Professional Cloud Architect Free Practice Questions — Page 10
Question 84
Your company is developing a web-based application. You need to make sure that production deployments are linked to source code commits and are fully auditable. What should you do?
A. Make sure a developer is tagging the code commit with the date and time of commit.
B. Make sure a developer is adding a comment to the commit that links to the deployment.
C. Make the container tag match the source code commit hash.
D. Make sure the developer is tagging the commits with latest.
Show Answer
Correct Answer: C
Explanation: To ensure production deployments are fully auditable and traceable to source code, you need an immutable, automated link between what is deployed and the exact code version. Tagging the built container image with the Git commit hash achieves this: each deployment can be traced directly back to a specific, immutable commit in the repository. Manual approaches like adding comments or tags such as dates or `latest` are error‑prone and not reliably auditable. Using the commit hash provides a precise, automated, and industry‑standard audit trail.
Question 85
Your company is designing its data lake on Google Cloud and wants to develop different ingestion pipelines to collect unstructured data from different sources.
After the data is stored in Google Cloud, it will be processed in several data pipelines to build a recommendation engine for end users on the website. The structure of the data retrieved from the source systems can change at any time. The data must be stored exactly as it was retrieved for reprocessing purposes in case the data structure is incompatible with the current processing pipelines. You need to design an architecture to support the use case after you retrieve the data. What should you do?
A. Send the data through the processing pipeline, and then store the processed data in a BigQuery table for reprocessing.
B. Store the data in a BigQuery table. Design the processing pipelines to retrieve the data from the table.
C. Send the data through the processing pipeline, and then store the processed data in a Cloud Storage bucket for reprocessing.
D. Store the data in a Cloud Storage bucket. Design the processing pipelines to retrieve the data from the bucket.
Show Answer
Correct Answer: D
Explanation: The requirements describe a classic data lake pattern: ingest unstructured data whose schema can change, store it exactly as received, and allow reprocessing later if pipelines change. Cloud Storage is the appropriate raw data lake storage for unstructured data and schema-on-read processing. Processing pipelines should read from Cloud Storage so the original raw data is preserved. BigQuery requires structured data and would not preserve raw formats as-is.
Question 87
You have deployed an application on Anthos clusters (formerly Anthos GKE). According to the SRE practices at your company, you need to be alerted if request latency is above a certain threshold for a specified amount of time. What should you do?
A. Install Anthos Service Mesh on your cluster. Use the Google Cloud Console to define a Service Level Objective (SLO), and create an alerting policy based on this SLO.
B. Enable the Cloud Trace API on your project, and use Cloud Monitoring Alerts to send an alert based on the Cloud Trace metrics.
C. Use Cloud Profiler to follow up the request latency. Create a custom metric in Cloud Monitoring based on the results of Cloud Profiler, and create an Alerting policy in case this metric exceeds the threshold.
D. Configure Anthos Config Management on your cluster, and create a yaml file that defines the SLO and alerting policy you want to deploy in your cluster.
Show Answer
Correct Answer: A
Explanation: SRE practices require defining SLOs and alerting when they are violated over time (error budgets). Anthos Service Mesh integrates with Cloud Monitoring to define latency-based SLOs and automatically create alerting policies that trigger when the SLO is at risk or violated. Cloud Trace and Cloud Profiler are diagnostic tools, not intended for SLO-based alerting, and Anthos Config Management does not provide runtime latency monitoring or alerting.
Question 88
Your company has an enterprise application running on Compute Engine that requires high availability and high performance. The application has been deployed on two instances in two zones in the same region in active-passive mode. The application writes data to a persistent disk. In the case of a single zone outage, that data should be immediately made available to the other instance in the other zone. You want to maximize performance while minimizing downtime and data loss.
What should you do?
A. 1. Attach a persistent SSD disk to the first instance. 2. Create a snapshot every hour. 3. In case of a zone outage, recreate a persistent SSD disk in the second instance where data is coming from the created snapshot.
B. 1. Create a Cloud Storage bucket. 2. Mount the bucket into the first instance with gcs-fuse. 3. In case of a zone outage, mount the Cloud Storage bucket to the second instance with gcs-fuse.
C. 1. Attach a regional SSD persistent disk to the first instance. 2. In case of a zone outage, force-attach the disk to the other instance.
D. 1. Attach a local SSD to the first instance disk. 2. Execute an rsync command every hour where the target is a persistent SSD disk attached to the second instance. 3. In case of a zone outage, use the second instance.
Show Answer
Correct Answer: C
Explanation: The requirement is immediate data availability across zones with minimal downtime and maximum performance. Regional SSD persistent disks synchronously replicate data across two zones in a region and are designed for high availability. In a zonal failure, the disk can be force-attached to the instance in the surviving zone with no data loss. Other options either introduce significant latency (gcs-fuse), data loss windows (snapshots or rsync), or do not provide immediate failover.
Question 89
For this question, refer to the TerramEarth case study. You are building a microservice-based application for TerramEarth. The application is based on Docker containers. You want to follow Google-recommended practices to build the application continuously and store the build artifacts. What should you do?
A. Configure a trigger in Cloud Build for new source changes. Invoke Cloud Build to build container images for each microservice, and tag them using the code commit hash. Push the images to the Container Registry.
B. Configure a trigger in Cloud Build for new source changes. The trigger invokes build jobs and build container images for the microservices. Tag the images with a version number, and push them to Cloud Storage.
C. Create a Scheduler job to check the repo every minute. For any new change, invoke Cloud Build to build container images for the microservices. Tag the images using the current timestamp, and push them to the Container Registry.
D. Configure a trigger in Cloud Build for new source changes. Invoke Cloud Build to build one container image, and tag the image with the label 'latest.' Push the image to the Container Registry.
Show Answer
Correct Answer: A
Explanation: Google-recommended CI/CD practices for containerized microservices include using Cloud Build triggers on source changes, building images automatically, tagging images immutably with the Git commit hash for traceability, and storing them in a dedicated container image service (Container Registry/Artifact Registry). Option A follows all of these practices. The other options use non-recommended tagging strategies (latest, timestamps), polling via Scheduler, or an inappropriate storage backend (Cloud Storage).
Question 90
For this question, refer to the TerramEarth case study. TerramEarth has a legacy web application that you cannot migrate to cloud. However, you still want to build a cloud-native way to monitor the application. If the application goes down, you want the URL to point to a "Site is unavailable" page as soon as possible. You also want your Ops team to receive a notification for the issue. You need to build a reliable solution for minimum cost. What should you do?
A. Create a scheduled job in Cloud Run to invoke a container every minute. The container will check the application URL. If the application is down, switch the URL to the "Site is unavailable" page, and notify the Ops team.
B. Create a cron job on a Compute Engine VM that runs every minute. The cron job invokes a Python program to check the application URL. If the application is down, switch the URL to the "Site is unavailable" page, and notify the Ops team.
C. Create a Cloud Monitoring uptime check to validate the application URL. If it fails, put a message in a Pub/Sub queue that triggers a Cloud Function to switch the URL to the "Site is unavailable" page, and notify the Ops team.
D. Use Cloud Error Reporting to check the application URL. If the application is down, switch the URL to the "Site is unavailable" page, and notify the Ops team.
Show Answer
Correct Answer: C
Explanation: Cloud Monitoring uptime checks can monitor external/on‑premises URLs without installing agents. They are purpose‑built, highly reliable, and low cost compared to custom polling jobs. An uptime check can trigger an alert that publishes to Pub/Sub, which in turn invokes a Cloud Function to switch traffic to a "Site is unavailable" page and notify Ops. This is fully cloud‑native, event‑driven (runs only on failure), and cheaper and more reliable than running scheduled containers or VMs. Cloud Error Reporting is not designed for availability checks.
Question 91
For this question, refer to the TerramEarth case study. You are migrating a Linux-based application from your private data center to Google Cloud. The
TerramEarth security team sent you several recent Linux vulnerabilities published by Common Vulnerabilities and Exposures (CVE). You need assistance in understanding how these vulnerabilities could impact your migration. What should you do? (Choose two.)
A. Open a support case regarding the CVE and chat with the support engineer.
B. Read the CVEs from the Google Cloud Status Dashboard to understand the impact.
C. Read the CVEs from the Google Cloud Platform Security Bulletins to understand the impact.
D. Post a question regarding the CVE in Stack Overflow to get an explanation.
E. Post a question regarding the CVE in a Google Cloud discussion group to get an explanation.
Show Answer
Correct Answer: A, C
Explanation: To understand how published Linux CVEs affect a migration to Google Cloud, you should use official Google resources and support. Google Cloud Platform Security Bulletins document relevant vulnerabilities, their impact, and mitigations for Google-managed services. If clarification is still needed, opening a support case allows you to discuss the CVEs directly with a Google support engineer. The Status Dashboard is not for CVE details, and community forums or Stack Overflow are not authoritative sources for security impact assessment.
Question 92
For this question, refer to the TerramEarth case study. You have broken down a legacy monolithic application into a few containerized RESTful microservices.
You want to run those microservices on Cloud Run. You also want to make sure the services are highly available with low latency to your customers. What should you do?
A. Deploy Cloud Run services to multiple availability zones. Create Cloud Endpoints that point to the services. Create a global HTTP(S) Load Balancing instance and attach the Cloud Endpoints to its backend.
B. Deploy Cloud Run services to multiple regions. Create serverless network endpoint groups pointing to the services. Add the serverless NEGs to a backend service that is used by a global HTTP(S) Load Balancing instance.
C. Deploy Cloud Run services to multiple regions. In Cloud DNS, create a latency-based DNS name that points to the services.
D. Deploy Cloud Run services to multiple availability zones. Create a TCP/IP global load balancer. Add the Cloud Run Endpoints to its backend service.
Show Answer
Correct Answer: B
Explanation: Cloud Run is a regional service, so to achieve high availability and low latency for global users you must deploy the services in multiple regions. A global HTTP(S) Load Balancer with serverless Network Endpoint Groups (NEGs) as backends is the supported way to route traffic to Cloud Run across regions, providing global anycast IPs, health checking, and latency-based routing. Other options either use unsupported backends (Cloud Endpoints), incorrect load balancer types, or DNS-only routing without integrated health checks and fast failover.
Question 93
For this question, refer to the TerramEarth case study. You start to build a new application that uses a few Cloud Functions for the backend. One use case requires a Cloud Function func_display to invoke another Cloud Function func_query. You want func_query only to accept invocations from func_display. You also want to follow Google's recommended best practices. What should you do?
A. Create a token and pass it in as an environment variable to func_display. When invoking func_query, include the token in the request. Pass the same token to func_query and reject the invocation if the tokens are different.
B. Make func_query 'Require authentication.' Create a unique service account and associate it to func_display. Grant the service account invoker role for func_query. Create an id token in func_display and include the token to the request when invoking func_query.
C. Make func_query 'Require authentication' and only accept internal traffic. Create those two functions in the same VP Create an ingress firewall rule for func_query to only allow traffic from func_display.
D. Create those two functions in the same project and VPC. Make func_query only accept internal traffic. Create an ingress firewall for func_query to only allow traffic from func_display. Also, make sure both functions use the same service account.
Show Answer
Correct Answer: B
Explanation: Google-recommended best practice for securing Cloud Function-to-Cloud Function calls is IAM-based authentication and authorization. You should require authentication on the receiving function, grant the Cloud Functions Invoker role to the calling function’s dedicated service account, and have the calling function generate and send a Google-signed ID token with the correct audience. This ensures only the intended function can invoke it without relying on shared secrets or network-only controls.
Question 94
You are working at an institution that processes medical data. You are migrating several workloads onto Google Cloud. Company policies require all workloads to run on physically separated hardware, and workloads from different clients must also be separated. You created a sole-tenant node group and added a node for each client. You need to deploy the workloads on these dedicated hosts. What should you do?
A. Add the node group name as a network tag when creating Compute Engine instances in order to host each workload on the correct node group.
B. Add the node name as a network tag when creating Compute Engine instances in order to host each workload on the correct node.
C. Use node affinity labels based on the node group name when creating Compute Engine instances in order to host each workload on the correct node group.
D. Use node affinity labels based on the node name when creating Compute Engine instances in order to host each workload on the correct node.
Show Answer
Correct Answer: D
Explanation: Sole-tenant nodes support node affinity labels at both the node group and individual node level. In this scenario, a single node group was created and a separate node was added for each client, meaning client isolation is enforced at the individual node level, not the group level. To ensure each client’s workloads are placed on their specific dedicated physical host, you must use node affinity labels based on the node name. Network tags do not control VM placement, and node-group affinity would allow workloads to land on any node within the group, which would not guarantee per-client separation.
$19
Get all 305 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.