Examkin

Tüm alıştırma soruları

537 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 1Soru →

A financial services organization is modernizing its transaction reconciliation architecture on Google Cloud. The architecture comprises two core workloads: (1) a stateless, containerized HTTP REST microservice that processes customer requests with highly variable traffic spikes and must scale down to zero instances when idle, and (2) a containerized batch job that processes end-of-day financial reconciliation files, running continuously for approximately 6 hours each night. The organization requires a solution that minimizes operational management overhead and eliminates compute infrastructure costs during idle periods. Which TWO compute platform selections should you recommend to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the stateless HTTP REST microservice to Cloud Run.; Execute the 6-hour financial reconciliation batch job using Cloud Run Jobs.

Cevap

Deploy the stateless HTTP REST microservice to Cloud Run, and execute the 6-hour financial reconciliation batch job using Cloud Run Jobs.
Cloud Run is the optimal platform for stateless containerized microservices requiring low management overhead and scale-to-zero capabilities. For containerized batch processes that run to completion over multiple hours (up to 24 hours), Cloud Run Jobs provides a fully managed execution environment that consumes resources only during active execution.

Adım Adım Çözüm

1
Analyze the operational and scaling requirements of the stateless microservice
Requirement identified for automatic scaling to zero, low management overhead, and HTTP request handling.
Cloud Run provides a fully managed serverless environment that hosts containerized HTTP microservices with zero cluster setup and automatic scale-to-zero capabilities.
2
Analyze the duration and infrastructure lifecycle requirements of the reconciliation task
Requirement identified for a containerized batch job running to completion over a 6-hour window without standing cluster costs.
Cloud Run Jobs executes task containers that run up to 24 hours and automatically cleans up resources upon completion, avoiding persistent compute billing.
3
Evaluate alternative platform choices against operational overhead and cost constraints
Rejected GKE, Compute Engine MIGs, and App Engine due to added management complexity, static baseline infrastructure costs, or execution duration limits.
GKE and Compute Engine introduce unnecessary operational maintenance, while App Engine Standard is tailored for web request handling rather than multi-hour batch runs.

Anahtar Kavram

Selecting serverless compute platforms (Cloud Run services for stateless web APIs and Cloud Run Jobs for long-running batch tasks) to minimize operational overhead and idle costs.
Soru 2Soru →

A healthcare startup plans to migrate its legacy on-premises architecture to Google Cloud. The environment consists of a 15 TB15\text{ TB} PostgreSQL transactional database and 25 TB25\text{ TB} of unstructured medical imaging files stored on an SMB file share. The company has a dedicated 1 Gbps1\text{ Gbps} network connection to GCP. The migration strategy must ensure minimal downtime for the database and direct online ingestion of the image files into Cloud Storage with automated integrity verification. Which TWO architectural solutions should be included in the migration design? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use Database Migration Service (DMS) with continuous CDC replication to migrate the PostgreSQL database to Cloud SQL.; Use Storage Transfer Service for on-premises data transfer to migrate the medical image files directly into Cloud Storage.

Cevap

The strategy should incorporate Database Migration Service (DMS) with continuous CDC for the PostgreSQL database and Storage Transfer Service for moving the file share data to Cloud Storage over the available network link.
The correct strategy combines Database Migration Service (DMS) for continuous CDC replication of the PostgreSQL database to Cloud SQL with Storage Transfer Service for streaming on-premises file share data to Cloud Storage. This design meets the requirements of minimal database downtime and online file migration over the 1 Gbps link.

Adım Adım Çözüm

1
Evaluate database migration requirements for operational continuity.
Database Migration Service (DMS) provides continuous replication (CDC) from on-premises PostgreSQL to Cloud SQL, enabling minimal cutover downtime.
Offline methods or schema shifts to distributed databases like Cloud Spanner incur significant downtime or unnecessary architecture modifications.
2
Evaluate bandwidth limits for the 25 TB file transfer.
A 25 TB dataset over a 1 Gbps link takes approximately 55 to 60 hours at theoretical full saturation, which easily fits within online transfer windows using Storage Transfer Service.
Storage Transfer Service automates checksum verification and agent-based multi-threaded transfer over existing network lines without needing physical appliance logistics.

Anahtar Kavram

Selecting optimal online migration services (DMS and Storage Transfer Service) based on dataset scale, minimal downtime requirements, and network throughput.
Soru 3Soru →

A Lead Cloud Architect is transitioning an enterprise infrastructure automation platform from Google Cloud Deployment Manager to Terraform within Cloud Build CI/CD pipelines. The new deployment pipeline must support multi-developer concurrent executions without state corruption, maintain recoverable state history, and strictly observe GCP least-privilege identity access controls during resource provisioning. Which TWO configurations must the architect implement to satisfy these security and operational requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a remote Google Cloud Storage (GCS) backend for Terraform state files with object versioning enabled.; Grant the Cloud Build service account the roles/iam.serviceAccountUser role on specific target provisioning service accounts.

Cevap

The architect must configure a remote Google Cloud Storage backend with object versioning enabled and grant the Cloud Build service account the Service Account User role on fine-grained target provisioning service accounts.
Configuring a Google Cloud Storage backend with object versioning ensures state locking during execution and retains state backup history. Combining this with granting the Service Account User role on specific target service accounts enforces least-privilege impersonation for Cloud Build deployments.

Adım Adım Çözüm

1
Analyze Terraform remote state management requirements for enterprise CI/CD workflows.
Identified that native GCS backends provide automatic object locking and object versioning to protect against concurrent modification and state loss.
Remote state backends prevent race conditions when multiple deployment pipelines run simultaneously.
2
Evaluate IAM least-privilege requirements for automated deployment agents.
Determined that Cloud Build service accounts should use service account impersonation by holding the Service Account User role on dedicated target provisioning service accounts.
Impersonation eliminates the need for primitive roles or static long-lived service account keys.

Anahtar Kavram

Enterprise Terraform state backend configuration and secure service account impersonation in Google Cloud.
Soru 4Soru →

A global gaming enterprise is preparing to launch a real-time multiplayer backend hosted on Google Cloud using automated Infrastructure as Code (IaC) pipelines with Terraform. The design requires deploying regional Compute Engine Managed Instance Groups (MIGs) across multiple zones to process high-throughput UDP traffic. To support the upcoming launch of 50,000 concurrent game instances, the deployment automation must prevent state concurrency conflicts, ensure successful automated resource creation without runtime quota rejections, and strictly observe least-privilege security principles. Which TWO architectural and administrative actions should the team perform as part of the initial provisioning strategy?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Terraform deployment pipeline to use a Cloud Storage backend configured with bucket versioning and object state locking enabled.; Submit a request to increase the regional Compute Engine N2 vCPU quota in the target deployment regions prior to triggering the automated provisioning pipeline.

Cevap

The correct provisioning strategy requires storing the Terraform state file in a Cloud Storage backend configured with versioning and object locking, and requesting regional Compute Engine vCPU quota increases before initiating the deployment.
Establishing a remote Cloud Storage backend with object versioning and state locking protects the IaC environment from concurrent modification and state file corruption. Concurrently, requesting regional Compute Engine vCPU quota increases prior to triggering large automated deployments ensures that compute provisioning requests succeed without hitting default quota caps.

Adım Adım Çözüm

1
Evaluate IaC state management requirements for automated pipelines
Configuring a Cloud Storage remote backend with state locking prevents race conditions and state corruption during concurrent pipeline executions.
Enterprise IaC automation requires centralized, lockable, and version-controlled remote state.
2
Analyze capacity requirements for large-scale compute resource provisioning
Requesting regional vCPU quota increases prior to deployment guarantees that Compute Engine MIG scaling operations will not be blocked by default quota limits.
Default project quotas in GCP often fall below the requirements of large-scale enterprise deployments, leading to runtime resource creation errors if not increased in advance.
3
Audit security and service choices against GCP architectural best practices
Reject primitive IAM roles and excessive administrative grants in favor of targeted roles like Service Account User, and avoid running non-containerized monoliths on GKE.
Adhering to least-privilege security and matching compute platforms to workload types prevents operational and compliance issues.

Anahtar Kavram

Provisioning Compute Engine Resources and IaC State Management
Tahmini Süre:2m 0s
Soru 5Soru →

A healthcare research organization needs to migrate its core data assets to Google Cloud within a strict 6-week timeframe. The workload consists of 3.5 PB3.5\text{ PB} of static genomic sequence files on an on-premises SAN and an active 15 TB15\text{ TB} transactional PostgreSQL database. The facility has a single 1 Gbps1\text{ Gbps} dedicated internet connection. The migration plan must ensure minimal database downtime with continuous synchronization, and governance rules mandate strict perimeter security controls to prevent data exfiltration to unauthorized external cloud resources. Which TWO architectural strategies should you incorporate into the migration design?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Utilize Google Cloud Transfer Appliance devices to perform an offline bulk migration of the 3.5 PB3.5\text{ PB} genomic dataset, and deploy Database Migration Service (DMS) with continuous Change Data Capture (CDC) for the PostgreSQL database.; Configure VPC Service Controls around the target Cloud Storage buckets and database instances to establish a secure perimeter and block unauthorized data movement.

Cevap

The correct architecture requires ordering Transfer Appliance devices for the petabyte-scale static dataset while using Database Migration Service with CDC for continuous database replication, combined with VPC Service Controls to prevent perimeter data exfiltration.
Moving 3.5 PB3.5\text{ PB} over a 1 Gbps1\text{ Gbps} network connection is mathematically impossible within 6 weeks, making offline Transfer Appliance devices mandatory for the static storage. Database Migration Service with CDC handles the live PostgreSQL replication. VPC Service Controls provide the required network perimeter boundary to safeguard against exfiltration to outside GCP projects.

Adım Adım Çözüm

1
Calculate data transfer throughput for the 3.5 PB3.5\text{ PB} static dataset.
At 1 Gbps1\text{ Gbps}, uploading 3.5 PB3.5\text{ PB} online requires 3.5×1015×8109×86400≈324\frac{3.5 \times 10^{15} \times 8}{10^9 \times 86400} \approx 324 days. This violates the 6-week constraint, necessitating an offline transfer solution like Transfer Appliance.
Petabyte-scale data transfers over constrained WAN links require physical offline hardware appliances.
2
Select database replication mechanism for zero/minimal downtime.
Database Migration Service (DMS) utilizing Change Data Capture (CDC) allows continuous replication of PostgreSQL WAL logs up to the final cutover window.
CDC minimizes operational downtime by allowing live transactional databases to sync continuously.
3
Select perimeter security mechanism to address data exfiltration requirements.
VPC Service Controls form a logical perimeter isolating target Cloud Storage and database resources.
VPC Service Controls prevent data egress to unauthorized GCP projects even if an identity has legitimate IAM read permissions.

Anahtar Kavram

Selecting data transfer appliances vs online transfer services based on bandwidth limitations, paired with VPC Service Controls for perimeter exfiltration defense.
Soru 6Soru →

A healthcare technology company is architecting a medical diagnostics platform on Google Cloud. The system consists of two distinct components: 1) A stateless REST API backend that receives patient request payloads and returns quick diagnostic summaries with highly variable, bursty web traffic, requiring minimal operational management; 2) A batch processing pipeline that runs legacy, uncontainerized diagnostic algorithms relying on custom Linux kernel modules for 3 hours every night. Which TWO compute solutions should you recommend to fulfill these requirements with the lowest operational overhead and optimal cost efficiency? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the stateless REST API backend onto Cloud Run.; Deploy the batch processing pipeline onto Compute Engine Managed Instance Groups using Spot VMs.

Cevap

Select Cloud Run for the stateless REST API backend and Compute Engine Managed Instance Groups using Spot VMs for the legacy batch processing pipeline.
Cloud Run is ideal for stateless REST APIs with bursty traffic because it automatically scales containers and requires zero cluster maintenance. For legacy workloads requiring custom kernel modules and running for short nightly windows, Compute Engine VMs provide the required OS-level access, while Spot VMs and Managed Instance Groups ensure maximum cost efficiency.

Adım Adım Çözüm

1
Analyze the stateless REST API requirements
Identified bursty HTTP traffic, stateless architecture, and minimal operational overhead preference.
Cloud Run is the optimal Google Cloud serverless compute platform for stateless containerized web services, scaling to zero when idle.
2
Analyze the legacy batch processing pipeline requirements
Identified dependency on custom Linux kernel modules and a 3-hour nightly execution window.
Serverless container environments (Cloud Run, Cloud Functions) do not permit custom host kernel modules. Compute Engine VMs permit full OS/kernel customization, and using Spot VMs within a Managed Instance Group optimizes costs for scheduled batch runs.

Anahtar Kavram

Selecting appropriate compute platforms based on containerization status, kernel/OS customization needs, scaling patterns, and management overhead constraints.
Soru 7Soru →

An enterprise architecture team is configuring network connectivity between two VPC networks, vpc-analytics and vpc-core, in Google Cloud. They decide to establish VPC Network Peering to allow internal IP address communication across the two networks. Which TWO statements accurately describe the requirements and behavior of VPC Network Peering in this scenario? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Peering configuration must be created symmetrically in both directions—from vpc-analytics to vpc-core and from vpc-core to vpc-analytics—before communication is fully established.; Exporting and importing custom routes must be explicitly enabled on the peering configurations if custom static or dynamic routes need to be shared across the peered networks.

Cevap

VPC Network Peering requires symmetrical peering setup in both directions and explicit configuration of custom route import/export settings to share non-subnet routes.
VPC Network Peering is established only when both VPC networks create a peering request to each other (symmetrical configuration). Additionally, while subnet routes are exchanged automatically upon peering, sharing custom dynamic or static routes across peered VPCs requires explicitly configuring the import and export custom routes flags on both ends.

Adım Adım Çözüm

1
Analyze VPC Network Peering setup requirements.
VPC Peering requires both network administrators to establish a peering configuration pairing both VPCs (bidirectional setup).
Peering stays in an inactive state until both VPCs explicitly approve the peering request.
2
Evaluate route propagation rules across peered VPC networks.
Subnet routes are exchanged by default, but custom dynamic and static routes require setting import and export custom route flags.
Cloud Router dynamic routes and static routes are not automatically shared without explicitly enabling custom route exchange.
3
Identify invalid VPC networking assumptions.
Reject transitive routing, lower-bandwidth HA VPN alternatives for intra-cloud high throughput, and relying solely on IAM for perimeter security.
VPC Network Peering is non-transitive, HA VPN has throughput caps per tunnel (3 Gbps), and VPC Service Controls are necessary to prevent data exfiltration.

Anahtar Kavram

VPC Network Peering establishing bilateral setup, non-transitivity, and custom route exchange mechanisms.
Soru 8Soru →

A global media enterprise is designing the cloud storage and database architecture on Google Cloud for a mission-critical application platform. The architecture must address two key technical requirements:

1. An operational relational database that requires strong consistency (ACID compliance) across multiple geographic regions, along with horizontal scaling for write operations.
2. A one-time bulk migration of a 3 PB3\text{ PB} historical analytics dataset stored on local network-attached storage (NAS) devices, where the available dedicated internet bandwidth is capped at 100 Mbps100\text{ Mbps}.

Which TWO design decisions should the architect select to fulfill these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Cloud Spanner as the operational database solution to support multi-region horizontal write scaling while maintaining strong ACID consistency.; Order Google Cloud Transfer Appliance devices to physically capture and ingest the 3 PB dataset into Cloud Storage.

Cevap

The optimal solution requires selecting Cloud Spanner for the globally scalable relational database and using GCP Transfer Appliance for the 3 PB offline bulk data migration.
Cloud Spanner is designed specifically for enterprise relational database workloads that require multi-region horizontal scaling for both reads and writes while preserving strict ACID transactional consistency. For the data migration requirement, transferring 3 PB3\text{ PB} over a 100 Mbps100\text{ Mbps} network link is mathematically unviable, taking over seven years. Google Cloud Transfer Appliance provides dedicated hardware for offline data ingestion, allowing petabyte-scale data to be physically transported to GCP securely and efficiently.

Adım Adım Çözüm

1
Evaluate operational relational database requirements against GCP database products.
Cloud Spanner satisfies global multi-region horizontal write scaling and strong ACID consistency, whereas Cloud SQL is limited to vertical scaling for writes and a single primary region.
Cloud Spanner uses TrueTime and distributed transactions to allow multi-region relational write scale.
2
Calculate data transfer time for 3 PB over a 100 Mbps network connection.
Transfer time exceeds 7.5 years (t=3×1015 bytes×8 bits/byte100×106 bits/sec≈2.4×108 secondst = \frac{3 \times 10^{15} \text{ bytes} \times 8 \text{ bits/byte}}{100 \times 10^6 \text{ bits/sec}} \approx 2.4 \times 10^8 \text{ seconds}).
Online migration via Storage Transfer Service is unfeasible within reasonable operational timelines.
3
Select the appropriate offline data transfer mechanism.
GCP Transfer Appliance allows shipping physical storage hardware to securely ingest petabyte-scale data into Cloud Storage.
Offline appliances bypass low-bandwidth WAN connections for massive datasets.

Anahtar Kavram

Selecting GCP Database and Storage Migration Services Based on Scale, Latency, and Network Throughput Constraints
Soru 9Soru →

An enterprise media streaming company is designing an automated continuous delivery pipeline for microservices deployed on Cloud Run using Cloud Build and Google Cloud Deploy. The architecture team requires progressive traffic shifting with automated rollback whenever latency or error rate metrics exceed defined thresholds during a release. Additionally, all container images deployed to production must be verifiably built by the authorized continuous integration pipeline, and individual developers must be prevented from executing direct manual deployments to production environments. Which TWO architectural configurations should the team implement to satisfy these requirements? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define Google Cloud Deploy targets and release pipelines configured with automated canary deployment strategies, integrating verification routines and automated rollbacks driven by Cloud Monitoring metric checks.; Configure Binary Authorization on the target Cloud Run services requiring attestations generated by Cloud Build, and restrict production deployment permissions strictly to the Cloud Deploy service account using IAM service account impersonation.

Cevap

The team should configure Google Cloud Deploy progressive canary release strategies with automated rollback capabilities based on metric checks, and enforce Binary Authorization attestations signed by Cloud Build while restricting deployment IAM permissions to the Cloud Deploy execution service account.
To achieve secure, automated release management on GCP, Google Cloud Deploy provides built-in progressive delivery features like canary deployments with automated rollback options upon metric or phase check failures. Pairing this with Binary Authorization ensures container images deployed to Cloud Run originate strictly from the verified Cloud Build pipeline. Restricting IAM rights to the deployment pipeline service account ensures compliance and prevents direct developer modifications.

Adım Adım Çözüm

1
Configure progressive release automation
Google Cloud Deploy delivery pipelines execute automated canary releases that evaluate metrics via Cloud Monitoring and trigger rollbacks if thresholds are breached.
Meets the requirement for progressive traffic shifting and automated failure mitigation.
2
Enforce artifact governance and minimal IAM access
Binary Authorization ensures only authorized container builds are deployed to Cloud Run, and IAM restrictions prevent developers from deploying directly.
Satisfies supply chain security requirements and enforces centralized CI/CD deployment execution.

Anahtar Kavram

Automating Continuous Deployment Pipelines and Release Strategies
Soru 10Soru →

A financial enterprise is establishing governance controls across its Google Cloud Organization hierarchy. The security compliance team requires that virtual machines cannot be assigned external public IP addresses and that all new infrastructure resources are restricted to the `us-central1` and `europe-west1` regions. Which TWO Organization Policy constraints should the cloud architect implement to enforce these administrative controls?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the `constraints/compute.vmExternalIpAccess` organization policy constraint to deny external IP address allocation on compute instances.; Set the `constraints/gcp.resourceLocations` organization policy constraint to allow resource creation only within `us-central1` and `europe-west1`.

Cevap

The cloud architect should configure the `constraints/compute.vmExternalIpAccess` constraint to block public IP assignment on VMs and the `constraints/gcp.resourceLocations` constraint to limit resource creation to the specified allowed regions.
The combination of the `constraints/compute.vmExternalIpAccess` constraint (which restricts public IP assignment to compute instances) and the `constraints/gcp.resourceLocations` constraint (which limits resource creation to designated GCP regions) centrally enforces the security and compliance requirements across the organization.

Adım Adım Çözüm

1
Identify the constraint required for external IP prevention on VMs.
Selecting `constraints/compute.vmExternalIpAccess` prevents Compute Engine instances from receiving external IPv4 or IPv6 addresses.
Organization policies provide programmatic constraints on Compute Engine networking options.
2
Identify the constraint required to restrict resource provisioning regions.
Selecting `constraints/gcp.resourceLocations` with an allowed list containing `us-central1` and `europe-west1` restricts resource deployment geographically.
Resource location constraints define regional boundaries across all supported GCP services in the resource hierarchy.

Anahtar Kavram

Organization Policy constraints define centralized programmatic guardrails across the GCP resource hierarchy to enforce security and compliance standards.
Soru 11Soru →

A global streaming media enterprise uses Google Cloud for its infrastructure. The enterprise security team needs to establish central governance guardrails across the Google Cloud resource hierarchy without causing immediate downtime to running systems. Specifically, they must satisfy two requirements: first, audit and evaluate the impact of prohibiting external IP addresses on Compute Engine instances within the 'Staging' folder before enforcing the block; second, enforce that all new Cloud Storage buckets across the entire organization are created strictly within the 'us-central1' and 'us-east1' regions. Which TWO architecture design choices should you implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the boolean constraint 'constraints/compute.vmExternalIpAccess' using a dry-run policy on the 'Staging' folder.; Enforce the list constraint 'constraints/gcp.resourceLocations' at the Organization root level with allowed values set to 'in-regions: [us-central1, us-east1]'.

Cevap

The correct architecture requires configuring the boolean constraint 'constraints/compute.vmExternalIpAccess' in dry-run mode on the 'Staging' folder and enforcing the list constraint 'constraints/gcp.resourceLocations' at the organization root level with allowed values for the designated regions.
The correct solution uses Google Cloud Organization Policies to enforce governance rules across the hierarchy. Applying the boolean constraint for external VM IP access in dry-run mode on the targeted folder enables logging of policy non-compliance without breaking active development workflows. Simultaneously, enforcing the resource location list constraint at the organization root guarantees inherited compliance for resource provisioning locations across all projects.

Adım Adım Çözüm

1
Identify the mechanism for non-disruptive testing of VM external IP restrictions.
Using dry-run organization policies allows security teams to test constraints by generating audit logs upon policy violation without actively denying resource creation.
Dry-run policy evaluation satisfies the requirement to evaluate impact without blocking existing or new staging workloads.
2
Determine the resource hierarchy node and constraint configuration for regional resource restriction.
Organization policies inherit down the resource hierarchy. Applying 'constraints/gcp.resourceLocations' at the Organization root enforces region constraints across all folders and projects.
List constraints with allowed values restricting regions ensure compliance across all Cloud Storage buckets created in the organization.

Anahtar Kavram

Organization Policy Dry-Run Evaluation and Resource Location List Constraints
Soru 12Soru →

An enterprise security team needs to grant an automated compliance auditing application running in a dedicated security project permission to inspect resource configurations and IAM policies across all projects nested within a folder named Production-Workloads. The security team must also allow a DevOps engineer to deploy and attach this service account to Compute Engine audit instances without granting the engineer the ability to modify IAM policies or elevate their own privileges. Which TWO configuration steps should the security architect implement to achieve this with minimal operational overhead and least privilege? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the automated service account the Cloud Asset Viewer role (roles/cloudasset.viewer) bound at the Production-Workloads folder level.; Grant the DevOps engineer the Service Account User role (roles/iam.serviceAccountUser) on the specific audit service account resource.

Cevap

Grant the automated service account the Cloud Asset Viewer role (roles/cloudasset.viewer) bound at the Production-Workloads folder level, and grant the DevOps engineer the Service Account User role (roles/iam.serviceAccountUser) on the specific audit service account resource.
Inheriting permissions from the folder level enables an automated service account to inspect assets across all child projects using a targeted predefined role. Restricting the DevOps engineer's permissions to the Service Account User role scoped specifically to the target service account permits deployment onto compute resources while preventing administrative privilege escalation.

Adım Adım Çözüm

1
Determine the optimal scoping and role for the automated auditing application.
Identify that Cloud Asset Viewer (roles/cloudasset.viewer) provides read access to metadata and IAM policies across resources without exposing underlying payload data.
Granting this role at the Production-Workloads folder level leverages resource hierarchy inheritance to cover all current and future child projects automatically.
2
Determine the least-privilege permission required for the DevOps engineer deploying the compute workload.
Assign the Service Account User role (roles/iam.serviceAccountUser) directly on the target service account resource.
This grants the engineer permission to impersonate or bind the service account to Compute Engine instances without granting Service Account Admin rights or folder-wide IAM administrative capabilities.

Anahtar Kavram

Resource Hierarchy IAM Inheritance and Service Account Impersonation Least Privilege
Soru 13Soru →

A biomedical research company is automating the infrastructure provisioning process on Google Cloud for a distributed genomic processing platform. The architecture requires deploying a private Google Kubernetes Engine (GKE) cluster for core compute services alongside automated Terraform pipelines for provisioning Compute Engine Managed Instance Groups (MIGs). The security and operations teams require that administrative control plane access to the private GKE cluster be strictly limited to trusted corporate networks, and that infrastructure state storage prevents concurrent execution conflicts or loss of state history. Which TWO deployment configuration actions should the Cloud Architect recommend to fulfill these operational and security constraints?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure control plane authorized networks on the private GKE cluster using explicit corporate CIDR ranges.; Configure a Google Cloud Storage remote backend with object versioning and state locking for Terraform state management.

Cevap

The correct architecture requires enabling control plane authorized networks with explicit corporate CIDR ranges on the private GKE cluster and storing Terraform state in a Google Cloud Storage backend configured with object versioning and state locking.
Configuring control plane authorized networks on private GKE clusters ensures master endpoint communication is strictly constrained to authorized corporate IP blocks. Concurrently, using Google Cloud Storage as a remote backend with versioning and state locking protects infrastructure state from corruption and concurrent pipeline conflicts.

Adım Adım Çözüm

1
Evaluate private GKE cluster control plane security requirements.
Identified that restricting master endpoint access requires configuring GKE control plane authorized networks with specific CIDR blocks.
Private GKE clusters require explicit authorized network rules to block unauthorized public network requests to the control plane.
2
Evaluate Infrastructure as Code (IaC) state management best practices.
Identified that Cloud Storage backend with state locking and object versioning fulfills concurrency and resilience needs.
Centralized, locked, and versioned remote backends prevent state corruption during automated CI/CD runs.
3
Analyze distractor options regarding IAM roles, IaC state, and compute platform selection.
Eliminated options recommending excessive IAM primitive/admin roles, local state storage, and redundant cluster creation.
These options violate least privilege, introduce state corruption risks, or add unnecessary operational complexity.

Anahtar Kavram

Provisioning private GKE clusters with control plane authorized networks and securing automated IaC state management in Cloud Storage.
Soru 14Soru →

An enterprise logistics corporation is deploying a new fleet management platform across multiple Google Cloud projects organized under a parent folder named `Fleet-Ops`. The compliance team mandates two strict governance guardrails: (1) prevent users from generating external service account keys to mitigate credential leakage risks, and (2) restrict all infrastructure deployment strictly to European regions (`europe-west1` and `europe-west4`). Additionally, the team must evaluate the operational impact of the key creation restriction on existing pipelines prior to active blocking. Which TWO actions should the security architect take to satisfy these governance requirements using Google Cloud Organization Policies?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply the boolean constraint `iam.disableServiceAccountKeyCreation` at the `Fleet-Ops` folder level with a dry-run policy spec to monitor violations in Cloud Logging before enforcing active blocking.; Apply the list constraint `gcp.resourceLocations` at the `Fleet-Ops` folder level, configuring the allowed values to include `in:europe-west1-locations` and `in:europe-west4-locations`.

Cevap

Configure an Organization Policy with a dry-run spec for the boolean constraint iam.disableServiceAccountKeyCreation at the Fleet-Ops folder level, and configure an Organization Policy with the list constraint gcp.resourceLocations allowing in:europe-west1-locations and in:europe-west4-locations at the Fleet-Ops folder level.
The solution requires applying two distinct Google Cloud Organization Policies at the `Fleet-Ops` folder level. First, applying the `iam.disableServiceAccountKeyCreation` boolean constraint with a dry-run policy spec allows security administrators to monitor logs in Cloud Logging for non-compliant service account key creation attempts without breaking current CI/CD pipelines. Second, enforcing the `gcp.resourceLocations` list constraint with explicit region group values restricts resource provisioning across all child projects strictly to `europe-west1` and `europe-west4`.

Adım Adım Çözüm

1
Identify the governance requirements for service account key restriction and dry-run evaluation.
Selected the boolean Organization Policy constraint `iam.disableServiceAccountKeyCreation` applied at the `Fleet-Ops` folder level with a dry-run configuration.
Dry-run policy enforcement logs violations to Cloud Logging without blocking actions, fulfilling the requirement to test impact on existing pipelines.
2
Identify the governance requirements for regional resource location boundaries.
Selected the list Organization Policy constraint `gcp.resourceLocations` configured with `in:europe-west1-locations` and `in:europe-west4-locations` at the `Fleet-Ops` folder level.
List constraints at the folder level prevent any underlying project from deploying resources outside the specified regional location groups.

Anahtar Kavram

Google Cloud Organization Policies enforcement, dry-run testing, and resource hierarchy inheritance
Soru 15Soru →

A platform engineering team is automating continuous deployment pipelines using Cloud Build and Cloud Deploy for microservice applications hosted on Google Kubernetes Engine (GKE). The architecture requires strict compliance with least-privilege IAM controls for pipeline execution and resilient infrastructure state management for pipeline provisioning. Which TWO design practices should the team implement to achieve these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Cloud Deploy execution service accounts with least-privilege roles such as Cloud Deploy Job Runner rather than primitive roles.; Store Infrastructure as Code (IaC) Terraform state files in a Cloud Storage backend with object versioning and state locking enabled.

Cevap

The correct practices are configuring Cloud Deploy execution service accounts with fine-grained roles such as Cloud Deploy Job Runner, and storing Infrastructure as Code (IaC) Terraform state files in a remote Cloud Storage backend with object versioning and state locking enabled.
Configuring Cloud Deploy execution service accounts with granular predefined roles adheres to least-privilege security principles. Concurrently, utilizing a Cloud Storage remote backend with versioning and object locking for Terraform state management prevents configuration drift, race conditions, and state file corruption during automated release deployments.

Adım Adım Çözüm

1
Evaluate IAM least-privilege execution requirements for continuous deployment services.
Identified that dedicated execution service accounts should be assigned granular roles like roles/clouddeploy.jobRunner rather than broad primitive roles.
Restricting deployment pipeline access ensures compliance with enterprise security standards and limits security blast radius.
2
Evaluate Infrastructure as Code state management requirements for automated delivery pipelines.
Selected Cloud Storage as a remote backend with versioning and state locking enabled.
Remote state backends protect against concurrency race conditions and allow safe rollback in automated IaC pipeline runs.

Anahtar Kavram

Automating Continuous Deployment Pipelines and Release Strategies with Least Privilege and Resilient IaC State Management
Soru 16Soru →

An enterprise financial network requires connecting an on-premises data center to a Google Cloud Virtual Private Cloud (VPC). The solution must meet a 99.99% availability SLA, provide mandatory end-to-end IPsec data encryption, and support dynamic route propagation. Which TWO architectural configurations must be implemented together to satisfy all requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy HA VPN over Cloud Interconnect using private IP addressing to satisfy both the 99.99% SLA and IPsec encryption constraints.; Configure Cloud Routers with dynamic BGP peering on both ends of the connection to manage automated route exchange and failover.

Cevap

To achieve a 99.99% SLA with mandatory IPsec encryption and dynamic routing, the architecture must deploy HA VPN over Cloud Interconnect (Private IP HA VPN) alongside Cloud Routers configured for BGP dynamic routing.
Combining HA VPN over Cloud Interconnect (Private IP HA VPN) fulfills both the 99.99% availability SLA requirement of Cloud Interconnect and the mandatory IPsec encryption requirement. Pair this with Cloud Routers running dynamic BGP to ensure continuous route exchange and high-availability automated failover.

Adım Adım Çözüm

1
Evaluate SLA and encryption requirements for hybrid connectivity.
Standard Cloud Interconnect provides a 99.99% SLA but does not natively encrypt traffic; standard HA VPN provides IPsec encryption but has a lower SLA. Combining HA VPN over Private IP Cloud Interconnect satisfies both constraints.
Private IP HA VPN allows IPsec tunnels to be established over Cloud Interconnect attachments, inheriting the 99.99% SLA while maintaining mandatory data encryption.
2
Configure dynamic routing components.
Cloud Routers are deployed to manage BGP sessions across the hybrid connection.
Dynamic BGP routing via Cloud Router enables automatic route propagation and failover necessary for SLA-backed high availability.

Anahtar Kavram

Configuring HA VPN over Cloud Interconnect with Cloud Router BGP for 99.99% SLA and encrypted transit
Soru 17Soru →

A mid-sized retail enterprise plans to migrate its core inventory management system to Google Cloud. During executive alignment meetings, business stakeholders express concern over potential operational disruption, while the IT operations team reports anxiety regarding their lack of cloud experience. Which TWO strategies should the Lead Cloud Architect recommend to address stakeholder requirements and manage organizational change effectively? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a structured training and technical enablement program for operations staff alongside pilot project migrations.; Conduct stakeholder workshops to define Service Level Objectives (SLOs) aligned with business availability requirements prior to migration.

Cevap

The Lead Cloud Architect should recommend establishing a structured training program alongside pilot migrations and conducting stakeholder workshops to define business-aligned Service Level Objectives (SLOs).
Managing organizational change requires addressing human readiness through structured enablement programs during pilot phases. Simultaneously, analyzing stakeholder requirements mandates defining clear, business-aligned SLOs to ensure operational expectations are met without disrupting business continuity.

Adım Adım Çözüm

1
Evaluate organizational change management and team readiness requirements.
Identified that hands-on training coupled with pilot migrations reduces team anxiety and builds cloud operational skills.
Technical enablement directly addresses the IT team's skill gaps and resistance to change.
2
Assess business stakeholder alignment on system reliability and performance.
Determined that collaborative SLO definition aligns business expectations with cloud technical architecture.
Stakeholders require clear agreement on availability targets to mitigate concerns about migration disruption.
3
Eliminate inappropriate anti-patterns such as primitive IAM role assignment and reliance on IAM alone for data exfiltration prevention.
Rejected options that breach security best practices or fail to provide proper security perimeters.
Least privilege and VPC Service Controls are mandatory GCP architectural principles.

Anahtar Kavram

Organizational Change Management and Stakeholder Requirement Alignment
Soru 18Soru →

An enterprise software organization is establishing centralized security guardrails across its Google Cloud resource hierarchy. The cloud security architect must enforce two specific governance mandates across all projects within a target folder:

1. Prevent developers from generating exportable service account keys to mitigate credential leakage risks.
2. Restrict the deployment of all Google Cloud location-based resources exclusively to the `us-central1` and `us-east1` regions.

Which TWO Organization Policy constraints should be configured at the target folder level to satisfy these mandates?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enforce the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` by setting its policy state to Enforced.; Configure the list constraint `constraints/gcp.resourceLocations` with an allowed list containing `in:us-central1-locations` and `in:us-east1-locations`.

Cevap

The correct configurations are enforcing the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` and setting the list constraint `constraints/gcp.resourceLocations` to allow `in:us-central1-locations` and `in:us-east1-locations`.
The correct configuration combines enforcing `constraints/iam.disableServiceAccountKeyCreation` to disable service account key creation and configuring `constraints/gcp.resourceLocations` to restrict GCP resource deployment to specified regions (`us-central1` and `us-east1`).

Adım Adım Çözüm

1
Identify the constraint type for service account key prevention.
The constraint `constraints/iam.disableServiceAccountKeyCreation` is a boolean Organization Policy constraint that prevents creation of service account keys when set to Enforced.
Organization Policies provide centralized governance guardrails across the resource hierarchy that IAM permissions alone cannot enforce.
2
Identify the constraint type for geographic location restrictions.
The constraint `constraints/gcp.resourceLocations` is a list constraint that limits where location-based GCP resources can be provisioned.
Specifying value groups such as `in:us-central1-locations` ensures data sovereignty and regional resource compliance across child projects.

Anahtar Kavram

Organization Policies and Constraints
Tahmini Süre:1m 30s
Soru 19Soru →

A retail enterprise organizes its Google Cloud infrastructure using an Organization node containing top-level folders named Staging and Production. The central Security Operations team requires read-only security visibility across all projects in the Production folder. Additionally, an automated deployment service account must create Compute Engine instances within a specific Production project and attach a pre-configured workload service account to those instances. Which TWO actions should a Cloud Architect recommend to fulfill these security requirements while enforcing least privilege and leveraging resource hierarchy inheritance?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the Security Reviewer role (roles/iam.securityReviewer) to the Security Operations group at the Production folder level.; Grant the deployment service account the Compute Instance Admin (v1) role on the project and the Service Account User role (roles/iam.serviceAccountUser) on the specific workload service account.

Cevap

Granting the Security Reviewer role to the Security Operations group at the Production folder level leverages resource hierarchy inheritance for broad read-only security visibility. Granting the deployment service account Compute Instance Admin on the project and Service Account User on the specific workload service account ensures instance creation and service account attachment adhere strictly to least privilege.
Inheritance down the resource hierarchy ensures that binding the Security Reviewer role at the Production folder level grants security visibility across all child projects. To attach a pre-configured service account to a Compute Engine instance, the deploying identity needs compute creation privileges on the project and the Service Account User role on the specific service account resource being attached.

Adım Adım Çözüm

1
Analyze read-only security visibility requirements across the Production folder hierarchy.
Assigning predefined Security Reviewer role at the Production folder level allows all child projects to inherit read-only security monitoring access automatically.
Resource hierarchy inheritance propagates IAM policy bindings down to child nodes, eliminating operational overhead while avoiding primitive role over-granting.
2
Analyze instance provisioning and service account attachment privileges for the deployment service account.
Grant Compute Instance Admin (v1) on the project and Service Account User on the specific target service account.
Attaching a service account to a compute resource requires roles/iam.serviceAccountUser on the target service account resource, not Service Account Admin.

Anahtar Kavram

Resource hierarchy IAM permission inheritance and least-privilege role scoping for compute workloads and service accounts
Soru 20Soru →

A financial services organization is migrating two distinct workloads to Google Cloud. The architecture team requires solution designs that minimize operational maintenance and infrastructure cost.

• Workload 1: A stateless, containerized HTTP REST API servicing unpredictable fraud check queries that must automatically scale to zero instances during idle periods.
• Workload 2: A containerized nightly batch process that executes non-HTTP financial risk simulations for up to 3 hours per run.

Which TWO Google Cloud compute platform configurations should you select to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Workload 1 as a Cloud Run service configured with request-based autoscaling.; Deploy Workload 2 as a Cloud Run job scheduled to execute the containerized task to completion.

Cevap

Deploy Workload 1 as a Cloud Run service configured with request-based autoscaling, and deploy Workload 2 as a Cloud Run job scheduled to execute the containerized task to completion.
For stateless HTTP APIs that require scaling to zero and zero server management, Cloud Run services provide fully managed container deployment with request-driven autoscaling. For batch containers that run to completion without listening for incoming network requests, Cloud Run Jobs provides a fully managed execution environment supporting long-running tasks.

Adım Adım Çözüm

1
Analyze requirements for Workload 1 (stateless HTTP microservice, unpredictable traffic, scale-to-zero, low operational overhead).
Cloud Run service is the optimal choice as it natively handles HTTP traffic, scales down to zero, and eliminates server maintenance.
Selecting a serverless container platform reduces operational complexity and cost for idle periods.
2
Analyze requirements for Workload 2 (non-HTTP batch container, nightly execution up to 3 hours, low operational overhead).
Cloud Run Jobs is the optimal choice for containerized workloads that run to completion without an HTTP endpoint and exceed typical function timeouts.
Cloud Run Jobs supports task execution up to 24 hours without cluster management overhead.

Anahtar Kavram

Selecting serverless container services (Cloud Run services vs Cloud Run Jobs) based on traffic patterns, execution duration, and event triggers.
Sayfa 1 / 27Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin