CertBlaze

Google

Professional Cloud Architect Free Practice Questions — Page 13

Question 116

For this question, refer to the TerramEarth case study. TerramEarth has decided to store data files in Cloud Storage. You need to configure Cloud Storage lifecycle rule to store 1 year of data and minimize file storage cost. Which two actions should you take?

A. Create a Cloud Storage lifecycle rule with Age: ג€30ג€, Storage Class: ג€Standardג€, and Action: ג€Set to Coldlineג€, and create a second GCS life-cycle rule with Age: ג€365ג€, Storage Class: ג€Coldlineג€, and Action: ג€Deleteג€.
B. Create a Cloud Storage lifecycle rule with Age: ג€30ג€, Storage Class: ג€Coldlineג€, and Action: ג€Set to Nearlineג€, and create a second GCS life-cycle rule with Age: ג€91ג€, Storage Class: ג€Coldlineג€, and Action: ג€Set to Nearlineג€.
C. Create a Cloud Storage lifecycle rule with Age: ג€90ג€, Storage Class: ג€Standardג€, and Action: ג€Set to Nearlineג€, and create a second GCS life-cycle rule with Age: ג€91ג€, Storage Class: ג€Nearlineג€, and Action: ג€Set to Coldlineג€.
D. Create a Cloud Storage lifecycle rule with Age: ג€30ג€, Storage Class: ג€Standardג€, and Action: ג€Set to Coldlineג€, and create a second GCS life-cycle rule with Age: ג€365ג€, Storage Class: ג€Nearlineג€, and Action: ג€Deleteג€.
Show Answer
Correct Answer: A
Explanation:
To minimize storage cost while retaining only one year of data, objects should transition to a cheaper storage class and then be deleted at 365 days. Option A correctly sets objects from Standard to Coldline after 30 days, reducing cost, and then deletes them at 365 days when they are in Coldline. Other options either lack deletion at one year, use incorrect storage-class conditions, or define illogical class transitions.

Question 117

Your company sends all Google Cloud logs to Cloud Logging. Your security team wants to monitor the logs. You want to ensure that the security team can react quickly if an anomaly such as an unwanted firewall change or server breach is detected. You want to follow Google-recommended practices. What should you do?

A. Schedule a cron job with Cloud Scheduler. The scheduled job queries the logs every minute for the relevant events.
B. Export logs to BigQuery, and trigger a query in BigQuery to process the log data for the relevant events.
C. Export logs to a Pub/Sub topic, and trigger Cloud Function with the relevant log events.
D. Export logs to a Cloud Storage bucket, and trigger Cloud Run with the relevant log events.
Show Answer
Correct Answer: C
Explanation:
Google-recommended practice for near–real-time security monitoring is to create a log sink that exports relevant Cloud Logging entries to Pub/Sub and triggers a Cloud Function. This enables event-driven, low-latency reactions to anomalies such as firewall changes or breaches. The other options rely on polling or batch processing, which are slower and not ideal for rapid response.

Question 118

Your company has an application deployed on Anthos clusters (formerly Anthos GKE) that is running multiple microservices. The cluster has both Anthos Service Mesh and Anthos Config Management configured. End users inform you that the application is responding very slowly. You want to identify the microservice that is causing the delay. What should you do?

A. Use the Service Mesh visualization in the Cloud Console to inspect the telemetry between the microservices.
B. Use Anthos Config Management to create a ClusterSelector selecting the relevant cluster. On the Google Cloud Console page for Google Kubernetes Engine, view the Workloads and filter on the cluster. Inspect the configurations of the filtered workloads.
C. Use Anthos Config Management to create a namespaceSelector selecting the relevant cluster namespace. On the Google Cloud Console page for Google Kubernetes Engine, visit the workloads and filter on the namespace. Inspect the configurations of the filtered workloads.
D. Reinstall istio using the default istio profile in order to collect request latency. Evaluate the telemetry between the microservices in the Cloud Console.
Show Answer
Correct Answer: A
Explanation:
Anthos Service Mesh provides built-in observability such as distributed tracing, latency metrics, and service-to-service telemetry. Using the Service Mesh visualization in the Cloud Console allows you to identify which microservice is introducing latency. Anthos Config Management is for configuration and policy management, not performance troubleshooting, and reinstalling Istio is unnecessary.

Question 119

You are working at a financial institution that stores mortgage loan approval documents on Cloud Storage. Any change to these approval documents must be uploaded as a separate approval file, so you want to ensure that these documents cannot be deleted or overwritten for the next 5 years. What should you do?

A. Create a retention policy on the bucket for the duration of 5 years. Create a lock on the retention policy.
B. Create the bucket with uniform bucket-level access, and grant a service account the role of Object Writer. Use the service account to upload new files.
C. Use a customer-managed key for the encryption of the bucket. Rotate the key after 5 years.
D. Create the bucket with fine-grained access control, and grant a service account the role of Object Writer. Use the service account to upload new files.
Show Answer
Correct Answer: A
Explanation:
The requirement is to ensure mortgage approval documents cannot be deleted or overwritten for 5 years. A Cloud Storage bucket retention policy enforces WORM (write once, read many) behavior: objects cannot be deleted or replaced until they reach the retention period. Locking the retention policy makes it immutable, preventing administrators from shortening or removing it, which is required for regulatory compliance. The other options do not prevent deletion or overwrite.

Question 120

You need to optimize batch file transfers into Cloud Storage for Mountkirk Games' new Google Cloud solution. The batch files contain game statistics that need to be staged in Cloud Storage and be processed by an extract transform load (ETL) tool. What should you do?

A. Use gsutil to batch move files in sequence.
B. Use gsutil to batch copy the files in parallel.
C. Use gsutil to extract the files as the first part of ETL.
D. Use gsutil to load the files as the last part of ETL.
Show Answer
Correct Answer: B
Explanation:
The goal is to optimize batch file transfers into Cloud Storage. Using gsutil with the -m (multi-threaded/multi-processing) option copies many files in parallel, maximizing throughput and reducing transfer time. The other options either perform sequential transfers or describe ETL steps rather than optimizing the data transfer itself.

Question 122

Your company has developed a monolithic, 3-tier application to allow external users to upload and share files. The solution cannot be easily enhanced and lacks reliability. The development team would like to re-architect the application to adopt microservices and a fully managed service approach, but they need to convince their leadership that the effort is worthwhile. Which advantage(s) should they highlight to leadership?

A. The new approach will be significantly less costly, make it easier to manage the underlying infrastructure, and automatically manage the CI/CD pipelines.
B. The monolithic solution can be converted to a container with Docker. The generated container can then be deployed into a Kubernetes cluster.
C. The new approach will make it easier to decouple infrastructure from application, develop and release new features, manage the underlying infrastructure, manage CI/CD pipelines and perform A/B testing, and scale the solution if necessary.
D. The process can be automated with Migrate for Compute Engine.
Show Answer
Correct Answer: C
Explanation:
Re-architecting to microservices with fully managed services primarily delivers agility and reliability benefits: decoupling infrastructure from applications, independent development and releases, easier scaling, improved resiliency, support for CI/CD and A/B testing, and reduced operational burden. These directly address the current lack of reliability and limited ability to enhance the monolith. Other options either focus on tooling migration without architectural benefits or overpromise cost savings and CI/CD automation.

Question 123

Your company is using Google Cloud. You have two folders under the Organization: Finance and Shopping. The members of the development team are in a Google Group. The development team group has been assigned the Project Owner role on the Organization. You want to prevent the development team from creating resources in projects in the Finance folder. What should you do?

A. Assign the development team group the Project Viewer role on the Finance folder, and assign the development team group the Project Owner role on the Shopping folder.
B. Assign the development team group only the Project Viewer role on the Finance folder.
C. Assign the development team group the Project Owner role on the Shopping folder, and remove the development team group Project Owner role from the Organization.
D. Assign the development team group only the Project Owner role on the Shopping folder.
Show Answer
Correct Answer: C
Explanation:
IAM roles in Google Cloud are inherited downward from the Organization to folders and projects. Since the development team group has the Project Owner role at the Organization level, they automatically have full permissions in all folders and projects, including Finance. Assigning a more restrictive role (like Viewer) at the Finance folder does not override the broader Organization-level Owner role. To prevent resource creation in Finance, you must remove the Project Owner role from the Organization and then grant Project Owner only where it is needed (the Shopping folder). This is exactly what option C does.

Question 124

For this question, refer to the Helicopter Racing League (HRL) case study. The HRL development team releases a new version of their predictive capability application every Tuesday evening at 3 a.m. UTC to a repository. The security team at HRL has developed an in-house penetration test Cloud Function called Airwolf. The security team wants to run Airwolf against the predictive capability application as soon as it is released every Tuesday. You need to set up Airwolf to run at the recurring weekly cadence. What should you do?

A. Set up Cloud Tasks and a Cloud Storage bucket that triggers a Cloud Function.
B. Set up a Cloud Logging sink and a Cloud Storage bucket that triggers a Cloud Function.
C. Configure the deployment job to notify a Pub/Sub queue that triggers a Cloud Function.
D. Set up Identity and Access Management (IAM) and Confidential Computing to trigger a Cloud Function.
Show Answer
Correct Answer: C
Explanation:
The requirement is to run the Airwolf penetration test automatically every time a new version of the application is released, which happens on a predictable weekly cadence (Tuesday 3 a.m. UTC), and to do so immediately after release. The most reliable trigger is the deployment event itself. By configuring the deployment job (CI/CD pipeline) to publish a message to Pub/Sub upon successful release, a Cloud Function can be triggered instantly and consistently each week. This ties execution directly to the release event rather than relying on time-based scheduling or unrelated services. The other options do not naturally model a release-driven trigger or introduce unnecessary components.

Question 125

Your company is planning to perform a lift and shift migration of their Linux RHEL 6.5+ virtual machines. The virtual machines are running in an on-premises VMware environment. You want to migrate them to Compute Engine following Google-recommended practices. What should you do?

A. 1. Define a migration plan based on the list of the applications and their dependencies. 2. Migrate all virtual machines into Compute Engine individually with Migrate for Compute Engine.
B. 1. Perform an assessment of virtual machines running in the current VMware environment. 2. Create images of all disks. Import disks on Compute Engine. 3. Create standard virtual machines where the boot disks are the ones you have imported.
C. 1. Perform an assessment of virtual machines running in the current VMware environment. 2. Define a migration plan, prepare a Migrate for Compute Engine migration RunBook, and execute the migration.
D. 1. Perform an assessment of virtual machines running in the current VMware environment. 2. Install a third-party agent on all selected virtual machines. 3. Migrate all virtual machines into Compute Engine.
Show Answer
Correct Answer: C
Explanation:
Google‑recommended lift‑and‑shift practice for VMware to Compute Engine is to first assess the existing environment, then plan migrations in waves based on application dependencies, and execute them using Migrate for Compute Engine (now Migrate to Virtual Machines). This involves creating and executing a migration plan/runbook rather than importing disks manually or migrating VMs one by one, which best preserves dependencies and aligns with Google guidance.

Question 126

Your company has announced that they will be outsourcing operations functions. You want to allow developers to easily stage new versions of a cloud-based application in the production environment and allow the outsourced operations team to autonomously promote staged versions to production. You want to minimize the operational overhead of the solution. Which Google Cloud product should you migrate to?

A. App Engine
B. GKE On-Prem
C. Compute Engine
D. Google Kubernetes Engine
Show Answer
Correct Answer: A
Explanation:
App Engine is a fully managed PaaS that minimizes operational overhead. It natively supports application versioning, staging, and traffic promotion, allowing developers to deploy new versions without impacting production and enabling an operations team to promote versions autonomously. GKE and Compute Engine require significantly more infrastructure and operational management, while App Engine abstracts these concerns.

$19

Get all 305 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full Professional Cloud Architect study guide →