Examkin

Tüm alıştırma soruları

1598 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 161Soru →

An enterprise organization is updating its release management pipeline for a mission-critical web application hosted on Google Cloud. The architecture uses Google Kubernetes Engine (GKE) for compute services and Cloud Spanner for backend database operations. The organization plans to implement automated canary deployments using Cloud Deploy and Service Directory, with automated traffic shifting based on real-time Cloud Monitoring error budget burn-rate metrics. To maintain high availability during releases and prevent operational failures, which TWO architectural practices must be incorporated into the deployment pipeline? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Structure database schema updates to be strictly backward-compatible with previous application versions prior to initiating canary traffic shifts.; Maintain all Terraform deployment pipeline state files in a versioned Cloud Storage backend with object locking enabled.

Cevap

The deployment strategy requires implementing backward-compatible database schemas before canary traffic splitting and maintaining IaC deployment state in versioned Cloud Storage buckets with locking enabled.
Safe canary releases require that both old and new code versions can run concurrently against shared backing stores; therefore, database schema changes must be backward-compatible (e.g., expand-contract pattern). Furthermore, reliable automated infrastructure delivery requires state files stored securely in remote versioned storage with locking mechanics to ensure deployment pipeline integrity.

Adım Adım Çözüm

1
Analyze database dependency requirements during canary traffic splitting.
Identified that both old and new container versions must run simultaneously against the shared database.
Non-backward-compatible schema migrations will cause immediate failures for requests routed to the baseline version during a canary roll-out.
2
Evaluate Infrastructure as Code state management for automated deployment pipelines.
Determined that concurrent CI/CD pipeline executions risk state locking conflicts and state corruption.
Centralized Cloud Storage backends with versioning and state locking guarantee atomic state updates across pipeline runs.
3
Evaluate distractor configurations against GCP architecture anti-patterns.
Eliminated options advocating primitive IAM role assignment, deep dependency health check probes, and per-build cluster provisioning.
These represent security risk, operational instability, and unnecessary compute overhead respectively.

Anahtar Kavram

Release Management Reliability and Zero-Downtime Deployment Strategies
Soru 162Soru →

An automated trading platform engineering team is establishing an Infrastructure as Code (IaC) deployment pipeline for Google Cloud workloads across development, staging, and production environments using Terraform and Cloud Build. The security policy mandates least privilege execution, environment isolation, protection against concurrent state modifications, and strict state version auditability. Which deployment architecture should the cloud architect recommend?

Cevabı ve açıklamayı göster

Cevap: Provision dedicated Cloud Storage buckets per environment with Object Versioning enabled for remote backends, enforce state locking via Cloud Storage native locking mechanisms, and configure Cloud Build pipelines to impersonate environment-specific service accounts granted minimal predefined IAM roles.

Cevap

Provision dedicated Cloud Storage buckets per environment with Object Versioning enabled for remote backends, enforce state locking via Cloud Storage native locking mechanisms, and configure Cloud Build pipelines to impersonate environment-specific service accounts granted minimal predefined IAM roles.
The correct approach enforces enterprise-grade Infrastructure as Code governance by isolating Terraform remote state backends into separate Cloud Storage buckets per environment, enabling state locking and object versioning to protect against state corruption, and scoping CI/CD pipeline access using dedicated service accounts with fine-grained predefined roles.

Adım Adım Çözüm

1
Isolate remote state storage across environment boundaries
Separate Cloud Storage buckets per environment prevent accidental cross-environment modifications.
Production and lower environments must be isolated at both resource and state management layers.
2
Enable Object Versioning and native locking on state backends
State locking prevents concurrent pipeline runs from corrupting state, while versioning enables state recovery.
Terraform relies on state consistency; versioning provides disaster recovery for state corruption.
3
Scope CI/CD execution identity with short-lived impersonation and minimal IAM roles
Cloud Build impersonates fine-grained service accounts without exposing static long-lived keys or over-privileged primitive roles.
Adheres to security least-privilege principles.

Anahtar Kavram

Enterprise IaC Governance with Terraform, Remote State Security, and Least Privilege CI/CD Execution
Tahmini Süre:2m 0s
Soru 163Soru →

An enterprise financial organization hosts a public-facing Web API on Google Cloud backed by internal Compute Engine instances storing sensitive customer records. The security engineering team mandates that the architecture must mitigate Layer 7 application attacks (such as SQL injection and rate flooding) at the network edge, while simultaneously establishing a strict perimeter boundary around the internal Google Cloud project resources to prevent data exfiltration to unauthorized storage destinations. Which TWO security controls should the cloud architect implement to fulfill these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Google Cloud Armor security policies with preconfigured WAF rules and attach them to the External HTTP(S) Load Balancer target backend services.; Establish a VPC Service Controls perimeter around the project holding internal resources, configuring explicit ingress and egress rules for allowed service communication.

Cevap

To protect public endpoints against Layer 7 attacks and enforce data exfiltration boundaries around internal project resources, the architecture must combine Google Cloud Armor security policies on the External HTTP(S) Load Balancer with a VPC Service Controls perimeter around the internal GCP services.
Google Cloud Armor provides edge security against application-layer attacks by applying WAF rules and rate-limiting policies directly at the load balancer level. Meanwhile, VPC Service Controls creates a cryptographically enforced perimeter around Google Cloud projects and services, isolating internal data resources to prevent exfiltration across service boundaries.

Adım Adım Çözüm

1
Identify edge security controls required for Layer 7 web threat mitigation.
Select Google Cloud Armor security policies attached to the External HTTP(S) Load Balancer.
Cloud Armor provides Web Application Firewall (WAF) capabilities, rate limiting, and DDoS protection at the Google network edge.
2
Identify perimeter controls required to prevent data exfiltration from internal GCP resources.
Select VPC Service Controls around the target project containing internal compute and storage resources.
VPC Service Controls isolates GCP resources inside a defined perimeter, blocking network-level exfiltration to unauthorized external buckets or services.

Anahtar Kavram

Defense-in-depth perimeter security integrating Google Cloud Armor for edge WAF/DDoS defense and VPC Service Controls for data exfiltration isolation.
Soru 164Soru →

A global educational publishing firm is migrating its interactive digital learning platform to Google Cloud. Executive leadership requires zero service downtime during major academic exam windows, strict data isolation for student telemetry, and smooth enablement for non-technical content operations teams who are transitioning from on-premises file servers. Which TWO strategies should the lead cloud architect execute to successfully manage organizational change and satisfy business stakeholder requirements? (Select TWO options.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a cloud governance framework paired with a role-based cloud enablement and training program tailored for content operations staff prior to migration cutover.; Audit workload capacity requirements early in the architectural phase and submit regional resource quota increase requests for compute and storage prior to peak user registration windows.

Cevap

The architect should establish a structured role-based training and cloud governance framework for non-technical teams prior to cutover, and proactively audit and request regional resource quota increases in advance of peak operational events.
Successful enterprise migrations require combining technical preparedness with organizational change management. Establishing a role-based training program empowers non-technical teams to transition smoothly without creating operational bottlenecks. Concurrently, requesting necessary quota increases in advance ensures that infrastructure scale matches peak business requirements without downtime.

Adım Adım Çözüm

1
Evaluate organizational change management and enablement requirements for non-technical stakeholders.
Identify that targeted role-based training coupled with clear cloud governance builds organizational capability without compromising operational security.
Non-technical teams transitioning from legacy on-premises workflows need structured upskilling to adapt smoothly without disrupting business operations.
2
Analyze capacity planning requirements against business availability SLAs during high-demand events.
Determine that GCP quota increases require lead time and must be requested before deployment and peak registration periods.
Failing to secure regional quotas beforehand risks deployment failures and unexpected outages during critical business windows.
3
Identify and eliminate security anti-patterns in distractor choices.
Reject the use of primitive Owner roles and sole reliance on IAM for data exfiltration prevention.
Primitive roles violate least privilege, while preventing exfiltration requires VPC Service Controls in addition to IAM permissions.

Anahtar Kavram

Organizational change enablement, cloud governance alignment, and proactive quota management in GCP enterprise migrations.
Tahmini Süre:2m 0s
Soru 165Soru →

A financial platform hosts stateless microservices on Cloud Run connected to a Cloud SQL for PostgreSQL instance. The application team plans to release a major update that requires a breaking database schema change, specifically renaming a critical column and changing its data type. The team must execute a zero-downtime canary deployment using Cloud Run traffic splitting, while maintaining the ability to instantly roll back traffic to the previous application revision without causing runtime errors or data corruption for users on either revision. Which release management strategy should you implement?

Cevabı ve açıklamayı göster

Cevap: Implement an expand-contract database migration pattern by adding the new column alongside the existing column, deploying the new Cloud Run revision using gradual traffic splitting, and removing the legacy column only after the new revision is fully deployed and verified.

Cevap

Implement an expand-contract database migration pattern by adding the new column alongside the existing column, deploying the new Cloud Run revision using gradual traffic splitting, and removing the legacy column only after the new revision is fully deployed and verified.
The correct strategy uses an expand-contract (also known as parallel run) database migration pattern. In canary deployments or blue-green releases, multiple application revisions run concurrently against the same database backend. To prevent runtime errors and ensure instant rollback capability, database schema changes must be non-breaking and backward-compatible. Adding the new column while writing to both columns ensures that the old application version continues working seamlessly alongside the canary version.

Adım Adım Çözüm

1
Analyze deployment constraints
Identified the need for zero-downtime canary deployment with simultaneous operation of old and new application revisions against a shared database.
Canary deployments shift traffic incrementally, meaning both application versions must query the database at the same time.
2
Evaluate database schema compatibility strategy
Adopt the expand-contract (parallel run) pattern.
Breaking schema changes must be decoupled into multi-phase additive changes so legacy application instances do not fail when querying missing columns.
3
Design canary release lifecycle
Phase 1: Expand database with new column/dual-write capability. Phase 2: Deploy new Cloud Run revision and split traffic. Phase 3: Contract database by removing legacy column after full rollout.
Ensures full rollback capability at any stage during traffic migration without service downtime or query errors.

Anahtar Kavram

Decoupling Database Schema Migrations from Application Deployments (Expand-Contract Pattern)
Tahmini Süre:3m 0s
Soru 166Soru →

An enterprise organization operates a multi-tenant payment platform across dozens of Google Cloud projects. To satisfy strict security compliance and operational requirements, high-severity application errors and audit logs across all projects must be aggregated into a centralized BigQuery dataset managed by the Security Operations team. However, high log generation rates from non-production diagnostic logging threaten to cause excessive Cloud Logging ingestion and storage costs. Which log routing and governance architecture should the Lead Cloud Architect implement?

Cevabı ve açıklamayı göster

Cevap: Create an aggregated Log Router sink at the organization folder level using an inclusion filter that selects audit logs and entries with severity equal to or greater than ERROR, routing to the central BigQuery dataset, while applying exclusion filters in non-production projects targeting only diagnostic logs with severity less than ERROR.

Cevap

Implement an organization-level aggregated Log Router sink configured with explicit inclusion filters for audit logs and error severity (severity >= ERROR), while using exclusion filters in non-production projects strictly for low-severity diagnostic logs (severity < ERROR).
Creating an aggregated Log Router sink at the organization or folder level ensures centralized compliance and operational log aggregation into BigQuery across all project environments. Configuring inclusion filters for audit logs and high severity levels (severity >= ERROR) combined with non-production exclusion filters for lower severity levels (severity < ERROR) successfully reduces storage costs without discarding critical incident diagnostic data.

Adım Adım Çözüm

1
Evaluate central governance requirements for multi-project log aggregation.
Using an organization-level aggregated sink enables central collection of compliance audit logs and critical application errors across all current and future projects.
Centralizing log router sinks at the folder or organization root avoids administrative drift and missing logs from newly created projects.
2
Determine the appropriate inclusion and exclusion filter configuration to manage costs without losing vital operational metrics.
Set inclusion filters for `severity >= ERROR` and audit logs, while filtering out verbose info/debug logs (`severity < ERROR`) at non-production sources.
Excluding debug/info logs reduces Cloud Logging ingestion fees while guaranteeing that high-severity operational events remain fully visible.
3
Verify security and least-privilege role requirements for log export service accounts.
Ensure sink service accounts are granted fine-grained destination roles (e.g., BigQuery Data Editor) rather than primitive roles, and protect sensitive storage locations using VPC Service Controls.
Adheres to security best practices for least privilege and data exfiltration prevention.

Anahtar Kavram

Log Router aggregated sinks and inclusion/exclusion filter strategy for enterprise observability and cost optimization.
Soru 167Soru →

A multinational logistics company runs workload components across dozens of Google Cloud projects managed under a single Google Cloud Organization. The security operations team requires all Cloud Audit Logs and application error logs from all projects to be centralized in a dedicated compliance Google Cloud project for long-term storage and analysis. Simultaneously, the operations team needs to prevent low-severity debug log ingestion from ballooning operational costs across the organization. Which architectural strategy should a Cloud Architect implement to fulfill these requirements securely and efficiently?

Cevabı ve açıklamayı göster

Cevap: Create an organization-level aggregated Log Router sink with an inclusion filter selecting Cloud Audit Logs and logs with severity of ERROR or higher, pointing to the central project log bucket, and assign the sink service account the Logs Bucket Writer role on the destination resource.

Cevap

Create an organization-level aggregated Log Router sink with an inclusion filter selecting Cloud Audit Logs and logs with severity of ERROR or higher, pointing to the central project log bucket, and assign the sink service account the Logs Bucket Writer role on the destination resource.
Creating an organization-level aggregated Log Router sink enables centralized log aggregation across all existing and future projects within the organization hierarchy. Specifying an inclusion filter for audit logs and error-level messages ensures only required compliance data is routed to the destination project, preventing costs associated with ingesting debug logs. Assigning the specific `roles/logging.bucketWriter` role to the sink service account satisfies security standards through fine-grained identity access.

Adım Adım Çözüm

1
Identify the multi-project log aggregation requirement
Recognize that an organization-level aggregated Log Router sink is required to capture log events across all child projects systematically.
Creating sinks individually in dozens of projects creates administrative overhead and operational inconsistency.
2
Define log filtering to balance compliance and cost optimization
Filter for required logs using inclusion criteria (Cloud Audit Logs and severity >= ERROR) to avoid ingesting low-severity debug logs.
Including only required high-value log types at the sink level prevents low-severity logs from being stored in the central project.
3
Establish secure cross-project identity and access management
Grant the aggregated sink's unique service account the predefined `roles/logging.bucketWriter` role on the target central log bucket.
Google Cloud Log Router uses service accounts to write logs across project boundaries securely under least-privilege principles.

Anahtar Kavram

Organization-level Aggregated Log Router Sinks and Filtering
Soru 168Soru →

An enterprise web application deployed across primary region `us-central1` and secondary recovery region `us-east4` experiences a total regional failure in `us-central1`. The application uses a Pilot Light DR pattern comprising a Cloud SQL PostgreSQL cross-region read replica and a minimal regional Managed Instance Group (MIG) in `us-east4`. To achieve recovery without split-brain data corruption or premature exposure of unvalidated endpoints, in what exact sequence should the SRE team execute the disaster recovery failover runbook tasks?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence for regional DR failover is: 1) Isolate `us-central1` compute and database write paths to eliminate split-brain risk, 2) Promote the `us-east4` Cloud SQL cross-region read replica to standalone primary, 3) Scale up the `us-east4` Managed Instance Group to full capacity, 4) Execute synthetic health and data integrity checks against the internal `us-east4` endpoint, and 5) Update Global Load Balancer backends to direct ingress traffic to `us-east4`.
In GCP enterprise DR execution, ensuring data consistency and split-brain prevention is the highest priority. The primary degraded region must first be fenced off by revoking write access. Next, the secondary database replica is promoted to primary so that compute nodes have a valid write target. Then, the pilot-light MIG is scaled to full capacity to accommodate production traffic. Next, internal synthetic validation tests verify system readiness. Finally, the Global Load Balancer backend configuration is updated to route public client traffic to the secondary region.

Adım Adım Çözüm

1
Isolate the primary region
Primary database and compute components are locked from receiving new writes, preventing data divergence.
Before promoting a secondary database, the primary region must be fenced off so that transient network recoveries do not cause split-brain data writes.
2
Promote the database replica
The Cloud SQL replica in `us-east4` becomes an independent primary database.
Application services cannot process state-changing user transactions until a writeable primary database is established.
3
Scale up compute capacity
The pilot-light MIG expands instances to handle production request volumes.
Compute resources must be provisioned and connected to the newly promoted database before receiving production workload demands.
4
Perform synthetic validation
Smoke tests confirm schema integrity, connection pool behavior, and application startup cleanliness.
Directing live user traffic to an unvalidated secondary stack risks mass request drops or silent application failures.
5
Shift global ingress traffic
The Global External Load Balancer routes user requests to the fully healthy secondary region.
Traffic shifting completes the failover procedure once end-to-end operational readiness is validated.

Anahtar Kavram

Disaster Recovery Failover Execution & Split-Brain Prevention
Soru 169Soru →

A smart grid energy management enterprise processes telemetry data ingested from municipal power meters into BigQuery and Cloud Storage within Google Cloud. The security operations team requires that internal analysts operating inside a management Compute Engine Virtual Machine (VM) retain administrative access to run BigQuery queries. However, the architecture must strictly prevent authorized users or compromised service accounts from exfiltrating sensitive data to Cloud Storage buckets outside the organization's perimeter, even if their IAM identities have full object creation permissions. Which solution should a Cloud Architect implement to satisfy these security requirements?

Cevabı ve açıklamayı göster

Cevap: Establish a VPC Service Controls perimeter around the project hosting BigQuery and Cloud Storage to block API data movement outside the designated perimeter boundaries.

Cevap

Establish a VPC Service Controls perimeter around the project hosting BigQuery and Cloud Storage to block API data movement outside the designated perimeter boundaries.
VPC Service Controls provide a perimeter boundary around Google Cloud services like BigQuery and Cloud Storage. By restricting API access to within the defined perimeter, it prevents data from being copied or exfiltrated to resources in external projects, regardless of the user's IAM permissions.

Adım Adım Çözüm

1
Analyze the core security requirement
The requirement demands preventing data exfiltration to unauthorized GCP resources by authorized users or compromised service accounts with valid IAM roles.
Standard IAM privileges permit authenticated identities to copy data to any storage bucket they can access unless constrained at the service perimeter level.
2
Evaluate Google Cloud perimeter security mechanisms
VPC Service Controls isolate Google Cloud service APIs (such as BigQuery and Cloud Storage) within defined security perimeters.
VPC Service Controls block unauthorized request paths and data transfers across perimeter borders even if IAM permissions allow the action.
3
Confirm the valid architectural solution
Placing the sensitive projects inside a VPC Service Controls perimeter prevents egress data movement to external storage locations.
VPC Service Controls are specifically designed to mitigate data exfiltration risks by enforcing perimeter controls directly on Google API endpoints.

Anahtar Kavram

VPC Service Controls data exfiltration prevention
Soru 170Soru →

A financial analytics enterprise processes real-time risk assessment calculations on Google Cloud using a Compute Engine Managed Instance Group (MIG) deployed across multiple zones in `us-central1`. During unpredictable market volatility events, compute demand spikes rapidly, requiring the MIG to scale up from 20 to 150 `n2-standard-16` instances. During a recent market event, autoscaling failed to provision required instances due to reaching the region's N2 vCPU quota limit and encountering transient stockouts of `n2-standard-16` instances in specific zones. The enterprise requires a solution that guarantees instance allocation during market spikes while adhering to GCP quota governance. Which architectural strategy should the Cloud Architect recommend?

Cevabı ve açıklamayı göster

Cevap: Submit a proactive regional N2 vCPU quota increase request for `us-central1` and configure Compute Engine zonal capacity reservations for the required `n2-standard-16` capacity.

Cevap

The Cloud Architect should submit a proactive regional N2 vCPU quota increase for `us-central1` and configure zonal capacity reservations for `n2-standard-16` instances.
To reliably handle scale-up events from 20 to 150 instances, both administrative quota and physical resource availability must be secured. Submitting a proactive regional vCPU quota increase for N2 instances in `us-central1` resolves project quota restrictions. Creating Compute Engine capacity reservations ensures Google Cloud physically reserves the required `n2-standard-16` compute capacity in the target zones, enabling the Managed Instance Group to scale seamlessly without running into stockouts.

Adım Adım Çözüm

1
Analyze capacity failure root causes
Identified two bottlenecks: regional vCPU project quota limit and hardware availability/stockouts in specific compute zones.
Scaling limits in Compute Engine occur at both administrative quota levels and physical hardware resource availability levels.
2
Evaluate GCP Quota Management
Proactively requesting a regional vCPU quota increase ensures project quota does not block instance creation during scale-up.
Quota limits exist to prevent unexpected spend and ensure fair resource distribution, requiring explicit quota requests prior to high-demand events.
3
Evaluate Infrastructure Reservation
Configuring Compute Engine Zonal Capacity Reservations guarantees that specific machine types (`n2-standard-16`) are reserved in the designated zones.
Capacity reservations ensure resources are physically set aside in target zones so autoscaling MIGs can consume them reliably during burst events.

Anahtar Kavram

Capacity Planning and Infrastructure Workload Scaling Optimization
Soru 171Soru →

An engineering team is configuring an automated CI/CD release pipeline for a web service deployed on Google Cloud Run using Terraform for infrastructure provisioning. The application relies on Cloud SQL for persistent data storage. Which TWO deployment and infrastructure management practices should the team implement to ensure release reliability and zero-downtime deployments?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Perform database schema changes using multi-phase, backward-compatible updates before deploying new application code.; Configure Cloud Storage with object versioning as a remote backend for storing Terraform state files.

Cevap

The team must perform database schema changes using multi-phase, backward-compatible updates before deploying new application code, and configure Cloud Storage with object versioning as a remote backend for storing Terraform state files.
Safe release management requires that database changes are backward-compatible so that both old and new application instances can run concurrently without errors during traffic migration. Additionally, reliable Infrastructure as Code deployments depend on centralized state management with locking and versioning enabled in Cloud Storage.

Adım Adım Çözüm

1
Ensure Database Backward Compatibility
Database schemas support both the active version and the new application version simultaneously.
Prevents live traffic errors and broken queries during canary traffic shifting or blue-green rollouts.
2
Configure Centralized IaC Remote Backend
Terraform state is locked during updates and maintained with full version history.
Prevents state corruption and concurrency conflicts across CI/CD execution runs.

Anahtar Kavram

Zero-downtime release management and Infrastructure as Code state management
Soru 172Soru →

A media streaming company organizes its Google Cloud resources using a folder hierarchy where each media platform (such as Video, Audio, and Gaming) has a dedicated folder containing multiple production and staging projects. The central security operations team needs to review security configurations and inspect IAM policies across all current and future projects in the 'Audio' folder without being able to read data stored inside Cloud Storage buckets or Cloud Bigtable instances, and without making configuration changes. Which approach follows Google-recommended best practices while minimizing administrative overhead?

Cevabı ve açıklamayı göster

Cevap: Grant the predefined Security Reviewer role (roles/iam.securityReviewer) to the security operations group at the 'Audio' folder level.

Cevap

Grant the predefined Security Reviewer role (roles/iam.securityReviewer) to the security operations group at the 'Audio' folder level.
Granting the Security Reviewer role at the folder level enforces least privilege by allowing access only to security configurations and IAM policies, while resource hierarchy inheritance automatically applies these permissions to all projects created under the folder.

Adım Adım Çözüm

1
Identify the resource scope and inheritance requirement.
Applying policy at the folder level ensures automatic inheritance across all child projects (present and future) within the 'Audio' folder.
Folder-level bindings minimize administrative overhead compared to per-project policy management.
2
Select the appropriate IAM role for security auditing without data access.
The Security Reviewer role (roles/iam.securityReviewer) provides permissions to inspect IAM policies and security settings without granting access to stored data payloads.
Enforces least privilege by avoiding primitive roles like Viewer which grant broad data access.

Anahtar Kavram

Resource Hierarchy Permission Inheritance and Predefined Security Roles
Soru 173Soru →

A retail organization's platform operations team is supporting a dev team that deploys microservices to a private Google Kubernetes Engine (GKE) cluster using an external CI/CD runner. During automated deployment pipeline runs, the build stage succeeds, but the deployment step fails to connect to the cluster's control plane API server. The operations team wants to enable the CI/CD pipeline to deploy container updates securely without exposing the control plane to public internet traffic generally. Which architectural advice should you provide to the development and operations teams?

Cevabı ve açıklamayı göster

Cevap: Configure Control Plane Authorized Networks on the private GKE cluster to explicitly allow access from the specific external IP CIDR block of the CI/CD deployment runners.

Cevap

Configure Control Plane Authorized Networks on the private GKE cluster to allow traffic specifically from the CI/CD deployment runner IP addresses.
Configuring Control Plane Authorized Networks allows platform teams to specify exact public IP ranges (such as those belonging to CI/CD deployment systems) authorized to access the private GKE cluster's API endpoint, fulfilling both security and deployment automation requirements.

Adım Adım Çözüm

1
Identify the root cause of the deployment connection failure.
The private GKE cluster control plane endpoint blocks inbound traffic originating from unauthorized external IP addresses.
Private GKE clusters restrict control plane API access by default to protect cluster administration endpoints.
2
Evaluate secure access options that maintain security boundaries and least privilege.
Configuring Control Plane Authorized Networks allows specific CIDR ranges (the CI/CD runner IPs) to reach the API server without exposing it to the open internet.
This balances pipeline automation requirements with robust perimeter security best practices on GCP.

Anahtar Kavram

Advising Development and Operation Teams on Private GKE Cluster Control Plane Access
Soru 174Soru →

A healthcare enterprise is executing its disaster recovery strategy across Google Cloud regions us-central1 (primary) and us-east4 (secondary). The workload manages critical electronic health records and requires a strict Recovery Point Objective (RPO) of zero and a Recovery Time Objective (RTO) under 1 minute for database failover. Additionally, on-premises hybrid connectivity demands a sustained throughput of 15 Gbps for continuous data synchronization, and isolated spoke VPCs must route failover traffic through a central hub VPC to reach secondary regional services without establishing direct full-mesh peering between every spoke. Which combined Google Cloud architectural strategy meets all operational, performance, and disaster recovery execution requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy Cloud Spanner using a multi-region instance configuration, provision Dedicated Interconnect for hybrid connectivity, and implement Network Connectivity Center with dynamic BGP routing for hub-and-spoke VPC architecture.

Cevap

Deploying Cloud Spanner with multi-region synchronous replication satisfies the zero RPO and sub-minute RTO requirement. Dedicated Interconnect provides the required 15 Gbps hybrid bandwidth, and Network Connectivity Center enables non-transitive network routing limitations of standard VPC peering to be resolved.
The solution combining Cloud Spanner multi-region instance configuration, Dedicated Interconnect, and Network Connectivity Center satisfies all three explicit constraints: Cloud Spanner ensures RPO=0 via multi-region synchronous replication; Dedicated Interconnect reliably handles 15 Gbps hybrid traffic; and Network Connectivity Center enables managed hub-and-spoke routing without violating VPC peering transitivity boundaries.

Adım Adım Çözüm

1
Evaluate data persistence requirements against RPO=0 and sub-minute RTO constraints.
Cloud SQL cross-region read replicas use asynchronous replication and manual/scripted promotion, which risks data loss (RPO > 0). Cloud Spanner multi-region configurations synchronously replicate writes across regions, ensuring RPO=0 and rapid automated failover.
Relational databases requiring absolute zero RPO across regions in GCP necessitate multi-region Cloud Spanner.
2
Assess hybrid network bandwidth requirements for 15 Gbps continuous sync.
HA VPN maxes out at 3 Gbps per tunnel (up to 5 Gbps in specific configurations) and requires complex multi-tunnel ECMP management for 15 Gbps. Dedicated Interconnect offers native 10 Gbps or 100 Gbps circuits suitable for high sustained throughput.
Dedicated Interconnect is the appropriate GCP pattern for sustained hybrid traffic above multi-gigabit thresholds.
3
Analyze hub-and-spoke VPC traffic routing constraints.
Standard VPC Network Peering is strictly non-transitive. Traffic cannot pass through a hub VPC to reach external or secondary regional destinations. Using Network Connectivity Center with Cloud Routers provides managed hub-and-spoke routing.
Transitive routing across spoke networks requires managed routing mechanisms such as Network Connectivity Center or VPN/Router appliance overlays.

Anahtar Kavram

Multi-region DR Execution with Cloud Spanner, Dedicated Interconnect, and Hub-and-Spoke Networking
Soru 175Soru →

An enterprise analytics application processes real-time telemetry and is deployed across two Google Cloud regions: `us-central1` (primary) and `us-west1` (secondary). The application uses Google Kubernetes Engine (GKE) clusters in both regions for stateless processing and a multi-region Cloud Bigtable instance for low-latency time-series data storage. A major regional utility failure renders all compute resources in `us-central1` completely unavailable. The disaster recovery plan mandates failing over active operations to `us-west1` with minimal Recovery Time Objective (RTO) while ensuring incoming client traffic is redirected and database operations resume cleanly. Which TWO operational steps must the response team execute to complete the disaster recovery failover?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the Cloud Bigtable app profile configuration to enforce single-cluster routing pointing to the cluster in `us-west1`.; Update the Cloud DNS failover routing policy or Global External Load Balancer backend service configuration to direct client traffic exclusively to the GKE ingress in `us-west1`.

Cevap

To execute disaster recovery failover, the team must update the Cloud Bigtable app profile to direct database requests to the healthy cluster in the secondary region and update Cloud DNS routing or Global Load Balancer backends to direct ingress traffic to the secondary GKE deployment.
During a regional failover, operational execution requires redirecting application traffic to healthy compute infrastructure and ensuring stateful service app profiles or endpoints route requests to active database clusters in the surviving region. Updating Cloud Bigtable app profiles to target the surviving cluster and updating Cloud DNS/Load Balancing endpoints ensures rapid restoration of service with minimal RTO.

Adım Adım Çözüm

1
Redirect database traffic at the application layer
Database queries from the secondary region are routed directly to the local, healthy Cloud Bigtable cluster.
Reconfiguring the app profile allows application instances in the surviving region to issue reads and writes against the local Bigtable cluster immediately.
2
Redirect incoming user and ingress traffic to the surviving region
Client traffic bypasses the impacted primary region and routes to the secondary GKE cluster.
Updating Cloud DNS routing policies or global load balancing backend weights ensures all public traffic is served by operational infrastructure.

Anahtar Kavram

Disaster Recovery Execution for Replicated Services and Traffic Steering
Soru 176Soru →

A software engineering team is constructing an automated local integration testing suite for an application that interacts with Cloud Bigtable. To run offline integration tests within an isolated CI container environment without network access to Google Cloud, the team starts the local emulator using `gcloud beta emulators bigtable start`. However, when test cases run, the application client library attempts to reach live Google Cloud endpoints and fails due to missing internet connectivity. Which configuration step must be performed so that the Cloud Bigtable client library routes requests directly to the locally running emulator process?

Cevabı ve açıklamayı göster

Cevap: Export the BIGTABLE_EMULATOR_HOST environment variable set to the host address and port where the emulator is running prior to executing the client application.

Cevap

Export the BIGTABLE_EMULATOR_HOST environment variable set to the host address and port where the emulator is running prior to executing the client application.
The Cloud Bigtable emulator runs as a local process. Official GCP client SDKs look for the BIGTABLE_EMULATOR_HOST environment variable upon initialization. When present, the SDK sends API calls to the specified local port instead of authenticating with live Google Cloud end points.

Adım Adım Çözüm

1
Identify how Google Cloud client libraries discover emulator endpoints.
Google Cloud client libraries automatically inspect environment variables (such as BIGTABLE_EMULATOR_HOST) to override default GCP service endpoints.
This allows offline local testing without modifying application code or making calls to live GCP APIs.
2
Configure the local test environment.
Set BIGTABLE_EMULATOR_HOST (e.g., BIGTABLE_EMULATOR_HOST=localhost:8086) in the shell or CI pipeline container running the tests.
The client SDK redirects all database reads and writes to the local Bigtable emulator process running on that socket.

Anahtar Kavram

Cloud Bigtable Emulator Host Environment Variable Configuration
Soru 177Soru →

A multinational pharmaceutical enterprise operates a supply chain web portal running on 20 Compute Engine virtual machines 24/7 with consistent resource utilization. Additionally, the enterprise executes a monthly inventory batch analytics job for 6 hours at the end of each month that requires 500 Compute Engine virtual machines. The FinOps team needs to reduce cloud compute expenses while maintaining system availability and operational efficiency. Which cost optimization strategy should the Cloud Architect recommend?

Cevabı ve açıklamayı göster

Cevap: Purchase Committed Use Discounts (CUDs) to cover the 20 web portal virtual machines, and utilize Spot VMs for the monthly 6-hour batch processing workload.

Cevap

Purchase Committed Use Discounts (CUDs) to cover the 20 web portal virtual machines, and utilize Spot VMs for the monthly 6-hour batch processing workload.
Applying Committed Use Discounts (CUDs) to steady, predictable 24/7 baseline capacity while leveraging Spot VMs for fault-tolerant, short-duration batch processing aligns with FinOps best practices by maximizing discount coverage without paying for idle capacity.

Adım Adım Çözüm

1
Analyze workload predictability and operational duration.
Identify the web portal (20 VMs running 24/7) as steady baseline compute capacity, and the monthly inventory analysis (500 VMs for 6 hours) as a short-duration batch workload.
Effective FinOps strategies separate predictable baseline demand from temporary peak demand.
2
Select the optimal Google Cloud pricing model for each workload tier.
Apply 1-year or 3-year Committed Use Discounts (CUDs) to the 24/7 baseline VMs to lock in lower hourly rates, and use Spot VMs for the batch analytics job.
CUDs require continuous hourly utilization to deliver savings, whereas Spot VMs offer heavy discounts suitable for batch jobs that can tolerate interruption.

Anahtar Kavram

FinOps Compute Optimization Strategy
Soru 178Soru →

A global supply chain enterprise operates a critical order management platform with a warm standby disaster recovery topology across Google Cloud regions `us-central1` (primary) and `europe-west3` (secondary). The application relies on Cloud SQL for PostgreSQL with asynchronous cross-region read replication. Following an unrecoverable regional disaster in `us-central1`, the operational engineering team must execute the disaster recovery runbook to restore service while ensuring data consistency and preventing split-brain states. In what sequential order should the operational team execute the disaster recovery failover tasks?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins by stopping ingress traffic and revoking write permissions on the primary region to prevent split-brain updates. Next, promote the cross-region Cloud SQL read replica in the secondary region to a standalone read-write database instance. Third, scale up the secondary Compute Engine managed instance groups to handle full application load. Fourth, update Cloud DNS routing policies to direct client traffic to the secondary region endpoints. Finally, re-establish disaster recovery redundancy by enabling backup schedules and creating a new cross-region read replica from the newly promoted primary instance.
The correct operational order minimizes data loss and prevents split-brain scenarios. First, isolating the degraded primary stops incoming transactions and lets asynchronous replication finish applying in-flight logs. Second, promoting the database replica enables write capabilities in the secondary region. Third, scaling up compute capacity ensures the secondary application tier can handle the incoming user load. Fourth, modifying DNS records steers user traffic to the active secondary region. Finally, restoring backup schedules and creating a new cross-region replica re-establishes disaster recovery protection.

Adım Adım Çözüm

1
Isolate the primary region workload
Prevents split-brain conditions and ensures all in-flight asynchronous database replication logs settle.
Promoting a replica while writes are still hitting the primary can lead to data divergence or corrupted application state.
2
Promote the secondary database replica
The Cloud SQL instance in `europe-west3` becomes a standalone primary database supporting read and write operations.
Application services cannot function properly without a writable persistent storage layer.
3
Provision and scale compute capacity in the secondary region
Compute Engine managed instance groups scale out to 100% target production size.
Ensures the application tier has sufficient resources to process production traffic without failure or severe latency degradation.
4
Redirect traffic via Cloud DNS
Client application traffic flows to the secondary region load balancer.
Traffic must only be routed once the underlying storage and compute layers are fully operational and ready to serve requests.
5
Re-establish disaster recovery redundancy
Automated backups are configured and a new secondary replica is provisioned in a third region or restored environment.
Leaves the enterprise with continuous DR protection following the primary region loss.

Anahtar Kavram

Disaster Recovery Failover Sequence and Split-Brain Prevention
Soru 179Soru →

A media streaming enterprise hosts public microservices on Google Cloud behind an External HTTP(S) Load Balancer, while storing sensitive user telemetry in BigQuery and Cloud Storage. The security team requires mitigating Layer 7 application attacks and SQL injection attempts at the edge, while also preventing authorized internal data analysts from exfiltrating sensitive telemetry data to external GCP resources. Which TWO architectural controls should the Cloud Architect implement to satisfy these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Cloud Armor security policies with preconfigured WAF rules and rate limiting on the External HTTP(S) Load Balancer backend service.; Establish a VPC Service Controls perimeter encompassing the GCP projects hosting BigQuery and Cloud Storage telemetry datasets.

Cevap

Configure Cloud Armor security policies on the External HTTP(S) Load Balancer backend service to block Layer 7 attacks, and establish a VPC Service Controls perimeter around BigQuery and Cloud Storage projects to prevent data exfiltration.
To defend against Layer 7 application threats and rate-limit ingress traffic, Cloud Armor security policies must be attached to the External HTTP(S) Load Balancer. To prevent data exfiltration by authorized identities accessing sensitive managed services (BigQuery and Cloud Storage), VPC Service Controls must be deployed around the hosting projects to restrict data movement across perimeter boundaries.

Adım Adım Çözüm

1
Identify edge security requirements for public-facing microservices.
Cloud Armor security policies with preconfigured OWASP rules provide Layer 7 application defense and rate limiting at the Google Cloud edge.
Public HTTPS endpoints need perimeter protection against web application attacks and traffic spikes before reaching backend workloads.
2
Identify exfiltration prevention requirements for sensitive data storage.
VPC Service Controls isolates managed storage services inside a defined security perimeter.
IAM permissions govern identity access but cannot prevent authorized identities from copying data across perimeter boundaries to external storage locations.

Anahtar Kavram

Perimeter defense combining Cloud Armor for Layer 7 web security and VPC Service Controls for exfiltration prevention
Soru 180Soru →

An energy utility company operates a serverless, stateless smart meter data processing service on Google Cloud Run, backed by Cloud SQL for PostgreSQL. The engineering team is planning a major release that includes both microservice logic updates and structural database schema alterations. The business requires zero downtime during the rollout, real-time validation of metrics on a small segment of production traffic, and an immediate zero-downtime rollback capability if error rates spike. Which release strategy and implementation approach should you recommend?

Cevabı ve açıklamayı göster

Cevap: Implement an expand-contract database schema migration pattern first, deploy the new application build as a new Cloud Run revision, and gradually shift traffic using Cloud Run revision traffic splitting to monitor performance before completing the rollout.

Cevap

Implement an expand-contract database schema migration pattern first, deploy the new application build as a new Cloud Run revision, and gradually shift traffic using Cloud Run revision traffic splitting to monitor performance before completing the rollout.
The combination of an expand-contract database migration strategy with Cloud Run revision traffic splitting provides a zero-downtime canary deployment. Decoupling database changes ensures backward compatibility so both old and new revisions can safely run concurrently, while Cloud Run traffic splitting enables real-time metric validation on a small subset of live users.

Adım Adım Çözüm

1
Ensure database backward compatibility
Database changes are deployed using the expand-contract pattern (adding new fields while maintaining old ones), ensuring both old and new application versions can operate simultaneously.
Prevents breaking active application instances during phased traffic migration or rollback.
2
Deploy new Cloud Run revision
The updated container image is deployed to Cloud Run as a distinct revision receiving 0% initial traffic.
Allows staging and verification of the deployment artifact without impacting live user traffic.
3
Execute canary traffic split
Cloud Run traffic management is configured to route a small percentage (e.g., 5%) of incoming requests to the new revision while observing operational metrics.
Validates application stability against real-world production traffic with minimal risk.

Anahtar Kavram

Canary Deployment with Backward-Compatible Database Schema
ÖncekiSayfa 9 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin