Managing Implementations of Cloud Architecture

172 soru

Tüm türler172 Çoktan seçmeli87 Çoklu seçim51 Eşleştirme3 Sıralama31

An enterprise microservice running on an on-premises Kubernetes cluster must programmatically access Google Cloud Storage and Cloud Spanner APIs. Enterprise compliance policies strictly prohibit downloading, exporting, or storing long-lived service account JSON key files anywhere on-premises or within deployment manifests. Furthermore, administrative scripts running in automated CI/CD pipelines via the gcloud CLI must execute operations as a targeted service account without managing key files. Which TWO implementation steps must you configure to satisfy these programmatic authentication and CLI requirements?

Geçerli olan tümünü seçin

Configure Workload Identity Federation to exchange Kubernetes service account OIDC tokens for short-lived Google Cloud federated credentials for the application SDK.

Configure the gcloud CLI in the CI/CD pipeline using the --impersonate-service-account flag to execute administrative commands via short-lived service account tokens.

Export a service account JSON key, encode it as a Kubernetes Secret, and mount it to set the GOOGLE_APPLICATION_CREDENTIALS environment variable inside the application container.

Grant the application service account the primitive Owner role at the project level to bypass IAM credential delegation constraints during API invocation.

Store the unencrypted local gcloud execution state and auth tokens in an unversioned shared local file repository across deployment pipeline runners.

Cevabı ve açıklamayı göster

Cevap: Configure Workload Identity Federation to exchange Kubernetes service account OIDC tokens for short-lived Google Cloud federated credentials for the application SDK.; Configure the gcloud CLI in the CI/CD pipeline using the --impersonate-service-account flag to execute administrative commands via short-lived service account tokens.

Cevap

Workload Identity Federation should be configured for the on-premises Kubernetes cluster to allow programmatic SDK authentication using short-lived OIDC tokens. For the gcloud CLI automation in CI/CD, service account impersonation should be enabled via the --impersonate-service-account flag.

Combining Workload Identity Federation for containerized SDK workloads with gcloud service account impersonation for automated scripts establishes a completely keyless programmatic interaction model. Workload Identity Federation exchanges external OIDC tokens for short-lived Google Cloud credentials, while gcloud impersonation generates short-lived tokens on the fly without storing long-lived service account JSON keys.

Adım Adım Çözüm

Establish keyless identity federation for the application SDK

Configure Workload Identity Federation using an Workload Identity Pool and Provider mapped to the on-premises Kubernetes cluster's OIDC issuer.

This avoids downloading long-lived service account JSON keys while allowing Application Default Credentials (ADC) to exchange OIDC tokens for Google OAuth2 access tokens.

Configure short-lived gcloud CLI access in automation pipelines

Execute gcloud commands using service account impersonation by specifying the target service account email with the --impersonate-service-account flag or setting the auth/impersonate_service_account gcloud property.

This generates temporary tokens for gcloud execution without creating or storing key files.

Anahtar Kavram

Programmatic GCP Interaction via Keyless Authentication and Service Account Impersonation

Soru 2Soru →

A cloud architecture team is refactoring an event-driven data pipeline that processes real-time transaction events via Cloud Pub/Sub and persists aggregated records into Cloud Bigtable. To cut cloud costs and accelerate CI/CD build execution, the team must run unit and integration tests completely offline without interacting with real Google Cloud API endpoints. Which TWO configuration steps must be implemented to ensure the client SDKs route all network requests to the locally running emulators? (Select TWO.)

Geçerli olan tümünü seçin

Export the environment variable PUBSUB_EMULATOR_HOST set to the host and port of the running Pub/Sub emulator before initializing the application client.

Grant the roles/owner primitive IAM role to the local emulator container's service account to bypass Cloud IAM API authentication during test execution.

Export the environment variable BIGTABLE_EMULATOR_HOST pointing to the socket of the local Bigtable emulator prior to invoking the test runner.

Provision an isolated Google Kubernetes Engine (GKE) cluster in a development GCP project to run emulator containers for each CI build stage.

Cevabı ve açıklamayı göster

Cevap: Export the environment variable PUBSUB_EMULATOR_HOST set to the host and port of the running Pub/Sub emulator before initializing the application client.; Export the environment variable BIGTABLE_EMULATOR_HOST pointing to the socket of the local Bigtable emulator prior to invoking the test runner.

Cevap

To route client SDK requests to local emulators offline, developers must export the PUBSUB_EMULATOR_HOST environment variable for Cloud Pub/Sub and the BIGTABLE_EMULATOR_HOST environment variable for Cloud Bigtable.

Google Cloud client SDKs for Cloud Pub/Sub and Cloud Bigtable automatically detect the PUBSUB_EMULATOR_HOST and BIGTABLE_EMULATOR_HOST environment variables. When set, client libraries automatically redirect API calls to local emulator sockets and disable network calls to production Google Cloud endpoints.

Adım Adım Çözüm

Identify the standard host environment variables defined by Google Cloud Client Libraries for service emulators.

PUBSUB_EMULATOR_HOST and BIGTABLE_EMULATOR_HOST are recognized automatically by GCP client libraries.

When these environment variables are populated with host:port values, client SDKs override default Google service endpoints and direct traffic to local emulator sockets.

Evaluate local emulator execution requirements against live GCP infrastructure provisioning.

Local environment variables allow completely offline, cost-free, high-speed test execution.

Emulators do not require active Cloud IAM roles, live service account credentials, or provisioned GKE compute clusters.

Anahtar Kavram

Google Cloud Client Library emulator auto-discovery via host environment variables

Soru 3Soru →

A healthcare enterprise is designing a secure CI/CD pipeline on Google Cloud using Cloud Build to automate infrastructure changes via Terraform and deploy containerized services. The security architect specifies that the build process must prevent privilege escalation, avoid local configuration state loss, and restrict network traffic to internal resources. Which TWO architectural practices should the team implement to satisfy these security and reliability requirements? (Select TWO.)

Geçerli olan tümünü seçin

Execute pipeline builds using Cloud Build private pools peered with a VPC network to prevent public internet access and enforce network perimeter controls.

Configure a Cloud Storage remote backend with Object Versioning for Terraform state and require Cloud Build to use service account impersonation with fine-grained roles.

Grant the Cloud Build service account the primitive Owner role and the Service Account Admin role across the project to ensure unrestricted resource creation capabilities.

Save the Terraform state file within the local transient workspace directory of the Cloud Build worker node to maximize execution speed and reduce storage API calls.

Cevabı ve açıklamayı göster

Cevap: Execute pipeline builds using Cloud Build private pools peered with a VPC network to prevent public internet access and enforce network perimeter controls.; Configure a Cloud Storage remote backend with Object Versioning for Terraform state and require Cloud Build to use service account impersonation with fine-grained roles.

Cevap

The team should execute builds using Cloud Build private pools peered to a VPC network and store Terraform state in a Cloud Storage remote backend with Object Versioning while enforcing service account impersonation.

Executing pipeline builds in Cloud Build private pools connected via VPC Network Peering guarantees private connectivity and strict perimeter security controls. Additionally, using Cloud Storage as a remote Terraform backend with versioning ensures durable, concurrent state tracking, while leveraging service account impersonation guarantees least-privilege security.

Adım Adım Çözüm

Evaluate network isolation requirements for build execution.

Using Cloud Build private pools connects build workers privately to internal VPC networks and prevents exfiltration over public endpoints.

Default Cloud Build runners operate in a shared public environment, which does not satisfy strict network perimeter requirements.

Evaluate infrastructure state management and IAM access strategy.

Centralizing state in Cloud Storage with object versioning ensures durable state tracking and disaster recovery, while service account impersonation enforces strict privilege boundaries.

Ephemeral local storage leads to lost state and corruption, and granting primitive roles grants excessive permissions.

Anahtar Kavram

Designing secure and resilient CI/CD pipelines with Cloud Build private pools, remote Terraform state locking, and least-privilege IAM impersonation.

Soru 4Soru →

A software development team is building a microservices-based event processing application on Google Cloud that relies heavily on Cloud Pub/Sub and Cloud Datastore. The team leads report high Google Cloud charges during early development iterations and security risks due to developers creating service account keys on their local workstations to authenticate against live Cloud resources during local testing. As a Cloud Architect advising the development and operations teams, which TWO actions should you recommend to establish a secure, cost-effective local development and integration testing workflow?

Geçerli olan tümünü seçin

Advise developers to run Cloud Pub/Sub and Datastore local emulators on their workstations for local unit and integration testing.

Configure local environment variables to point application client libraries to the local emulator endpoints instead of live Google Cloud API endpoints.

Generate long-lived JSON service account keys with the Project Owner role and commit them into the shared Git repository for developer convenience.

Grant every developer the Editor role at the project level so they can dynamically provision cloud resources whenever tests run.

Grant developers the Service Account Admin role on the project to allow automated creation of temporary service accounts during local test execution.

Cevabı ve açıklamayı göster

Cevap: Advise developers to run Cloud Pub/Sub and Datastore local emulators on their workstations for local unit and integration testing.; Configure local environment variables to point application client libraries to the local emulator endpoints instead of live Google Cloud API endpoints.

Cevap

The development and operations teams should be advised to run Cloud Pub/Sub and Cloud Datastore local emulators on developer workstations and configure local environment variables to direct client libraries to the emulator endpoints.

Recommending Google Cloud local emulators allows developers to perform fast, isolated integration testing locally on their workstations without incurring live cloud consumption charges or requiring service account keys. Redirecting Google Cloud client libraries via environment variables ensures that application code remains environment-agnostic without requiring code changes.

Adım Adım Çözüm

Identify the causes of cloud costs and security vulnerabilities during local development

Connecting local dev environments to live cloud services generates resource consumption costs and requires managing long-lived IAM service account keys.

Direct cloud resource connection from local machines introduces security risks and unnecessary expenses.

Evaluate GCP emulator capability for local development workflows

Google Cloud provides local emulators (e.g., gcloud emulators pubsub, datastore) that simulate GCP service behaviors locally without network calls to GCP endpoints.

Emulators eliminate GCP resource usage costs and eliminate the need for GCP authentication credentials during local testing.

Configure environment variables for client library redirection

Setting environment variables (such as PUBSUB_EMULATOR_HOST) automatically redirects Google Cloud SDK client calls to local localhost ports.

Client libraries natively support emulator redirection variables, keeping application code clean and identical between dev and production environments.

Anahtar Kavram

Advising Development and Operation Teams on Local Emulators and Environment Workflows

Soru 5Soru →

A financial analytics firm provisions its multi-environment Google Cloud infrastructure using Terraform executed via Cloud Build CI/CD pipelines. The lead cloud architect must establish a centralized Infrastructure as Code (IaC) governance model that prevents concurrent state updates, protects state file integrity, and adheres to the principle of least privilege. Which strategy should the architect implement?

Configure a remote Terraform backend using a Cloud Storage bucket with Object Versioning enabled, and execute Cloud Build pipelines using a dedicated service account granted fine-grained, predefined IAM roles.

Store state files directly within the source control repository using encrypted local backends, allowing Cloud Build triggers to commit updated state files after each deployment run.

Configure a remote Cloud Storage backend for state storage, and grant the Cloud Build service account the primitive Editor role across all targeted Google Cloud projects to streamline provisioning.

Configure a remote Cloud Storage backend for Terraform state, but instruct operations engineers to make urgent infrastructure changes directly via the Google Cloud Console during system outages.

Cevabı ve açıklamayı göster

Cevap: Configure a remote Terraform backend using a Cloud Storage bucket with Object Versioning enabled, and execute Cloud Build pipelines using a dedicated service account granted fine-grained, predefined IAM roles.

Cevap

The correct solution configures a Cloud Storage remote backend with Object Versioning enabled to provide distributed state locking and state historical backup. Combining this backend with a dedicated Cloud Build service account assigned fine-grained predefined IAM roles follows Google Cloud recommended architectural practices for secure, scalable Infrastructure as Code deployment.

Adım Adım Çözüm

Establish secure remote state management.

Configuring Google Cloud Storage (GCS) as a remote backend provides built-in state locking and object versioning to protect against race conditions and concurrent modifications.

Remote state centralization prevents local state divergence and guards against corrupting environment definitions.

Scope permissions according to least privilege.

Assign fine-grained predefined roles (or custom roles) to the Cloud Build service account managing the infrastructure execution.

Avoid using primitive roles like Editor or Owner to minimize the blast radius of automated pipeline operations.

Enforce strict deployment workflow controls.

Ensure all modifications pass through automated CI/CD code reviews and plan/apply pipelines rather than manual operator edits.

Prevents configuration drift between actual cloud resources and the declarative code state.

Anahtar Kavram

Terraform Remote Backend & IAM Least Privilege Governance

Tahmini Süre:1m 30s

Soru 6Soru →

A platform engineering team is deploying a Python application in an on-premises container environment. The application needs to programmatically create and manage resources across multiple Google Cloud projects using Google Cloud Client Libraries. Enterprise security policy strictly forbids downloading service account JSON key files and mandates short-lived credentials alongside fine-grained authorization. Which TWO configuration steps should the team implement to establish secure programmatic interaction with Google Cloud APIs?

Geçerli olan tümünü seçin

Set up Workload Identity Federation using an on-premises OpenID Connect (OIDC) identity provider to allow the application to exchange short-lived federated tokens for Google Cloud service account tokens.

Initialize the Google Cloud Client Libraries using standard application code patterns that rely on Application Default Credentials (ADC) to auto-detect credential sources from the execution environment.

Generate a service account JSON key file, encode it as a base64 string, and inject it directly into the application container environment variables.

Grant the service account the primitive Owner role (`roles/owner`) at the organization node level to guarantee uninterrupted programmatic access across all current and future projects.

Cevabı ve açıklamayı göster

Cevap: Set up Workload Identity Federation using an on-premises OpenID Connect (OIDC) identity provider to allow the application to exchange short-lived federated tokens for Google Cloud service account tokens.; Initialize the Google Cloud Client Libraries using standard application code patterns that rely on Application Default Credentials (ADC) to auto-detect credential sources from the execution environment.

Cevap

The team should configure Workload Identity Federation using an on-premises OIDC identity provider for short-lived token exchange and initialize the Google Cloud Client Libraries using Application Default Credentials (ADC) for seamless credential discovery.

The combination of Workload Identity Federation and Application Default Credentials provides keyless authentication for on-premises container workloads. Workload Identity Federation trades external OIDC tokens for short-lived Google Cloud service account tokens, while ADC allows SDK client libraries to automatically discover and use those short-lived credentials without hardcoded configuration.

Adım Adım Çözüm

Establish federated identity trust with Google Cloud IAM

Configured Workload Identity Pool and Provider to trust external OIDC identity tokens.

Allows external workloads to authenticate programmatically without requiring downloadable service account keys.

Configure application environment for token exchange

Created a credential configuration file specifying the Workload Identity provider details and target service account.

Enables Application Default Credentials (ADC) to automatically exchange external tokens for short-lived Google Cloud access tokens.

Instantiate client libraries using implicit ADC loading

Client libraries automatically pick up credentials from the ADC environment location without hardcoded parameters.

Ensures clean, maintainable, and secure programmatic GCP interaction compliant with enterprise governance.

Anahtar Kavram

Programmatic GCP API authentication using Workload Identity Federation and Application Default Credentials (ADC)

Soru 7Soru →

A telemetry platform team operating a global IoT data ingestion service on Google Cloud is restructuring their deployment pipeline and environment governance. Currently, engineers perform manual infrastructure modifications through the Cloud Console and authenticate CI/CD jobs using long-lived service account keys saved locally. As a Principal Cloud Architect, you are advising the development and operations teams on implementing GCP best practices for automation, security, and state management. Which TWO practices should you recommend? (Select TWO.)

Geçerli olan tümünü seçin

Authenticate external CI/CD deployment pipelines using Workload Identity Federation rather than exporting long-lived service account JSON keys.

Store Terraform state files in a Cloud Storage bucket configured with object versioning and state locking enabled.

Grant the Editor primitive role to the deployment service account to ensure all existing and future infrastructure provisioning operations succeed.

Maintain Infrastructure as Code state files within developer local Git repositories to track infrastructure revisions alongside application source code.

Assign the Service Account Admin role to developer accounts to allow Compute Engine instances to run under application service accounts.

Cevabı ve açıklamayı göster

Cevap: Authenticate external CI/CD deployment pipelines using Workload Identity Federation rather than exporting long-lived service account JSON keys.; Store Terraform state files in a Cloud Storage bucket configured with object versioning and state locking enabled.

Cevap

The correct recommendations are authenticating external CI/CD deployment pipelines using Workload Identity Federation instead of long-lived keys, and storing Terraform state files in a Cloud Storage bucket configured with object versioning and state locking.

Advising DevOps teams effectively involves enforcing key security and operational principles. Authenticating pipelines using Workload Identity Federation avoids storing long-lived credentials, and using Cloud Storage for Terraform state management ensures centralized, locked, and versioned state file tracking.

Adım Adım Çözüm

Evaluate identity and authentication requirements for deployment automation.

Workload Identity Federation replaces long-lived key management with short-lived, federated credentials.

Eliminating exported service account keys mitigates credential exfiltration risk and management overhead.

Establish secure Infrastructure as Code (IaC) state management standards.

Remote state in Cloud Storage with versioning and object locking guarantees state consistency.

Prevents state file corruption and race conditions across multi-developer teams.

Anahtar Kavram

Advising Development and Operation Teams on Secure Automation and IaC Best Practices

Soru 8Soru →

An automated trading platform engineering team is establishing an Infrastructure as Code (IaC) deployment pipeline for Google Cloud workloads across development, staging, and production environments using Terraform and Cloud Build. The security policy mandates least privilege execution, environment isolation, protection against concurrent state modifications, and strict state version auditability. Which deployment architecture should the cloud architect recommend?

Provision dedicated Cloud Storage buckets per environment with Object Versioning enabled for remote backends, enforce state locking via Cloud Storage native locking mechanisms, and configure Cloud Build pipelines to impersonate environment-specific service accounts granted minimal predefined IAM roles.

Store state files locally within ephemeral Cloud Build execution containers during pipeline execution, and grant developers project Owner roles so they can manually fix resource provisioning errors via the Cloud Console if an apply step fails.

Use a single shared Cloud Storage bucket across all environments without Object Versioning or locking to simplify pipeline configuration, and execute Cloud Build pipelines using the default Project Editor role to avoid IAM permissions errors.

Configure Terraform to maintain state in an unversioned single Cloud Storage bucket while allowing parallel pipeline steps to run without state locks to minimize CI/CD build execution time.

Cevabı ve açıklamayı göster

Cevap: Provision dedicated Cloud Storage buckets per environment with Object Versioning enabled for remote backends, enforce state locking via Cloud Storage native locking mechanisms, and configure Cloud Build pipelines to impersonate environment-specific service accounts granted minimal predefined IAM roles.

Cevap

The correct approach enforces enterprise-grade Infrastructure as Code governance by isolating Terraform remote state backends into separate Cloud Storage buckets per environment, enabling state locking and object versioning to protect against state corruption, and scoping CI/CD pipeline access using dedicated service accounts with fine-grained predefined roles.

Adım Adım Çözüm

Isolate remote state storage across environment boundaries

Separate Cloud Storage buckets per environment prevent accidental cross-environment modifications.

Production and lower environments must be isolated at both resource and state management layers.

Enable Object Versioning and native locking on state backends

State locking prevents concurrent pipeline runs from corrupting state, while versioning enables state recovery.

Terraform relies on state consistency; versioning provides disaster recovery for state corruption.

Scope CI/CD execution identity with short-lived impersonation and minimal IAM roles

Cloud Build impersonates fine-grained service accounts without exposing static long-lived keys or over-privileged primitive roles.

Adheres to security least-privilege principles.

Anahtar Kavram

Enterprise IaC Governance with Terraform, Remote State Security, and Least Privilege CI/CD Execution

Tahmini Süre:2m 0s

Soru 9Soru →

A retail organization's platform operations team is supporting a dev team that deploys microservices to a private Google Kubernetes Engine (GKE) cluster using an external CI/CD runner. During automated deployment pipeline runs, the build stage succeeds, but the deployment step fails to connect to the cluster's control plane API server. The operations team wants to enable the CI/CD pipeline to deploy container updates securely without exposing the control plane to public internet traffic generally. Which architectural advice should you provide to the development and operations teams?

Configure Control Plane Authorized Networks on the private GKE cluster to explicitly allow access from the specific external IP CIDR block of the CI/CD deployment runners.

Disable the private endpoint on the GKE control plane to allow the API server to accept incoming connections from any public internet IP address.

Grant the primitive Owner role (roles/owner) to the service account used by the deployment pipeline to bypass control plane network access limitations.

Assign the Service Account Admin role (roles/iam.serviceAccountAdmin) to the deployment runner service account so it can modify IAM policies dynamically during deployment.

Cevabı ve açıklamayı göster

Cevap: Configure Control Plane Authorized Networks on the private GKE cluster to explicitly allow access from the specific external IP CIDR block of the CI/CD deployment runners.

Cevap

Configure Control Plane Authorized Networks on the private GKE cluster to allow traffic specifically from the CI/CD deployment runner IP addresses.

Configuring Control Plane Authorized Networks allows platform teams to specify exact public IP ranges (such as those belonging to CI/CD deployment systems) authorized to access the private GKE cluster's API endpoint, fulfilling both security and deployment automation requirements.

Adım Adım Çözüm

Identify the root cause of the deployment connection failure.

The private GKE cluster control plane endpoint blocks inbound traffic originating from unauthorized external IP addresses.

Private GKE clusters restrict control plane API access by default to protect cluster administration endpoints.

Evaluate secure access options that maintain security boundaries and least privilege.

Configuring Control Plane Authorized Networks allows specific CIDR ranges (the CI/CD runner IPs) to reach the API server without exposing it to the open internet.

This balances pipeline automation requirements with robust perimeter security best practices on GCP.

Anahtar Kavram

Advising Development and Operation Teams on Private GKE Cluster Control Plane Access

Soru 10Soru →

A software engineering team is constructing an automated local integration testing suite for an application that interacts with Cloud Bigtable. To run offline integration tests within an isolated CI container environment without network access to Google Cloud, the team starts the local emulator using `gcloud beta emulators bigtable start`. However, when test cases run, the application client library attempts to reach live Google Cloud endpoints and fails due to missing internet connectivity. Which configuration step must be performed so that the Cloud Bigtable client library routes requests directly to the locally running emulator process?

Export the BIGTABLE_EMULATOR_HOST environment variable set to the host address and port where the emulator is running prior to executing the client application.

Grant the primitive Owner role (roles/owner) to a local service account key file and reference it via standard Application Default Credentials.

Store the Bigtable schema and emulator data in an unversioned local directory and synchronize it to a Cloud Storage backend using Terraform prior to test execution.

Provision an isolated Google Kubernetes Engine (GKE) cluster in GCP for each test runner to host the Bigtable emulator container.

Cevabı ve açıklamayı göster

Cevap: Export the BIGTABLE_EMULATOR_HOST environment variable set to the host address and port where the emulator is running prior to executing the client application.

Cevap

Export the BIGTABLE_EMULATOR_HOST environment variable set to the host address and port where the emulator is running prior to executing the client application.

The Cloud Bigtable emulator runs as a local process. Official GCP client SDKs look for the BIGTABLE_EMULATOR_HOST environment variable upon initialization. When present, the SDK sends API calls to the specified local port instead of authenticating with live Google Cloud end points.

Adım Adım Çözüm

Identify how Google Cloud client libraries discover emulator endpoints.

Google Cloud client libraries automatically inspect environment variables (such as BIGTABLE_EMULATOR_HOST) to override default GCP service endpoints.

This allows offline local testing without modifying application code or making calls to live GCP APIs.

Configure the local test environment.

Set BIGTABLE_EMULATOR_HOST (e.g., BIGTABLE_EMULATOR_HOST=localhost:8086) in the shell or CI pipeline container running the tests.

The client SDK redirects all database reads and writes to the local Bigtable emulator process running on that socket.

Anahtar Kavram

Cloud Bigtable Emulator Host Environment Variable Configuration

Soru 11Soru →

An energy utility company operates a serverless, stateless smart meter data processing service on Google Cloud Run, backed by Cloud SQL for PostgreSQL. The engineering team is planning a major release that includes both microservice logic updates and structural database schema alterations. The business requires zero downtime during the rollout, real-time validation of metrics on a small segment of production traffic, and an immediate zero-downtime rollback capability if error rates spike. Which release strategy and implementation approach should you recommend?

Implement an expand-contract database schema migration pattern first, deploy the new application build as a new Cloud Run revision, and gradually shift traffic using Cloud Run revision traffic splitting to monitor performance before completing the rollout.

Perform a Blue-Green cutover by applying destructive database schema changes to remove deprecated columns immediately, then switch 100% of load balancer traffic to the new revision.

Replatform the stateless microservice from Cloud Run to a Google Kubernetes Engine (GKE) cluster with an Istio service mesh to handle canary traffic routing between pod deployments.

Provision a parallel blue-green environment by duplicating all underlying compute resources in Compute Engine Managed Instance Groups across regions without verifying regional CPU core quotas ahead of deployment.

Cevabı ve açıklamayı göster

Cevap: Implement an expand-contract database schema migration pattern first, deploy the new application build as a new Cloud Run revision, and gradually shift traffic using Cloud Run revision traffic splitting to monitor performance before completing the rollout.

Cevap

The combination of an expand-contract database migration strategy with Cloud Run revision traffic splitting provides a zero-downtime canary deployment. Decoupling database changes ensures backward compatibility so both old and new revisions can safely run concurrently, while Cloud Run traffic splitting enables real-time metric validation on a small subset of live users.

Adım Adım Çözüm

Ensure database backward compatibility

Database changes are deployed using the expand-contract pattern (adding new fields while maintaining old ones), ensuring both old and new application versions can operate simultaneously.

Prevents breaking active application instances during phased traffic migration or rollback.

Deploy new Cloud Run revision

The updated container image is deployed to Cloud Run as a distinct revision receiving 0% initial traffic.

Allows staging and verification of the deployment artifact without impacting live user traffic.

Execute canary traffic split

Cloud Run traffic management is configured to route a small percentage (e.g., 5%) of incoming requests to the new revision while observing operational metrics.

Validates application stability against real-world production traffic with minimal risk.

Anahtar Kavram

Canary Deployment with Backward-Compatible Database Schema

Soru 12Soru →

An enterprise biotechnology organization is designing an automated continuous delivery pipeline to manage infrastructure across multiple Google Cloud projects using Terraform. The pipeline must guarantee secure remote state persistence, prevent state file corruption during concurrent deployment execution, eliminate long-lived service account authentication keys, and maintain strict identity least privilege. Which TWO actions should the cloud architecture team implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Configure a Google Cloud Storage backend with Object Versioning enabled for remote Terraform state storage and state locking.

Store state files locally within ephemeral build runners and upload unversioned copies to Cloud Storage after execution.

Authenticate the external deployment runner using Workload Identity Federation to impersonate a dedicated service account with fine-grained IAM roles.

Grant the Owner primitive role to the CI/CD service account to prevent deployment pipeline failures across GCP services.

Perform manual resource updates directly via Google Cloud Console whenever urgent deployment lock issues arise in production.

Cevabı ve açıklamayı göster

Cevap: Configure a Google Cloud Storage backend with Object Versioning enabled for remote Terraform state storage and state locking.; Authenticate the external deployment runner using Workload Identity Federation to impersonate a dedicated service account with fine-grained IAM roles.

Cevap

The architecture team should store remote Terraform state in a Google Cloud Storage bucket with Object Versioning enabled to ensure state resilience and concurrency control, and authenticate external deployment pipelines using Workload Identity Federation to eliminate long-lived service account keys while enforcing least privilege through fine-grained IAM roles.

Configuring Cloud Storage with Object Versioning provides secure, centralized, and version-controlled remote state persistence that automatically handles locking to prevent concurrent state modifications. Pairing this backend with Workload Identity Federation allows external CI/CD systems to securely assume dedicated GCP service account identities using short-lived tokens, adhering strictly to least-privilege access without exporting static credential files.

Adım Adım Çözüm

Evaluate remote backend state lock and durability requirements

Selected Cloud Storage with Object Versioning to store Terraform state securely with locking and version history.

Google Cloud Storage backends provide native file locking mechanisms to prevent concurrent state access and maintain version history against corruption.

Assess pipeline authentication security and key management constraints

Selected Workload Identity Federation for external CI/CD pipeline access.

Workload Identity Federation enables short-lived identity exchange for service account impersonation without creating long-lived exported JSON keys.

Verify adherence to least privilege security rules

Scoped service account access to predefined granular roles rather than broad primitive roles.

Primitive roles like Owner grant excessive broad permissions and break enterprise GCP compliance standards.

Anahtar Kavram

Infrastructure as Code Governance, State Backend Lock Security, and Pipeline Identity Scoping

Soru 13Soru →

A cloud administrator regularly manages infrastructure across separate development, staging, and production Google Cloud projects from a single workstation using the gcloud CLI. Currently, the administrator manually re-authenticates or overrides environment variables whenever switching target environments, which increases the risk of executing administrative commands against the wrong project. Which approach aligns with Google Cloud best practices for managing and switching between multiple environment settings cleanly when using the gcloud CLI?

Create separate named gcloud configurations for each environment using gcloud config configurations create, define project and account settings within each configuration, and activate the required profile using gcloud config configurations activate.

Generate long-lived JSON service account key files for each project and write a wrapper shell script that dynamically exports GOOGLE_APPLICATION_CREDENTIALS pointing to the respective key file prior to running gcloud commands.

Assign the primitive Owner IAM role to the administrator's personal account across all target projects so that gcloud commands automatically inherit administrative context without explicitly defining configurations.

Perform all resource changes for staging and production manually via the Google Cloud Console, reserving gcloud CLI usage exclusively for the local development environment.

Cevabı ve açıklamayı göster

Cevap: Create separate named gcloud configurations for each environment using gcloud config configurations create, define project and account settings within each configuration, and activate the required profile using gcloud config configurations activate.

Cevap

Create and activate separate named gcloud configurations for each target project environment using the gcloud config configurations command group.

The gcloud CLI provides native support for multiple named configurations via `gcloud config configurations`. Each named configuration maintains its own set of properties, including default project ID, active user account, region, and zone. Activating a specific named configuration instantly switches the active operational context, preventing accidental execution against unintended projects without requiring static credential files.

Adım Adım Çözüm

Identify the requirement for isolated, reproducible CLI environment contexts.

Recognize that managing multiple Google Cloud projects requires switching gcloud settings like default project, region, zone, and authentication identity.

Manual overrides via environment variables or continuous re-authentication lead to configuration errors and operational risk.

Evaluate the native gcloud CLI features designed for multi-environment context management.

Determine that `gcloud config configurations` provides named profile management for distinct environment settings.

Named configurations isolate settings into discrete profiles that can be created, configured, and activated on demand.

Select the correct sequence of gcloud configuration management commands.

Use `gcloud config configurations create <name>` to establish profiles for development, staging, and production, and `gcloud config configurations activate <name>` to switch contexts safely.

This avoids downloading static service account keys, maintains security best practices, and prevents accidental operations in the wrong project environment.

Anahtar Kavram

gcloud Named Configurations for Environment Management

Soru 14Soru →

A financial services organization deploys a Go-based microservice on Google Kubernetes Engine (GKE) that programmatically ingests data by publishing messages to Cloud Pub/Sub and writing records to Cloud Bigtable using official Google Cloud Client Libraries. During high-volume market events, the application experiences transient HTTP $429$ (Too Many Requests) rate limit errors and HTTP $503$ (Service Unavailable) errors. The security and platform architecture teams require a solution that adheres to GCP authentication best practices while ensuring resilient API interaction and minimal operational overhead. Which implementation strategy should the cloud architect recommend?

Utilize the built-in retry policies of the Google Cloud Client Libraries configured with truncated exponential backoff and randomized jitter, while authenticating via Application Default Credentials (ADC) bound to a Kubernetes Service Account using Workload Identity.

Generate a long-lived service account JSON key file, embed it directly into the application container image, and write a custom linear retry loop with fixed one-second delay intervals.

Assign the primitive Owner IAM role (roles/owner) to the GKE node pool's default service account to automatically bypass API rate limits and quota restrictions.

Persist failed API call states to an unversioned local file inside the container, and execute local Terraform commands from within the application to re-provision resources upon each failure.

Cevabı ve açıklamayı göster

Cevap: Utilize the built-in retry policies of the Google Cloud Client Libraries configured with truncated exponential backoff and randomized jitter, while authenticating via Application Default Credentials (ADC) bound to a Kubernetes Service Account using Workload Identity.

Cevap

The option recommending built-in Google Cloud Client Library retry policies with truncated exponential backoff and jitter alongside Workload Identity correctly addresses both API rate limiting and secure authentication. Google Cloud Client Libraries natively support Application Default Credentials (ADC) and automatic retry handling for idempotent requests, avoiding static credential management and preventing thundering herd spikes.

Adım Adım Çözüm

Analyze authentication requirements for GKE applications

Workload Identity allows Kubernetes Service Accounts to act as IAM Service Accounts using short-lived tokens via Application Default Credentials (ADC), eliminating the need for service account keys.

Hardcoding or bundling static JSON service account keys introduces security vulnerabilities.

Evaluate API resilience strategies for transient HTTP 429 and 503 errors

Official Google Cloud Client Libraries provide standard retry mechanisms that use truncated exponential backoff with randomized jitter.

Exponential backoff prevents overwhelming APIs during overload spikes, while jitter prevents synchronization thundering herd problems.

Synthesize the architecture recommendation

Combine Workload Identity for identity management with native Client Library retry logic for programmatic GCP API interaction.

This satisfies both security and operational resilience standards for GCP cloud architecture.

Anahtar Kavram

Programmatic GCP API Resilience and Secure Authentication via ADC

Soru 15Soru →

A financial enterprise is designing a Continuous Integration and Continuous Delivery (CI/CD) pipeline on Google Cloud using Cloud Build and Terraform to manage infrastructure deployments inside a restricted security environment governed by VPC Service Controls. The architecture team requires that the pipeline prevents configuration drift, protects state files against concurrency corruption and exfiltration, and strictly enforces the principle of least privilege. Which TWO architectural controls should be implemented in this CI/CD pipeline design? (Select TWO.)

Geçerli olan tümünü seçin

Store the Terraform state file in a Cloud Storage bucket configured with object versioning and state locking, executing builds via Cloud Build private worker pools inside the network perimeter.

Grant the Cloud Build trigger service account the Service Account User role (roles/iam.serviceAccountUser) on a dedicated custom deployment service account to perform resource provisioning through short-lived impersonation.

Assign the primitive Owner role (roles/owner) directly to the Cloud Build default service account to prevent permission errors when provisioning complex multi-resource topologies.

Maintain the Terraform state file within the ephemeral container storage of the Cloud Build runner workspace to avoid external network calls and prevent state data exfiltration.

Cevabı ve açıklamayı göster

Cevap: Store the Terraform state file in a Cloud Storage bucket configured with object versioning and state locking, executing builds via Cloud Build private worker pools inside the network perimeter.; Grant the Cloud Build trigger service account the Service Account User role (roles/iam.serviceAccountUser) on a dedicated custom deployment service account to perform resource provisioning through short-lived impersonation.

Cevap

The optimal design requires storing Terraform state in a versioned Cloud Storage bucket with state locking while running builds on Cloud Build private worker pools inside the VPC Service Controls perimeter, and granting the build service account the Service Account User role to impersonate a dedicated deployment service account.

The correct approach combines secure remote state management with private network execution and fine-grained identity impersonation. Storing Terraform state in a Cloud Storage bucket with object versioning and state locking prevents state file corruption and concurrency conflicts during concurrent deployments. Executing Cloud Build builds on private worker pools allows secure deployment within a VPC Service Controls perimeter. Additionally, granting the Cloud Build build trigger service account the `roles/iam.serviceAccountUser` role on a dedicated deployment service account enables minimal, audited permission delegation through service account impersonation.

Adım Adım Çözüm

Establish secure remote state management and network perimeter boundary for IaC execution.

Configuring a Cloud Storage remote backend with state locking and object versioning ensures concurrent apply operations do not corrupt state. Running Cloud Build on private worker pools satisfies VPC Service Controls compliance requirements.

VPC Service Controls block public Cloud Build pool traffic, requiring private worker pools peered to the VPC for internal resource provisioning.

Configure fine-grained IAM privilege separation for build execution.

The Cloud Build service account is granted `roles/iam.serviceAccountUser` on a specific target service account that possesses minimal required deployment permissions.

Impersonation prevents assigning permanent broad privileges directly to build pipeline identities, adhering to GCP security architecture best practices.

Anahtar Kavram

Secure CI/CD Pipeline Design with Cloud Build, IaC State Locking, and IAM Service Account Impersonation

Soru 16Soru →

A software engineering team is designing a CI/CD pipeline using Cloud Build to automate infrastructure updates with Terraform and deploy microservices to a private Google Kubernetes Engine (GKE) cluster. The pipeline needs to read and update Terraform state files stored in a Cloud Storage bucket, interact with the GKE control plane, and execute containerized deployments. To adhere to Google Cloud security best practices and the principle of least privilege, how should the Cloud Build pipeline permissions and network configuration be designed?

Assign the primitive Owner role to the Cloud Build service account at the project level to ensure full administrative access to Cloud Storage state files and GKE resources.

Grant fine-grained roles such as Storage Object Admin on the specific state bucket and Kubernetes Engine Developer on the cluster, while routing Cloud Build traffic through a private worker pool authorized to access the GKE control plane.

Grant the Cloud Build service account the Service Account Admin role across the project so that it can elevate its privileges dynamically during pipeline execution.

Store the Terraform state files on local ephemeral disks within the Cloud Build build steps to avoid granting Cloud Storage IAM permissions.

Cevabı ve açıklamayı göster

Cevap: Grant fine-grained roles such as Storage Object Admin on the specific state bucket and Kubernetes Engine Developer on the cluster, while routing Cloud Build traffic through a private worker pool authorized to access the GKE control plane.

Cevap

The solution follows security best practices by assigning minimal, resource-scoped IAM roles (Storage Object Admin on the state bucket and Kubernetes Engine Developer on the cluster) and utilizing Cloud Build Private Pools to securely communicate with the private GKE master endpoint.

Adım Adım Çözüm

Identify the minimum required IAM permissions for each pipeline operation

The pipeline requires Object Admin rights restricted to the specific Terraform state bucket and Developer access to the GKE cluster, rather than project-wide primitive or service account admin roles.

Enforces the principle of least privilege and prevents unauthorized operational modifications across other project resources.

Establish secure network connectivity between Cloud Build and private GKE control plane endpoints

Cloud Build Private Pools connected via VPC peering allow worker nodes to access private GKE master IP ranges.

Default public Cloud Build workers cannot access private GKE control planes unless authorized IP ranges or private worker pools are configured.

Ensure durable infrastructure state management

Remote persistent storage in Cloud Storage with object versioning guarantees state file preservation across automated pipeline builds.

Ephemeral runner storage causes loss of state and breaks infrastructure automation.

Anahtar Kavram

Least-privilege IAM configuration and private network isolation for Cloud Build pipelines interacting with GKE and Cloud Storage

Soru 17Soru →

A fintech enterprise is modernizing a legacy online payment portal to eliminate architectural technical debt during its migration from an on-premises data center to Google Cloud. The application architecture consists of lightweight, stateless HTTP API microservices and a standard single-region 3 TB relational database. The migration strategy mandates minimizing operational management overhead for compute while maintaining backward compatibility for database schema updates to support continuous rollout without downtime.

Which TWO architectural actions should the team take to achieve these requirements? (Select TWO)

Geçerli olan tümünü seçin

Deploy the stateless HTTP API microservices to Cloud Run.

Migrate the database to Cloud SQL using Database Migration Service (DMS) and implement an expand-and-contract schema pattern during migration.

Deploy the stateless HTTP API microservices on a dedicated Google Kubernetes Engine (GKE) Standard cluster with cluster autoscaling.

Migrate the relational database directly to Cloud Spanner to handle standard single-region database operations.

Cevabı ve açıklamayı göster

Cevap: Deploy the stateless HTTP API microservices to Cloud Run.; Migrate the database to Cloud SQL using Database Migration Service (DMS) and implement an expand-and-contract schema pattern during migration.

Cevap

The team should deploy the stateless HTTP microservices to Cloud Run and migrate the relational database to Cloud SQL using Database Migration Service (DMS) while leveraging an expand-and-contract schema pattern.

Deploying stateless microservices to Cloud Run minimizes operational management by using a fully managed serverless execution model. Migrating the relational database to Cloud SQL using Database Migration Service provides a streamlined migration path, while using an expand-and-contract schema pattern ensures zero-downtime schema migrations that maintain backward compatibility across old and new application versions.

Adım Adım Çözüm

Evaluate compute modernization choices against technical debt and operational overhead constraints.

Cloud Run provides a fully managed serverless compute environment for containerized stateless HTTP microservices without requiring node provisioning or cluster control plane management.

Choosing GKE for simple stateless services creates unnecessary operational complexity and maintenance burden.

Select database destination and continuous replication migration tooling.

Cloud SQL provides managed relational database capabilities suitable for single-region workload sizes, managed seamlessly via Database Migration Service (DMS).

Cloud Spanner is designed for globally distributed scale and adds unnecessary cost and refactoring overhead for standard single-region relational databases.

Define database schema migration strategy to ensure zero-downtime rollout.

The expand-and-contract pattern allows new and old application versions to read/write concurrently during deployment by making non-breaking incremental schema changes.

Executing breaking database schema changes during live migration disrupts legacy application instances.

Anahtar Kavram

Managing Technology Debt and Legacy Cloud Migrations

Soru 18Soru →

A pharmaceutical distribution company manages its Google Cloud infrastructure using Terraform within a centralized Cloud Build CI/CD pipeline. During an emergency operational incident, an engineer manually updated the machine type and auto-scaling limits of an unmanaged instance group directly in the Google Cloud Console. The infrastructure team now needs to resolve this configuration drift and bring the state back into alignment with IaC governance standards without tearing down existing production workloads. Which approach should the cloud architect recommend?

Update the local Terraform HCL codebase to reflect the upgraded instance group specifications, execute a terraform plan to confirm zero resource destruction, and commit the changes to trigger the pipeline.

Continue allowing manual updates via the Cloud Console during operational incidents, and execute a scheduled terraform apply step with a force flag to overwrite drift automatically.

Delete the existing remote Terraform state object in the Cloud Storage bucket and re-run terraform init to rebuild the state file from scratch.

Grant the Cloud Build service account the Project Owner primitive role across all environments so the pipeline can forcefully reconcile unmanaged resources.

Cevabı ve açıklamayı göster

Cevap: Update the local Terraform HCL codebase to reflect the upgraded instance group specifications, execute a terraform plan to confirm zero resource destruction, and commit the changes to trigger the pipeline.

Cevap

The correct approach is to update the Terraform HCL code to match the manual configuration changes, perform a plan check to ensure no destructive updates are scheduled, and commit the code to version control. This restores parity between code, state, and live GCP resources while maintaining IaC governance.

Adım Adım Çözüm

Identify the drift source

Recognize that manual modifications performed in the Cloud Console caused the live environment to deviate from the stored state file.

Infrastructure as Code requires declarative code to represent the true desired state of managed cloud resources.

Update Terraform code definition

Modify the instance group resource block parameters in HCL to match the updated live resource attributes.

Bringing code in line with manual emergency changes captures valid operational adjustments in version control.

Validate state execution plan

Run terraform plan to verify that Terraform detects no unexpected changes or resource replacements.

Prevents accidental downtime or recreation of production resources before committing to main branches.

Anahtar Kavram

Remediating Infrastructure Configuration Drift in Terraform

Tahmini Süre:1m 30s

Soru 19Soru →

An online learning platform automates its Google Cloud infrastructure deployments using Terraform executed within a continuous integration and continuous delivery (CI/CD) pipeline. The Lead Cloud Architect must establish a secure governance model for deployment pipeline authentication, permission scoping, and Terraform state management following Google Cloud best practices. Which design strategy should the architect implement?

Generate a service account JSON key file, grant the service account the primitive Owner role, store the key in the CI/CD secret manager, and configure a Cloud Storage remote state backend.

Authenticate the CI/CD pipeline using Workload Identity Federation, grant minimal predefined IAM roles to the deployment service account, and store state files in a Cloud Storage bucket with object versioning and state locking enabled.

Authenticate the pipeline using Workload Identity Federation, grant fine-grained IAM roles to the pipeline, and store Terraform state files on the local persistent disk of the dedicated CI/CD build runner.

Authenticate the pipeline using service account impersonation, and instruct operators to manually modify infrastructure in the Cloud Console during operational incidents before running terraform refresh in the pipeline.

Cevabı ve açıklamayı göster

Cevap: Authenticate the CI/CD pipeline using Workload Identity Federation, grant minimal predefined IAM roles to the deployment service account, and store state files in a Cloud Storage bucket with object versioning and state locking enabled.

Cevap

Google Cloud best practices for Infrastructure as Code (IaC) pipelines require keyless authentication via Workload Identity Federation, strict scoping of deployment service accounts using fine-grained predefined IAM roles, and centralized remote state management in Cloud Storage with state locking and versioning enabled.

Adım Adım Çözüm

Configure pipeline authentication without service account keys

Workload Identity Federation allows external CI/CD workloads to exchange short-lived tokens for GCP IAM credentials securely.

Eliminating exportable JSON keys prevents credential exfiltration and management toil.

Enforce the principle of least privilege for deployment permissions

Assign specific, predefined IAM roles required only for the target resources managed by the pipeline.

Avoids over-privileged primitive roles like Owner or Editor that create broad security risks.

Configure a centralized, secure remote state backend

Store Terraform state in a Cloud Storage bucket configured with state locking and object versioning.

Prevents concurrent execution state corruption and enables recovery from bad state updates.

Anahtar Kavram

IaC Security Governance and Remote State Management

Soru 20Soru →

A global logistics and freight management company is modernizing its on-premises dispatch tracking system to Google Cloud to resolve significant architectural technical debt. The legacy system relies on microservices accessing a shared 20 TB MySQL database directly, causing tight coupling and schema migration failures. The business demands zero downtime during migration and a decoupled architecture moving forward.

Which of the following architectural actions should the cloud architect recommend to mitigate technical debt and execute the migration successfully? (Select TWO.)

Geçerli olan tümünü seçin

Use Database Migration Service (DMS) with continuous change data capture (CDC) to sync to Cloud SQL for MySQL, and utilize the expand-and-contract pattern to decouple application deployments from schema changes.

Refactor application microservices to communicate via REST APIs and Cloud Pub/Sub asynchronous messaging instead of querying shared database tables directly.

Order a Google Cloud Transfer Appliance to perform an offline bulk copy of the 20 TB database, followed by immediate blue-green deployment with non-backwards-compatible schema changes.

Migrate the database to Cloud Spanner to handle standard relational workloads, and host stateless web microservices on Google Kubernetes Engine (GKE) with dedicated node pools.

Cevabı ve açıklamayı göster

Cevap: Use Database Migration Service (DMS) with continuous change data capture (CDC) to sync to Cloud SQL for MySQL, and utilize the expand-and-contract pattern to decouple application deployments from schema changes.; Refactor application microservices to communicate via REST APIs and Cloud Pub/Sub asynchronous messaging instead of querying shared database tables directly.

Cevap

The correct recommendations are using Database Migration Service with continuous CDC replication combined with the expand-and-contract pattern, and refactoring microservices to communicate via APIs and Cloud Pub/Sub messaging instead of accessing shared database tables directly.

To manage technical debt during cloud migration, legacy shared database dependencies must be eliminated by introducing API layers and event messaging (Cloud Pub/Sub). Additionally, migrating live data with Database Migration Service using CDC alongside an expand-and-contract schema strategy enables zero-downtime migration and safe schema evolution.

Adım Adım Çözüm

Evaluate data migration and schema coupling strategies.

Database Migration Service (DMS) provides zero-downtime continuous replication from on-premises MySQL to Cloud SQL. Applying the expand-and-contract pattern ensures backwards-compatible schema changes during transition.

This resolves legacy schema coupling debt while maintaining zero downtime during migration.

Address service coupling and database access technical debt.

Decoupling services by introducing API endpoints and Cloud Pub/Sub event streams removes direct database sharing between microservices.

This establishes clear service boundaries and prevents cross-service database locks and rigid dependencies.

Anahtar Kavram

Managing Technical Debt and Decoupling Legacy Cloud Migrations

Sayfa 1 / 9Sonraki

Managing Implementations of Cloud Architecture

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram