Professional Cloud Architect Free Practice Questions — Page 2
Question 3
A large, multinational corporation is migrating to Google Cloud. The company has several distinct business units: Finance, Marketing, and Research and Development (R&D). The central security team has mandated governance requirements for each business unit:
• Finance: Must be restricted to deploying resources only in specific, compliant regions (us-central1 and europe-west2). Access to their projects must be tightly controlled by a dedicated finance-admins group.
• Marketing: Needs separate environments for production and development, with different teams managing each environment.
• R&D: Requires maximum flexibility to experiment with new services but must be completely isolated to prevent any impact on production systems.
• Global Auditing: A central compliance team requires read-only access to view all resources across the entire company for auditing purposes.
You need to design a resource hierarchy that enforces these security policies at scale according to the Google Cloud Well-Architected Framework while providing the correct level of autonomy for each business unit. What should you do?
A. Create a folder for each department under the root Organization node. Apply the resource location Organization Policy on the Finance folder. Within the Marketing folder, create separate projects for mktg-prod and mktg-dev. Grant the compliance team the roles/viewer role at the Organization level.
B. Place all projects directly under the Organization node. Use network tags and service accounts to enforce security boundaries between the different department workloads. Apply the resource location Organization Policy on the Finance project.
C. Create separate Google Cloud Organizations for each department (Finance, Marketing, and R&D). Grant the compliance team the roles/viewer role for each organization.
D. Create a single project for each department. Apply the resource location policy directly to the Finance project. Grant the compliance team the roles/browser role on each project individually.
Show Answer
Correct Answer: A
Explanation: Using folders to represent business units enables inheritance of IAM and Organization Policies. Applying the resource location constraint at the Finance folder restricts all Finance projects to compliant regions, and Finance-specific IAM can be granted at the folder. Marketing can separate production and development into distinct projects under its folder, allowing different teams to manage each. R&D receives its own isolated folder for autonomy. Granting read-only access at the Organization level provides centralized auditing across all resources. The other options either bypass the hierarchy, require unnecessary multiple Organizations, or manage permissions and policies at an unscalable project level.
Question 4
You are developing a deep learning model that requires high-performance access to large volumes of media data currently stored in Cloud Storage. Model training will be executed on multiple VM instances with GPUs attached, but your application must interact with the data as if it were on the local file system. You need to minimize complexity and cost. What should you do?
A. Copy the data from Cloud Storage to Filestore, and then mount the Filestore volume as a local file system on your VM instances.
B. Create a shared persistent disk, attach the disk to your VM instances, and load data from the Cloud Storage bucket.
C. Use the gcsfuse command line tool to mount the Cloud Storage bucket as a local file system, and perform read/write operations in your bucket using standard file system semantics.
D. Use the gsutil command line tool to download the data to your VM instances.
Show Answer
Correct Answer: C
Explanation: gcsfuse mounts a Cloud Storage bucket as a POSIX-like file system, allowing applications to access bucket objects through standard file system operations without copying data or provisioning additional storage. This minimizes operational complexity and cost compared with Filestore or downloading data locally. Shared persistent disks are not designed to expose Cloud Storage directly.
Question 4
You deploy your custom Java application to Google App Engine. It fails to deploy and gives you the following stack trace.
What should you do?
A. Upload missing JAR files and redeploy your application.
B. Digitally sign all of your JAR files and redeploy your application
C. Recompile the CLoakedServlet class using and MD5 hash instead of SHA1
Show Answer
Correct Answer: B
Explanation: The SHA1 digest error means the class content does not match the digest recorded in its JAR’s manifest, commonly because the JAR was modified or its signature metadata is stale. Rebuild and digitally sign the affected JARs so their integrity metadata matches, then redeploy. Missing JARs or recompiling the class with MD5 would not address the mismatch.
Question 4
TerramEarth's 20 million vehicles are scattered around the world. Based on the vehicle's location, its telemetry data is stored in a Google Cloud Storage (GCS) regional bucket (US, Europe, or Asia). The CTO has asked you to run a report on the raw telemetry data to determine why vehicles are breaking down after 100 K miles. You want to run this job on all the data.
What is the most cost-effective way to run this job?
A. Move all the data into 1 zone, then launch a Cloud Dataproc cluster to run the job
B. Move all the data into 1 region, then launch a Google Cloud Dataproc cluster to run the job
C. Launch a cluster in each region to preprocess and compress the raw data, then move the data into a multi-region bucket and use a Dataproc cluster to finish the job
D. Launch a cluster in each region to preprocess and compress the raw data, then move the data into a region bucket and use a Cloud Dataproc cluster to finish the job
Show Answer
Correct Answer: D
Explanation: Preprocess and compress the telemetry near its regional source to reduce the volume transferred across regions. Then consolidate the compressed data in a single regional bucket and run the final Dataproc job there. A regional bucket avoids the added cost of multi-region storage, which is not needed for this batch analysis.
Question 5
A news feed web service has the following code running on Google App Engine. During peak load, users report that they can see news articles they already viewed.
What is the most likely cause of this problem?
A. The session variable is local to just a single instance
B. The session variable is being overwritten in Cloud Datastore
C. The URL of the API needs to be modified to prevent caching
D. The HTTP Expires header needs to be set to -1 stop caching
Show Answer
Correct Answer: A
Explanation: The `sessions` dictionary is stored in the application process’s memory, so each App Engine instance has its own copy. At peak load, requests may be served by different instances, which won’t share the user’s viewed-article history. Store session data in shared, persistent storage instead.
Question 5
Your company has successfully migrated to the cloud and wants to analyze their data stream to optimize operations. They do not have any existing code for this analysis, so they are exploring all their options. These options include a mix of batch and stream processing, as they are running some hourly jobs and live- processing some data as it comes in.
Which technology should they use for this?
A. Google Cloud Dataproc
B. Google Cloud Dataflow
C. Google Container Engine with Bigtable
D. Google Compute Engine with Google BigQuery
Show Answer
Correct Answer: B
Explanation: Google Cloud Dataflow supports both batch processing (such as hourly jobs) and real-time stream processing in a managed service, making it the best fit for building new data pipelines without managing processing infrastructure.
Question 5
You are designing a central, automated infrastructure deployment process for your organization using Terraform and Cloud Build. The security team prohibits the use of long-lived, static service account keys in any CI/CD pipeline. Additionally, while developers can propose infrastructure changes for peer review, they must not have permissions to directly apply changes in the production project. You need to design a secure and automated workflow for applying Terraform changes that meets the security team's requirements and ensures proper governance. What should you do?
A. Configure the Cloud Build pipeline to use service account impersonation. Set up a trigger that automatically runs terraform apply when a pull request is merged.
B. Use service account impersonation in Cloud Build. Configure the pipeline to run terraform plan on pull requests, and require manual approval before running terraform apply.
C. Configure the pipeline to only run terraform plan. After a pull request is approved, have an authorized developer run terraform apply from a secured workstation.
D. Create a privileged service account and store its JSON key in Secret Manager. Configure the Cloud Build pipeline to fetch this key during execution to authenticate Terraform.
Show Answer
Correct Answer: B
Explanation: Using service account impersonation avoids long-lived service account keys by issuing short-lived credentials at runtime. Running terraform plan on pull requests supports peer review without granting developers production apply permissions. Requiring a manual approval before terraform apply provides a governance checkpoint while allowing the privileged Cloud Build pipeline to perform the deployment.
Question 6
To speed up data retrieval, more vehicles will be upgraded to cellular connections and be able to transmit data to the ETL process. The current FTP process is error-prone and restarts the data transfer from the start of the file when connections fail, which happens often. You want to improve the reliability of the solution and minimize data transfer time on the cellular connections.
What should you do?
A. Use one Google Container Engine cluster of FTP servers. Save the data to a Multi-Regional bucket. Run the ETL process using data in the bucket
B. Use multiple Google Container Engine clusters running FTP servers located in different regions. Save the data to Multi-Regional buckets in US, EU, and Asia. Run the ETL process using the data in the bucket
C. Directly transfer the files to different Google Cloud Multi-Regional Storage bucket locations in US, EU, and Asia using Google APIs over HTTP(S). Run the ETL process using the data in the bucket
D. Directly transfer the files to a different Google Cloud Regional Storage bucket location in US, EU, and Asia using Google APIs over HTTP(S). Run the ETL process to retrieve the data from each Regional bucket
Show Answer
Correct Answer: D
Explanation: Use Google Cloud Storage’s HTTP(S) APIs with regional buckets near the vehicles. Resumable uploads let a failed transfer continue from where it stopped instead of restarting the whole file, improving reliability and reducing cellular data transfer time. Regional buckets are also a better fit for data feeding analytics pipelines than multi-regional buckets.
Question 6
The migration of JencoMart's application to Google Cloud Platform (GCP) is progressing too slowly. The infrastructure is shown in the diagram. You want to maximize throughput.
What are three potential bottlenecks? (Choose three.)
A. A single VPN tunnel, which limits throughput
B. A tier of Google Cloud Storage that is not suited for this task
C. A copy command that is not suited to operate over long distances
D. Fewer virtual machines (VMs) in GCP than on-premises machines
E. A separate storage layer outside the VMs, which is not suited for this task
F. Complicated internet connectivity between the on-premises infrastructure and GCP
Show Answer
Correct Answer: A, C, F
Explanation: A single VPN tunnel can cap transfer throughput. A basic copy command may perform poorly or require retries over a long-distance connection, and the internet path between the on-premises systems and GCP can introduce further bandwidth or latency constraints. The diagram does not establish that the VM count or storage arrangement is itself a bottleneck.
Sources:
https://cloud.google.com/blog/products/gcp/performing-vm-mass-migrations-to-google-cloud-with-velostrata
Question 6
Your employer is a financial services company that recently acquired a popular fintech startup. The startup's core application is a monolithic Python application running on a managed instance group of Compute Engine virtual machines with a single, large PostgreSQL database. Your development team struggles with slow deployment cycles, and the monolithic design of the startup's core application makes it difficult to integrate new. ML-powered fraud detection models. You need a long-term strategy that improves developer agility and positions the company to leverage Google Cloud's advanced data and AI capabilities for future innovations. What should you do?
A. Deploy the ML fraud detection model to a Vertex AI endpoint. Create a REST API for the model and modify the monolithic Python application to call this endpoint for real-time fraud analysis.
B. Containerize the application, deploy it to Google Kubernetes Engine (GKE), and migrate the PostgreSQL database to Cloud SQL for PostgreSQL.
C. Propose a phased, event-driven migration to a microservices architecture. Use Pub/Sub for asynchronous communication and deploy the fraud models on Vertex AI endpoints.
D. Migrate the PostgreSQL database to Cloud SQL for PostgreSQL. Replicate the data into BigQuery using Datastream, and then train and deploy the fraud detection models directly within BigQuery using BigQuery ML.
Show Answer
Correct Answer: C
Explanation: A phased migration from a monolith to an event-driven microservices architecture directly addresses slow deployment cycles and improves developer agility. Pub/Sub enables loose coupling and asynchronous communication, while Vertex AI endpoints provide a scalable managed platform for serving ML fraud detection models. This approach also positions the organization to adopt Google Cloud data and AI services over time without a risky full rewrite.
$19
Get all 307 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
