Professional Cloud Architect Free Practice Questions — Page 15
Question 138
Your company has just acquired another company, and you have been asked to integrate their existing Google Cloud environment into your company's data center. Upon investigation, you discover that some of the RFC 1918 IP ranges being used in the new company's Virtual Private Cloud (VPC) overlap with your data center IP space. What should you do to enable connectivity and make sure that there are no routing conflicts when connectivity is established?
A. Create a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply new IP addresses so there is no overlapping IP space.
B. Create a Cloud VPN connection from the new VPC to the data center, and create a Cloud NAT instance to perform NAT on the overlapping IP space.
C. Create a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply a custom route advertisement to block the overlapping IP space.
D. Create a Cloud VPN connection from the new VPC to the data center, and apply a firewall rule that blocks the overlapping IP space.
Show Answer
Correct Answer: B
Explanation: The core problem is overlapping RFC 1918 IP ranges between the VPC and the data center. To enable connectivity without routing conflicts, address translation is required so that each side sees non-overlapping addresses.
Using NAT between the VPC and the data center solves this by translating one side’s overlapping IP space into a non-overlapping range. In Google Cloud, this is achieved with Private NAT (via Cloud NAT with Cloud VPN/Interconnect), which is specifically designed to handle private-to-private connectivity when IP ranges overlap.
Re‑IPing the entire VPC (A) is disruptive and not required. Blocking routes (C) or firewall rules (D) avoids conflicts but does not actually enable full connectivity. Therefore, performing NAT on the overlapping IP space is the correct solution.
Question 139
Your company provides a recommendation engine for retail customers. You are providing retail customers with an API where they can submit a user ID and the
API returns a list of recommendations for that user. You are responsible for the API lifecycle and want to ensure stability for your customers in case the API makes backward-incompatible changes. You want to follow Google-recommended practices. What should you do?
A. Create a distribution list of all customers to inform them of an upcoming backward-incompatible change at least one month before replacing the old API with the new API.
B. Create an automated process to generate API documentation, and update the public API documentation as part of the CI/CD process when deploying an update to the API.
C. Use a versioning strategy for the APIs that increases the version number on every backward-incompatible change.
D. Use a versioning strategy for the APIs that adds the suffix ג€DEPRECATEDג€ to the current API version number on every backward-incompatible change. Use the current version number for the new API.
Show Answer
Correct Answer: C
Explanation: Google API design guidelines recommend explicit API versioning. When you introduce a backward-incompatible (breaking) change, you must increment the API version so existing clients can continue using the old version without breaking. This is the primary mechanism to ensure stability. The other options (notifications, documentation updates, or marking deprecated) are useful practices but do not, by themselves, guarantee backward compatibility.
Question 140
Mountkirk Games wants you to secure the connectivity from the new gaming application platform to Google Cloud. You want to streamline the process and follow
Google-recommended practices. What should you do?
A. Configure Workload Identity and service accounts to be used by the application platform.
B. Use Kubernetes Secrets, which are obfuscated by default. Configure these Secrets to be used by the application platform.
C. Configure Kubernetes Secrets to store the secret, enable Application-Layer Secrets Encryption, and use Cloud Key Management Service (Cloud KMS) to manage the encryption keys. Configure these Secrets to be used by the application platform.
D. Configure HashiCorp Vault on Compute Engine, and use customer managed encryption keys and Cloud Key Management Service (Cloud KMS) to manage the encryption keys. Configure these Secrets to be used by the application platform.
Show Answer
Correct Answer: A
Explanation: Mountkirk Games is deploying applications on GKE that need to access Google Cloud services. Google-recommended best practice is to use Workload Identity with Google Cloud service accounts. This avoids long-lived service account keys and Kubernetes Secrets, provides strong identity binding between pods and service accounts, simplifies management, and improves security. The other options rely on secret storage or external vaults, which are unnecessary and less streamlined for accessing Google Cloud APIs.
Question 141
You are developing your microservices application on Google Kubernetes Engine. During testing, you want to validate the behavior of your application in case a specific microservice should suddenly crash. What should you do?
A. Add a taint to one of the nodes of the Kubernetes cluster. For the specific microservice, configure a pod anti-affinity label that has the name of the tainted node as a value.
B. Use Istio's fault injection on the particular microservice whose faulty behavior you want to simulate.
C. Destroy one of the nodes of the Kubernetes cluster to observe the behavior.
D. Configure Istio's traffic management features to steer the traffic away from a crashing microservice.
Show Answer
Correct Answer: B
Explanation: The goal is to test the behavior when a specific microservice crashes. Istio fault injection allows you to deliberately simulate application-level failures (such as HTTP errors or delays) for a particular service in a controlled and targeted way, without impacting nodes or unrelated services. Destroying a node tests infrastructure failure and may affect multiple services, while taints/affinity or traffic steering do not simulate a crash.
Question 142
Your company wants you to build a highly reliable web application with a few public APIs as the backend. You don't expect a lot of user traffic, but traffic could spike occasionally. You want to leverage Cloud Load Balancing, and the solution must be cost-effective for users. What should you do?
A. Store static content such as HTML and images in Cloud CDN. Host the APIs on App Engine and store the user data in Cloud SQL.
B. Store static content such as HTML and images in a Cloud Storage bucket. Host the APIs on a zonal Google Kubernetes Engine cluster with worker nodes in multiple zones, and save the user data in Cloud Spanner.
C. Store static content such as HTML and images in Cloud CDN. Use Cloud Run to host the APIs and save the user data in Cloud SQL.
D. Store static content such as HTML and images in a Cloud Storage bucket. Use Cloud Functions to host the APIs and save the user data in Firestore.
Show Answer
Correct Answer: D
Explanation: The requirements emphasize high reliability, occasional traffic spikes, Cloud Load Balancing support, and strong cost efficiency with low baseline traffic. Cloud Functions is serverless, integrates with HTTP(S) Load Balancing, and scales to zero, making it very cost‑effective. Cloud Storage is ideal and inexpensive for static content hosting. Firestore is a managed, scalable datastore without the fixed costs of Cloud SQL or Cloud Spanner. Other options introduce unnecessary cost or operational overhead (GKE, Spanner, or always-on databases), or misuse CDN as a primary storage layer.
Question 143
You are implementing the infrastructure for a web service on Google Cloud. The web service needs to receive and store the data from 500,000 requests per second. The data will be queried later in real time, based on exact matches of a known set of attributes. There will be periods where the web service will not receive any requests. The business wants to keep costs low. Which web service platform and database should you use for the application?
A. Cloud Run and BigQuery
B. Cloud Run and Cloud Bigtable
C. A Compute Engine autoscaling managed instance group and BigQuery
D. A Compute Engine autoscaling managed instance group and Cloud Bigtable
Show Answer
Correct Answer: B
Explanation: The service must handle extremely high write throughput (500,000 rps), support real-time queries on exact-match attributes, and minimize cost during idle periods. Cloud Bigtable is designed for massive, low-latency write and read workloads with predictable, key-based queries, making it a better fit than BigQuery, which is optimized for analytical queries. Cloud Run automatically scales to meet traffic demand and can scale to zero when there are no requests, reducing costs compared to always-on Compute Engine instance groups. Therefore, Cloud Run with Cloud Bigtable best satisfies performance and cost requirements.
Question 144
Your operations team has asked you to help diagnose a performance issue in a production application that runs on Compute Engine. The application is dropping requests that reach it when under heavy load. The process list for affected instances shows a single application process that is consuming all available CPU, and autoscaling has reached the upper limit of instances. There is no abnormal load on any other related systems, including the database. You want to allow production traffic to be served again as quickly as possible. Which action should you recommend?
A. Change the autoscaling metric to agent.googleapis.com/memory/percent_used.
B. Restart the affected instances on a staggered schedule.
C. SSH to each instance and restart the application process.
D. Increase the maximum number of instances in the autoscaling group.
Show Answer
Correct Answer: D
Explanation: The application is CPU-bound and autoscaling has already hit its maximum instance limit, so it cannot add capacity to handle load. To restore service as quickly as possible, you should increase the maximum number of instances so autoscaling can scale out and distribute traffic. Changing metrics or restarting instances/processes would not address the immediate capacity constraint.
Question 145
Your organization has decided to restrict the use of external IP addresses on instances to only approved instances. You want to enforce this requirement across all of your Virtual Private Clouds (VPCs). What should you do?
A. Remove the default route on all VPCs. Move all approved instances into a new subnet that has a default route to an internet gateway.
B. Create a new VPC in custom mode. Create a new subnet for the approved instances, and set a default route to the internet gateway on this new subnet.
C. Implement a Cloud NAT solution to remove the need for external IP addresses entirely.
D. Set an Organization Policy with a constraint on constraints/compute.vmExternalIpAccess. List the approved instances in the allowedValues list.
Show Answer
Correct Answer: D
Explanation: To enforce a restriction on external IP usage consistently across all VPCs, you must use an organization-wide control rather than per-VPC routing or subnet design. The Organization Policy constraint `constraints/compute.vmExternalIpAccess` is specifically designed to control which VM instances are allowed to have external IP addresses. By setting this policy at the organization (or folder/project) level and allowing only approved instances, you centrally enforce the requirement across all VPCs. The other options either do not scale across all VPCs, do not directly control external IP assignment, or change network architecture without enforcing a strict policy.
Question 146
You have an application that runs in Google Kubernetes Engine (GKE). Over the last 2 weeks, customers have reported that a specific part of the application returns errors very frequently. You currently have no logging or monitoring solution enabled on your GKE cluster. You want to diagnose the problem, but you have not been able to replicate the issue. You want to cause minimal disruption to the application. What should you do?
A. 1. Update your GKE cluster to use Cloud Operations for GKE. 2. Use the GKE Monitoring dashboard to investigate logs from affected Pods.
B. 1. Create a new GKE cluster with Cloud Operations for GKE enabled. 2. Migrate the affected Pods to the new cluster, and redirect traffic for those Pods to the new cluster. 3. Use the GKE Monitoring dashboard to investigate logs from affected Pods.
C. 1. Update your GKE cluster to use Cloud Operations for GKE, and deploy Prometheus. 2. Set an alert to trigger whenever the application returns an error.
D. 1. Create a new GKE cluster with Cloud Operations for GKE enabled, and deploy Prometheus. 2. Migrate the affected Pods to the new cluster, and redirect traffic for those Pods to the new cluster. 3. Set an alert to trigger whenever the application returns an error.
Show Answer
Correct Answer: A
Explanation: The goal is to diagnose an intermittent production issue with minimal disruption. Enabling Cloud Operations for GKE on the existing cluster provides native logging and monitoring without recreating or migrating clusters, which avoids unnecessary risk and complexity. Once enabled, you can inspect logs and metrics from the affected Pods to understand the errors. Creating a new cluster or migrating workloads would be disruptive, and deploying Prometheus or setting alerts does not directly help with root-cause analysis when no historical data exists. Therefore, updating the existing cluster to use Cloud Operations and investigating Pod logs is the most appropriate approach.
Question 147
Your company has a project in Google Cloud with three Virtual Private Clouds (VPCs). There is a Compute Engine instance on each VPC. Network subnets do not overlap and must remain separated. The network configuration is shown below.
Instance #1 is an exception and must communicate directly with both Instance #2 and Instance #3 via internal IPs. How should you accomplish this?
A. Create a cloud router to advertise subnet #2 and subnet #3 to subnet #1.
B. Add two additional NICs to Instance #1 with the following configuration: ג€¢ NIC1 ג—‹ VPC: VPC #2 ג—‹ SUBNETWORK: subnet #2 ג€¢ NIC2 ג—‹ VPC: VPC #3 ג—‹ SUBNETWORK: subnet #3 Update firewall rules to enable traffic between instances.
C. Create two VPN tunnels via CloudVPN: ג€¢ 1 between VPC #1 and VPC #2. ג€¢ 1 between VPC #2 and VPC #3. Update firewall rules to enable traffic between the instances.
D. Peer all three VPCs: ג€¢ Peer VPC #1 with VPC #2. ג€¢ Peer VPC #2 with VPC #3. Update firewall rules to enable traffic between the instances.
Show Answer
Correct Answer: B
Explanation: Only Instance #1 needs access to both other VPCs while keeping the VPCs themselves isolated. Attaching multiple network interfaces to Instance #1—one in VPC #2 and one in VPC #3—allows it to communicate with Instances #2 and #3 via internal IPs without peering or connecting the VPCs together. VPC peering or VPN would connect networks more broadly, violating the separation requirement. Firewall rules must allow the traffic on each interface.
$19
Get all 305 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.