Professional Cloud Architect Free Practice Questions — Page 16
Question 148
Your company is designing its application landscape on Compute Engine. Whenever a zonal outage occurs, the application should be restored in another zone as quickly as possible with the latest application data. You need to design the solution to meet this requirement. What should you do?
A. Create a snapshot schedule for the disk containing the application data. Whenever a zonal outage occurs, use the latest snapshot to restore the disk in the same zone.
B. Configure the Compute Engine instances with an instance template for the application, and use a regional persistent disk for the application data. Whenever a zonal outage occurs, use the instance template to spin up the application in another zone in the same region. Use the regional persistent disk for the application data.
C. Create a snapshot schedule for the disk containing the application data. Whenever a zonal outage occurs, use the latest snapshot to restore the disk in another zone within the same region.
D. Configure the Compute Engine instances with an instance template for the application, and use a regional persistent disk for the application data. Whenever a zonal outage occurs, use the instance template to spin up the application in another region. Use the regional persistent disk for the application data.
Show Answer
Correct Answer: B
Explanation: The requirement is rapid recovery from a zonal outage with the latest data. Regional persistent disks synchronously replicate data across two zones within the same region, providing zero RPO and immediate availability in another zone. Using an instance template allows fast recreation of the VM in a healthy zone. Snapshots are slower and not zero RPO, and regional disks cannot be used across regions, making other options unsuitable.
Question 149
You have developed a non-critical update to your application that is running in a managed instance group, and have created a new instance template with the update that you want to release. To prevent any possible impact to the application, you don't want to update any running instances. You want any new instances that are created by the managed instance group to contain the new update. What should you do?
A. Start a new rolling restart operation.
B. Start a new rolling replace operation.
C. Start a new rolling update. Select the Proactive update mode.
D. Start a new rolling update. Select the Opportunistic update mode.
Show Answer
Correct Answer: D
Explanation: The requirement is to ensure that no currently running instances are updated, while new instances use the new instance template. A rolling update in Opportunistic (selective) mode only applies the new template when new instances are created (for example, due to autoscaling or manual resize) or when you explicitly target instances. Proactive mode would automatically update existing instances, which violates the requirement. Rolling restart or replace would also impact running instances.
Question 150
You need to deploy a stateful workload on Google Cloud. The workload can scale horizontally, but each instance needs to read and write to the same POSIX filesystem. At high load, the stateful workload needs to support up to 100 MB/s of writes. What should you do?
A. Use a persistent disk for each instance.
B. Use a regional persistent disk for each instance.
C. Create a Cloud Filestore instance and mount it in each instance.
D. Create a Cloud Storage bucket and mount it in each instance using gcsfuse.
Show Answer
Correct Answer: C
Explanation: The workload requires a shared POSIX-compliant filesystem that multiple instances can read and write concurrently, with sustained write throughput around 100 MB/s. Cloud Filestore provides a managed NFS service that is POSIX-compliant and designed for shared access with sufficient performance. Persistent disks (zonal or regional) cannot be mounted read-write by multiple instances, and Cloud Storage via gcsfuse is not POSIX-compliant and is unsuitable for high-write, low-latency filesystem semantics.
Question 151
You are working at a sports association whose members range in age from 8 to 30. The association collects a large amount of health data, such as sustained injuries. You are storing this data in BigQuery. Current legislation requires you to delete such information upon request of the subject. You want to design a solution that can accommodate such a request. What should you do?
A. Use a unique identifier for each individual. Upon a deletion request, delete all rows from BigQuery with this identifier.
B. When ingesting new data in BigQuery, run the data through the Data Loss Prevention (DLP) API to identify any personal information. As part of the DLP scan, save the result to Data Catalog. Upon a deletion request, query Data Catalog to find the column with personal information.
C. Create a BigQuery view over the table that contains all data. Upon a deletion request, exclude the rows that affect the subject's data from this view. Use this view instead of the source table for all analysis tasks.
D. Use a unique identifier for each individual. Upon a deletion request, overwrite the column with the unique identifier with a salted SHA256 of its value.
Show Answer
Correct Answer: A
Explanation: To comply with deletion requests (for example under GDPR), you must be able to reliably remove all data related to a specific individual. Using a unique identifier per individual and deleting all rows associated with that identifier directly satisfies the legal requirement to delete the subject’s data. The other options either only identify or mask data (B and D) or merely hide data via a view without actually deleting it from storage (C), which does not meet the requirement.
Question 152
Your company has sensitive data in Cloud Storage buckets. Data analysts have Identity Access Management (IAM) permissions to read the buckets. You want to prevent data analysts from retrieving the data in the buckets from outside the office network. What should you do?
A. 1. Create a VPC Service Controls perimeter that includes the projects with the buckets. 2. Create an access level with the CIDR of the office network.
B. 1. Create a firewall rule for all instances in the Virtual Private Cloud (VPC) network for source range. 2. Use the Classless Inter-domain Routing (CIDR) of the office network.
C. 1. Create a Cloud Function to remove IAM permissions from the buckets, and another Cloud Function to add IAM permissions to the buckets. 2. Schedule the Cloud Functions with Cloud Scheduler to add permissions at the start of business and remove permissions at the end of business.
D. 1. Create a Cloud VPN to the office network. 2. Configure Private Google Access for on-premises hosts.
Show Answer
Correct Answer: A
Explanation: The requirement is to prevent data exfiltration from Cloud Storage buckets while still allowing authorized analysts to read data only from the office network. VPC Service Controls are designed for this purpose: they create a security perimeter around Google-managed services like Cloud Storage. By placing the projects with the buckets inside a service perimeter and defining an access level that allows access only from the office network CIDR, access to the buckets is blocked from outside that network even if IAM permissions exist. Firewall rules, VPNs, or scheduled IAM changes do not control access to Google-managed services at this level and do not address data exfiltration risk.
Question 153
Your company uses the Firewall Insights feature in the Google Network Intelligence Center. You have several firewall rules applied to Compute Engine instances.
You need to evaluate the efficiency of the applied firewall ruleset. When you bring up the Firewall Insights page in the Google Cloud Console, you notice that there are no log rows to display. What should you do to troubleshoot the issue?
A. Enable Virtual Private Cloud (VPC) flow logging.
B. Enable Firewall Rules Logging for the firewall rules you want to monitor.
C. Verify that your user account is assigned the compute.networkAdmin Identity and Access Management (IAM) role.
D. Install the Google Cloud SDK, and verify that there are no Firewall logs in the command line output.
Show Answer
Correct Answer: B
Explanation: Firewall Insights relies on firewall rule logs to analyze rule usage and efficiency. If no log rows are displayed, it indicates that firewall rules logging is not enabled. By enabling Firewall Rules Logging on the relevant firewall rules, logs are generated and Firewall Insights can display data. VPC flow logs, IAM roles, or SDK checks do not address missing Firewall Insights data.
Question 154
You are managing an application deployed on Cloud Run for Anthos, and you need to define a strategy for deploying new versions of the application. You want to evaluate the new code with a subset of production traffic to decide whether to proceed with the rollout. What should you do?
A. Deploy a new revision to Cloud Run with the new version. Configure traffic percentage between revisions.
B. Deploy a new service to Cloud Run with the new version. Add a Cloud Load Balancing instance in front of both services.
C. In the Google Cloud Console page for Cloud Run, set up continuous deployment using Cloud Build for the development branch. As part of the Cloud Build trigger, configure the substitution variable TRAFFIC_PERCENTAGE with the percentage of traffic you want directed to a new version.
D. In the Google Cloud Console, configure Traffic Director with a new Service that points to the new version of the application on Cloud Run. Configure Traffic Director to send a small percentage of traffic to the new version of the application.
Show Answer
Correct Answer: A
Explanation: Cloud Run for Anthos supports revision-based deployments with traffic splitting. Deploying a new revision of the same service automatically creates a new revision, and you can configure a percentage of production traffic to be routed to it. This enables canary or gradual rollouts to evaluate the new version before full rollout, without additional infrastructure.
Question 155
You are implementing a single Cloud SQL MySQL second-generation database that contains business-critical transaction data. You want to ensure that the minimum amount of data is lost in case of catastrophic failure. Which two features should you implement? (Choose two.)
A. Sharding
B. Read replicas
C. Binary logging
D. Automated backups
E. Semisynchronous replication
Show Answer
Correct Answer: C, D
Explanation: To minimize data loss (low RPO) for a single Cloud SQL MySQL instance, you need point-in-time recovery. Automated backups provide regular full backups as a recovery base, and binary logging records all changes between backups so you can restore to just before a catastrophic failure. Other options focus on scaling or availability, not data recovery.
Question 156
Your company has an application running on multiple Compute Engine instances. You need to ensure that the application can communicate with an on-premises service that requires high throughput via internal IPs, while minimizing latency. What should you do?
A. Use OpenVPN to configure a VPN tunnel between the on-premises environment and Google Cloud.
B. Configure a direct peering connection between the on-premises environment and Google Cloud.
C. Use Cloud VPN to configure a VPN tunnel between the on-premises environment and Google Cloud.
D. Configure a Cloud Dedicated Interconnect connection between the on-premises environment and Google Cloud.
Show Answer
Correct Answer: D
Explanation: The requirement is high throughput, low latency, and communication over internal IPs between on‑premises and Google Cloud. Cloud Dedicated Interconnect provides a private, dedicated physical connection to Google’s network, supporting very high bandwidth and consistently low latency while enabling VPC internal IP connectivity. VPN options (OpenVPN or Cloud VPN) traverse the public internet and cannot guarantee the required throughput or latency, and Direct Peering does not provide VPC internal IP connectivity.
Question 157
You are monitoring Google Kubernetes Engine (GKE) clusters in a Cloud Monitoring workspace. As a Site Reliability Engineer (SRE), you need to triage incidents quickly. What should you do?
A. Navigate the predefined dashboards in the Cloud Monitoring workspace, and then add metrics and create alert policies.
B. Navigate the predefined dashboards in the Cloud Monitoring workspace, create custom metrics, and install alerting software on a Compute Engine instance.
C. Write a shell script that gathers metrics from GKE nodes, publish these metrics to a Pub/Sub topic, export the data to BigQuery, and make a Data Studio dashboard.
D. Create a custom dashboard in the Cloud Monitoring workspace for each incident, and then add metrics and create alert policies.
Show Answer
Correct Answer: A
Explanation: For rapid incident triage in GKE, SRE best practice is to use Cloud Monitoring’s predefined GKE dashboards, which provide immediate visibility into cluster, node, pod, and workload health without setup time. You can then add relevant metrics and create alert policies to detect and respond to issues proactively. Creating new dashboards per incident or building custom metric pipelines adds unnecessary delay and complexity, which conflicts with the goal of quick triage.
$19
Get all 305 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.