Professional Cloud Architect Free Practice Questions
This is the free Google Professional Cloud Architect practice question bank —
160 of 305 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Google documentation —
see our methodology.
Question 1
A financial services company is decommissioning one of its on-premises data centers. As part of this initiative, the company needs to perform a one-time migration of 500 ТВ of historical transaction archives to a Cloud Storage bucket for long-term retention. The data center’s internet egress is 1 Gbps, which is shared with critical business operations. You must complete the secure data transfer within a 60-day window to meet the decommissioning deadline. What should you do?
A. Provision a Partner Interconnect connection with a 10 Gbps capacity to accelerate the data transfer, and then use Storage Transfer Service.
B. Write a script that uses the gcloud storage cp --parallel command to upload the data in chunks over the public internet during off-peak hours.
C. Use Storage Transfer Service to create an agent-based transfer job that moves the data from the on-premises file servers directly to the Cloud Storage bucket.
D. Order a Transfer Appliance, copy the data to the appliance using your high-speed local network, and ship it back to Google to upload the data into your Cloud Storage bucket.
Show Answer
Correct Answer: D
Explanation: Transferring 500 TB over a shared 1 Gbps internet link within 60 days would risk congestion and may not reliably meet the deadline. A Transfer Appliance is designed for large, one-time, offline migrations: you copy data locally at high speed without impacting business traffic, then ship the appliance to Google for direct upload into Cloud Storage, ensuring a secure and timely transfer.
Question 1
You are designing a central, automated infrastructure deployment process for your organization using Terraform and Cloud Build. The security team prohibits the use of long-lived, static service account keys in any CI/CD pipeline. Additionally, while developers can propose infrastructure changes for peer review, they must not have permissions to directly apply changes in the production project. You need to design a secure and automated workflow for applying Terraform changes that meets the security team's requirements and ensures proper governance. What should you do?
A. Configure the Cloud Build pipeline to use service account impersonation. Set up a trigger that automatically runs terraform apply when a pull request is merged.
B. Use service account impersonation in Cloud Build. Configure the pipeline to run terraform plan on pull requests, and require manual approval before running terraform apply.
C. Configure the pipeline to only run terraform plan. After a pull request is approved, have an authorized developer run terraform apply from a secured workstation.
D. Create a privileged service account and store its JSON key in Secret Manager. Configure the Cloud Build pipeline to fetch this key during execution to authenticate Terraform.
Show Answer
Correct Answer: B
Explanation: Using service account impersonation avoids long‑lived static keys by issuing short‑lived credentials at runtime, satisfying security requirements. Running terraform plan on pull requests enables peer review and transparency without granting apply permissions to developers. Adding a manual approval gate before terraform apply enforces governance and ensures that production changes are applied only after explicit authorization, while still keeping the process automated and secure.
Question 2
Your company is a global financial services provider that processes and analyzes a high volume of credit card transactions in real time for fraud detection. Your analytics team must run complex batch queries on the same transaction data for daily reporting. You need to design a data processing solution that can handle both real-time and batch processing of the transaction data while minimizing operational overhead and infrastructure management. What should you do?
A. Use Dataprep to ingest the transactions.
B. Use Dataflow to process the streaming data.
C. Use a Dataproc cluster for both the streaming and batch workloads.
D. Use BigQuery for the batch analytics reports.
E. Use Firestore to store and analyze the transaction data.
Show Answer
Correct Answer: B, D
Explanation: The requirement is to support both real-time stream processing for fraud detection and batch analytics for reporting with minimal operational overhead. Dataflow is a fully managed, serverless service designed for high-volume streaming processing and can also handle batch workloads using the same pipeline model, making it ideal for real-time transaction analysis. BigQuery is a serverless data warehouse optimized for complex analytical queries on large datasets, making it the best choice for daily batch reporting once the processed transaction data is stored there. Together, they meet both real-time and batch needs while minimizing infrastructure management.
Question 2
Your employer is a financial services company that recently acquired a popular fintech startup. The startup's core application is a monolithic Python application running on a managed instance group of Compute Engine virtual machines with a single, large PostgreSQL database. Your development team struggles with slow deployment cycles, and the monolithic design of the startup's core application makes it difficult to integrate new. ML-powered fraud detection models. You need a long-term strategy that improves developer agility and positions the company to leverage Google Cloud's advanced data and AI capabilities for future innovations. What should you do?
A. Deploy the ML fraud detection model to a Vertex AI endpoint. Create a REST API for the model and modify the monolithic Python application to call this endpoint for real-time fraud analysis.
B. Containerize the application, deploy it to Google Kubernetes Engine (GKE), and migrate the PostgreSQL database to Cloud SQL for PostgreSQL.
C. Propose a phased, event-driven migration to a microservices architecture. Use Pub/Sub for asynchronous communication and deploy the fraud models on Vertex AI endpoints.
D. Migrate the PostgreSQL database to Cloud SQL for PostgreSQL. Replicate the data into BigQuery using Datastream, and then train and deploy the fraud detection models directly within BigQuery using BigQuery ML.
Show Answer
Correct Answer: C
Explanation: A phased, event-driven migration to microservices directly addresses slow deployment cycles and long-term agility by decoupling components. Using Pub/Sub enables asynchronous communication and independent scaling, while deploying fraud detection models on Vertex AI leverages managed, advanced AI capabilities. The phased approach minimizes risk and supports gradual modernization, making it the strongest long-term strategy compared to point fixes or partial migrations.
Question 3
A large, multinational corporation is migrating to Google Cloud. The company has several distinct business units: Finance, Marketing, and Research and Development (R&D). The central security team has mandated governance requirements for each business unit:
• Finance: Must be restricted to deploying resources only in specific, compliant regions (us-central1 and europe-west2). Access to their projects must be tightly controlled by a dedicated finance-admins group.
• Marketing: Needs separate environments for production and development, with different teams managing each environment.
• R&D: Requires maximum flexibility to experiment with new services but must be completely isolated to prevent any impact on production systems.
• Global Auditing: A central compliance team requires read-only access to view all resources across the entire company for auditing purposes.
You need to design a resource hierarchy that enforces these security policies at scale according to the Google Cloud Well-Architected Framework while providing the correct level of autonomy for each business unit. What should you do?
A. Create a folder for each department under the root Organization node. Apply the resource location Organization Policy on the Finance folder. Within the Marketing folder, create separate projects for mktg-prod and mktg-dev. Grant the compliance team the roles/viewer role at the Organization level.
B. Place all projects directly under the Organization node. Use network tags and service accounts to enforce security boundaries between the different department workloads. Apply the resource location Organization Policy on the Finance project.
C. Create separate Google Cloud Organizations for each department (Finance, Marketing, and R&D). Grant the compliance team the roles/viewer role for each organization.
D. Create a single project for each department. Apply the resource location policy directly to the Finance project. Grant the compliance team the roles/browser role on each project individually.
Show Answer
Correct Answer: A
Explanation: Using folders under a single Organization aligns with Google Cloud’s resource hierarchy and enables policy inheritance at scale. A Finance folder allows enforcing compliant regions via Organization Policy and tight IAM control with a finance-admins group. Marketing can have separate prod and dev projects under its folder with distinct teams. R&D can be isolated in its own folder/projects while retaining flexibility. Granting the auditing team a read-only role at the Organization level provides visibility across all resources without manual per-project management. Other options either break governance best practices, reduce isolation, or do not scale.
Question 3
Your company has hired an external auditing firm to perform a compliance audit. Your company’s governance policy requires that external auditors be managed in a single Google Group that is granted temporary, read-only access to a Cloud Storage bucket named audit-evidence-bucket. Access must be traceable to the individual auditor's identity and be active only for the duration of the audit engagement, which runs the entire month of October. You need a secure access control strategy that avoids administrative overhead and complies with your company's governance policy. What should you do?
A. Apply an IAM policy binding that grants the roles/storage.objectViewer role to the Google Group. Configure this binding with a time-based IAM Condition that automatically grants access from October 1 to November 1.
B. Create a service account, and grant it the roles/storage.objectViewer role on the bucket. Generate and share Signed URLs for each object in the bucket with an expiration date of November 1.
C. Use Cloud Scheduler to run a Cloud Run functions script that adds the IAM binding of roles/storage.objectViewer to the Google Group on October 1 and another that removes the IAM binding on November 1.
D. Use Workforce Identity Federation to map the auditors’ group to the Google Group. Bind the roles/storage.objectViewer role to this Google Group. Configure a 1-month session duration on the provider.
Show Answer
Correct Answer: A
Explanation: Granting roles/storage.objectViewer to the auditors’ Google Group with a time-based IAM Condition satisfies all requirements. The Google Group centralizes management per governance policy, Cloud Audit Logs still record the individual user identities for traceability, and the IAM Condition enforces automatic start and end dates for access during October without manual intervention. The access is read-only and scoped only to the bucket, minimizing risk and administrative overhead.
Question 4
You are developing a deep learning model that requires high-performance access to large volumes of media data currently stored in Cloud Storage. Model training will be executed on multiple VM instances with GPUs attached, but your application must interact with the data as if it were on the local file system. You need to minimize complexity and cost. What should you do?
A. Copy the data from Cloud Storage to Filestore, and then mount the Filestore volume as a local file system on your VM instances.
B. Create a shared persistent disk, attach the disk to your VM instances, and load data from the Cloud Storage bucket.
C. Use the gcsfuse command line tool to mount the Cloud Storage bucket as a local file system, and perform read/write operations in your bucket using standard file system semantics.
D. Use the gsutil command line tool to download the data to your VM instances.
Show Answer
Correct Answer: C
Explanation: The requirement is to access Cloud Storage data as if it were on a local file system across multiple GPU VMs, while minimizing cost and complexity. gcsfuse mounts a Cloud Storage bucket directly as a file system, allowing standard POSIX-like read/write access without copying or duplicating data. Filestore adds extra cost and management overhead, shared persistent disks are not designed for high‑throughput shared training data and still require data staging, and gsutil requires explicitly downloading data to each VM, increasing complexity and storage usage.
Question 4
Company Overview -
KnightMotives is a car manufacturer specializing in autonomous, self-driving vehicles, including Battery Electric Vehicles (BEVs), hybrids and traditional internal combustion engine (ICE) vehicles. While KnightMotives has made strides with the in-vehicle experience in their BEV fleet, the hybrid and ICE vehicles have yet to implement these new systems and are viewed poorly by critics and drivers. The lack of modern in-vehicle technology in hybrid and ICE vehicles has resulted in declining sales and customer satisfaction.
KnightMotives wants to modernize the consumer experience across all vehicles within five years Artificial Intelligence offers a unique opportunity to revolutionize the in-vehicle experience, as well as the shopping buying and service/maintenance experience. Investment in this new technology will require a shift in financial priorities on a global scale.
KnightMotives also wants to improve their online ordering system, which is unreliable. Systems for customers to build their vehicle online for acquisition through a dealer are not delivering the data or reliability that dealers need, causing. A strain in the relationship between KnightMotives and dealers. Service technicians and sales staff need better tooling to enhance dealer successes, including built-to-order vehicles.
Solution Concept -
KnightMotives wants to shift from manufacturing cars to creating a complete and compelling “automotive experience.” Then strategy prioritizes delivering a consistent experience across all models, developing AI-powered features, generating new revenue from data monetization, adopting a digital focus to differentiate their brand from competitors, and developing better tools for mechanics and salespeople.
Existing Technical Environment -
KnightMotives's IT is largely on-premises with some applications on major cloud platforms. Their supply chain runs on an outdated mainframe, and Enterprise Resource Planning (ERP) is also outdated, making new promotions and dealer discounts difficult to implement. Dealers have no budget for new equipment. There is fragmentation across vehicles with multiple code bases, and significant technical debt from supporting backwards compatibility. Network connectivity to manufacturing plants and vehicle connectivity in rural areas are challenges.
Business Requirements -
Key business requirements include fostering a personalized relationship with the driver and delivering a cohesive experience across all models. Creating a better build-to-order model will reduce time on the lot and provide transparency for both dealers and customers. Additionally, KnightMotives seeks to monetize corporate data to finance new technology investments, as their current AI infrastructure is obsolete and corporate data remains siloed. Security is a paramount concern due to past data breaches Adherence to European Union (EU) data protection regulations, especially for emerging autonomous platforms, is critical.
KnightMotives plans to make significant investments in fully autonomous driving capabilities, with initial implementation targeting regions with favorable regulatory environments. Prioritizing employee upskilling, attracting top-tier talent, and fostering better communication between business and technical teams are also critical objectives.
Technical Requirements -
• Modernizing the in-vehicle experience includes developing a consistent user experience (UX) that seamlessly integrates AI-powered features across all models, updating in-vehicle hardware and software in legacy models to support new UX features and AI capabilities, and ensuring reliable network connectivity, especially in rural areas, to support real-time AI features and data transmission.
• Network upgrades are necessary to support increased data traffic and improve connectivity between plants and headquarters.
• IT infrastructure modernization requires adopting a hybrid cloud strategy to leverage the benefits of both on-premises and cloud infrastructure, and gradually modernizing or replacing legacy systems to improve efficiency and agility.
• Autonomous vehicle development and testing requires investing in cutting-edge AI and machine learning technologies, building a robust simulation environment, and ensuring compliance with evolving regulations related to autonomous vehicles.
• Data monetization and insights requires implementing a robust data management platform, strict data security and privacy measures, and a scalable AI/ML infrastructure.
• Increased focus on security and risk management involves implementing a comprehensive security framework to protect against cyber threats and data breaches, developing an incident response plan, and providing security awareness training to employees.
• Providing a delightful experience for dealers and customers requires improving the online build-to-order system; developing modern dealer tools to streamline dealer operations, including sales, service, and inventory management; and implementing a comprehensive Customer Relationship Management (CRM) system to track customer interactions personalize experiences, and improve customer satisfaction.
Executive Statement -
KnightMotives is committed to enhancing safety and saving lives by leveraging an extensive body of data — encompassing driving, road conditions, behavioral studies, and crash safety statistics — to create compelling digital experiences for drivers. Our AI consistently outperforms national safety statistics, ensuring the unique and coveted KnightMotives experience is aligned across all our vehicle models.
Michael Knight, KnightMotives CEO
For this question, refer to the KnightMotives Automotive case study. You are responsible for designing the network infrastructure architecture for KnightMotives's new environment on Google Cloud. You need to design the new VPC topology. You want to ensure a guaranteed bandwidth and low latency between the plants and Google Cloud resources. What should you do?
A. Create a Standard Tier VPC. and ensure a subnet is available in the region closest to a plant. Establish a Cloud Interconnect between each subnet and the local plant.
B. Create a Standard Tier VPC. and ensure a subnet is available in the region closest to a plant Establish Direct Peering between Google's Edge Network and the local plant.
C. Create a Premium Ter VPand ensure a subnet is available in the region closest to a plant. Establish a Cloud Interconnect between each subnet and the local plant.
D. Create a Premium Ter VPC. and ensure a subnet is available in the region closest to a plant. Establish Direct Peering between Google's Edge Network and the local plant.
Show Answer
Correct Answer: C
Explanation: KnightMotives requires guaranteed bandwidth, low latency, and reliable connectivity between on‑premises plants and Google Cloud. Cloud Interconnect is the Google-recommended option for guaranteed bandwidth and consistent low latency, unlike Direct Peering which offers no bandwidth guarantees. Using a Premium Tier VPC ensures traffic stays on Google’s global private network for optimal performance. Placing subnets in regions closest to each plant further minimizes latency. Therefore, a Premium Tier VPC with Cloud Interconnect best satisfies the requirements.
Question 5
A large healthcare provider's primary electronic health record (EHR) application runs on Compute Engine instances with a Cloud SQL for PostgreSQL database, all located in the us-west1 region. A new regulatory mandate requires you to implement and document a business continuity plan (BCP). This plan must ensure that the EHR application can be fully recovered and operational in a different geographical region with a recovery time objective (RTO) of two hours and a recovery point objective (RPO) of 15 minutes. You need to design a disaster recovery strategy that meets these strict BCP requirements. What should you do?
A. Deploy active managed instance groups (MIGs) in both us-west1 and us-east1, fronted by a global external HTTP(S) Load Balancer. For the database, use a cross-region read replica in us-east1, and rely on load balancer health checks to automatically fail over all traffic during an outage.
B. Use Terraform to define the application’s compute infrastructure. During a disaster, configure the Cloud SQL database in us-west1 to use a cross-region read replica in us-east1, build the environment in us-east1, and promote the replica.
C. Take daily snapshots of the Compute Engine disks and Cloud SQL database. Copy these snapshots to a Cloud Storage bucket in us-east1. During a disaster, manually restore the virtual machines (VMs) and database from the latest snapshots
D. Deploy a regional MIG in us-west1 for high availability, and rely on the Google Cloud SLA to ensure the region remains online.
Show Answer
Correct Answer: A
Explanation: Option A provides an automated, cross-region disaster recovery architecture that meets both objectives. Active deployments in two regions behind a global HTTP(S) Load Balancer enable rapid failover well within a 2‑hour RTO. A cross‑region Cloud SQL read replica with near‑real‑time replication supports an RPO of 15 minutes. The load balancer and health checks minimize manual intervention, which is essential for a documented, reliable BCP. The other options involve manual rebuilds, infrequent backups, or single‑region reliance, which cannot meet the stated RTO/RPO.
Question 5
Your team plans to use Vertex AI to develop and deploy machine learning models for various use cases for fraud detection, product recommendations, and customer churn prediction. You want to enhance the security posture of the Vertex AI and Workbench environment by restricting data exfiltration. What should you do?
A. Enable Private Google Access for the VPC network to allow Vertex AI services to access public Google services without traversing the public internet.
B. Enable VPC Flow Logs to monitor network traffic to and from Vertex AI services and to identify suspicious activity.
C. Create a service perimeter and include ml.googleapis.com and document.googleapis.com as protected services.
D. Create a service perimeter and include aiplatform.googleapis.com and notebooks.googleapis.com as protected services.
Show Answer
Correct Answer: D
Explanation: To restrict data exfiltration for Vertex AI and Workbench, you should use VPC Service Controls to create a service perimeter around the relevant Google-managed services. Vertex AI is protected via aiplatform.googleapis.com and Workbench via notebooks.googleapis.com. Including these services in a service perimeter prevents data from being accessed or exfiltrated outside trusted networks. Other options improve access or monitoring but do not enforce exfiltration prevention.
$19
Get all 305 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.