Professional Cloud Architect Free Practice Questions — Page 14
Question 137
For this question, refer to the Helicopter Racing League (HRL) case study. The HRL development team releases a new version of their predictive capability application every Tuesday evening at 3 a.m. UTC to a repository. The security team at HRL has developed an in-house penetration test Cloud Function called
Airwolf. The security team wants to run Airwolf against the predictive capability application as soon as it is released every Tuesday. You need to set up Airwolf to run at the recurring weekly cadence. What should you do?
A. Set up Cloud Tasks and a Cloud Storage bucket that triggers a Cloud Function.
B. Set up a Cloud Logging sink and a Cloud Storage bucket that triggers a Cloud Function.
C. Configure the deployment job to notify a Pub/Sub queue that triggers a Cloud Function.
D. Set up Identity and Access Management (IAM) and Confidential Computing to trigger a Cloud Function.
Show Answer
Correct Answer: C
Explanation: The requirement is to run the penetration test as soon as a new application version is released every Tuesday. The best event-driven design is for the deployment pipeline to publish a Pub/Sub message upon a successful release, which triggers a Cloud Function that runs Airwolf. This ties execution to the actual deployment event rather than a fixed clock time. The other options introduce unrelated services or storage triggers that do not naturally represent the application release event.
Question 138
Your company is planning to perform a lift and shift migration of their Linux RHEL 6.5+ virtual machines. The virtual machines are running in an on-premises
VMware environment. You want to migrate them to Compute Engine following Google-recommended practices. What should you do?
A. 1. Define a migration plan based on the list of the applications and their dependencies. 2. Migrate all virtual machines into Compute Engine individually with Migrate for Compute Engine.
B. 1. Perform an assessment of virtual machines running in the current VMware environment. 2. Create images of all disks. Import disks on Compute Engine. 3. Create standard virtual machines where the boot disks are the ones you have imported.
C. 1. Perform an assessment of virtual machines running in the current VMware environment. 2. Define a migration plan, prepare a Migrate for Compute Engine migration RunBook, and execute the migration.
D. 1. Perform an assessment of virtual machines running in the current VMware environment. 2. Install a third-party agent on all selected virtual machines. 3. Migrate all virtual machines into Compute Engine.
Show Answer
Correct Answer: C
Explanation: Google-recommended migration practice for VMware to Compute Engine starts with assessing the existing environment, then planning the migration based on dependencies, and executing migrations in organized waves using Migrate for Compute Engine (now Migrate to Virtual Machines). A migration runbook/wave-based plan is the recommended approach. Importing raw disk images manually or migrating VMs individually does not reflect Google's recommended workflow, and third-party agents are not the standard recommendation.
Question 139
Your company has announced that they will be outsourcing operations functions. You want to allow developers to easily stage new versions of a cloud-based application in the production environment and allow the outsourced operations team to autonomously promote staged versions to production. You want to minimize the operational overhead of the solution. Which Google Cloud product should you migrate to?
A. App Engine
B. GKE On-Prem
C. Compute Engine
D. Google Kubernetes Engine
Show Answer
Correct Answer: A
Explanation: App Engine is the best fit because it is a fully managed PaaS with built-in application versioning, staged deployments, traffic splitting, and easy promotion of versions to production. This allows developers to deploy new versions without immediately serving traffic, while an operations team can later promote the staged version with minimal operational effort. GKE and Compute Engine require significantly more infrastructure and operational management, and GKE On-Prem adds even more operational overhead.
Question 140
Your development team has created a mobile game app. You want to test the new mobile app on Android and iOS devices with a variety of configurations. You need to ensure that testing is efficient and cost-effective. What should you do?
A. Upload your mobile app to the Firebase Test Lab, and test the mobile app on Android and iOS devices.
B. Create Android and iOS VMs on Google Cloud, install the mobile app on the VMs, and test the mobile app.
C. Create Android and iOS containers on Google Kubernetes Engine (GKE), install the mobile app on the containers, and test the mobile app.
D. Upload your mobile app with different configurations to Firebase Hosting and test each configuration.
Show Answer
Correct Answer: A
Explanation: Firebase Test Lab is the managed Google service designed to test Android and iOS apps across a wide range of physical devices and configurations efficiently and cost-effectively. Android/iOS VMs are not a practical or supported approach for this purpose, GKE cannot run iOS containers, and Firebase Hosting is for hosting web content, not mobile app device testing.
Question 141
Your company is developing a new application that will allow globally distributed users to upload pictures and share them with other selected users. The application will support millions of concurrent users. You want to allow developers to focus on just building code without having to create and maintain the underlying infrastructure. Which service should you use to deploy the application?
A. App Engine
B. Cloud Endpoints
C. Compute Engine
D. Google Kubernetes Engine
Show Answer
Correct Answer: A
Explanation: App Engine is a fully managed platform-as-a-service that allows developers to focus on writing and deploying application code without managing the underlying infrastructure. It automatically handles scaling to support large numbers of concurrent users. Cloud Endpoints is for API management, while Compute Engine and Google Kubernetes Engine require more infrastructure and operational management.
Question 142
You have deployed several instances on Compute Engine. As a security requirement, instances cannot have a public IP address. There is no VPN connection between Google Cloud and your office, and you need to connect via SSH into a specific machine without violating the security requirements. What should you do?
A. Configure Cloud NAT on the subnet where the instance is hosted. Create an SSH connection to the Cloud NAT IP address to reach the instance.
B. Add all instances to an unmanaged instance group. Configure TCP Proxy Load Balancing with the instance group as a backend. Connect to the instance using the TCP Proxy IP.
C. Configure Identity-Aware Proxy (IAP) for the instance and ensure that you have the role of IAP-secured Tunnel User. Use the gcloud command line tool to ssh into the instance.
D. Create a bastion host in the network to SSH into the bastion host from your office location. From the bastion host, SSH into the desired instance.
Show Answer
Correct Answer: C
Explanation: Identity-Aware Proxy (IAP) TCP forwarding is the recommended Google Cloud solution for SSH access to Compute Engine instances that do not have external IP addresses. Grant the user the IAP-secured Tunnel User role and use the gcloud compute ssh command, which establishes an authenticated tunnel through IAP. Cloud NAT does not accept inbound SSH, TCP Proxy Load Balancing is not intended for administrative SSH access to individual VMs, and a bastion host would typically require a public IP, conflicting with the stated security requirement.
Question 143
Your development teams release new versions of games running on Google Kubernetes Engine (GKE) daily. You want to create service level indicators (SLIs) to evaluate the quality of the new versions from the user's perspective. What should you do?
A. Create CPU Utilization and Request Latency as service level indicators.
B. Create GKE CPU Utilization and Memory Utilization as service level indicators.
C. Create Request Latency and Error Rate as service level indicators.
D. Create Server Uptime and Error Rate as service level indicators.
Show Answer
Correct Answer: C
Explanation: Service level indicators should reflect the end-user experience rather than internal resource utilization. Request latency measures responsiveness, and error rate measures the success of user requests. CPU, memory, and server uptime are operational metrics, but they do not directly capture the quality experienced by users.
Question 145
Mountkirk Games wants to limit the physical location of resources to their operating Google Cloud regions. What should you do?
A. Configure an organizational policy which constrains where resources can be deployed.
B. Configure IAM conditions to limit what resources can be configured.
C. Configure the quotas for resources in the regions not being used to 0.
D. Configure a custom alert in Cloud Monitoring so you can disable resources as they are created in other regions.
Show Answer
Correct Answer: A
Explanation: Use an Organization Policy with the resource locations constraint to restrict where supported Google Cloud resources can be created. This is the built-in preventive control for limiting deployments to approved regions. IAM Conditions do not enforce resource geography, quotas are not intended for geographic policy enforcement, and monitoring alerts are reactive rather than preventive.
Question 146
Your team is developing a web application that will be deployed on Google Kubernetes Engine (GKE). Your CTO expects a successful launch and you need to ensure your application can handle the expected load of tens of thousands of users. You want to test the current deployment to ensure the latency of your application stays below a certain threshold. What should you do?
A. Use a load testing tool to simulate the expected number of concurrent users and total requests to your application, and inspect the results.
B. Enable autoscaling on the GKE cluster and enable horizontal pod autoscaling on your application deployments. Send curl requests to your application, and validate if the auto scaling works.
C. Replicate the application over multiple GKE clusters in every Google Cloud region. Configure a global HTTP(S) load balancer to expose the different clusters over a single global IP address.
D. Use Cloud Debugger in the development environment to understand the latency between the different microservices.
Show Answer
Correct Answer: A
Explanation: The goal is to verify that the current deployment can handle the expected traffic while keeping latency below a target threshold. The appropriate approach is to perform load testing by simulating the anticipated concurrent users and request volume, then measure latency and other performance metrics. Autoscaling configuration alone does not validate latency under realistic load, multi-region deployment addresses availability rather than performance testing, and Cloud Debugger is for debugging rather than load or latency validation.
Question 147
Your team will start developing a new application using microservices architecture on Kubernetes Engine. As part of the development lifecycle, any code change that has been pushed to the remote develop branch on your GitHub repository should be built and tested automatically. When the build and test are successful, the relevant microservice will be deployed automatically in the development environment. You want to ensure that all code deployed in the development environment follows this process. What should you do?
A. Have each developer install a pre-commit hook on their workstation that tests the code and builds the container when committing on the development branch. After a successful commit, have the developer deploy the newly built container image on the development cluster.
B. Install a post-commit hook on the remote git repository that tests the code and builds the container when code is pushed to the development branch. After a successful commit, have the developer deploy the newly built container image on the development cluster.
C. Create a Cloud Build trigger based on the development branch that tests the code, builds the container, and stores it in Container Registry. Create a deployment pipeline that watches for new images and deploys the new image on the development cluster. Ensure only the deployment tool has access to deploy new versions.
D. Create a Cloud Build trigger based on the development branch to build a new container image and store it in Container Registry. Rely on Vulnerability Scanning to ensure the code tests succeed. As the final step of the Cloud Build process, deploy the new container image on the development cluster. Ensure only Cloud Build has access to deploy new versions.
Show Answer
Correct Answer: C
Explanation: A proper CI/CD pipeline should automatically trigger on pushes to the development branch, run tests, build the container image, store it in the registry, and then deploy only after successful validation. Restricting deployment permissions to the deployment tool ensures that all code reaching the development environment has gone through the required pipeline. Options A and B rely on developers for deployment and do not enforce the process. Option D incorrectly treats vulnerability scanning as a substitute for running the required build and test steps.
$19
Get all 306 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.