Professional Cloud Architect Free Practice Questions — Page 11
Question 105
For this question, refer to the TerramEarth case study. You have broken down a legacy monolithic application into a few containerized RESTful microservices.
You want to run those microservices on Cloud Run. You also want to make sure the services are highly available with low latency to your customers. What should you do?
A. Deploy Cloud Run services to multiple availability zones. Create Cloud Endpoints that point to the services. Create a global HTTP(S) Load Balancing instance and attach the Cloud Endpoints to its backend.
B. Deploy Cloud Run services to multiple regions. Create serverless network endpoint groups pointing to the services. Add the serverless NEGs to a backend service that is used by a global HTTP(S) Load Balancing instance.
C. Deploy Cloud Run services to multiple regions. In Cloud DNS, create a latency-based DNS name that points to the services.
D. Deploy Cloud Run services to multiple availability zones. Create a TCP/IP global load balancer. Add the Cloud Run Endpoints to its backend service.
Show Answer
Correct Answer: B
Explanation: Cloud Run is a regional service. For high availability and low latency, deploy the services in multiple regions and use a global external HTTP(S) Load Balancer with serverless Network Endpoint Groups (NEGs) that point to the regional Cloud Run services. This provides global routing to the nearest healthy backend. Cloud Endpoints is an API management product, not a load balancer backend, Cloud DNS latency-based routing is not the recommended pattern for Cloud Run multi-region traffic management, and Cloud Run is not deployed by availability zone nor behind a TCP load balancer.
Question 106
For this question, refer to the TerramEarth case study. You start to build a new application that uses a few Cloud Functions for the backend. One use case requires a Cloud Function func_display to invoke another Cloud Function func_query. You want func_query only to accept invocations from func_display. You also want to follow Google's recommended best practices. What should you do?
A. Create a token and pass it in as an environment variable to func_display. When invoking func_query, include the token in the request. Pass the same token to func_query and reject the invocation if the tokens are different.
B. Make func_query 'Require authentication.' Create a unique service account and associate it to func_display. Grant the service account invoker role for func_query. Create an id token in func_display and include the token to the request when invoking func_query.
C. Make func_query 'Require authentication' and only accept internal traffic. Create those two functions in the same VP Create an ingress firewall rule for func_query to only allow traffic from func_display.
D. Create those two functions in the same project and VPC. Make func_query only accept internal traffic. Create an ingress firewall for func_query to only allow traffic from func_display. Also, make sure both functions use the same service account.
Show Answer
Correct Answer: B
Explanation: The recommended Google Cloud pattern for function-to-function invocation is IAM-based authentication. Configure the target function to require authentication, assign a dedicated service account to the calling function, grant that service account the Cloud Functions Invoker role on the target function, and have the calling function generate and send a Google-signed ID token when invoking the target. This follows least privilege and avoids shared secrets or network-based controls as the primary security mechanism.
Question 107
You are working at an institution that processes medical data. You are migrating several workloads onto Google Cloud. Company policies require all workloads to run on physically separated hardware, and workloads from different clients must also be separated. You created a sole-tenant node group and added a node for each client. You need to deploy the workloads on these dedicated hosts. What should you do?
A. Add the node group name as a network tag when creating Compute Engine instances in order to host each workload on the correct node group.
B. Add the node name as a network tag when creating Compute Engine instances in order to host each workload on the correct node.
C. Use node affinity labels based on the node group name when creating Compute Engine instances in order to host each workload on the correct node group.
D. Use node affinity labels based on the node name when creating Compute Engine instances in order to host each workload on the correct node.
Show Answer
Correct Answer: D
Explanation: Sole-tenant placement is controlled with node affinity labels, not network tags. Because the node group contains one node per client and each client's workloads must be pinned to that specific dedicated host, use the default node affinity label based on the individual node name (compute.googleapis.com/node-name). A node-group affinity would allow placement on any node in the group, which does not satisfy per-client node assignment.
Question 108
You are migrating third-party applications from optimized on-premises virtual machines to Google Cloud. You are unsure about the optimum CPU and memory options. The applications have a consistent usage pattern across multiple weeks. You want to optimize resource usage for the lowest cost. What should you do?
A. Create an instance template with the smallest available machine type, and use an image of the third-party application taken from a current on-premises virtual machine. Create a managed instance group that uses average CPU utilization to autoscale the number of instances in the group. Modify the average CPU utilization threshold to optimize the number of instances running.
B. Create an App Engine flexible environment, and deploy the third-party application using a Dockerfile and a custom runtime. Set CPU and memory options similar to your application's current on-premises virtual machine in the app.yaml file.
C. Create multiple Compute Engine instances with varying CPU and memory options. Install the Cloud Monitoring agent, and deploy the third-party application on each of them. Run a load test with high traffic levels on the application, and use the results to determine the optimal settings.
D. Create a Compute Engine instance with CPU and memory options similar to your application's current on-premises virtual machine. Install the Cloud Monitoring agent, and deploy the third-party application. Run a load test with normal traffic levels on the application, and follow the Rightsizing Recommendations in the Cloud Console.
Show Answer
Correct Answer: D
Explanation: For a workload with consistent usage patterns over multiple weeks, the recommended approach is to migrate to a Compute Engine instance, monitor actual resource usage, and use Compute Engine Rightsizing Recommendations to optimize CPU and memory for the lowest cost. Option A assumes horizontal autoscaling and only targets CPU utilization. Option B changes the deployment model unnecessarily. Option C is more expensive and manual than using Google's built-in rightsizing recommendations.
Question 109
For this question, refer to the TerramEarth case study. TerramEarth has about 1 petabyte (PB) of vehicle testing data in a private data center. You want to move the data to Cloud Storage for your machine learning team. Currently, a 1-Gbps interconnect link is available for you. The machine learning team wants to start using the data in a month. What should you do?
A. Request Transfer Appliances from Google Cloud, export the data to appliances, and return the appliances to Google Cloud.
B. Configure the Storage Transfer service from Google Cloud to send the data from your data center to Cloud Storage.
C. Make sure there are no other users consuming the 1Gbps link, and use multi-thread transfer to upload the data to Cloud Storage.
D. Export files to an encrypted USB device, send the device to Google Cloud, and request an import of the data to Cloud Storage.
Show Answer
Correct Answer: A
Explanation: Use Google Cloud Transfer Appliance for approximately 1 PB of on-premises data when network bandwidth (1 Gbps) is insufficient to meet a one-month deadline. A sustained 1 Gbps transfer of 1 PB would take roughly three months or more under ideal conditions, while Transfer Appliance is designed for large-scale offline migrations. Storage Transfer Service is not the best fit for this time-constrained bulk migration from a private data center, and exporting to a generic USB device is not a supported solution.
Question 110
Your team needs to create a Google Kubernetes Engine (GKE) cluster to host a newly built application that requires access to third-party services on the internet.
Your company does not allow any Compute Engine instance to have a public IP address on Google Cloud. You need to create a deployment strategy that adheres to these guidelines. What should you do?
A. Configure the GKE cluster as a private cluster, and configure Cloud NAT Gateway for the cluster subnet.
B. Configure the GKE cluster as a private cluster. Configure Private Google Access on the Virtual Private Cloud (VPC).
C. Configure the GKE cluster as a route-based cluster. Configure Private Google Access on the Virtual Private Cloud (VPC).
D. Create a Compute Engine instance, and install a NAT Proxy on the instance. Configure all workloads on GKE to pass through this proxy to access third-party services on the Internet.
Show Answer
Correct Answer: A
Explanation: A private GKE cluster ensures nodes do not have public IP addresses. To allow workloads on private nodes to access third-party services on the public internet while keeping nodes private, configure Cloud NAT for outbound internet access. Private Google Access only enables access to Google APIs and services, not arbitrary third-party internet endpoints. A self-managed NAT proxy on a Compute Engine VM is unnecessary and less reliable than the managed Cloud NAT service.
Question 111
Your organization has stored sensitive data in a Cloud Storage bucket. For regulatory reasons, your company must be able to rotate the encryption key used to encrypt the data in the bucket. The data will be processed in Dataproc. You want to follow Google-recommended practices for security. What should you do?
A. Create a key with Cloud Key Management Service (KMS). Encrypt the data using the encrypt method of Cloud KMS.
B. Create a key with Cloud Key Management Service (KMS). Set the encryption key on the bucket to the Cloud KMS key.
C. Generate a GPG key pair. Encrypt the data using the GPG key. Upload the encrypted data to the bucket.
D. Generate an AES-256 encryption key. Encrypt the data in the bucket using the customer-supplied encryption keys feature.
Show Answer
Correct Answer: B
Explanation: Use a Cloud KMS customer-managed encryption key (CMEK) for the Cloud Storage bucket. This is the Google-recommended approach for encrypting Cloud Storage data when you need customer-controlled key management and rotation. Dataproc integrates with CMEK-protected Cloud Storage. Options A and C perform application-level encryption instead of using Cloud Storage's integrated encryption. Option D uses customer-supplied encryption keys (CSEK), which are not the recommended approach and place key management burden on the customer.
Question 112
You are designing a Data Warehouse on Google Cloud and want to store sensitive data in BigQuery. Your company requires you to generate the encryption keys outside of Google Cloud. You need to implement a solution. What should you do?
A. Generate a new key in Cloud Key Management Service (Cloud KMS). Store all data in Cloud Storage using the customer-managed key option and select the created key. Set up a Dataflow pipeline to decrypt the data and to store it in a new BigQuery dataset.
B. Generate a new key in Cloud KMS. Create a dataset in BigQuery using the customer-managed key option and select the created key.
C. Import a key in Cloud KMS. Store all data in Cloud Storage using the customer-managed key option and select the created key. Set up a Dataflow pipeline to decrypt the data and to store it in a new BigQuery dataset.
D. Import a key in Cloud KMS. Create a dataset in BigQuery using the customer-supplied key option and select the created key.
Show Answer
Correct Answer: C
Explanation: The requirement is that the encryption keys be generated outside Google Cloud. BigQuery supports customer-managed encryption keys (CMEK) from Cloud KMS, including imported key material (EKM/imported keys), but it does not support customer-supplied encryption keys (CSEK). Therefore, generate the key externally, import it into Cloud KMS, and use it as a CMEK. Among the provided options, C is the only one that starts with an imported key; D is incorrect because it refers to customer-supplied keys, which BigQuery does not support. The Dataflow/decryption part is unnecessary in practice, but C is the closest valid choice given the options.
Sources:
https://docs.cloud.google.com/bigquery/docs/release-notes
Question 113
Your company has an application running as a Deployment in a Google Kubernetes Engine (GKE) cluster. You have separate clusters for development, staging, and production. You have discovered that the team is able to deploy a Docker image to the production cluster without first testing the deployment in development and then staging. You want to allow the team to have autonomy but want to prevent this from happening. You want a Google Cloud solution that can be implemented quickly with minimal effort. What should you do?
A. Configure a Kubernetes lifecycle hook to prevent the container from starting if it is not approved for usage in the given environment.
B. Implement a corporate policy to prevent teams from deploying Docker images to an environment unless the Docker image was tested in an earlier environment.
C. Configure binary authorization policies for the development, staging, and production clusters. Create attestations as part of the continuous integration pipeline.
D. Create a Kubernetes admissions controller to prevent the container from starting if it is not approved for usage in the given environment.
Show Answer
Correct Answer: C
Explanation: Binary Authorization is the Google Cloud feature designed to enforce deployment policies for container images in GKE. By requiring attestations generated during the CI pipeline after successful testing in development and staging, production can be configured to admit only images that have passed the required promotion process. This is a managed solution that requires much less effort than building a custom admission controller. Lifecycle hooks do not enforce deployment policy, and a corporate policy alone is not a technical enforcement mechanism.
Question 114
An application development team has come to you for advice. They are planning to write and deploy an HTTP(S) API using Go 1.12. The API will have a very unpredictable workload and must remain reliable during peaks in traffic. They want to minimize operational overhead for this application. Which approach should you recommend?
A. Develop the application with containers, and deploy to Google Kubernetes Engine.
B. Develop the application for App Engine standard environment.
C. Use a Managed Instance Group when deploying to Compute Engine.
D. Develop the application for App Engine flexible environment, using a custom runtime.
Show Answer
Correct Answer: B
Explanation: App Engine Standard supports Go 1.12 and is designed for fully managed deployment with automatic scaling that can rapidly handle unpredictable traffic while minimizing operational overhead. GKE, Managed Instance Groups, and App Engine Flexible all require more infrastructure management or are less optimized for this use case.
$19
Get all 306 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.