Professional Cloud Architect Free Practice Questions — Page 12
Question 105
Your company has a Google Cloud project that uses BigQuery for data warehousing. They have a VPN tunnel between the on-premises environment and Google
Cloud that is configured with Cloud VPN. The security team wants to avoid data exfiltration by malicious insiders, compromised code, and accidental oversharing.
What should they do?
A. Configure Private Google Access for on-premises only.
B. Perform the following tasks: 1. Create a service account. 2. Give the BigQuery JobUser role and Storage Reader role to the service account. 3. Remove all other IAM access from the project.
C. Configure VPC Service Controls and configure Private Google Access.
D. Configure Private Google Access.
Show Answer
Correct Answer: C
Explanation: VPC Service Controls are specifically designed to mitigate data exfiltration risks from Google-managed services like BigQuery by creating a service perimeter that blocks access from unauthorized networks, stolen credentials, malicious insiders, compromised code, and accidental oversharing. Private Google Access complements this by ensuring traffic to Google APIs stays on Google’s network. Together, they address the stated security concerns. Other options do not provide exfiltration protection for BigQuery.
Question 106
Your company is planning to upload several important files to Cloud Storage. After the upload is completed, they want to verify that the uploaded content is identical to what they have on-premises. You want to minimize the cost and effort of performing this check. What should you do?
A. 1. Use Linux shasum to compute a digest of files you want to upload. 2. Use gsutil -m to upload all the files to Cloud Storage. 3. Use gsutil cp to download the uploaded files. 4. Use Linux shasum to compute a digest of the downloaded files. 5. Compare the hashes.
B. 1. Use gsutil -m to upload the files to Cloud Storage. 2. Develop a custom Java application that computes CRC32C hashes. 3. Use gsutil ls -L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files. 4. Compare the hashes.
C. 1. Use gsutil -m to upload all the files to Cloud Storage. 2. Use gsutil cp to download the uploaded files. 3. Use Linux diff to compare the content of the files.
D. 1. Use gsutil -m to upload the files to Cloud Storage. 2. Use gsutil hash -c FILE_NAME to generate CRC32C hashes of all on-premises files. 3. Use gsutil ls -L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files. 4. Compare the hashes.
Show Answer
Correct Answer: D
Explanation: The goal is to verify data integrity after upload with minimal cost and effort. Cloud Storage already stores CRC32C hashes for objects, which can be listed using gsutil ls -L without downloading data. Using gsutil hash -c on local (on‑premises) files generates matching CRC32C hashes, allowing a direct comparison. This avoids downloading files (which adds cost and time) and avoids custom code. Therefore, option D is the most efficient and correct approach.
Question 107
For this question, refer to the EHR Healthcare case study. You are responsible for designing the Google Cloud network architecture for Google Kubernetes
Engine. You want to follow Google best practices. Considering the EHR Healthcare business and technical requirements, what should you do to reduce the attack surface?
A. Use a private cluster with a private endpoint with master authorized networks configured.
B. Use a public cluster with firewall rules and Virtual Private Cloud (VPC) routes.
C. Use a private cluster with a public endpoint with master authorized networks configured.
D. Use a public cluster with master authorized networks enabled and firewall rules.
Show Answer
Correct Answer: A
Explanation: To reduce the attack surface and follow Google best practices, the control plane should not be exposed to the public internet. A private GKE cluster with a private endpoint ensures that both the nodes and the Kubernetes API server are reachable only via internal IPs. Configuring master authorized networks further restricts control-plane access to explicitly allowed CIDR ranges. This combination minimizes external exposure of the control plane while still allowing secure administration over private connectivity (such as VPN or Interconnect), making it the most secure option among the choices.
Question 108
For this question, refer to the EHR Healthcare case study. In the past, configuration errors put public IP addresses on backend servers that should not have been accessible from the Internet. You need to ensure that no one can put external IP addresses on backend Compute Engine instances and that external IP addresses can only be configured on frontend Compute Engine instances. What should you do?
A. Create an Organizational Policy with a constraint to allow external IP addresses only on the frontend Compute Engine instances.
B. Revoke the compute.networkAdmin role from all users in the project with front end instances.
C. Create an Identity and Access Management (IAM) policy that maps the IT staff to the compute.networkAdmin role for the organization.
D. Create a custom Identity and Access Management (IAM) role named GCE_FRONTEND with the compute.addresses.create permission.
Show Answer
Correct Answer: A
Explanation: The requirement is to technically prevent external IPs from being attached to backend instances while still allowing them on frontend instances. Google Cloud Organization Policy Service provides constraints (such as restricting external IP usage) that can be scoped using projects, folders, or resource tags to allow external IPs only on approved frontend VMs. IAM role changes or custom roles do not enforce configuration constraints on resources themselves and cannot reliably prevent misconfiguration. Therefore, using an Organizational Policy is the correct and recommended approach.
Question 109
For this question, refer to the EHR Healthcare case study. You are a developer on the EHR customer portal team. Your team recently migrated the customer portal application to Google Cloud. The load has increased on the application servers, and now the application is logging many timeout errors. You recently incorporated Pub/Sub into the application architecture, and the application is not logging any Pub/Sub publishing errors. You want to improve publishing latency.
What should you do?
A. Increase the Pub/Sub Total Timeout retry value.
B. Move from a Pub/Sub subscriber pull model to a push model.
C. Turn off Pub/Sub message batching.
D. Create a backup Pub/Sub message queue.
Show Answer
Correct Answer: C
Explanation: The issue is publishing latency, not subscriber delivery or publish failures. In Pub/Sub, publisher-side message batching trades latency for throughput: messages wait in memory until a batch is filled or a delay threshold is reached. Under higher load, this queuing can increase per-message publish latency and contribute to application timeouts even without Pub/Sub errors. Disabling batching sends messages immediately, reducing publish latency. Subscriber push/pull models and retry timeout settings do not affect publisher-side latency, and a backup queue is irrelevant.
Question 110
You need to upgrade the EHR connection to comply with their requirements. The new connection design must support business-critical needs and meet the same network and security policy requirements. What should you do?
A. Add a new Dedicated Interconnect connection.
B. Upgrade the bandwidth on the Dedicated Interconnect connection to 100 G.
C. Add three new Cloud VPN connections.
D. Add a new Carrier Peering connection.
Show Answer
Correct Answer: A
Explanation: To meet business-critical and security requirements, you must maintain the same Dedicated Interconnect design and SLA. Existing Dedicated Interconnect links cannot be upgraded in place from one link type or capacity tier to another (for example, 10 Gbps to 100 Gbps). Instead, Google Cloud requires provisioning a new Dedicated Interconnect connection and migrating traffic to it. Cloud VPN does not meet the same performance/SLA needs, and Carrier Peering does not provide an SLA for GCP workloads.
Question 111
Your company has a Kubernetes application that pulls messages from Pub/Sub and stores them in Filestore. Because the application is simple, it was deployed as a single pod. The infrastructure team has analyzed Pub/Sub metrics and discovered that the application cannot process the messages in real time. Most of them wait for minutes before being processed. You need to scale the elaboration process that is I/O-intensive. What should you do?
A. Use kubectl autoscale deployment APP_NAME --max 6 --min 2 --cpu-percent 50 to configure Kubernetes autoscaling deployment.
B. Configure a Kubernetes autoscaling deployment based on the subscription/push_request_latencies metric.
C. Use the --enable-autoscaling flag when you create the Kubernetes cluster.
D. Configure a Kubernetes autoscaling deployment based on the subscription/num_undelivered_messages metric.
Show Answer
Correct Answer: D
Explanation: The bottleneck is message backlog in Pub/Sub, not CPU. For an I/O‑intensive pull subscriber, the correct way to scale is based on how many messages are waiting to be processed. The subscription/num_undelivered_messages metric directly reflects backlog and can be used as an external metric for a Kubernetes Horizontal Pod Autoscaler. CPU-based autoscaling (A) is ineffective for I/O-bound workloads, push latency metrics (B) are irrelevant for pull subscribers, and enabling cluster autoscaling (C) does not scale pods based on workload demand.
Question 113
You are developing an application using different microservices that should remain internal to the cluster. You want to be able to configure each microservice with a specific number of replicas. You also want to be able to address a specific microservice from any other microservice in a uniform way, regardless of the number of replicas the microservice scales to. You need to implement this solution on Google Kubernetes Engine. What should you do?
A. Deploy each microservice as a Deployment. Expose the Deployment in the cluster using a Service, and use the Service DNS name to address it from other microservices within the cluster.
B. Deploy each microservice as a Deployment. Expose the Deployment in the cluster using an Ingress, and use the Ingress IP address to address the Deployment from other microservices within the cluster.
C. Deploy each microservice as a Pod. Expose the Pod in the cluster using a Service, and use the Service DNS name to address the microservice from other microservices within the cluster.
D. Deploy each microservice as a Pod. Expose the Pod in the cluster using an Ingress, and use the Ingress IP address name to address the Pod from other microservices within the cluster.
Show Answer
Correct Answer: A
Explanation: Deployments let you define and scale a specific number of replicas for each microservice. A Kubernetes Service provides a stable virtual IP and DNS name that load-balances traffic across the replicas and remains internal to the cluster. Other microservices can reliably address the service via its DNS name regardless of how many replicas are running. Ingress is for external HTTP(S) access, and individual Pods are not appropriate for replica management.
Question 114
Your company has a networking team and a development team. The development team runs applications on Compute Engine instances that contain sensitive data. The development team requires administrative permissions for Compute Engine. Your company requires all network resources to be managed by the networking team. The development team does not want the networking team to have access to the sensitive data on the instances. What should you do?
A. 1. Create a project with a standalone VPC and assign the Network Admin role to the networking team. 2. Create a second project with a standalone VPC and assign the Compute Admin role to the development team. 3. Use Cloud VPN to join the two VPCs.
B. 1. Create a project with a standalone Virtual Private Cloud (VPC), assign the Network Admin role to the networking team, and assign the Compute Admin role to the development team.
C. 1. Create a project with a Shared VPC and assign the Network Admin role to the networking team. 2. Create a second project without a VPC, configure it as a Shared VPC service project, and assign the Compute Admin role to the development team.
D. 1. Create a project with a standalone VPC and assign the Network Admin role to the networking team. 2. Create a second project with a standalone VPC and assign the Compute Admin role to the development team. 3. Use VPC Peering to join the two VPCs.
Show Answer
Correct Answer: C
Explanation: The requirement is to strictly separate network administration from compute administration while still allowing applications to run on shared network resources. In a single project (option B), the Compute Admin role includes compute.network.* permissions, which would allow the development team to modify networking resources—violating the requirement that only the networking team manages networks. Shared VPC is designed for this exact scenario: the networking team controls the VPC in a host project, while the development team manages Compute Engine instances in a service project that has no VPC of its own. This ensures the networking team cannot access instance data, and the development team cannot manage network resources.
Question 115
You need to deploy an application on Google Cloud that must run on a Debian Linux environment. The application requires extensive configuration in order to operate correctly. You want to ensure that you can install Debian distribution updates with minimal manual intervention whenever they become available. What should you do?
A. Create a Compute Engine instance template using the most recent Debian image. Create an instance from this template, and install and configure the application as part of the startup script. Repeat this process whenever a new Google-managed Debian image becomes available.
B. Create a Debian-based Compute Engine instance, install and configure the application, and use OS patch management to install available updates.
C. Create an instance with the latest available Debian image. Connect to the instance via SSH, and install and configure the application on the instance. Repeat this process whenever a new Google-managed Debian image becomes available.
D. Create a Docker container with Debian as the base image. Install and configure the application as part of the Docker image creation process. Host the container on Google Kubernetes Engine and restart the container whenever a new update is available.
Show Answer
Correct Answer: B
Explanation: The key requirement is to install Debian distribution (OS) updates with minimal manual intervention on a Debian environment that has extensive, one-time application configuration. Google Compute Engine OS Patch Management is designed exactly for this use case: it automates ongoing OS security and distribution updates on long‑running Debian VMs without rebuilding instances or reconfiguring applications. Options A and C require recreating instances whenever new images are released, which is manual and disruptive. Option D focuses on containers and image rebuilds, not automatic Debian OS updates. Therefore, using OS patch management on a configured Debian VM is the correct choice.
$19
Get all 305 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.