Professional Cloud Architect Free Practice Questions
This is the free Google Professional Cloud Architect practice question bank —
160 of 306 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-06.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
A financial services company is decommissioning one of its on-premises data centers. As part of this initiative, the company needs to perform a one-time migration of 500 ТВ of historical transaction archives to a Cloud Storage bucket for long-term retention. The data center’s internet egress is 1 Gbps, which is shared with critical business operations. You must complete the secure data transfer within a 60-day window to meet the decommissioning deadline. What should you do?
A. Provision a Partner Interconnect connection with a 10 Gbps capacity to accelerate the data transfer, and then use Storage Transfer Service.
B. Write a script that uses the gcloud storage cp --parallel command to upload the data in chunks over the public internet during off-peak hours.
C. Use Storage Transfer Service to create an agent-based transfer job that moves the data from the on-premises file servers directly to the Cloud Storage bucket.
D. Order a Transfer Appliance, copy the data to the appliance using your high-speed local network, and ship it back to Google to upload the data into your Cloud Storage bucket.
Show Answer
Correct Answer: D
Explanation: 500 TB over a shared 1 Gbps internet connection is impractical within the constraints and would consume bandwidth needed for business operations. A Transfer Appliance is designed for large one-time bulk migrations: copy data locally at high speed, ship the appliance to Google, and Google uploads the data securely into Cloud Storage. Partner Interconnect would require provisioning new connectivity and Storage Transfer Service alone still depends on available network bandwidth.
Question 2
Your company is a global financial services provider that processes and analyzes a high volume of credit card transactions in real time for fraud detection. Your analytics team must run complex batch queries on the same transaction data for daily reporting. You need to design a data processing solution that can handle both real-time and batch processing of the transaction data while minimizing operational overhead and infrastructure management. What should you do?
A. Use Dataprep to ingest the transactions.
B. Use Dataflow to process the streaming data.
C. Use a Dataproc cluster for both the streaming and batch workloads.
D. Use BigQuery for the batch analytics reports.
E. Use Firestore to store and analyze the transaction data.
Show Answer
Correct Answer: B, D
Explanation: Use Dataflow for serverless, scalable real-time stream processing of high-volume transaction data, which also supports unified batch/stream processing with Apache Beam while minimizing operational overhead. Use BigQuery as the serverless data warehouse for complex batch analytics and daily reporting. Dataproc requires cluster management, Dataprep is for data preparation rather than streaming pipelines, and Firestore is not designed for large-scale analytical queries.
Question 3
A large, multinational corporation is migrating to Google Cloud. The company has several distinct business units: Finance, Marketing, and Research and Development (R&D). The central security team has mandated governance requirements for each business unit:
• Finance: Must be restricted to deploying resources only in specific, compliant regions (us-central1 and europe-west2). Access to their projects must be tightly controlled by a dedicated finance-admins group.
• Marketing: Needs separate environments for production and development, with different teams managing each environment.
• R&D: Requires maximum flexibility to experiment with new services but must be completely isolated to prevent any impact on production systems.
• Global Auditing: A central compliance team requires read-only access to view all resources across the entire company for auditing purposes.
You need to design a resource hierarchy that enforces these security policies at scale according to the Google Cloud Well-Architected Framework while providing the correct level of autonomy for each business unit. What should you do?
A. Create a folder for each department under the root Organization node. Apply the resource location Organization Policy on the Finance folder. Within the Marketing folder, create separate projects for mktg-prod and mktg-dev. Grant the compliance team the roles/viewer role at the Organization level.
B. Place all projects directly under the Organization node. Use network tags and service accounts to enforce security boundaries between the different department workloads. Apply the resource location Organization Policy on the Finance project.
C. Create separate Google Cloud Organizations for each department (Finance, Marketing, and R&D). Grant the compliance team the roles/viewer role for each organization.
D. Create a single project for each department. Apply the resource location policy directly to the Finance project. Grant the compliance team the roles/browser role on each project individually.
Show Answer
Correct Answer: A
Explanation: Using folders to represent business units enables inheritance of IAM and Organization Policies. Applying the resource location constraint at the Finance folder restricts all Finance projects to compliant regions, and Finance-specific IAM can be granted at the folder. Marketing can separate production and development into distinct projects under its folder, allowing different teams to manage each. R&D receives its own isolated folder for autonomy. Granting read-only access at the Organization level provides centralized auditing across all resources. The other options either bypass the hierarchy, require unnecessary multiple Organizations, or manage permissions and policies at an unscalable project level.
Question 4
You are developing a deep learning model that requires high-performance access to large volumes of media data currently stored in Cloud Storage. Model training will be executed on multiple VM instances with GPUs attached, but your application must interact with the data as if it were on the local file system. You need to minimize complexity and cost. What should you do?
A. Copy the data from Cloud Storage to Filestore, and then mount the Filestore volume as a local file system on your VM instances.
B. Create a shared persistent disk, attach the disk to your VM instances, and load data from the Cloud Storage bucket.
C. Use the gcsfuse command line tool to mount the Cloud Storage bucket as a local file system, and perform read/write operations in your bucket using standard file system semantics.
D. Use the gsutil command line tool to download the data to your VM instances.
Show Answer
Correct Answer: C
Explanation: gcsfuse mounts a Cloud Storage bucket as a POSIX-like file system, allowing applications to access bucket objects through standard file system operations without copying data or provisioning additional storage. This minimizes operational complexity and cost compared with Filestore or downloading data locally. Shared persistent disks are not designed to expose Cloud Storage directly.
Question 5
You are designing a central, automated infrastructure deployment process for your organization using Terraform and Cloud Build. The security team prohibits the use of long-lived, static service account keys in any CI/CD pipeline. Additionally, while developers can propose infrastructure changes for peer review, they must not have permissions to directly apply changes in the production project. You need to design a secure and automated workflow for applying Terraform changes that meets the security team's requirements and ensures proper governance. What should you do?
A. Configure the Cloud Build pipeline to use service account impersonation. Set up a trigger that automatically runs terraform apply when a pull request is merged.
B. Use service account impersonation in Cloud Build. Configure the pipeline to run terraform plan on pull requests, and require manual approval before running terraform apply.
C. Configure the pipeline to only run terraform plan. After a pull request is approved, have an authorized developer run terraform apply from a secured workstation.
D. Create a privileged service account and store its JSON key in Secret Manager. Configure the Cloud Build pipeline to fetch this key during execution to authenticate Terraform.
Show Answer
Correct Answer: B
Explanation: Using service account impersonation avoids long-lived service account keys by issuing short-lived credentials at runtime. Running terraform plan on pull requests supports peer review without granting developers production apply permissions. Requiring a manual approval before terraform apply provides a governance checkpoint while allowing the privileged Cloud Build pipeline to perform the deployment.
Question 6
Your employer is a financial services company that recently acquired a popular fintech startup. The startup's core application is a monolithic Python application running on a managed instance group of Compute Engine virtual machines with a single, large PostgreSQL database. Your development team struggles with slow deployment cycles, and the monolithic design of the startup's core application makes it difficult to integrate new. ML-powered fraud detection models. You need a long-term strategy that improves developer agility and positions the company to leverage Google Cloud's advanced data and AI capabilities for future innovations. What should you do?
A. Deploy the ML fraud detection model to a Vertex AI endpoint. Create a REST API for the model and modify the monolithic Python application to call this endpoint for real-time fraud analysis.
B. Containerize the application, deploy it to Google Kubernetes Engine (GKE), and migrate the PostgreSQL database to Cloud SQL for PostgreSQL.
C. Propose a phased, event-driven migration to a microservices architecture. Use Pub/Sub for asynchronous communication and deploy the fraud models on Vertex AI endpoints.
D. Migrate the PostgreSQL database to Cloud SQL for PostgreSQL. Replicate the data into BigQuery using Datastream, and then train and deploy the fraud detection models directly within BigQuery using BigQuery ML.
Show Answer
Correct Answer: C
Explanation: A phased migration from a monolith to an event-driven microservices architecture directly addresses slow deployment cycles and improves developer agility. Pub/Sub enables loose coupling and asynchronous communication, while Vertex AI endpoints provide a scalable managed platform for serving ML fraud detection models. This approach also positions the organization to adopt Google Cloud data and AI services over time without a risky full rewrite.
Question 7
Your company has hired an external auditing firm to perform a compliance audit. Your company’s governance policy requires that external auditors be managed in a single Google Group that is granted temporary, read-only access to a Cloud Storage bucket named audit-evidence-bucket. Access must be traceable to the individual auditor's identity and be active only for the duration of the audit engagement, which runs the entire month of October. You need a secure access control strategy that avoids administrative overhead and complies with your company's governance policy. What should you do?
A. Apply an IAM policy binding that grants the roles/storage.objectViewer role to the Google Group. Configure this binding with a time-based IAM Condition that automatically grants access from October 1 to November 1.
B. Create a service account, and grant it the roles/storage.objectViewer role on the bucket. Generate and share Signed URLs for each object in the bucket with an expiration date of November 1.
C. Use Cloud Scheduler to run a Cloud Run functions script that adds the IAM binding of roles/storage.objectViewer to the Google Group on October 1 and another that removes the IAM binding on November 1.
D. Use Workforce Identity Federation to map the auditors’ group to the Google Group. Bind the roles/storage.objectViewer role to this Google Group. Configure a 1-month session duration on the provider.
Show Answer
Correct Answer: A
Explanation: Grant the Google Group the Storage Object Viewer role on the bucket with a time-based IAM Condition using request.time from October 1 through November 1. This satisfies the governance requirement to manage auditors through a single Google Group, provides read-only access, automatically expires access without scheduled administrative actions, and Cloud Audit Logs record the individual authenticated user, preserving traceability.
Question 8
Company Overview -
KnightMotives is a car manufacturer specializing in autonomous, self-driving vehicles, including Battery Electric Vehicles (BEVs), hybrids and traditional internal combustion engine (ICE) vehicles. While KnightMotives has made strides with the in-vehicle experience in their BEV fleet, the hybrid and ICE vehicles have yet to implement these new systems and are viewed poorly by critics and drivers. The lack of modern in-vehicle technology in hybrid and ICE vehicles has resulted in declining sales and customer satisfaction.
KnightMotives wants to modernize the consumer experience across all vehicles within five years Artificial Intelligence offers a unique opportunity to revolutionize the in-vehicle experience, as well as the shopping buying and service/maintenance experience. Investment in this new technology will require a shift in financial priorities on a global scale.
KnightMotives also wants to improve their online ordering system, which is unreliable. Systems for customers to build their vehicle online for acquisition through a dealer are not delivering the data or reliability that dealers need, causing. A strain in the relationship between KnightMotives and dealers. Service technicians and sales staff need better tooling to enhance dealer successes, including built-to-order vehicles.
Solution Concept -
KnightMotives wants to shift from manufacturing cars to creating a complete and compelling “automotive experience.” Then strategy prioritizes delivering a consistent experience across all models, developing AI-powered features, generating new revenue from data monetization, adopting a digital focus to differentiate their brand from competitors, and developing better tools for mechanics and salespeople.
Existing Technical Environment -
KnightMotives's IT is largely on-premises with some applications on major cloud platforms. Their supply chain runs on an outdated mainframe, and Enterprise Resource Planning (ERP) is also outdated, making new promotions and dealer discounts difficult to implement. Dealers have no budget for new equipment. There is fragmentation across vehicles with multiple code bases, and significant technical debt from supporting backwards compatibility. Network connectivity to manufacturing plants and vehicle connectivity in rural areas are challenges.
Business Requirements -
Key business requirements include fostering a personalized relationship with the driver and delivering a cohesive experience across all models. Creating a better build-to-order model will reduce time on the lot and provide transparency for both dealers and customers. Additionally, KnightMotives seeks to monetize corporate data to finance new technology investments, as their current AI infrastructure is obsolete and corporate data remains siloed. Security is a paramount concern due to past data breaches Adherence to European Union (EU) data protection regulations, especially for emerging autonomous platforms, is critical.
KnightMotives plans to make significant investments in fully autonomous driving capabilities, with initial implementation targeting regions with favorable regulatory environments. Prioritizing employee upskilling, attracting top-tier talent, and fostering better communication between business and technical teams are also critical objectives.
Technical Requirements -
• Modernizing the in-vehicle experience includes developing a consistent user experience (UX) that seamlessly integrates AI-powered features across all models, updating in-vehicle hardware and software in legacy models to support new UX features and AI capabilities, and ensuring reliable network connectivity, especially in rural areas, to support real-time AI features and data transmission.
• Network upgrades are necessary to support increased data traffic and improve connectivity between plants and headquarters.
• IT infrastructure modernization requires adopting a hybrid cloud strategy to leverage the benefits of both on-premises and cloud infrastructure, and gradually modernizing or replacing legacy systems to improve efficiency and agility.
• Autonomous vehicle development and testing requires investing in cutting-edge AI and machine learning technologies, building a robust simulation environment, and ensuring compliance with evolving regulations related to autonomous vehicles.
• Data monetization and insights requires implementing a robust data management platform, strict data security and privacy measures, and a scalable AI/ML infrastructure.
• Increased focus on security and risk management involves implementing a comprehensive security framework to protect against cyber threats and data breaches, developing an incident response plan, and providing security awareness training to employees.
• Providing a delightful experience for dealers and customers requires improving the online build-to-order system; developing modern dealer tools to streamline dealer operations, including sales, service, and inventory management; and implementing a comprehensive Customer Relationship Management (CRM) system to track customer interactions personalize experiences, and improve customer satisfaction.
Executive Statement -
KnightMotives is committed to enhancing safety and saving lives by leveraging an extensive body of data — encompassing driving, road conditions, behavioral studies, and crash safety statistics — to create compelling digital experiences for drivers. Our AI consistently outperforms national safety statistics, ensuring the unique and coveted KnightMotives experience is aligned across all our vehicle models.
Michael Knight, KnightMotives CEO
For this question, refer to the KnightMotives Automotive case study. You are responsible for designing the network infrastructure architecture for KnightMotives's new environment on Google Cloud. You need to design the new VPC topology. You want to ensure a guaranteed bandwidth and low latency between the plants and Google Cloud resources. What should you do?
A. Create a Standard Tier VPC. and ensure a subnet is available in the region closest to a plant. Establish a Cloud Interconnect between each subnet and the local plant.
B. Create a Standard Tier VPC. and ensure a subnet is available in the region closest to a plant Establish Direct Peering between Google's Edge Network and the local plant.
C. Create a Premium Ter VPand ensure a subnet is available in the region closest to a plant. Establish a Cloud Interconnect between each subnet and the local plant.
D. Create a Premium Ter VPC. and ensure a subnet is available in the region closest to a plant. Establish Direct Peering between Google's Edge Network and the local plant.
Show Answer
Correct Answer: C
Explanation: Guaranteed bandwidth and low latency between on-premises plants and Google Cloud require Cloud Interconnect, not Direct Peering. Premium Tier uses Google's global backbone and is the appropriate choice for enterprise connectivity across regions. Standard Tier does not provide the same global backbone advantages.
Question 9
Your machine learning (ML) engineers use self-hosted Jupyter notebooks for tasks such as data preparation, model training, and fine-tuning. The operations team then deploys these models in various environments. You want to provide maximum flexibility for ML engineers, promote collaboration with a common toolset, and leverage Google Cloud's scalability, while following Google-recommended practices. What should you do?
A. Use AutoML for machine learning and Cloud Deploy for model deployment.
B. Use Colab Enterprise for machine learning and DevOps for model deployment.
C. Use Vertex AI for machine learning and machine learning operations (MLOps) for model deployment.
D. Use TensorFlow for machine learning and Cloud Deploy for model deployment.
Show Answer
Correct Answer: C
Explanation: Vertex AI is Google Cloud's recommended managed platform for end-to-end ML workflows. It supports notebook-based development, data preparation, training, hyperparameter tuning, collaboration, deployment, monitoring, and MLOps capabilities, providing scalability while allowing ML engineers flexibility. The other options either do not provide the full recommended MLOps platform or pair unrelated deployment services.
Question 10
A large healthcare provider's primary electronic health record (EHR) application runs on Compute Engine instances with a Cloud SQL for PostgreSQL database, all located in the us-west1 region. A new regulatory mandate requires you to implement and document a business continuity plan (BCP). This plan must ensure that the EHR application can be fully recovered and operational in a different geographical region with a recovery time objective (RTO) of two hours and a recovery point objective (RPO) of 15 minutes. You need to design a disaster recovery strategy that meets these strict BCP requirements. What should you do?
A. Deploy active managed instance groups (MIGs) in both us-west1 and us-east1, fronted by a global external HTTP(S) Load Balancer. For the database, use a cross-region read replica in us-east1, and rely on load balancer health checks to automatically fail over all traffic during an outage.
B. Use Terraform to define the application’s compute infrastructure. During a disaster, configure the Cloud SQL database in us-west1 to use a cross-region read replica in us-east1, build the environment in us-east1, and promote the replica.
C. Take daily snapshots of the Compute Engine disks and Cloud SQL database. Copy these snapshots to a Cloud Storage bucket in us-east1. During a disaster, manually restore the virtual machines (VMs) and database from the latest snapshots
D. Deploy a regional MIG in us-west1 for high availability, and rely on the Google Cloud SLA to ensure the region remains online.
Show Answer
Correct Answer: A
Explanation: Option A best satisfies the stated DR objectives. Running application instances in two regions behind a global load balancer enables rapid application failover, while a cross-region Cloud SQL read replica provides near-real-time replication that can be promoted in the disaster region, supporting an RPO on the order of minutes and an RTO within two hours. Option B requires building infrastructure during the disaster, increasing recovery time. Option C's daily snapshots cannot meet a 15-minute RPO. Option D only provides regional high availability, not cross-region disaster recovery.
$19
Get all 306 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.