Professional Cloud Architect Free Practice Questions — Page 11
Question 95
You are migrating third-party applications from optimized on-premises virtual machines to Google Cloud. You are unsure about the optimum CPU and memory options. The applications have a consistent usage pattern across multiple weeks. You want to optimize resource usage for the lowest cost. What should you do?
A. Create an instance template with the smallest available machine type, and use an image of the third-party application taken from a current on-premises virtual machine. Create a managed instance group that uses average CPU utilization to autoscale the number of instances in the group. Modify the average CPU utilization threshold to optimize the number of instances running.
B. Create an App Engine flexible environment, and deploy the third-party application using a Dockerfile and a custom runtime. Set CPU and memory options similar to your application's current on-premises virtual machine in the app.yaml file.
C. Create multiple Compute Engine instances with varying CPU and memory options. Install the Cloud Monitoring agent, and deploy the third-party application on each of them. Run a load test with high traffic levels on the application, and use the results to determine the optimal settings.
D. Create a Compute Engine instance with CPU and memory options similar to your application's current on-premises virtual machine. Install the Cloud Monitoring agent, and deploy the third-party application. Run a load test with normal traffic levels on the application, and follow the Rightsizing Recommendations in the Cloud Console.
Show Answer
Correct Answer: D
Explanation: The goal is to find optimal CPU and memory at the lowest cost for workloads with consistent usage over weeks. Using a Compute Engine instance with monitoring and then applying Rightsizing Recommendations leverages historical CPU and memory utilization to provide cost-optimized machine type recommendations. This is specifically designed for steady workloads and avoids overprovisioning without unnecessary load testing or architectural changes.
Question 96
For this question, refer to the TerramEarth case study. TerramEarth has about 1 petabyte (PB) of vehicle testing data in a private data center. You want to move the data to Cloud Storage for your machine learning team. Currently, a 1-Gbps interconnect link is available for you. The machine learning team wants to start using the data in a month. What should you do?
A. Request Transfer Appliances from Google Cloud, export the data to appliances, and return the appliances to Google Cloud.
B. Configure the Storage Transfer service from Google Cloud to send the data from your data center to Cloud Storage.
C. Make sure there are no other users consuming the 1Gbps link, and use multi-thread transfer to upload the data to Cloud Storage.
D. Export files to an encrypted USB device, send the device to Google Cloud, and request an import of the data to Cloud Storage.
Show Answer
Correct Answer: A
Explanation: You need to move 1 PB of data within about one month, but only have a 1‑Gbps network link. At 1 Gbps, transferring 1 PB over the network would take roughly 90–120 days under ideal conditions, which is far too slow. Google Cloud Transfer Appliance is specifically designed for very large, time‑constrained, on‑premises data migrations (tens of TB to PB scale) and avoids network bandwidth limitations. Storage Transfer Service and multi‑threaded uploads still rely on the same limited network link, and exporting to USB is not practical at this scale. Therefore, requesting Transfer Appliances is the correct choice.
Question 97
Your team needs to create a Google Kubernetes Engine (GKE) cluster to host a newly built application that requires access to third-party services on the internet.
Your company does not allow any Compute Engine instance to have a public IP address on Google Cloud. You need to create a deployment strategy that adheres to these guidelines. What should you do?
A. Configure the GKE cluster as a private cluster, and configure Cloud NAT Gateway for the cluster subnet.
B. Configure the GKE cluster as a private cluster. Configure Private Google Access on the Virtual Private Cloud (VPC).
C. Configure the GKE cluster as a route-based cluster. Configure Private Google Access on the Virtual Private Cloud (VPC).
D. Create a Compute Engine instance, and install a NAT Proxy on the instance. Configure all workloads on GKE to pass through this proxy to access third-party services on the Internet.
Show Answer
Correct Answer: A
Explanation: The application needs outbound access to third-party services on the public internet, while company policy forbids public IPs on Compute Engine instances. A GKE private cluster ensures nodes have no public IPs, and Cloud NAT provides controlled outbound internet access for those private nodes. Private Google Access only allows access to Google APIs and services, not general third-party internet endpoints, and the other options do not meet the requirements as cleanly or securely. Therefore, configuring a private GKE cluster with Cloud NAT is the correct approach.
Question 98
Your organization has stored sensitive data in a Cloud Storage bucket. For regulatory reasons, your company must be able to rotate the encryption key used to encrypt the data in the bucket. The data will be processed in Dataproc. You want to follow Google-recommended practices for security. What should you do?
A. Create a key with Cloud Key Management Service (KMS). Encrypt the data using the encrypt method of Cloud KMS.
B. Create a key with Cloud Key Management Service (KMS). Set the encryption key on the bucket to the Cloud KMS key.
C. Generate a GPG key pair. Encrypt the data using the GPG key. Upload the encrypted data to the bucket.
D. Generate an AES-256 encryption key. Encrypt the data in the bucket using the customer-supplied encryption keys feature.
Show Answer
Correct Answer: B
Explanation: Google-recommended practice for encrypting Cloud Storage data with key rotation requirements is to use customer-managed encryption keys (CMEK) in Cloud KMS. By setting a Cloud KMS key as the bucket’s default encryption key, you can rotate keys by creating new key versions and updating the primary version without re-encrypting data manually. This integrates seamlessly with Dataproc and avoids insecure or operationally complex approaches like client-side encryption or customer-supplied keys.
Question 99
You are designing a Data Warehouse on Google Cloud and want to store sensitive data in BigQuery. Your company requires you to generate the encryption keys outside of Google Cloud. You need to implement a solution. What should you do?
A. Generate a new key in Cloud Key Management Service (Cloud KMS). Store all data in Cloud Storage using the customer-managed key option and select the created key. Set up a Dataflow pipeline to decrypt the data and to store it in a new BigQuery dataset.
B. Generate a new key in Cloud KMS. Create a dataset in BigQuery using the customer-managed key option and select the created key.
C. Import a key in Cloud KMS. Store all data in Cloud Storage using the customer-managed key option and select the created key. Set up a Dataflow pipeline to decrypt the data and to store it in a new BigQuery dataset.
D. Import a key in Cloud KMS. Create a dataset in BigQuery using the customer-supplied key option and select the created key.
Show Answer
Correct Answer: D
Explanation: The requirement is to generate encryption keys outside Google Cloud while encrypting data stored in BigQuery. BigQuery supports Customer-Managed Encryption Keys (CMEK) via Cloud KMS, including keys that are imported into KMS (externally generated). Options A and B are invalid because they generate keys inside Google Cloud. Option C unnecessarily stages data in Cloud Storage and decrypts it before loading into BigQuery, which does not meet the goal of encrypting data at rest in BigQuery with the external key. Option D best matches the requirement by importing an externally generated key into Cloud KMS and using it to encrypt a BigQuery dataset (despite the wording confusion around CSEK vs CMEK).
Question 100
Your company has an application running as a Deployment in a Google Kubernetes Engine (GKE) cluster. You have separate clusters for development, staging, and production. You have discovered that the team is able to deploy a Docker image to the production cluster without first testing the deployment in development and then staging. You want to allow the team to have autonomy but want to prevent this from happening. You want a Google Cloud solution that can be implemented quickly with minimal effort. What should you do?
A. Configure a Kubernetes lifecycle hook to prevent the container from starting if it is not approved for usage in the given environment.
B. Implement a corporate policy to prevent teams from deploying Docker images to an environment unless the Docker image was tested in an earlier environment.
C. Configure binary authorization policies for the development, staging, and production clusters. Create attestations as part of the continuous integration pipeline.
D. Create a Kubernetes admissions controller to prevent the container from starting if it is not approved for usage in the given environment.
Show Answer
Correct Answer: C
Explanation: Binary Authorization is a native GKE feature designed to enforce image deployment policies with minimal setup. By configuring Binary Authorization policies per cluster and requiring attestations from the CI pipeline, you can ensure that only images that have passed through development and staging are allowed into production. This provides an automated, enforceable control that preserves team autonomy while preventing untested images from reaching production. The other options either rely on manual compliance, act too late in the container lifecycle, or require more custom effort to implement.
Question 101
An application development team has come to you for advice. They are planning to write and deploy an HTTP(S) API using Go 1.12. The API will have a very unpredictable workload and must remain reliable during peaks in traffic. They want to minimize operational overhead for this application. Which approach should you recommend?
A. Develop the application with containers, and deploy to Google Kubernetes Engine.
B. Develop the application for App Engine standard environment.
C. Use a Managed Instance Group when deploying to Compute Engine.
D. Develop the application for App Engine flexible environment, using a custom runtime.
Show Answer
Correct Answer: B
Explanation: The requirements are unpredictable traffic, high reliability during spikes, minimal operational overhead, and Go 1.12 support. App Engine standard environment natively supports Go 1.12, provides automatic scaling that can handle sudden traffic spikes, and can scale down to zero when idle, minimizing cost and operations. GKE and Managed Instance Groups require significantly more operational management, and App Engine flexible does not scale to zero and has higher overhead. Therefore, App Engine standard is the best fit.
Question 102
Your company has a support ticketing solution that uses App Engine Standard. The project that contains the App Engine application already has a Virtual Private
Cloud (VPC) network fully connected to the company's on-premises environment through a Cloud VPN tunnel. You want to enable the App Engine application to communicate with a database that is running in the company's on-premises environment. What should you do?
A. Configure private Google access for on-premises hosts only.
B. Configure private Google access.
C. Configure private services access.
D. Configure serverless VPC access.
Show Answer
Correct Answer: D
Explanation: App Engine Standard runs in a serverless environment that is not directly attached to a VPC. To allow it to reach private IP resources, including on‑premises databases reachable through an existing Cloud VPN, you must configure Serverless VPC Access. This creates a VPC connector that lets App Engine send traffic into the VPC and onward through the VPN tunnel. Private Google Access and Private Services Access are for accessing Google APIs/services, not on‑premises resources.
Question 103
For this question, refer to the EHR Healthcare case study. You need to define the technical architecture for hybrid connectivity between EHR's on-premises systems and Google Cloud. You want to follow Google's recommended practices for production-level applications. Considering the EHR Healthcare business and technical requirements, what should you do?
A. Configure two Partner Interconnect connections in one metro (City), and make sure the Interconnect connections are placed in different metro zones.
B. Configure two VPN connections from on-premises to Google Cloud, and make sure the VPN devices on-premises are in separate racks.
C. Configure Direct Peering between EHR Healthcare and Google Cloud, and make sure you are peering at least two Google locations.
D. Configure two Dedicated Interconnect connections in one metro (City) and two connections in another metro, and make sure the Interconnect connections are placed in different metro zones.
Show Answer
Correct Answer: D
Explanation: EHR requires a secure, high‑performance hybrid connection and the question explicitly says to follow Google’s recommended practices for production‑level applications. Google recommends a Dedicated Interconnect design with redundancy across two metros and separate metro zones to achieve production‑grade (99.99%) availability. Option D matches this reference architecture: four Dedicated Interconnects split across two metros and zones, providing maximum resilience, bandwidth, and SLA. VPN and peering do not meet performance or use‑case requirements, and a single‑metro Partner Interconnect is not Google’s recommended production topology.
Question 104
For this question, refer to the EHR Healthcare case study. You need to define the technical architecture for securely deploying workloads to Google Cloud. You also need to ensure that only verified containers are deployed using Google Cloud services. What should you do? (Choose two.)
A. Enable Binary Authorization on GKE, and sign containers as part of a CI/CD pipeline.
B. Configure Jenkins to utilize Kritis to cryptographically sign a container as part of a CI/CD pipeline.
C. Configure Container Registry to only allow trusted service accounts to create and deploy containers from the registry.
D. Configure Container Registry to use vulnerability scanning to confirm that there are no vulnerabilities before deploying the workload.
Show Answer
Correct Answer: A, D
Explanation: Binary Authorization on GKE enforces that only images with valid attestations (signatures) can be deployed, which directly ensures only verified containers run. Vulnerability scanning via Container Analysis integrates with Binary Authorization to provide security attestations based on scan results, strengthening secure deployment by preventing images with known vulnerabilities from being promoted.
$19
Get all 305 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.