CertBlaze

Google

Professional Cloud Architect Free Practice Questions — Page 13

Question 126

You are developing an application using different microservices that should remain internal to the cluster. You want to be able to configure each microservice with a specific number of replicas. You also want to be able to address a specific microservice from any other microservice in a uniform way, regardless of the number of replicas the microservice scales to. You need to implement this solution on Google Kubernetes Engine. What should you do?

A. Deploy each microservice as a Deployment. Expose the Deployment in the cluster using a Service, and use the Service DNS name to address it from other microservices within the cluster.
B. Deploy each microservice as a Deployment. Expose the Deployment in the cluster using an Ingress, and use the Ingress IP address to address the Deployment from other microservices within the cluster.
C. Deploy each microservice as a Pod. Expose the Pod in the cluster using a Service, and use the Service DNS name to address the microservice from other microservices within the cluster.
D. Deploy each microservice as a Pod. Expose the Pod in the cluster using an Ingress, and use the Ingress IP address name to address the Pod from other microservices within the cluster.
Show Answer
Correct Answer: A
Explanation:
Use a Deployment to manage the desired replica count for each stateless microservice. Expose each Deployment with an internal Kubernetes Service, which provides a stable virtual IP and DNS name that remains constant as Pods scale up, down, or are replaced. Other microservices should communicate using the Service's DNS name. Ingress is intended primarily for external HTTP(S) access, not internal service-to-service communication, and deploying standalone Pods does not provide replica management.

Question 127

Your company has a networking team and a development team. The development team runs applications on Compute Engine instances that contain sensitive data. The development team requires administrative permissions for Compute Engine. Your company requires all network resources to be managed by the networking team. The development team does not want the networking team to have access to the sensitive data on the instances. What should you do?

A. 1. Create a project with a standalone VPC and assign the Network Admin role to the networking team. 2. Create a second project with a standalone VPC and assign the Compute Admin role to the development team. 3. Use Cloud VPN to join the two VPCs.
B. 1. Create a project with a standalone Virtual Private Cloud (VPC), assign the Network Admin role to the networking team, and assign the Compute Admin role to the development team.
C. 1. Create a project with a Shared VPC and assign the Network Admin role to the networking team. 2. Create a second project without a VPC, configure it as a Shared VPC service project, and assign the Compute Admin role to the development team.
D. 1. Create a project with a standalone VPC and assign the Network Admin role to the networking team. 2. Create a second project with a standalone VPC and assign the Compute Admin role to the development team. 3. Use VPC Peering to join the two VPCs.
Show Answer
Correct Answer: C
Explanation:
A Shared VPC separates network administration from workload administration. The networking team manages the host project's VPC, while the development team manages Compute Engine instances in a service project without owning the network resources. This satisfies the requirement that networking controls the network while developers administer VMs containing sensitive data. Sources: https://www.dumpspedia.com/professional-cloud-security-engineer-google-cloud-certified-professional-cloud-security-engineer-dumps.html

Question 128

You need to deploy an application on Google Cloud that must run on a Debian Linux environment. The application requires extensive configuration in order to operate correctly. You want to ensure that you can install Debian distribution updates with minimal manual intervention whenever they become available. What should you do?

A. Create a Compute Engine instance template using the most recent Debian image. Create an instance from this template, and install and configure the application as part of the startup script. Repeat this process whenever a new Google-managed Debian image becomes available.
B. Create a Debian-based Compute Engine instance, install and configure the application, and use OS patch management to install available updates.
C. Create an instance with the latest available Debian image. Connect to the instance via SSH, and install and configure the application on the instance. Repeat this process whenever a new Google-managed Debian image becomes available.
D. Create a Docker container with Debian as the base image. Install and configure the application as part of the Docker image creation process. Host the container on Google Kubernetes Engine and restart the container whenever a new update is available.
Show Answer
Correct Answer: B
Explanation:
The requirement is to keep a Debian-based application up to date with minimal manual intervention while preserving its extensive configuration. OS patch management is designed to automate operating system updates on existing Compute Engine VM instances. Options A and C require recreating or reconfiguring instances whenever new images are released, increasing manual effort. Option D changes the deployment model to containers and incorrectly implies that simply restarting containers applies base OS updates; container images must be rebuilt and redeployed to receive updated base images.

Question 129

For this question, refer to the TerramEarth case study. TerramEarth has decided to store data files in Cloud Storage. You need to configure Cloud Storage lifecycle rule to store 1 year of data and minimize file storage cost. Which two actions should you take?

A. Create a Cloud Storage lifecycle rule with Age: ג€30ג€, Storage Class: ג€Standardג€, and Action: ג€Set to Coldlineג€, and create a second GCS life-cycle rule with Age: ג€365ג€, Storage Class: ג€Coldlineג€, and Action: ג€Deleteג€.
B. Create a Cloud Storage lifecycle rule with Age: ג€30ג€, Storage Class: ג€Coldlineג€, and Action: ג€Set to Nearlineג€, and create a second GCS life-cycle rule with Age: ג€91ג€, Storage Class: ג€Coldlineג€, and Action: ג€Set to Nearlineג€.
C. Create a Cloud Storage lifecycle rule with Age: ג€90ג€, Storage Class: ג€Standardג€, and Action: ג€Set to Nearlineג€, and create a second GCS life-cycle rule with Age: ג€91ג€, Storage Class: ג€Nearlineג€, and Action: ג€Set to Coldlineג€.
D. Create a Cloud Storage lifecycle rule with Age: ג€30ג€, Storage Class: ג€Standardג€, and Action: ג€Set to Coldlineג€, and create a second GCS life-cycle rule with Age: ג€365ג€, Storage Class: ג€Nearlineג€, and Action: ג€Deleteג€.
Show Answer
Correct Answer: A
Explanation:
To minimize storage cost while retaining data for one year, transition objects from Standard to Coldline after 30 days, then delete them at 365 days. Option A correctly matches the storage class condition for the deletion rule (Coldline). Option D would not match because it attempts to delete only objects in Nearline even though they were transitioned to Coldline. Options B and C do not satisfy the stated one-year retention and cost optimization goal.

Question 130

Your company sends all Google Cloud logs to Cloud Logging. Your security team wants to monitor the logs. You want to ensure that the security team can react quickly if an anomaly such as an unwanted firewall change or server breach is detected. You want to follow Google-recommended practices. What should you do?

A. Schedule a cron job with Cloud Scheduler. The scheduled job queries the logs every minute for the relevant events.
B. Export logs to BigQuery, and trigger a query in BigQuery to process the log data for the relevant events.
C. Export logs to a Pub/Sub topic, and trigger Cloud Function with the relevant log events.
D. Export logs to a Cloud Storage bucket, and trigger Cloud Run with the relevant log events.
Show Answer
Correct Answer: C
Explanation:
Export Cloud Logging entries to Pub/Sub and trigger a Cloud Function for near real-time, event-driven processing and automated response. This is the Google-recommended pattern for quickly reacting to security-relevant log events. Polling with Cloud Scheduler is inefficient, BigQuery is better suited for analytics than immediate response, and Cloud Storage is not intended for low-latency event handling.

Question 131

Your company has an application deployed on Anthos clusters (formerly Anthos GKE) that is running multiple microservices. The cluster has both Anthos Service Mesh and Anthos Config Management configured. End users inform you that the application is responding very slowly. You want to identify the microservice that is causing the delay. What should you do?

A. Use the Service Mesh visualization in the Cloud Console to inspect the telemetry between the microservices.
B. Use Anthos Config Management to create a ClusterSelector selecting the relevant cluster. On the Google Cloud Console page for Google Kubernetes Engine, view the Workloads and filter on the cluster. Inspect the configurations of the filtered workloads.
C. Use Anthos Config Management to create a namespaceSelector selecting the relevant cluster namespace. On the Google Cloud Console page for Google Kubernetes Engine, visit the workloads and filter on the namespace. Inspect the configurations of the filtered workloads.
D. Reinstall istio using the default istio profile in order to collect request latency. Evaluate the telemetry between the microservices in the Cloud Console.
Show Answer
Correct Answer: A
Explanation:
Anthos Service Mesh provides observability features, including service topology visualization, telemetry, latency metrics, tracing, and monitoring between microservices. To identify which microservice is introducing delay, inspect the Service Mesh visualization and telemetry in the Cloud Console. Anthos Config Management manages and enforces configuration, not runtime performance analysis. Reinstalling Istio is unnecessary because Anthos Service Mesh already collects the required telemetry.

Question 132

You are working at a financial institution that stores mortgage loan approval documents on Cloud Storage. Any change to these approval documents must be uploaded as a separate approval file, so you want to ensure that these documents cannot be deleted or overwritten for the next 5 years. What should you do?

A. Create a retention policy on the bucket for the duration of 5 years. Create a lock on the retention policy.
B. Create the bucket with uniform bucket-level access, and grant a service account the role of Object Writer. Use the service account to upload new files.
C. Use a customer-managed key for the encryption of the bucket. Rotate the key after 5 years.
D. Create the bucket with fine-grained access control, and grant a service account the role of Object Writer. Use the service account to upload new files.
Show Answer
Correct Answer: A
Explanation:
A Cloud Storage bucket retention policy prevents objects from being deleted or overwritten until the configured retention period expires. Locking the retention policy makes it immutable, ensuring the 5-year retention requirement cannot be reduced or removed. The other options address access control or encryption, not immutable retention.

Question 133

You need to optimize batch file transfers into Cloud Storage for Mountkirk Games' new Google Cloud solution. The batch files contain game statistics that need to be staged in Cloud Storage and be processed by an extract transform load (ETL) tool. What should you do?

A. Use gsutil to batch move files in sequence.
B. Use gsutil to batch copy the files in parallel.
C. Use gsutil to extract the files as the first part of ETL.
D. Use gsutil to load the files as the last part of ETL.
Show Answer
Correct Answer: B
Explanation:
To optimize batch transfers into Cloud Storage before ETL processing, use gsutil's parallel copy capability (for example, with the -m option). Parallel copying significantly improves throughput for large batches. The other options either serialize transfers or incorrectly place extraction/loading steps into the transfer process.

Question 135

Your company has developed a monolithic, 3-tier application to allow external users to upload and share files. The solution cannot be easily enhanced and lacks reliability. The development team would like to re-architect the application to adopt microservices and a fully managed service approach, but they need to convince their leadership that the effort is worthwhile. Which advantage(s) should they highlight to leadership?

A. The new approach will be significantly less costly, make it easier to manage the underlying infrastructure, and automatically manage the CI/CD pipelines.
B. The monolithic solution can be converted to a container with Docker. The generated container can then be deployed into a Kubernetes cluster.
C. The new approach will make it easier to decouple infrastructure from application, develop and release new features, manage the underlying infrastructure, manage CI/CD pipelines and perform A/B testing, and scale the solution if necessary.
D. The process can be automated with Migrate for Compute Engine.
Show Answer
Correct Answer: C
Explanation:
A microservices architecture combined with fully managed services primarily provides better decoupling of infrastructure and application, faster independent development and deployment of features, improved scalability, support for modern deployment practices such as A/B testing, and reduced operational burden for infrastructure management. It does not automatically manage CI/CD pipelines, and it is not guaranteed to be significantly less costly. Converting a monolith into a container or using Migrate for Compute Engine does not achieve the stated architectural goals.

Question 136

Your company is using Google Cloud. You have two folders under the Organization: Finance and Shopping. The members of the development team are in a Google Group. The development team group has been assigned the Project Owner role on the Organization. You want to prevent the development team from creating resources in projects in the Finance folder. What should you do?

A. Assign the development team group the Project Viewer role on the Finance folder, and assign the development team group the Project Owner role on the Shopping folder.
B. Assign the development team group only the Project Viewer role on the Finance folder.
C. Assign the development team group the Project Owner role on the Shopping folder, and remove the development team group Project Owner role from the Organization.
D. Assign the development team group only the Project Owner role on the Shopping folder.
Show Answer
Correct Answer: C
Explanation:
IAM roles granted at the Organization level are inherited by all child folders and projects. Granting a less-privileged role (such as Viewer) on the Finance folder does not override the inherited Owner role. To prevent the development team from creating resources in Finance projects, you must remove the Organization-level Project Owner grant and instead grant Project Owner only on the Shopping folder, limiting the higher privilege to that branch of the resource hierarchy.

$19

Get all 306 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full Professional Cloud Architect study guide →