Professional Cloud Architect Free Practice Questions — Page 12
Question 115
Your company has a support ticketing solution that uses App Engine Standard. The project that contains the App Engine application already has a Virtual Private
Cloud (VPC) network fully connected to the company's on-premises environment through a Cloud VPN tunnel. You want to enable the App Engine application to communicate with a database that is running in the company's on-premises environment. What should you do?
A. Configure private Google access for on-premises hosts only.
B. Configure private Google access.
C. Configure private services access.
D. Configure serverless VPC access.
Show Answer
Correct Answer: D
Explanation: App Engine Standard runs in a serverless environment that is not directly attached to your VPC. To reach private resources, including an on-premises database reachable through a Cloud VPN connected to the VPC, you configure Serverless VPC Access. Private Google Access is for reaching Google APIs/services over private networking, and Private Services Access is for private connectivity to supported Google managed services such as Cloud SQL, not on-premises databases.
Question 116
For this question, refer to the EHR Healthcare case study. You need to define the technical architecture for hybrid connectivity between EHR's on-premises systems and Google Cloud. You want to follow Google's recommended practices for production-level applications. Considering the EHR Healthcare business and technical requirements, what should you do?
A. Configure two Partner Interconnect connections in one metro (City), and make sure the Interconnect connections are placed in different metro zones.
B. Configure two VPN connections from on-premises to Google Cloud, and make sure the VPN devices on-premises are in separate racks.
C. Configure Direct Peering between EHR Healthcare and Google Cloud, and make sure you are peering at least two Google locations.
D. Configure two Dedicated Interconnect connections in one metro (City) and two connections in another metro, and make sure the Interconnect connections are placed in different metro zones.
Show Answer
Correct Answer: D
Explanation: For production-grade hybrid connectivity, Google recommends redundant Dedicated Interconnect deployments across two metros, with two connections per metro in different edge availability domains (metro zones). This provides high availability and resilient, high-performance private connectivity suitable for enterprise production workloads. VPN and Direct Peering do not meet the stated production hybrid connectivity goal, and a single-metro Partner Interconnect design is less aligned with the recommended production topology.
Question 117
For this question, refer to the EHR Healthcare case study. You need to define the technical architecture for securely deploying workloads to Google Cloud. You also need to ensure that only verified containers are deployed using Google Cloud services. What should you do? (Choose two.)
A. Enable Binary Authorization on GKE, and sign containers as part of a CI/CD pipeline.
B. Configure Jenkins to utilize Kritis to cryptographically sign a container as part of a CI/CD pipeline.
C. Configure Container Registry to only allow trusted service accounts to create and deploy containers from the registry.
D. Configure Container Registry to use vulnerability scanning to confirm that there are no vulnerabilities before deploying the workload.
Show Answer
Correct Answer: A, D
Explanation: Binary Authorization on GKE with image signing enforces that only attested (verified) containers can be deployed. Vulnerability scanning in Container Registry/Container Analysis complements this by automatically scanning images for known vulnerabilities before deployment decisions. Option B is not the standard Google-managed approach for signing (Kritis is an optional project, not the required service), and C controls who can push images rather than verifying container trustworthiness.
Sources:
https://www.marks4sure.com/professional-cloud-architect-google-cloud-certified-professional-cloud-architect-exam-questions.html
Question 118
Your company has a Google Cloud project that uses BigQuery for data warehousing. They have a VPN tunnel between the on-premises environment and Google
Cloud that is configured with Cloud VPN. The security team wants to avoid data exfiltration by malicious insiders, compromised code, and accidental oversharing.
What should they do?
A. Configure Private Google Access for on-premises only.
B. Perform the following tasks: 1. Create a service account. 2. Give the BigQuery JobUser role and Storage Reader role to the service account. 3. Remove all other IAM access from the project.
C. Configure VPC Service Controls and configure Private Google Access.
D. Configure Private Google Access.
Show Answer
Correct Answer: C
Explanation: VPC Service Controls are specifically designed to mitigate data exfiltration risks for supported Google Cloud services such as BigQuery by establishing a security perimeter. Private Google Access complements this by enabling private access to Google APIs and services without traversing the public internet. Options A and D only address private connectivity and do not provide exfiltration protection, while B is overly restrictive and does not address the stated security objective.
Question 119
Your company is planning to upload several important files to Cloud Storage. After the upload is completed, they want to verify that the uploaded content is identical to what they have on-premises. You want to minimize the cost and effort of performing this check. What should you do?
A. 1. Use Linux shasum to compute a digest of files you want to upload. 2. Use gsutil -m to upload all the files to Cloud Storage. 3. Use gsutil cp to download the uploaded files. 4. Use Linux shasum to compute a digest of the downloaded files. 5. Compare the hashes.
B. 1. Use gsutil -m to upload the files to Cloud Storage. 2. Develop a custom Java application that computes CRC32C hashes. 3. Use gsutil ls -L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files. 4. Compare the hashes.
C. 1. Use gsutil -m to upload all the files to Cloud Storage. 2. Use gsutil cp to download the uploaded files. 3. Use Linux diff to compare the content of the files.
D. 1. Use gsutil -m to upload the files to Cloud Storage. 2. Use gsutil hash -c FILE_NAME to generate CRC32C hashes of all on-premises files. 3. Use gsutil ls -L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files. 4. Compare the hashes.
Show Answer
Correct Answer: D
Explanation: Cloud Storage stores CRC32C hashes for objects, and gsutil can compute CRC32C hashes for local files with `gsutil hash -c`. Using `gsutil ls -L` retrieves the uploaded object's CRC32C, allowing a direct comparison without downloading the objects or writing custom code. This minimizes both cost and operational effort.
Question 120
For this question, refer to the EHR Healthcare case study. You are responsible for designing the Google Cloud network architecture for Google Kubernetes
Engine. You want to follow Google best practices. Considering the EHR Healthcare business and technical requirements, what should you do to reduce the attack surface?
A. Use a private cluster with a private endpoint with master authorized networks configured.
B. Use a public cluster with firewall rules and Virtual Private Cloud (VPC) routes.
C. Use a private cluster with a public endpoint with master authorized networks configured.
D. Use a public cluster with master authorized networks enabled and firewall rules.
Show Answer
Correct Answer: A
Explanation: A private GKE cluster with a private control plane endpoint minimizes exposure by removing public internet access to the control plane. Configuring master authorized networks further restricts which internal CIDR ranges can reach the private endpoint. This aligns with Google security best practices for reducing the attack surface. Options with a public control plane endpoint (C) expose more surface even if restricted, while public clusters (B, D) are less secure.
Question 121
For this question, refer to the EHR Healthcare case study. In the past, configuration errors put public IP addresses on backend servers that should not have been accessible from the Internet. You need to ensure that no one can put external IP addresses on backend Compute Engine instances and that external IP addresses can only be configured on frontend Compute Engine instances. What should you do?
A. Create an Organizational Policy with a constraint to allow external IP addresses only on the frontend Compute Engine instances.
B. Revoke the compute.networkAdmin role from all users in the project with front end instances.
C. Create an Identity and Access Management (IAM) policy that maps the IT staff to the compute.networkAdmin role for the organization.
D. Create a custom Identity and Access Management (IAM) role named GCE_FRONTEND with the compute.addresses.create permission.
Show Answer
Correct Answer: A
Explanation: Use an Organization Policy constraint to restrict external IP usage. The Compute Engine organization policy for VM external IP access can deny external IPs by default while allowing exceptions (such as frontend instances via tags or scoped policy). IAM roles control who can perform actions, not enforce which instances may have external IPs. Removing networkAdmin or creating a custom role does not prevent misconfiguration across specific backend instances.
Question 122
For this question, refer to the EHR Healthcare case study. You are a developer on the EHR customer portal team. Your team recently migrated the customer portal application to Google Cloud. The load has increased on the application servers, and now the application is logging many timeout errors. You recently incorporated Pub/Sub into the application architecture, and the application is not logging any Pub/Sub publishing errors. You want to improve publishing latency.
What should you do?
A. Increase the Pub/Sub Total Timeout retry value.
B. Move from a Pub/Sub subscriber pull model to a push model.
C. Turn off Pub/Sub message batching.
D. Create a backup Pub/Sub message queue.
Show Answer
Correct Answer: C
Explanation: Turning off Pub/Sub message batching reduces publish latency because batching intentionally holds messages until a batch is formed, trading latency for throughput. The question specifically asks to improve publishing latency, not subscriber delivery. Increasing retry timeout does not make publishing faster, switching pull to push affects subscribers rather than publishers, and a backup queue does not address publish latency.
Question 123
You need to upgrade the EHR connection to comply with their requirements. The new connection design must support business-critical needs and meet the same network and security policy requirements. What should you do?
A. Add a new Dedicated Interconnect connection.
B. Upgrade the bandwidth on the Dedicated Interconnect connection to 100 G.
C. Add three new Cloud VPN connections.
D. Add a new Carrier Peering connection.
Show Answer
Correct Answer: A
Explanation: Add a new Dedicated Interconnect connection. For business-critical connectivity with the same network and security requirements, Dedicated Interconnect is the appropriate service. High availability requires redundant Dedicated Interconnect connections, upgrading an existing 10 Gbps link to 100 Gbps is not an in-place bandwidth change, Cloud VPN does not provide the same dedicated connectivity characteristics, and Carrier Peering is not a replacement for private Google Cloud connectivity.
Question 124
Your company has a Kubernetes application that pulls messages from Pub/Sub and stores them in Filestore. Because the application is simple, it was deployed as a single pod. The infrastructure team has analyzed Pub/Sub metrics and discovered that the application cannot process the messages in real time. Most of them wait for minutes before being processed. You need to scale the elaboration process that is I/O-intensive. What should you do?
A. Use kubectl autoscale deployment APP_NAME --max 6 --min 2 --cpu-percent 50 to configure Kubernetes autoscaling deployment.
B. Configure a Kubernetes autoscaling deployment based on the subscription/push_request_latencies metric.
C. Use the --enable-autoscaling flag when you create the Kubernetes cluster.
D. Configure a Kubernetes autoscaling deployment based on the subscription/num_undelivered_messages metric.
Show Answer
Correct Answer: D
Explanation: For a Pub/Sub pull-based workload, the best autoscaling signal is the backlog of unprocessed messages. Configuring the Horizontal Pod Autoscaler to use the external metric subscription/num_undelivered_messages scales pods according to actual queue depth. CPU-based autoscaling is inappropriate for an I/O-bound workload, push_request_latencies applies to push subscriptions rather than pull consumers, and merely enabling cluster autoscaling does not autoscale application pods.
$19
Get all 306 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.