Professional Cloud Architect Free Practice Questions — Page 10
Question 94
For this question, refer to the Helicopter Racing League (HRL) case study. Your team is in charge of creating a payment card data vault for card numbers used to bill tens of thousands of viewers, merchandise consumers, and season ticket holders. You need to implement a custom card tokenization service that meets the following requirements:
* It must provide low latency at minimal cost.
* It must be able to identify duplicate credit cards and must not store plaintext card numbers.
* It should support annual key rotation.
Which storage approach should you adopt for your tokenization service?
A. Store the card data in Secret Manager after running a query to identify duplicates.
B. Encrypt the card data with a deterministic algorithm stored in Firestore using Datastore mode.
C. Encrypt the card data with a deterministic algorithm and shard it across multiple Memorystore instances.
D. Use column-level encryption to store the data in Cloud SQL.
Show Answer
Correct Answer: B
Explanation: Deterministic encryption allows the same card number to produce the same ciphertext/token, enabling duplicate detection without storing plaintext. Firestore in Datastore mode provides a scalable, low-latency, cost-effective persistent store suitable for a token vault, and supports designs with Cloud KMS for annual key rotation. Secret Manager is not intended as a high-volume token store, Memorystore is an in-memory cache rather than durable storage, and Cloud SQL is less aligned with the scalability and architecture described.
Question 95
You are responsible for the Google Cloud environment in your company. Multiple departments need access to their own projects, and the members within each department will have the same project responsibilities. You want to structure your Google Cloud environment for minimal maintenance and maximum overview of
IAM permissions as each department's projects start and end. You want to follow Google-recommended practices. What should you do?
A. Grant all department members the required IAM permissions for their respective projects.
B. Create a Google Group per department and add all department members to their respective groups. Create a folder per department and grant the respective group the required IAM permissions at the folder level. Add the projects under the respective folders.
C. Create a folder per department and grant the respective members of the department the required IAM permissions at the folder level. Structure all projects for each department under the respective folders.
D. Create a Google Group per department and add all department members to their respective groups. Grant each group the required IAM permissions for their respective projects.
Show Answer
Correct Answer: B
Explanation: Using Google Groups for department membership and assigning IAM roles at the folder level follows Google Cloud best practices. Folders provide hierarchical organization so permissions inherit to projects, reducing ongoing maintenance as projects are created or deleted. Managing users through groups simplifies membership changes without modifying IAM bindings on individual projects.
Question 96
Your company wants to migrate their 10-TB on-premises database export into Cloud Storage. You want to minimize the time it takes to complete this activity, the overall cost, and database load. The bandwidth between the on-premises environment and Google Cloud is 1 Gbps. You want to follow Google-recommended practices. What should you do?
A. Develop a Dataflow job to read data directly from the database and write it into Cloud Storage.
B. Use the Data Transfer appliance to perform an offline migration.
C. Use a commercial partner ETL solution to extract the data from the on-premises database and upload it into Cloud Storage.
D. Compress the data and upload it with gsutil -m to enable multi-threaded copy.
Show Answer
Correct Answer: D
Explanation: A 10 TB transfer over a 1 Gbps link is feasible in roughly a day under ideal conditions, far faster than the end-to-end turnaround of requesting, shipping, loading, and returning a Transfer Appliance. Compressing the export and using gsutil with the -m flag maximizes available bandwidth through parallel uploads while keeping costs low and avoiding repeated database reads. Dataflow and ETL tools are unnecessary for a database export that already exists.
Question 97
Your company is developing a web-based application. You need to make sure that production deployments are linked to source code commits and are fully auditable. What should you do?
A. Make sure a developer is tagging the code commit with the date and time of commit.
B. Make sure a developer is adding a comment to the commit that links to the deployment.
C. Make the container tag match the source code commit hash.
D. Make sure the developer is tagging the commits with latest.
Show Answer
Correct Answer: C
Explanation: Using the source code commit hash as the container image tag creates an immutable, direct mapping between the deployed artifact and the exact source revision. This makes deployments traceable and fully auditable. The other options rely on manual processes or mutable/non-unique tagging conventions and do not provide the same reliable linkage.
Question 98
Your company is designing its data lake on Google Cloud and wants to develop different ingestion pipelines to collect unstructured data from different sources.
After the data is stored in Google Cloud, it will be processed in several data pipelines to build a recommendation engine for end users on the website. The structure of the data retrieved from the source systems can change at any time. The data must be stored exactly as it was retrieved for reprocessing purposes in case the data structure is incompatible with the current processing pipelines. You need to design an architecture to support the use case after you retrieve the data. What should you do?
A. Send the data through the processing pipeline, and then store the processed data in a BigQuery table for reprocessing.
B. Store the data in a BigQuery table. Design the processing pipelines to retrieve the data from the table.
C. Send the data through the processing pipeline, and then store the processed data in a Cloud Storage bucket for reprocessing.
D. Store the data in a Cloud Storage bucket. Design the processing pipelines to retrieve the data from the bucket.
Show Answer
Correct Answer: D
Explanation: The requirement is to preserve the raw, unstructured data exactly as it was received so it can be reprocessed if schemas change. Cloud Storage is the appropriate data lake storage for raw objects, while downstream processing pipelines should read from this immutable raw layer. BigQuery is not intended as the primary store for arbitrary raw unstructured data in this scenario, and storing only processed data would not satisfy the reprocessing requirement.
Question 100
You have deployed an application on Anthos clusters (formerly Anthos GKE). According to the SRE practices at your company, you need to be alerted if request latency is above a certain threshold for a specified amount of time. What should you do?
A. Install Anthos Service Mesh on your cluster. Use the Google Cloud Console to define a Service Level Objective (SLO), and create an alerting policy based on this SLO.
B. Enable the Cloud Trace API on your project, and use Cloud Monitoring Alerts to send an alert based on the Cloud Trace metrics.
C. Use Cloud Profiler to follow up the request latency. Create a custom metric in Cloud Monitoring based on the results of Cloud Profiler, and create an Alerting policy in case this metric exceeds the threshold.
D. Configure Anthos Config Management on your cluster, and create a yaml file that defines the SLO and alerting policy you want to deploy in your cluster.
Show Answer
Correct Answer: A
Explanation: For SRE-style latency objectives, the appropriate approach is to define a Service Level Objective (SLO) and create an alerting policy based on that SLO. Anthos Service Mesh integrates with Cloud Monitoring to expose service metrics, define SLOs, and alert on SLO/error budget consumption. Cloud Trace is primarily for distributed tracing and troubleshooting rather than SLO-based alerting, Cloud Profiler is for CPU/memory profiling rather than request latency alerts, and Anthos Config Management is not used to define SLOs and alerting policies.
Question 101
Your company has an enterprise application running on Compute Engine that requires high availability and high performance. The application has been deployed on two instances in two zones in the same region in active-passive mode. The application writes data to a persistent disk. In the case of a single zone outage, that data should be immediately made available to the other instance in the other zone. You want to maximize performance while minimizing downtime and data loss.
What should you do?
A. 1. Attach a persistent SSD disk to the first instance. 2. Create a snapshot every hour. 3. In case of a zone outage, recreate a persistent SSD disk in the second instance where data is coming from the created snapshot.
B. 1. Create a Cloud Storage bucket. 2. Mount the bucket into the first instance with gcs-fuse. 3. In case of a zone outage, mount the Cloud Storage bucket to the second instance with gcs-fuse.
C. 1. Attach a regional SSD persistent disk to the first instance. 2. In case of a zone outage, force-attach the disk to the other instance.
D. 1. Attach a local SSD to the first instance disk. 2. Execute an rsync command every hour where the target is a persistent SSD disk attached to the second instance. 3. In case of a zone outage, use the second instance.
Show Answer
Correct Answer: C
Explanation: Regional SSD persistent disks synchronously replicate data across two zones in the same region, providing immediate availability after a zonal failure. In an active-passive deployment, if the primary zone fails, you can force-attach the regional persistent disk to the standby instance in the other zone, minimizing downtime and data loss while maintaining high performance. Snapshots and rsync are asynchronous and can lose recent data, and Cloud Storage via gcs-fuse is not an appropriate replacement for low-latency block storage.
Question 102
For this question, refer to the TerramEarth case study. You are building a microservice-based application for TerramEarth. The application is based on Docker containers. You want to follow Google-recommended practices to build the application continuously and store the build artifacts. What should you do?
A. Configure a trigger in Cloud Build for new source changes. Invoke Cloud Build to build container images for each microservice, and tag them using the code commit hash. Push the images to the Container Registry.
B. Configure a trigger in Cloud Build for new source changes. The trigger invokes build jobs and build container images for the microservices. Tag the images with a version number, and push them to Cloud Storage.
C. Create a Scheduler job to check the repo every minute. For any new change, invoke Cloud Build to build container images for the microservices. Tag the images using the current timestamp, and push them to the Container Registry.
D. Configure a trigger in Cloud Build for new source changes. Invoke Cloud Build to build one container image, and tag the image with the label 'latest.' Push the image to the Container Registry.
Show Answer
Correct Answer: A
Explanation: Google-recommended CI/CD practice is to use Cloud Build triggers on source changes, build container images automatically, tag images with the Git commit hash for traceability, and store them in a container image registry. Cloud Storage is not the recommended repository for container images, polling with Cloud Scheduler is unnecessary compared to native triggers, and using only the 'latest' tag reduces reproducibility and traceability.
Question 103
For this question, refer to the TerramEarth case study. TerramEarth has a legacy web application that you cannot migrate to cloud. However, you still want to build a cloud-native way to monitor the application. If the application goes down, you want the URL to point to a "Site is unavailable" page as soon as possible. You also want your Ops team to receive a notification for the issue. You need to build a reliable solution for minimum cost. What should you do?
A. Create a scheduled job in Cloud Run to invoke a container every minute. The container will check the application URL. If the application is down, switch the URL to the "Site is unavailable" page, and notify the Ops team.
B. Create a cron job on a Compute Engine VM that runs every minute. The cron job invokes a Python program to check the application URL. If the application is down, switch the URL to the "Site is unavailable" page, and notify the Ops team.
C. Create a Cloud Monitoring uptime check to validate the application URL. If it fails, put a message in a Pub/Sub queue that triggers a Cloud Function to switch the URL to the "Site is unavailable" page, and notify the Ops team.
D. Use Cloud Error Reporting to check the application URL. If the application is down, switch the URL to the "Site is unavailable" page, and notify the Ops team.
Show Answer
Correct Answer: C
Explanation: Cloud Monitoring uptime checks are designed to monitor HTTP(S) endpoints, including externally hosted or on-premises applications. An alert can publish to Pub/Sub, which triggers a Cloud Function to switch the URL to a maintenance page and notify the Ops team. This is a cloud-native, event-driven approach with low operational overhead and lower cost than continuously polling from a VM or scheduled container. Cloud Error Reporting is not intended for availability monitoring.
Question 104
For this question, refer to the TerramEarth case study. You are migrating a Linux-based application from your private data center to Google Cloud. The
TerramEarth security team sent you several recent Linux vulnerabilities published by Common Vulnerabilities and Exposures (CVE). You need assistance in understanding how these vulnerabilities could impact your migration. What should you do? (Choose two.)
A. Open a support case regarding the CVE and chat with the support engineer.
B. Read the CVEs from the Google Cloud Status Dashboard to understand the impact.
C. Read the CVEs from the Google Cloud Platform Security Bulletins to understand the impact.
D. Post a question regarding the CVE in Stack Overflow to get an explanation.
E. Post a question regarding the CVE in a Google Cloud discussion group to get an explanation.
Show Answer
Correct Answer: A, C
Explanation: Opening a Google Cloud support case is the appropriate way to get authoritative guidance on how published Linux CVEs may affect your migration. Google Cloud Platform Security Bulletins are the official source for Google Cloud's assessment and mitigation information related to security vulnerabilities. The Google Cloud Status Dashboard is for service availability, not CVE analysis, and community forums such as Stack Overflow or discussion groups are not authoritative sources for security impact assessment.
$19
Get all 306 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.