Professional Cloud Architect Free Practice Questions — Page 16
Question 158
Your organization has decided to restrict the use of external IP addresses on instances to only approved instances. You want to enforce this requirement across all of your Virtual Private Clouds (VPCs). What should you do?
A. Remove the default route on all VPCs. Move all approved instances into a new subnet that has a default route to an internet gateway.
B. Create a new VPC in custom mode. Create a new subnet for the approved instances, and set a default route to the internet gateway on this new subnet.
C. Implement a Cloud NAT solution to remove the need for external IP addresses entirely.
D. Set an Organization Policy with a constraint on constraints/compute.vmExternalIpAccess. List the approved instances in the allowedValues list.
Show Answer
Correct Answer: D
Explanation: The correct way to enforce restrictions on external IP address usage across all projects and VPCs in an organization is to use the Organization Policy constraint `constraints/compute.vmExternalIpAccess`. You can allow only explicitly approved VM instances by listing them in `allowedValues`. Options A and B misuse VPC routing, which does not control assignment of external IPs, and C changes outbound connectivity but does not enforce that only approved instances may have external IP addresses.
Question 159
You have an application that runs in Google Kubernetes Engine (GKE). Over the last 2 weeks, customers have reported that a specific part of the application returns errors very frequently. You currently have no logging or monitoring solution enabled on your GKE cluster. You want to diagnose the problem, but you have not been able to replicate the issue. You want to cause minimal disruption to the application. What should you do?
A. 1. Update your GKE cluster to use Cloud Operations for GKE. 2. Use the GKE Monitoring dashboard to investigate logs from affected Pods.
B. 1. Create a new GKE cluster with Cloud Operations for GKE enabled. 2. Migrate the affected Pods to the new cluster, and redirect traffic for those Pods to the new cluster. 3. Use the GKE Monitoring dashboard to investigate logs from affected Pods.
C. 1. Update your GKE cluster to use Cloud Operations for GKE, and deploy Prometheus. 2. Set an alert to trigger whenever the application returns an error.
D. 1. Create a new GKE cluster with Cloud Operations for GKE enabled, and deploy Prometheus. 2. Migrate the affected Pods to the new cluster, and redirect traffic for those Pods to the new cluster. 3. Set an alert to trigger whenever the application returns an error.
Show Answer
Correct Answer: A
Explanation: Enable Cloud Operations for GKE on the existing cluster to add logging and monitoring with minimal disruption, then use the collected logs and monitoring views to investigate the intermittent errors when they recur. Creating a new cluster introduces unnecessary disruption, and deploying Prometheus solely for this scenario is not required because Cloud Operations provides native logging and monitoring capabilities for diagnosis.
Question 160
Your company has a project in Google Cloud with three Virtual Private Clouds (VPCs). There is a Compute Engine instance on each VPC. Network subnets do not overlap and must remain separated. The network configuration is shown below.
Instance #1 is an exception and must communicate directly with both Instance #2 and Instance #3 via internal IPs. How should you accomplish this?
A. Create a cloud router to advertise subnet #2 and subnet #3 to subnet #1.
B. Add two additional NICs to Instance #1 with the following configuration: ג€¢ NIC1 ג—‹ VPC: VPC #2 ג—‹ SUBNETWORK: subnet #2 ג€¢ NIC2 ג—‹ VPC: VPC #3 ג—‹ SUBNETWORK: subnet #3 Update firewall rules to enable traffic between instances.
C. Create two VPN tunnels via CloudVPN: ג€¢ 1 between VPC #1 and VPC #2. ג€¢ 1 between VPC #2 and VPC #3. Update firewall rules to enable traffic between the instances.
D. Peer all three VPCs: ג€¢ Peer VPC #1 with VPC #2. ג€¢ Peer VPC #2 with VPC #3. Update firewall rules to enable traffic between the instances.
Show Answer
Correct Answer: B
Explanation: Using multiple network interfaces allows a single VM to connect to multiple VPC networks without connecting those VPCs to each other. This satisfies the requirement that only Instance #1 communicate directly with Instance #2 and Instance #3 over internal IPs while keeping the VPCs otherwise separated. Cloud Router does not provide this connectivity, the VPN option does not connect VPC #1 directly to VPC #3 as described, and the proposed peering topology is not appropriate because VPC peering is non-transitive and the listed peerings would not provide VPC #1-to-VPC #3 connectivity. Firewall rules must allow the desired traffic on each interface.
Question 161
Your company is designing its application landscape on Compute Engine. Whenever a zonal outage occurs, the application should be restored in another zone as quickly as possible with the latest application data. You need to design the solution to meet this requirement. What should you do?
A. Create a snapshot schedule for the disk containing the application data. Whenever a zonal outage occurs, use the latest snapshot to restore the disk in the same zone.
B. Configure the Compute Engine instances with an instance template for the application, and use a regional persistent disk for the application data. Whenever a zonal outage occurs, use the instance template to spin up the application in another zone in the same region. Use the regional persistent disk for the application data.
C. Create a snapshot schedule for the disk containing the application data. Whenever a zonal outage occurs, use the latest snapshot to restore the disk in another zone within the same region.
D. Configure the Compute Engine instances with an instance template for the application, and use a regional persistent disk for the application data. Whenever a zonal outage occurs, use the instance template to spin up the application in another region. Use the regional persistent disk for the application data.
Show Answer
Correct Answer: B
Explanation: Regional Persistent Disks synchronously replicate data across two zones within the same region, providing the latest application data during a zonal outage (near-zero RPO). Using an instance template allows rapid recreation of the VM in the surviving zone, minimizing recovery time. Snapshots are point-in-time backups and may lose recent writes, while regional persistent disks cannot be attached across regions, so option D is invalid.
Question 162
You have developed a non-critical update to your application that is running in a managed instance group, and have created a new instance template with the update that you want to release. To prevent any possible impact to the application, you don't want to update any running instances. You want any new instances that are created by the managed instance group to contain the new update. What should you do?
A. Start a new rolling restart operation.
B. Start a new rolling replace operation.
C. Start a new rolling update. Select the Proactive update mode.
D. Start a new rolling update. Select the Opportunistic update mode.
Show Answer
Correct Answer: D
Explanation: Opportunistic rolling updates update the instance template used by the managed instance group but do not automatically update existing running instances. Existing VMs remain unchanged, while any newly created instances (for example due to autoscaling or manual resize) are created from the new instance template. Proactive updates, by contrast, automatically roll the update out to existing instances.
Question 163
You need to deploy a stateful workload on Google Cloud. The workload can scale horizontally, but each instance needs to read and write to the same POSIX filesystem. At high load, the stateful workload needs to support up to 100 MB/s of writes. What should you do?
A. Use a persistent disk for each instance.
B. Use a regional persistent disk for each instance.
C. Create a Cloud Filestore instance and mount it in each instance.
D. Create a Cloud Storage bucket and mount it in each instance using gcsfuse.
Show Answer
Correct Answer: C
Explanation: The workload requires a shared POSIX-compliant filesystem that can be mounted by multiple instances and support concurrent read/write access. Persistent Disks (including regional PDs) are block devices intended for attachment to individual instances and are not the appropriate shared POSIX filesystem for horizontally scaled workloads. Cloud Storage mounted with gcsfuse is object storage and is not POSIX compliant. Cloud Filestore provides a managed NFS, POSIX-compliant shared filesystem suitable for this use case and can support the required throughput with the appropriate service tier.
Question 164
You are working at a sports association whose members range in age from 8 to 30. The association collects a large amount of health data, such as sustained injuries. You are storing this data in BigQuery. Current legislation requires you to delete such information upon request of the subject. You want to design a solution that can accommodate such a request. What should you do?
A. Use a unique identifier for each individual. Upon a deletion request, delete all rows from BigQuery with this identifier.
B. When ingesting new data in BigQuery, run the data through the Data Loss Prevention (DLP) API to identify any personal information. As part of the DLP scan, save the result to Data Catalog. Upon a deletion request, query Data Catalog to find the column with personal information.
C. Create a BigQuery view over the table that contains all data. Upon a deletion request, exclude the rows that affect the subject's data from this view. Use this view instead of the source table for all analysis tasks.
D. Use a unique identifier for each individual. Upon a deletion request, overwrite the column with the unique identifier with a salted SHA256 of its value.
Show Answer
Correct Answer: A
Explanation: Use a unique identifier for each individual so all records associated with that person can be located and deleted when a valid deletion request is received. This directly satisfies the requirement to remove the subject's stored health data. The DLP/Data Catalog option helps classify or locate sensitive fields but does not itself provide a deletion strategy. A view only hides data rather than deleting it, and hashing the identifier is pseudonymization, not deletion.
Question 165
Your company has sensitive data in Cloud Storage buckets. Data analysts have Identity Access Management (IAM) permissions to read the buckets. You want to prevent data analysts from retrieving the data in the buckets from outside the office network. What should you do?
A. 1. Create a VPC Service Controls perimeter that includes the projects with the buckets. 2. Create an access level with the CIDR of the office network.
B. 1. Create a firewall rule for all instances in the Virtual Private Cloud (VPC) network for source range. 2. Use the Classless Inter-domain Routing (CIDR) of the office network.
C. 1. Create a Cloud Function to remove IAM permissions from the buckets, and another Cloud Function to add IAM permissions to the buckets. 2. Schedule the Cloud Functions with Cloud Scheduler to add permissions at the start of business and remove permissions at the end of business.
D. 1. Create a Cloud VPN to the office network. 2. Configure Private Google Access for on-premises hosts.
Show Answer
Correct Answer: A
Explanation: VPC Service Controls is designed to mitigate data exfiltration from supported Google Cloud services such as Cloud Storage. By placing the projects containing the buckets inside a service perimeter and creating an Access Context Manager access level that allows only the office network CIDR, analysts with IAM permissions can access the buckets only from the authorized network. Firewall rules do not control access to Cloud Storage, scheduled IAM changes do not enforce network location, and Cloud VPN with Private Google Access alone does not restrict access by source network.
Question 166
Your company uses the Firewall Insights feature in the Google Network Intelligence Center. You have several firewall rules applied to Compute Engine instances.
You need to evaluate the efficiency of the applied firewall ruleset. When you bring up the Firewall Insights page in the Google Cloud Console, you notice that there are no log rows to display. What should you do to troubleshoot the issue?
A. Enable Virtual Private Cloud (VPC) flow logging.
B. Enable Firewall Rules Logging for the firewall rules you want to monitor.
C. Verify that your user account is assigned the compute.networkAdmin Identity and Access Management (IAM) role.
D. Install the Google Cloud SDK, and verify that there are no Firewall logs in the command line output.
Show Answer
Correct Answer: B
Explanation: Firewall Insights relies on Firewall Rules Logging data. If the Firewall Insights page shows no log rows, the primary troubleshooting step is to enable Firewall Rules Logging on the firewall rules you want to analyze. VPC Flow Logs are a different logging feature and are not a substitute for firewall rule logs. IAM permissions or the Cloud SDK would not create the missing log data.
Question 167
You are managing an application deployed on Cloud Run for Anthos, and you need to define a strategy for deploying new versions of the application. You want to evaluate the new code with a subset of production traffic to decide whether to proceed with the rollout. What should you do?
A. Deploy a new revision to Cloud Run with the new version. Configure traffic percentage between revisions.
B. Deploy a new service to Cloud Run with the new version. Add a Cloud Load Balancing instance in front of both services.
C. In the Google Cloud Console page for Cloud Run, set up continuous deployment using Cloud Build for the development branch. As part of the Cloud Build trigger, configure the substitution variable TRAFFIC_PERCENTAGE with the percentage of traffic you want directed to a new version.
D. In the Google Cloud Console, configure Traffic Director with a new Service that points to the new version of the application on Cloud Run. Configure Traffic Director to send a small percentage of traffic to the new version of the application.
Show Answer
Correct Answer: A
Explanation: Cloud Run for Anthos supports gradual rollouts by deploying a new revision of an existing service and splitting traffic between revisions. This enables canary testing with a subset of production traffic before completing the rollout. Creating a separate service with a load balancer is unnecessary, Cloud Build trigger variables are not the mechanism for revision traffic splitting, and Traffic Director is not used for traffic management between revisions of the same Cloud Run service.
$19
Get all 306 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.