKE) clusters to eliminate per-request serverless charges.

Assign the primitive Owner IAM role on the Billing Account to individual engineering team leads so they can directly purchase commitments and manage billing hierarchies.

Cevabı ve açıklamayı göster

Cevap: Enable organization-level Cloud Billing data export to BigQuery and configure Cloud Billing Budgets with Pub/Sub notifications for automated spending alerts and governance.; Apply Committed Use Discounts (CUDs) to cover predictable, steady-state Compute Engine baseline workloads at the billing account level, and utilize Spot VMs for fault-tolerant batch workloads.

Cevap

The Cloud Architect should recommend enabling organization-level Cloud Billing data export to BigQuery combined with Cloud Billing budget alerts via Pub/Sub, as well as applying Committed Use Discounts for steady-state baseline workloads while running fault-tolerant batch workloads on Spot VMs.

The correct strategy combines technical right-sizing and financial governance. Exporting organizational billing data to BigQuery provides centralized visibility across all projects and supports custom analysis, while integrating billing budgets with Cloud Pub/Sub allows automated cost control actions. Additionally, applying CUDs to predictable baseline capacity secures significant discounts, while using Spot VMs for fault-tolerant batch jobs reduces compute costs by up to 60-90% without committing to unneeded capacity.

Adım Adım Çözüm

Analyze workload characteristics for baseline vs variable usage

Identified steady-state microservices suited for Committed Use Discounts and fault-tolerant batch tasks suited for Spot VMs.

Matching pricing models to workload predictability minimizes unit cost.

Establish centralized visibility and governance mechanisms

Configured organization-wide billing export to BigQuery and budget alerts with Pub/Sub automation.

Centralized billing data export enables granular cost allocation, custom dashboards, and programmatic budget management.

Anahtar Kavram

FinOps Cloud Cost Optimization and Governance Framework

Soru 1443Soru →

An enterprise application hosted in an on-premises Kubernetes cluster needs to programmatically upload large batch analytical files to a Google Cloud Storage bucket without using static long-lived service account keys. The security team mandates that the architecture must adhere to the principle of least privilege and prevent credential exfiltration risks. Which of the following configuration steps should the team implement? (Select TWO.)

Geçerli olan tümünü seçin

Configure Workload Identity Federation to establish a trust relationship between the on-premises identity provider and Google Cloud IAM.

Grant the federated identity permission to impersonate a dedicated service account bound strictly to the minimal Cloud Storage IAM roles required.

Generate a service account JSON key file and mount it as a secret into the application pod, pointing GOOGLE_APPLICATION_CREDENTIALS to the key path.

Assign the primitive Owner IAM role to the service account to ensure all programmatic API calls execute without permission errors.

Cevabı ve açıklamayı göster

Cevap: Configure Workload Identity Federation to establish a trust relationship between the on-premises identity provider and Google Cloud IAM.; Grant the federated identity permission to impersonate a dedicated service account bound strictly to the minimal Cloud Storage IAM roles required.

Cevap

The team should configure Workload Identity Federation between the on-premises identity provider and Google Cloud IAM, and grant the federated identity permission to impersonate a dedicated service account restricted to the necessary minimal Cloud Storage IAM roles.

Workload Identity Federation allows external applications to authenticate to GCP programmatically using short-lived tokens, eliminating long-lived key management risks. Granting permissions to impersonate a dedicated service account configured with fine-grained GCS access satisfies least-privilege requirements.

Adım Adım Çözüm

Establish federated identity trust.

On-premises Kubernetes tokens can be exchanged for short-lived Google Cloud federated tokens.

Eliminates the need for downloading or managing long-lived service account JSON key files.

Configure service account impersonation with fine-grained IAM roles.

The application assumes a service account that holds only the minimal permissions necessary for Cloud Storage operations.

Enforces least-privilege security controls without over-granting administrative access.

Anahtar Kavram

Keyless programmatic authentication using Workload Identity Federation and least-privilege Service Account Impersonation.

Soru 1444Soru →

A online gaming telemetry platform is establishing automated pre-deployment testing procedures on Google Cloud. The infrastructure is provisioned using Terraform and deploys containerized microservices onto private Google Kubernetes Engine (GKE) clusters. To prevent deployment failures during high-traffic game launches and enforce operational security, the cloud architecture team needs to validate solution readiness in the CI/CD pipeline prior to production release. Which TWO validation procedures should the cloud architect incorporate into the automated testing pipeline? (Select TWO.)

Geçerli olan tümünü seçin

Automate pre-flight quota checks by querying regional resource limits against anticipated peak capacity demands before executing infrastructure provisioning.

Configure the Cloud Storage remote backend for Terraform state files with Object Versioning and Object Locking enabled to prevent state corruption during automated runs.

Grant the deployment service account the Service Account Admin role (roles/iam.serviceAccountAdmin) to allow the CI/CD runner to attach runtime identities to GKE nodes.

Disable GKE control plane authorized networks during the pre-flight testing phase to guarantee unconstrained API access for external CI/CD pipeline runners.

Cevabı ve açıklamayı göster

Cevap: Automate pre-flight quota checks by querying regional resource limits against anticipated peak capacity demands before executing infrastructure provisioning.; Configure the Cloud Storage remote backend for Terraform state files with Object Versioning and Object Locking enabled to prevent state corruption during automated runs.

Cevap

The validation procedures that should be incorporated into the automated testing pipeline are: automating pre-flight regional resource quota checks against peak capacity demands prior to provisioning, and configuring the Cloud Storage remote backend for Terraform with Object Versioning and Object Locking enabled.

Automating regional quota verification prevents resource allocation failures during deployment, while enforcing Object Versioning and Object Locking on the Terraform backend in Cloud Storage secures IaC state against race conditions and corruption.

Adım Adım Çözüm

Evaluate pre-deployment capacity constraints

Ensure regional quota availability matches expected peak load prior to execution

Requesting compute and storage resources beyond active quotas during deployment causes mid-apply failures and service outages.

Establish secure Infrastructure as Code (IaC) state management validation

Implement Cloud Storage object versioning and state locking

Prevents state file corruption and concurrency conflicts across pipeline execution cycles.

Enforce least-privilege IAM and secure networking boundaries

Use Service Account User roles and maintain GKE authorized networks

Avoids security misconfigurations such as administrative over-privileging or exposing private cluster endpoints.

Anahtar Kavram

Technical Solution Testing and Validation Procedures

Soru 1445Soru →

An enterprise financial organization stores sensitive customer data in BigQuery datasets within Google Cloud. Security policies mandate that analysts working within the internal network must be able to query the data, but must be strictly prevented from copying or exporting dataset contents to external, non-company Google Cloud Storage buckets or datasets, even if the analysts possess administrative IAM permissions. Which solution should a Cloud Architect implement to meet these security requirements?

Configure a VPC Service Controls perimeter around the project containing BigQuery and Cloud Storage, restricting service API access and preventing data movement across the perimeter boundary.

Implement granular Identity and Access Management (IAM) custom roles that revoke object export privileges while retaining query execution permissions.

Establish VPC Network Peering between internal and external project networks and rely on transitive VPC routing boundaries to restrict destination traffic.

Grant primitive IAM Viewer roles to analysts across all projects and configure Cloud Audit Logging to monitor for unauthorized data export activity.

Cevabı ve açıklamayı göster

Cevap: Configure a VPC Service Controls perimeter around the project containing BigQuery and Cloud Storage, restricting service API access and preventing data movement across the perimeter boundary.

Cevap

Configure a VPC Service Controls perimeter around the project containing BigQuery and Cloud Storage, restricting service API access and preventing data movement across the perimeter boundary.

VPC Service Controls defines security perimeters around GCP service resources (such as BigQuery and Cloud Storage) to mitigate data exfiltration risks. It blocks API communication between perimetrized services and external resources, ensuring data cannot be transferred out even by users with high-privilege IAM roles.

Adım Adım Çözüm

Identify the primary threat vector in the scenario.

The core risk is data exfiltration by authorized identities possessing broad IAM privileges.

IAM roles specify who can interact with resources, but cannot restrict the destination project or perimeter when data is copied across Google Cloud APIs.

Evaluate perimeter control mechanisms on Google Cloud.

VPC Service Controls establishes a boundary around GCP resources to isolate services like BigQuery and Cloud Storage.

This prevents data from being copied or exfiltrated outside the defined perimeter boundary regardless of IAM permissions.

Anahtar Kavram

VPC Service Controls exfiltration prevention

Soru 1446Soru →

An enterprise energy utility company operates a mission-critical smart grid monitoring platform on Google Cloud. The primary infrastructure runs in europe-west3 (Frankfurt), featuring stateless microservices on a Compute Engine Managed Instance Group (MIG) and transactional telemetry data stored in Cloud SQL for PostgreSQL. The company requires a Disaster Recovery (DR) execution plan to fail over to europe-west1 (Belgium). The architecture must guarantee a Recovery Point Objective (RPO) under 1 minute and a Recovery Time Objective (RTO) under 15 minutes, while strictly minimizing ongoing secondary region infrastructure costs during normal operational state. Which disaster recovery strategy should the Cloud Architect implement?

Maintain a cross-region read replica of Cloud SQL in europe-west1, alongside a minimal Warm Standby MIG scaled to one instance using pre-validated instance templates. Upon DR declaration, promote the read replica to standalone primary, scale out the MIG to baseline capacity, and update Cloud DNS routing.

Implement a Cold Backup pattern by scheduling automated Cloud Storage exports of the PostgreSQL database and exporting compute VM custom images to europe-west1. During a outage, restore the database from storage objects and instantiate new MIG compute resources from the custom images.

Provision a Pilot Light architecture keeping Cloud SQL cross-region replication active with zero active VM instances in europe-west1, and configure automated failover scripts to submit regional Compute Engine quota increases and spin up MIG instances upon failure declaration.

Migrate the database layer from Cloud SQL to Cloud Spanner with a multi-region configuration spanning europe-west3 and europe-west1, and continuously run fully scaled active-active MIG clusters at 100% baseline compute capacity in both regions.

Cevabı ve açıklamayı göster

Cevap: Maintain a cross-region read replica of Cloud SQL in europe-west1, alongside a minimal Warm Standby MIG scaled to one instance using pre-validated instance templates. Upon DR declaration, promote the read replica to standalone primary, scale out the MIG to baseline capacity, and update Cloud DNS routing.

Cevap

The correct strategy balances RPO, RTO, and cost by using Cloud SQL cross-region asynchronous read replication (yielding sub-minute RPO) alongside a Warm Standby MIG pre-configured with instance templates and minimal baseline instance count in europe-west1. Promoting the database replica and scaling the existing MIG allows operational recovery well under 15 minutes while keeping steady-state secondary compute costs extremely low.

Adım Adım Çözüm

Analyze RPO requirements

RPO < 1 minute requires continuous asynchronous data replication between regions rather than periodic batch file backups.

Cloud SQL cross-region read replicas continuously stream write-ahead logs (WAL) from europe-west3 to europe-west1, securing near-zero RPO.

Analyze RTO and cost constraints

RTO < 15 minutes paired with minimal idle cost favors a Warm Standby compute pattern over Cold Backup or fully scaled Hot Standby.

Maintaining a single minimal instance in the secondary MIG validates template readiness and quota availability, enabling rapid scale-out within minutes during failover.

Evaluate execution sequence

Promote Cloud SQL replica to primary, trigger MIG scale-out, and re-point DNS routing.

Promoting the database read replica creates a writeable database instance in europe-west1 while compute capacity expands to handle full production traffic.

Anahtar Kavram

Disaster Recovery Strategy Selection (Warm Standby vs. Cold Backup vs. Active-Active)

Soru 1447Soru →

A security team is establishing identity and access management controls for an automated workload running on Compute Engine virtual machines in a workload project `stg-workloads`. The workload requires read access to sensitive database credentials stored in Google Cloud Secret Manager in a centralized security project `sec-mgmt`. Which of the following architectural security controls should be implemented to enforce service account lifecycle security and least privilege access? (Select TWO.)

Geçerli olan tümünü seçin

Attach a dedicated service account to the Compute Engine instances and rely on Application Default Credentials (ADC) instead of generating long-lived service account JSON keys.

Grant the compute service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) bound directly to the target secret resource in project `sec-mgmt`.

Assign the primitive Editor role (`roles/editor`) on project `sec-mgmt` to the compute service account to ensure seamless API connectivity across all security services.

Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the compute service account so it can create runtime tokens for administrative tasks.

Require Customer-Supplied Encryption Keys (CSEK) to encrypt secret payloads in Secret Manager to avoid using Google managed KMS key rotation.

Cevabı ve açıklamayı göster

Cevap: Attach a dedicated service account to the Compute Engine instances and rely on Application Default Credentials (ADC) instead of generating long-lived service account JSON keys.; Grant the compute service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) bound directly to the target secret resource in project `sec-mgmt`.

Cevap

The correct security controls are to attach a dedicated service account to the Compute Engine instances using Application Default Credentials (ADC) rather than exporting static JSON keys, and to grant that service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) restricted specifically to the target secret resource.

The correct approach combines keyless authentication and resource-level role assignment. Attaching a dedicated service account to Compute Engine instances enables Application Default Credentials (ADC), eliminating service account key management overhead and exposure. Furthermore, granting the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) specifically on the target secret enforces strict least privilege across project boundaries.

Adım Adım Çözüm

Eliminate static credentials for service account lifecycle security.

Using metadata server authentication via Application Default Credentials (ADC) attached to the Compute Engine instance avoids creating and managing exported long-lived JSON keys.

Exported keys present high exposure and exfiltration risks.

Apply resource-level IAM role bindings for least privilege access to secrets.

Granting `roles/secretmanager.secretAccessor` at the specific secret resource level in project `sec-mgmt` ensures the instance can only read the designated secret payload.

Restricting roles to specific resources prevents unintended access to other secrets within the project.

Anahtar Kavram

Keyless Authentication and Least-Privilege IAM Secret Access

Tahmini Süre:1m 30s

Soru 1448Soru →

A digital entertainment platform operates dozens of Google Cloud projects managed by separate game development studios. The workload architecture consists of a steady, predictable baseline of continuous backend telemetry processing, alongside unpredictable, short-lived spikes during live gaming events. The central platform team needs to implement a FinOps governance framework that enforces cost guardrails per studio while optimizing overall compute spend across all projects. Which architecture and cost management strategy should you recommend?

Leverage Cloud Billing account-level Committed Use Discounts (CUDs) to cover the aggregate steady baseline compute load, deploy Spot VMs in Managed Instance Groups (MIGs) for transient spike workloads, and configure Pub/Sub-driven Cloud Functions on billing budget alerts to execute automated resource governance.

Purchase 3-year Standard Committed Use Discounts (CUDs) individually within each project scaled to match peak anticipated traffic for live gaming events.

Provision dedicated Google Kubernetes Engine (GKE) clusters with reserved zonal node pools in every project to handle baseline and spike capacity identically.

Grant primitive IAM Owner roles to studio lead engineers so they can manually increase regional quotas and create high-priority compute instances during live event spikes.

Cevabı ve açıklamayı göster

Cevap: Leverage Cloud Billing account-level Committed Use Discounts (CUDs) to cover the aggregate steady baseline compute load, deploy Spot VMs in Managed Instance Groups (MIGs) for transient spike workloads, and configure Pub/Sub-driven Cloud Functions on billing budget alerts to execute automated resource governance.

Cevap

The optimal strategy leverages Cloud Billing account-level Committed Use Discounts (CUDs) to cover aggregate baseline compute across projects, uses Spot VMs for transient burst workloads, and implements automated budget alert notifications via Pub/Sub and Cloud Functions.

Combining billing account-level CUDs for shared baseline workloads with Spot VMs for transient spikes delivers maximum cost savings. Programmatic billing alerts connected to Cloud Functions provide automated guardrails without over-granting security permissions.

Adım Adım Çözüm

Evaluate baseline vs bursty compute requirements across projects.

Identified steady aggregate usage suitable for commitments and stateless transient usage suitable for Spot instances.

Committed Use Discounts apply across projects linked to the same billing account, maximizing discount coverage for steady-state usage without lock-in to single project peaks.

Select cost-effective compute models for spike workloads.

Configured Managed Instance Groups (MIGs) utilizing Spot VMs for event-driven traffic surges.

Spot VMs provide up to 60-91% savings compared to on-demand pricing, perfectly fitting fault-tolerant spike processing.

Establish programmatic governance guardrails.

Connected Cloud Billing budget alerts to Pub/Sub topics and Cloud Functions.

Automated budget actions enable real-time enforcement of cost policies without exposing broad primitive IAM permissions to end users.

Anahtar Kavram

FinOps Compute Optimization and Automated Governance

Soru 1449Soru →

A digital banking SaaS platform operates a critical payment authorization API deployed on Google Kubernetes Engine (GKE). The service has an availability Service Level Objective (SLO) defined as a $99.95\%$ successful request rate measured over a rolling 30-day window. SRE engineers observed two recurring operational problems: slow, progressive budget consumption going undetected until the 30-day budget was completely exhausted, and transient 2-minute error spikes triggering high-priority pages that resolved prior to engineer intervention. The SRE team needs to establish an alerting strategy in Cloud Monitoring that reliably detects significant error budget consumption while eliminating alert fatigue from transient spikes. Which alerting implementation should the SRE team configure?

Configure multi-window, multi-burn-rate alerts in Cloud Monitoring that page when both short-lookback (1-hour) and long-lookback (6-hour) windows simultaneously exceed a

14.4\times

burn-rate threshold.

Configure a static metric threshold alert in Cloud Monitoring to page the on-call engineer whenever the HTTP 5xx error rate exceeds

0.05\%

over a 5-minute evaluation interval.

Configure alerts based on GKE cluster node CPU and memory utilization thresholds exceeding

85\%

for more than 10 minutes to infer service availability impact before error budgets are consumed.

Configure a single-window alert across the entire rolling 30-day window that pages the SRE team whenever accumulated error budget consumption reaches

50\%

Cevabı ve açıklamayı göster

Cevap: Configure multi-window, multi-burn-rate alerts in Cloud Monitoring that page when both short-lookback (1-hour) and long-lookback (6-hour) windows simultaneously exceed a $14.4\times$ burn-rate threshold.

Cevap

The SRE team should implement multi-window, multi-burn-rate alerting in Cloud Monitoring using short-lookback (1-hour) and long-lookback (6-hour) windows to measure budget consumption rate accurately without noise.

According to Google SRE best practices, multi-window multi-burn-rate alerts evaluate error budget consumption rates across both short lookback windows (to ensure rapid response and quick alert reset) and long lookback windows (to ensure the error burn rate is sustained before paging). This dual-window requirement eliminates false alerts caused by transient spikes while ensuring critical outages that consume budget rapidly are flagged immediately.

Adım Adım Çözüm

Analyze the operational requirements for alerting on SLOs

Identified two requirements: detect sustained/significant error budget consumption quickly, and avoid alerting on transient spikes.

Static threshold alerts and single-window alerts fail to balance alerting speed with alert precision.

Evaluate Google Site Reliability Engineering (SRE) best practices for SLO alerting

Multi-window, multi-burn-rate alerting requires both short (e.g., 1-hour) and long (e.g., 6-hour) windows to exceed the burn rate threshold (e.g.,

14.4\times

burn rate consumes

2\%

of error budget in 1 hour).

Requiring the burn rate to be sustained across both windows prevents transient spikes (which clear quickly from the 1-hour window) from paging engineers, while ensuring rapid detection of real outages.

Compare against incorrect distractor options

Static metrics, CPU alerts, and single 30-day window alerts either create alert fatigue or fail to catch critical burn events in time.

SLI/SLO management requires measuring actual user-impacting error budget consumption rates rather than raw resource consumption or fixed short static thresholds.

Anahtar Kavram

Multi-Window, Multi-Burn-Rate Alerting on Error Budgets

Soru 1450Soru →

An enterprise architecture team is implementing an observability and log management design for an application running on Google Kubernetes Engine (GKE). The team wants to reduce Cloud Logging ingestion costs by preventing verbose application DEBUG logs from being ingested into the `_Default` log bucket, while ensuring that all ERROR-severity application logs and Cloud Audit Logs remain fully available for real-time alerting and compliance export. Which approach correctly achieves this observability strategy without accidentally dropping critical log entries?

Configure an exclusion filter on the `_Default` log bucket specifically matching `resource.type="k8s_container" AND severity="DEBUG"`, while maintaining a Log Router sink to export audit and high-severity logs.

Apply a global log exclusion filter matching `resource.type="k8s_container"` across the entire project to stop container log ingestion into Cloud Logging, relying solely on metric indicators.

Grant the primitive Owner role (`roles/owner`) to the Log Router service account to automatically bypass all log exclusion rules for audit logs.

Configure VPC Service Controls around the GKE cluster and rely on perimeter data boundary rules to stop debug log ingestion into Cloud Logging buckets.

Cevabı ve açıklamayı göster

Cevap: Configure an exclusion filter on the `_Default` log bucket specifically matching `resource.type="k8s_container" AND severity="DEBUG"`, while maintaining a Log Router sink to export audit and high-severity logs.

Cevap

Configure a fine-grained exclusion filter on the `_Default` log bucket matching `resource.type="k8s_container" AND severity="DEBUG"` alongside Log Router sinks for audit and error log exports.

Configuring a granular exclusion filter on the `_Default` log bucket specifying both `resource.type="k8s_container"` and `severity="DEBUG"` allows high-volume debug logs to be discarded while preserving higher severity logs (such as ERROR) and Cloud Audit Logs for incident response and compliance.

Adım Adım Çözüm

Analyze cost optimization and reliability logging requirements.

Identified that only verbose DEBUG logs need to be excluded, while ERROR logs and Audit Logs must be retained.

Exclusion filters prevent matching log entries from being ingested into log buckets, avoiding storage and ingestion charges.

Evaluate the granularity of log exclusion filters.

Combining `resource.type="k8s_container"` with `severity="DEBUG"` explicitly isolates non-critical debug telemetry.

Overbroad exclusion filters risk inadvertently discarding critical application errors and compliance logs.

Verify Log Router sink and security perimeter interaction.

Log Router sinks process logs prior to bucket exclusion rules and IAM/VPC SC controls govern access, not log filtering.

Ensures audit log export and real-time monitoring remain unaffected by bucket-level exclusion filters.

Anahtar Kavram

Cloud Logging Log Router Sinks and Exclusion Filters

Soru 1451Soru →

A financial payment gateway company hosts its primary transaction processing system on Compute Engine Managed Instance Groups (MIGs) in `us-east1` and maintains a warm standby disaster recovery environment in `us-central1`. The infrastructure utilizes a dedicated hybrid connection to on-premises data centers and connects to central shared security services in another VPC. During a catastrophic regional facility outage in `us-east1`, the incident response team executes their Disaster Recovery (DR) runbook to restore application processing in `us-central1` within an RTO of 15 minutes. Which TWO operational steps must the cloud engineering team perform to successfully execute the DR failover? (Select TWO.)

Geçerli olan tümünü seçin

Scale up the standby Compute Engine Managed Instance Groups in `us-central1` using pre-requested regional quota increases and capacity reservations.

Update the Cloud DNS routing policy to shift production traffic from the primary `us-east1` load balancer IP to the secondary `us-central1` load balancer IP.

Re-architect and migrate standard regional Cloud SQL transactional databases to Cloud Spanner during the active failover procedure to establish zero-RPO multi-region write capability.

Route emergency traffic from the `us-central1` VPC through an existing VPC Network Peering connection to a central transit VPC to reach the shared services VPC without establishing direct peering.

Cevabı ve açıklamayı göster

Cevap: Scale up the standby Compute Engine Managed Instance Groups in `us-central1` using pre-requested regional quota increases and capacity reservations.; Update the Cloud DNS routing policy to shift production traffic from the primary `us-east1` load balancer IP to the secondary `us-central1` load balancer IP.

Cevap

The correct operational steps are to scale up the standby Managed Instance Groups in the disaster recovery region using pre-allocated regional quota and capacity reservations, and to update Cloud DNS routing policies to direct production traffic to the load balancer endpoint in the secondary region.

Executing a disaster recovery failover for compute workloads requires rapidly scaling standby instance capacity in the secondary region using pre-configured capacity reservations and regional quota allowances. Once backend compute resources are active, network entry points such as Cloud DNS routing policies must be updated to steer inbound client requests to the secondary regional load balancer.

Adım Adım Çözüm

Ensure compute resources in the secondary region (`us-central1`) can be provisioned rapidly without hitting regional limit barriers.

The secondary Managed Instance Group successfully scales out instances backed by pre-arranged regional quotas and reservations.

Requesting quota increases during an active regional disaster takes too long and leads to failover execution failure.

Update global entry points to direct application traffic to the newly scaled backend infrastructure in `us-central1`.

Cloud DNS updates traffic steering to point to the active load balancer in the secondary region.

Traffic must be explicitly shifted to the secondary region to complete the failover process and restore application availability.

Anahtar Kavram

Disaster Recovery Execution and Capacity Management

Soru 1452Soru →

A platform engineer needs to configure a software developer's local environment to run Python scripts that programmatically manage Google Cloud Storage buckets using Google Cloud Client Libraries. Enterprise security policy strictly prohibits downloading JSON service account keys. The scripts must run using the identity and permissions of a target service account. Place the operational steps in the correct chronological sequence to establish secure programmatic access via Application Default Credentials (ADC) with service account impersonation.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with granting the user identity the Service Account Token Creator role on the target service account, followed by authenticating the user session via gcloud auth login, generating local ADC with impersonation using gcloud auth application-default login --impersonate-service-account, and finally running Python code that initializes Google Cloud Client Libraries using standard ADC auto-discovery.

To enable secure local programmatic interaction with GCP APIs without downloading key files, IAM impersonation permissions must first be granted via the Service Account Token Creator role on the target service account. The developer then logs in with user credentials using gcloud auth login. Next, Application Default Credentials (ADC) are configured with impersonation via gcloud auth application-default login --impersonate-service-account. Finally, the Python application code initializes Google Cloud Client Libraries using standard ADC detection, executing securely under the target service account identity.

Adım Adım Çözüm

Assign the Service Account Token Creator IAM role on the target service account

The developer identity acquires permission to generate tokens on behalf of the service account

Service account impersonation requires explicit token creation permissions granted on the target service account resource.

Authenticate user credentials with gcloud auth login

An active user credential session is stored locally for gcloud CLI operations

gcloud requires an authenticated principal session to authorize token exchange requests for service account impersonation.

Generate local ADC configured for service account impersonation

Application Default Credentials file is written referencing the impersonated service account email

Executing gcloud auth application-default login with the --impersonate-service-account flag configures the local ADC configuration for seamless SDK consumption.

Initialize Google Cloud Client Library in application code

The application makes API calls authorized under the target service account identity without downloading private keys

Google Cloud SDK client libraries automatically locate the ADC configuration file and handle short-lived token requests behind the scenes.

Anahtar Kavram

Application Default Credentials (ADC) with Service Account Impersonation

Tahmini Süre:2m 0s

Soru 1453Soru →

An enterprise engineering team is implementing a zero-downtime Blue-Green release process on Google Cloud for a critical transactional service backed by a Cloud Spanner database. The release includes non-backward-compatible application logic and database schema changes. In which logical sequence should the team perform the deployment operations to ensure zero service disruption and safe rollback capabilities?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: First, apply additive database schema changes (expand phase). Second, deploy and validate the new version in the isolated green environment. Third, switch live traffic to the green environment using the Cloud Load Balancer. Fourth, execute destructive schema cleanup (contract phase) after decommissioning the legacy blue environment.

Safe release management with database migrations requires an expand-contract pattern. Additive database changes must precede application deployment so the active environment remains unaffected. Next, the new code version is deployed to an isolated green environment for verification. Once validated, traffic is shifted atomically at the load balancer layer. Finally, after the legacy blue environment is drained and decommissioned, destructive database cleanup (contract phase) can safely run.

Adım Adım Çözüm

Execute expand-phase DDL operations on the database.

Database supports both old and new schema fields simultaneously without breaking the active production version.

Prevents database errors in the currently active blue environment while preparing the database for the new software version.

Deploy and test the new release in the green environment.

The green environment is fully provisioned, initialized, and health-checked without accepting public traffic.

Ensures that application startup, dependencies, and diagnostic endpoints are fully functional prior to traffic cutover.

Shift production traffic to the green environment.

Cloud Load Balancer directs incoming end-user requests to the green environment instances.

Achieves zero-downtime cutover while keeping the blue environment on standby for immediate rollback if unexpected errors occur.

Decommission the blue environment and execute contract-phase DDL cleanup.

Legacy compute resources are released and deprecated database fields are removed.

Completes the release lifecycle safely after confirming stability and closing the rollback window.

Anahtar Kavram

Zero-Downtime Blue-Green Deployments with Expand-Contract Database Schema Migration

Tahmini Süre:2m 30s

Soru 1454Soru →

A financial services enterprise is establishing a release validation procedure for a mission-critical fraud detection processing system on Google Cloud. As the Principal Cloud Architect, you must sequence the testing and validation phases to ensure zero-downtime deployment, service quota adequacy, and technical solution verification prior to full customer traffic exposure. In what order should these deployment and validation steps be executed from first to last?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with IaC dry-run and IAM policy validation, followed by staging infrastructure provisioning with pre-flight quota and connectivity tests, followed by load and SLO validation under peak stress in staging, and concludes with a canary deployment in production.

A complete GCP architectural validation procedure follows a progressive shift-left methodology: static code/IaC verification comes first, followed by functional staging provisioning with quota checks, then stress and load testing for SLO adherence, and finally a controlled canary rollout to production.

Adım Adım Çözüm

Validate IaC and IAM Security Boundaries

Identifies syntax errors, state conflicts, and permission violations prior to provisioning resources.

Static analysis and dry-run execution prevent broken or insecure infrastructure changes from attempting resource creation.

Provision Staging and Run Pre-flight Functional Tests

Verifies that API quotas, network paths, and synthetic telemetry process successfully.

Functional validation ensures all downstream dependencies and Cloud API limits are healthy before applying high traffic volume.

Execute Load and Resilience Stress Testing

Confirms system scaling behavior and SLO compliance under simulated operational peak traffic.

Load testing reveals performance bottlenecks and auto-scaling limits in a controlled staging environment prior to production exposure.

Initiate Canary Production Deployment

Gradually routes live traffic while evaluating error budgets and monitoring metrics.

Canary releases minimize customer impact in production, allowing safe rollback if telemetry indicates unexpected failures.

Anahtar Kavram

Phased Technical Solution Testing and Release Validation Strategy

Soru 1455Soru →

A multinational smart grid utility company ingests smart meter telemetry from millions of households into Google Cloud. During extreme weather events, peak message volumes rapidly surge up to six times baseline within a 15-minute window. The processing layer uses Compute Engine Managed Instance Groups (MIGs) pulling telemetry messages from Pub/Sub queues, and the workload is known to be network I/O-intensive rather than CPU-bound. You need to ensure the architecture scales dynamically and maintains operational capacity without message processing delays during sudden load spikes. Which TWO actions should you recommend?

Geçerli olan tümünü seçin

Configure the MIG autoscaling policy based on Cloud Monitoring metrics measuring Pub/Sub queue depth and unacknowledged message age.

Configure the MIG autoscaling policy strictly around target CPU utilization thresholds set at 80% across compute instances.

Perform proactive quota capacity reviews and submit regional N2 vCPU quota increase requests well in advance of peak weather seasons.

Migrate the processing workers to a multi-region Google Kubernetes Engine cluster with dedicated node pools solely to reduce provisioning overhead.

Cevabı ve açıklamayı göster

Cevap: Configure the MIG autoscaling policy based on Cloud Monitoring metrics measuring Pub/Sub queue depth and unacknowledged message age.; Perform proactive quota capacity reviews and submit regional N2 vCPU quota increase requests well in advance of peak weather seasons.

Cevap

The architect should configure MIG autoscaling based on Pub/Sub queue depth and unacknowledged message age metrics, while also submitting proactive regional vCPU quota increase requests in advance of peak seasonal demand.

The correct recommendations focus on aligning the autoscaling trigger metric with the actual bottleneck (Pub/Sub queue depth rather than CPU utilization) and ensuring that cloud infrastructure capacity limits (regional vCPU quotas) are raised prior to predicted traffic surges.

Adım Adım Çözüm

Analyze workload resource bottlenecks.

Identified that the message consumption workload is network I/O-bound rather than CPU-bound.

I/O-bound workloads do not saturate CPU, making CPU utilization metrics ineffective for autoscaling triggers.

Select appropriate autoscaling metric for queue processing.

Choose Pub/Sub queue length and unacknowledged message age as custom Cloud Monitoring scaling signals.

Queue-based metrics directly reflect incoming workload pressure and force the MIG to add instances before backlog breaches SLOs.

Verify infrastructure quota headrooms.

Evaluate current regional Compute Engine vCPU quotas against peak scaling targets and request limit increases in advance.

Autoscaling attempts that exceed GCP regional quotas will be denied, causing queue backup regardless of autoscaler settings.

Anahtar Kavram

Workload scaling optimization for I/O-bound message consumers requires custom queue depth scaling metrics combined with proactive regional quota management.

Soru 1456Soru →

A financial payment platform processes real-time credit transactions on Google Cloud using Compute Engine Managed Instance Groups (MIGs) fronted by an External HTTP(S) Load Balancer. The engineering team is planning a zero-downtime blue-green deployment for a major application revision that includes database schema modifications on Cloud SQL for PostgreSQL. Which TWO architectural and operational steps must the team execute to achieve zero downtime and maintain immediate rollback capabilities? (Select TWO answers.)

Geçerli olan tümünü seçin

Apply backward-compatible database schema changes (expand phase) prior to directing live user traffic to the new green instance group.

Execute destructive database schema column removals concurrently with the load balancer traffic cutover to streamline database migration.

Pre-allocate compute instance capacity and confirm passing backend health checks on the green environment before updating load balancer target pool routing.

Rely on automatic default quota increases during traffic cutover rather than validating regional Compute Engine quotas in advance.

Cevabı ve açıklamayı göster

Cevap: Apply backward-compatible database schema changes (expand phase) prior to directing live user traffic to the new green instance group.; Pre-allocate compute instance capacity and confirm passing backend health checks on the green environment before updating load balancer target pool routing.

Cevap

The platform team must apply backward-compatible database schema changes before shifting traffic and ensure green environment compute capacity and health checks are fully validated prior to load balancer cutover.

In blue-green deployments involving relational databases, zero downtime requires decoupled database and application deployments. Using an expand-contract pattern guarantees that database schema updates remain backward-compatible with the active deployment while preparing for the new code release. Additionally, verifying target pool health and regional compute capacity prior to traffic cutover ensures that the green environment can immediately sustain production load without dropping connections.

Adım Adım Çözüm

Implement the expand phase of an expand-contract schema strategy on Cloud SQL.

Database additions (such as new columns or tables) are made backwards-compatible so legacy blue and updated green application versions function concurrently.

Prevents database errors when both environments interact with the database during canary or blue-green cutovers.

Provision and validate the green Compute Engine Managed Instance Group.

Green MIG instances pass HTTP health checks and regional instance quotas are confirmed.

Guarantees full operational readiness and capacity before user request redirection.

Update External HTTP(S) Load Balancer URL maps or target pools to switch traffic to the green MIG.

Traffic cutover completes seamlessly with active blue instances serving remaining active connections until drained.

Achieves zero-downtime release with straightforward rollback by reverting load balancer configuration.

Anahtar Kavram

Expand-Contract Database Migration and Health Verification in Blue-Green Deployments

Soru 1457Soru →

A global telematics company operates an automated fleet tracking system in Google Cloud. The primary streaming pipeline runs in `us-central1`, ingesting real-time data via Cloud Pub/Sub, processing it with Cloud Dataflow, and storing state in a regional Cloud Bigtable cluster. In the event of a catastrophic failure in `us-central1`, the operational recovery runbook requires executing a controlled regional failover to `us-east4` with zero data loss for persistent state. What is the correct sequential order of operational steps to execute this disaster recovery failover runbook?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational failover sequence begins by redirecting client ingress traffic via Cloud DNS to the secondary Cloud Pub/Sub topic, followed by draining the primary Cloud Dataflow pipeline to preserve inflight data, promoting the target Cloud Bigtable cluster app profile to us-east4, and finally launching the failover Cloud Dataflow processing job in us-east4.

Executing regional failover for streaming systems requires a strict sequence: first, redirect client traffic at the ingress layer (DNS/PubSub) so new data buffers safely in the secondary region; second, drain the degraded region's stream processing engine (Dataflow) to preserve inflight data and adhere to RPO zero targets; third, promote the replicated database layer (Cloud Bigtable) by updating routing app profiles; fourth, spin up the secondary stream processing workers in the recovery region to resume normal operations.

Adım Adım Çözüm

Adjust Cloud DNS traffic routing to point client devices to the secondary ingestion Pub/Sub topic in us-east4.

New telemetry stream data is safely buffered in the failover region's Pub/Sub topic.

Immediate DNS traffic redirection stops new workload accumulation in the failing region and prevents client connection timeouts.

Issue a drain command to the primary Cloud Dataflow streaming pipeline operating in us-central1.

Inflight records stored in Pub/Sub and Dataflow pipeline buffers are processed and committed to Cloud Bigtable before job termination.

Draining ensures RPO requirements are met without dropping records currently residing in pipeline memory.

Update Cloud Bigtable App Profiles to route application traffic to the replicated instance cluster in us-east4.

The database storage tier in us-east4 is configured as the active target for read/write queries.

Storage cluster app profiles must be switched after inflight primary writes are finished to prevent split-brain conditions or data inconsistency.

Start the secondary Cloud Dataflow streaming job in us-east4 reading from the failover Pub/Sub subscription.

Stream ingestion and processing fully resume in the failover region.

The failover data processing pipeline can safely start once both the ingress queue and storage layer are properly configured in the secondary region.

Anahtar Kavram

Disaster Recovery Execution Order for Streaming and Storage Workloads

Soru 1458Soru →

An e-commerce company operates a critical catalog search service deployed on Google Cloud Run backed by Cloud Bigtable. The Site Reliability Engineering (SRE) team established a Service Level Objective (SLO) of 99.9% success rate over a rolling 30-day window. To balance fast detection of catastrophic failures with low false-alarm noise during minor events, which alerting policy should the team implement in Cloud Monitoring?

Implement multi-window, multi-burn-rate alerts that trigger based on consuming specific percentages of the 30-day error budget over short and long lookback windows.

Configure a static threshold alert that fires immediately whenever the 5-minute request error percentage exceeds 0.1%.

Set up alert thresholds directly on Cloud Run instance CPU and memory utilization metrics exceeding 85% over a 10-minute average.

Configure load balancer health check probes to run synchronous database queries against Cloud Bigtable on every health check request.

Cevabı ve açıklamayı göster

Cevap: Implement multi-window, multi-burn-rate alerts that trigger based on consuming specific percentages of the 30-day error budget over short and long lookback windows.

Cevap

The team should implement multi-window, multi-burn-rate alerts that evaluate error budget consumption rates over short and long lookback windows.

According to Google SRE principles, multi-window, multi-burn-rate alerts evaluate both the magnitude and duration of error budget consumption. Using multiple lookback windows (such as a 1-hour window for high burn-rate critical pages and a 6-hour or 3-day window for low burn-rate non-urgent notifications) ensures quick response to major outages without alerting on short, non-threatening spikes.

Adım Adım Çözüm

Identify the reliability requirement

The target is to protect a 99.9% rolling 30-day SLO while preventing alert fatigue and detecting budget exhaustion early.

SRE best practices recommend alerting on error budget burn rate rather than raw metric thresholds.

Evaluate alerting mechanisms for SLOs

Multi-window, multi-burn-rate alerting evaluates consumption of the error budget over multiple time windows (e.g., 1-hour short window for critical paging, 6-hour/3-day windows for ticket creation).

This strategy captures fast budget depletion quickly while avoiding false alarms from self-correcting micro-spikes.

Differentiate from sub-optimal alternatives

Static metric thresholds and infrastructure metric monitoring fail to accurately reflect user experience or budget consumption speed.

Resource metrics (CPU/RAM) and static short-window error spikes do not directly map to SLO compliance.

Anahtar Kavram

Multi-window multi-burn-rate alerting

Soru 1459Soru →

A global logistics provider is designing an automated testing and release validation procedure for a new real-time fleet telemetry tracking application. The infrastructure deployment uses Terraform scripts to dynamically provision Google Kubernetes Engine (GKE) clusters, Cloud SQL databases, and VPC networking in target regions for automated load testing. Past dry-run deployments failed midway due to regional API quota exhaustion and missing service account permissions, causing inconsistent test environments and corrupted state tracking. Which validation procedure should the Cloud Architect implement to prevent these deployment failures during technical testing?

Implement automated pre-flight pipeline checks that query GCP Service Quotas APIs and simulate IAM role impersonation prior to running infrastructure deployment steps.

Store Terraform state files within the local storage of the CI/CD build runner to speed up environment validation and prevent state access permission failures.

Disable control plane authorized networks on private GKE clusters during deployment validation so external CI/CD runners can access endpoints without authentication setup.

Configure the CI/CD pipeline to attempt infrastructure provisioning continuously, relying on cloud provider auto-retries when regional compute quota limits are exceeded.

Cevabı ve açıklamayı göster

Cevap: Implement automated pre-flight pipeline checks that query GCP Service Quotas APIs and simulate IAM role impersonation prior to running infrastructure deployment steps.

Cevap

Implement automated pre-flight pipeline checks that query GCP Service Quotas APIs and simulate IAM role impersonation prior to running infrastructure deployment steps.

The optimal validation procedure involves inserting automated pre-flight validation steps into the deployment pipeline. By querying GCP Service Quotas APIs and verifying that the pipeline's service account possesses necessary IAM permissions before provisioning begins, the organization avoids mid-deployment failures, state corruption, and incomplete environment builds.

Adım Adım Çözüm

Analyze deployment validation requirements

Identify that failures occurred mid-execution due to quota exhaustion and missing IAM permissions.

Technical solution testing requires repeatable and predictable environment provisioning before load tests run.

Design pre-flight verification procedures

Incorporate API calls to check regional quota availability and verify service account access prior to applying IaC scripts.

Automated pre-flight checks prevent partial infrastructure builds, preventing state corruption and resource leakage.

Anahtar Kavram

Pre-flight validation of resource quotas and IAM permissions in CI/CD pipelines

Soru 1460Soru →

A DevOps team needs to allow an application running on an external AWS EC2 instance to retrieve database credentials from GCP Secret Manager without creating or downloading service account keys. Sequence the steps required to establish Workload Identity Federation and securely access the secret following Google Cloud security best practices.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of steps is: 1) Create a Workload Identity Pool and AWS Provider in Google Cloud. 2) Grant the AWS IAM role permission to impersonate the GCP service account using the Workload Identity User role. 3) Grant the GCP service account the Secret Manager Secret Accessor role. 4) Exchange the AWS credentials for short-lived GCP tokens via the Security Token Service API to retrieve the secret.

Configuring Workload Identity Federation requires establishing trust with the external AWS provider first. Next, the external identity must be authorized to impersonate the designated GCP service account using the `roles/iam.workloadIdentityUser` role. Then, the GCP service account must be granted the specific secret access permission (`roles/secretmanager.secretAccessor`). Finally, the external application uses STS to exchange its native AWS security token for short-lived GCP credentials to fetch the secret payload.

Adım Adım Çözüm

Establish federation baseline

Workload Identity Pool and AWS Provider configured in GCP IAM

Google Cloud must recognize and validate assertion tokens issued by AWS IAM.

Bind external identity to GCP service account

IAM policy binding added for `roles/iam.workloadIdentityUser`

Allows authenticated AWS identities matching attribute conditions to impersonate the GCP service account.

Authorize secret access

GCP service account assigned `roles/secretmanager.secretAccessor`

Enforces least privilege by granting payload reading rights only to the service account, avoiding primitive roles.

Token exchange and runtime retrieval

Short-lived GCP access token generated and used to read secret

Eliminates static long-lived credentials by using short-lived tokens generated on demand via STS.

Anahtar Kavram

Workload Identity Federation for external workloads accessing GCP Secret Manager

ÖncekiSayfa 73 / 80Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram