Professional Cloud Architect Free Practice Questions — Page 2
Question 11
Your company uses a custom-built application running on a Compute Engine virtual machine (VM). This application processes real-time sales data and writes it to a zonal Persistent Disk. A recent internal audit requires that you implement a backup and recovery plan to protect against zonal failures. Your company has a strict policy that all backup data must be retained for at least 90 days and stored in a separate project with limited access. You need to implement a fully automated backup solution that meets these requirements with minimal operational overhead. What should you do?
A. Write a script to create daily backups of the Persistent Disk. Copy the backups to a different zone and apply a label to each snapshot to indicate the deletion date.
B. Use gcloud commands to create snapshots of the Persistent Disk. Store the snapshots in a regional Cloud Storage bucket and configure a lifecycle rule to delete objects older than 90 days.
C. Create a snapshot schedule to automatically create Persistent Disk snapshots and use a script to move and store them in a multi-regional Cloud Storage bucket.
D. Use the Backup and Disaster Recovery (DR) service to create a backup plan. Configure the backup plan to take daily snapshots and store them in a backup vault with a 90-day retention policy.
Show Answer
Correct Answer: D
Explanation: Backup and Disaster Recovery provides a managed, automated backup solution with backup plans, backup vaults, configurable retention policies, and cross-project storage capabilities. It minimizes operational overhead while satisfying the requirements for automated daily backups, 90-day retention, and storing backups in a separate project with restricted access.
Question 12
Your team plans to use Vertex AI to develop and deploy machine learning models for various use cases for fraud detection, product recommendations, and customer churn prediction. You want to enhance the security posture of the Vertex AI and Workbench environment by restricting data exfiltration. What should you do?
A. Enable Private Google Access for the VPC network to allow Vertex AI services to access public Google services without traversing the public internet.
B. Enable VPC Flow Logs to monitor network traffic to and from Vertex AI services and to identify suspicious activity.
C. Create a service perimeter and include ml.googleapis.com and document.googleapis.com as protected services.
D. Create a service perimeter and include aiplatform.googleapis.com and notebooks.googleapis.com as protected services.
Show Answer
Correct Answer: D
Explanation: To restrict data exfiltration from Vertex AI and Vertex AI Workbench, use VPC Service Controls by creating a service perimeter around the relevant Google APIs. The correct protected services are aiplatform.googleapis.com for Vertex AI and notebooks.googleapis.com for Vertex AI Workbench. Private Google Access and VPC Flow Logs do not provide data exfiltration protection, and ml.googleapis.com/document.googleapis.com are not the appropriate APIs for Vertex AI and Workbench.
Question 13
You are deploying a highly confidential data processing workload on Google Cloud. Your company’s compliance framework mandates that cryptographic keys used for encrypting data at rest must be generated and stored exclusively within a validated Hardware Security Module (HSM). You want to use a fully integrated Google Cloud managed service to handle the lifecycle and usage of these keys. What should you do?
A. Use Customer-Supplied Encryption Keys (CSEK) by providing your on-premises generated key with each API request.
B. Import your on-premises HSM key material into a Cloud KMS key with the SOFTWARE protection level.
C. Create a new key in Cloud Key Management Service (Cloud KMS) with the HSM protection level.
D. Configure Cloud External Key Manager (Cloud EKM) to connect to your on-premises HSM.
Show Answer
Correct Answer: C
Explanation: The requirement is that keys be generated and stored exclusively within a validated HSM while using a fully integrated Google Cloud managed service. Cloud KMS keys with the HSM protection level are generated inside Google-managed FIPS-validated HSMs and remain protected within the HSM boundary. CSEK relies on customer-managed external keys, importing into a SOFTWARE protection key does not satisfy HSM-only generation/storage, and Cloud EKM uses external HSMs rather than Google Cloud's fully integrated managed HSM service.
Question 14
You are monitoring Google Kubernetes Engine (GKE) clusters in a Cloud Monitoring workspace. As a Site Reliability Engineer (SRE), you need to triage incidents quickly. What should you do?
A. 1. Navigate the predefined dashboards in the Cloud Monitoring workspace. 2. Add metrics and create alert policies.
B. 1. Write a shell script that gathers metrics from GKE nodes, and publish these metrics to a Pub/Sub topic. 2. Export the data to BigQuery. and make a Data Studio dashboard.
C. 1. Create a custom dashboard in the Cloud Monitoring workspace for each incident. 2. Add metrics and create alert policies.
D. 1. Navigate the predefined dashboards in the Cloud Monitoring workspace. 2. Create custom metrics and install alerting software on a Compute Engine instance.
Show Answer
Correct Answer: A
Explanation: For rapid incident triage in GKE, Cloud Monitoring's predefined dashboards provide immediate visibility into cluster, node, workload, and Kubernetes metrics. You can then add relevant metrics and create alerting policies within Cloud Monitoring. The other options involve unnecessary custom tooling, creating dashboards during incidents, or external alerting mechanisms instead of the native monitoring workflow.
Question 15
Your organization uses Google Kubernetes Engine (GKE) and Amazon Elastic Kubernetes Service (EKS) to manage a complex Kubernetes environment across multiple cloud providers. You need to deploy a solution that streamlines configuration management, enforces security policies, and ensures consistent application deployment across all of the environments. You want to follow Google-recommended practices. What should you do?
A. Leverage Argo CD for GitOps-based continuous delivery and Open Policy Agent (OPA) for policy enforcement, and develop a controller for multi-cluster configuration management.
B. Deploy Crossplane for managing cloud resources as Kubernetes objects, FluxCD for GitOps-based configuration synchronization, and Kyverno for policy enforcement.
C. Deploy Kustomize for configuration customization, Config Sync with multiple Git repositories, and a script to enforce security policies.
D. Utilize Config Sync as part of GKE to synchronize configurations from a centralized repository, and utilize Policy Controller to enforce policies using OPA Gatekeeper.
Show Answer
Correct Answer: D
Explanation: Google-recommended multi-cluster configuration management for GKE and hybrid/multi-cloud environments is Config Sync combined with Policy Controller (OPA Gatekeeper), both part of GKE Enterprise/Anthos Config Management. Config Sync provides GitOps-style synchronization across registered clusters, including supported EKS clusters, while Policy Controller enforces consistent security and governance policies. The other options rely on third-party tools or custom scripting/controllers rather than Google's recommended integrated approach.
Question 16
Your organization is going to migrate applications to Kubernetes and use managed cloud services to deploy applications. Your team is new to Kubernetes and wants to quickly onboard engineers. You want to reduce operational overhead, so the engineering team can focus on developing consumer requirements instead of maintaining the infrastructure. What should you do?
A. Package your application into a Docker image, and deploy it to Kubernetes on Compute Engine.
B. Leverage Cloud Build to create a container image, and deploy it automatically to Kubernetes on Compute Engine.
C. Assess application and dependencies for containerization Develop a migration strategy for deployment to GKE in Standard mode.
D. Assess application and dependencies for containerization. Develop a migration strategy for deployment to GKE in Autopilot mode.
Show Answer
Correct Answer: D
Explanation: GKE Autopilot is designed to minimize operational overhead by managing the Kubernetes infrastructure, including nodes, scaling, and many operational tasks. For a team new to Kubernetes that wants to onboard quickly and focus on application development rather than cluster management, assessing the application for containerization and planning a migration to GKE Autopilot is the best fit. Options A and B use Kubernetes on Compute Engine, which requires significantly more infrastructure management, while GKE Standard still requires node management compared to Autopilot.
Question 17
You need to build and deploy a containerized web application to Google Cloud. The application is very write-heavy and requires a relational database as its data store. The application needs to be highly available in multiple cloud regions. You want to minimize operational overhead while following Google-recommended practices. What should you do?
A. Deploy the application to GKE clusters in multiple regions and expose the application endpoint with a regional load balancer. Use Cloud SQL as the database.
B. Deploy the application to Cloud Run in multiple regions behind a global HTTPS load balancer. Use Spanner as the database.
C. Deploy the application to a GKE standard cluster behind a global HTTPS load balancer. Use Firestore as the database with multi-region locations enabled.
D. Deploy the application to a GKE standard cluster with a global ingress to expose the application endpoint. Use Bigtable as the database.
Show Answer
Correct Answer: B
Explanation: The requirements are containerized deployment, relational database, heavy writes, multi-region high availability, and minimal operational overhead. Cloud Run provides a fully managed serverless platform for containers with low operational overhead and can be deployed in multiple regions behind a global HTTPS load balancer. Cloud Spanner is a fully managed relational database designed for horizontal scaling, strong consistency, and multi-region high availability, making it the recommended choice over Cloud SQL for this workload. Firestore and Bigtable are NoSQL databases, and Cloud SQL does not provide the same multi-region write availability and scalability as Spanner.
Question 18
Your ecommerce web application includes many products with pictures and videos. You need to improve the application's page load speed and reduce the latency for customer requests. What should you do? (Choose two.)
A. Deploy your application to Cloud Run and enable concurrency.
B. Use Memorystore tor Redis.
C. Implement CDN with the application's external HTTPS load balancer.
D. Change the database from Bigtable to Spanner.
E. Deploy your application to a GKE Autopilot cluster instead of a regular GKE cluster.
Show Answer
Correct Answer: B, C
Explanation: A CDN attached to the external HTTPS load balancer caches static assets such as product images and videos close to users, reducing latency and improving page load speed. Memorystore for Redis can cache frequently accessed application data (such as product metadata and sessions), reducing backend/database load and speeding responses. The other options do not directly address static content delivery or request latency as effectively for this scenario.
Question 19
Your company wants to optimize Google Cloud costs for their development and staging environments. These environments are workstations used by developers Monday through Friday, 9:00 AM to 6:00 PM local time. Currently, the environments run on a fleet of nl-standard-4 Compute Engine instances that operate 24/7, leading to a high monthly cost for resources that are idle more than 70% of the time. You need to implement a solution that significantly reduces the monthly cost of these non-production environments without impacting the development team's productivity during work hours. What should you do?
A. Schedule the virtual machines to start and stop to match your team’s work schedule.
B. Purchase three-year committed use discounts (CUDs) for the existing nl-standard-4 instances.
C. Upgrade all instances to the N2 machine series.
D. Re-architect the environments to run on a regional managed instance group (MIG) with autoscaling enabled.
Show Answer
Correct Answer: A
Explanation: Scheduling development and staging VMs to automatically start before business hours and stop after business hours eliminates most idle runtime while preserving availability during working hours. Committed use discounts still charge for committed capacity, upgrading machine series does not address idle time, and a managed instance group with autoscaling is not the primary cost optimization for fixed developer workstations that are simply unused outside office hours.
Question 20
You manage a highly distributed, hybrid- and multi-cloud IT environment, and your developers rely heavily on Prometheus for their workflows. You need a cloud-based, highly scalable, low-maintenance enterprise solution that supports Prometheus Query Language (PromQL) queries, quick metric viewing, and efficient issue diagnosis. What should you do?
A. Deploy a Prometheus operator in your existing Kubernetes and Serverless setup across multi-cloud environments.
B. Set up Cloud Monitoring as a single pane of glass across multi-cloud environments.
C. Enable Google Cloud Managed Service for Prometheus to monitor and alert on your workloads at scale.
D. Build a SaaS-based, Prometheus-compatible solution to display metrics for each cloud in a customizable way.
Show Answer
Correct Answer: C
Explanation: Google Cloud Managed Service for Prometheus is a fully managed, cloud-based, highly scalable, low-maintenance service designed for Prometheus workloads. It supports PromQL, integrates with Cloud Monitoring for fast metric exploration and troubleshooting, and is intended for monitoring and alerting across large-scale hybrid and multi-cloud environments.
$19
Get all 306 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.