Professional Cloud Architect Free Practice Questions — Page 5
Question 32
Your team is running applications on a Google Kubernetes Engine (GKE) cluster with a private endpoint. You've set up a Cloud Deploy pipeline, but deployments to the GKE cluster are failing. You need to resolve the issue. What should you do?
A. Use VPC Service Controls with Cloud Build Update the Cloud pipeline to use Cloud Build as its execution environment.
B. Create a Cloud Build private pool in the default VPC. Use Cloud Build to deploy the applications to the GKE cluster.
C. Create a Cloud Build private pool that is peered with the same VPC network as your GKE cluster. Update the Cloud Deploy pipeline to use this private pool as its execution environment.
D. Create a custom target in Cloud Deploy Update the deploy pipeline to use the custom target for the application deployment.
Show Answer
Correct Answer: C
Explanation: GKE with a private endpoint is not reachable from the default Google-managed Cloud Build workers used by Cloud Deploy. To deploy successfully, the execution environment must have network connectivity to the cluster’s VPC. Creating a Cloud Build private pool that is peered with the same VPC as the GKE cluster provides that private network access. Updating the Cloud Deploy pipeline to use this private pool allows the render and deploy phases to reach the GKE private endpoint and resolves the deployment failures.
Question 33
A Cloud Run service running your serverless application is unable to connect to an AlloyDB database created with default configurations. You need to troubleshoot and resolve the issue as quickly as possible. What should you do?
A. Verify that the Cloud Run service and AlloyDB instance are in the same region.
B. Enable Direct VPC egress for the Cloud Run service, and send traffic directly to a VPC.
C. Disable the default public IP address of the AlloyDB instance, and use the private IP address in the connection string.
D. Create a Cloud SQL instance, and migrate the AlloyDB database to PostgreSQL on Cloud SQL.
Show Answer
Correct Answer: B
Explanation: AlloyDB instances are created with private IP addresses inside a VPC by default. Cloud Run services run outside the VPC unless explicitly configured. To allow Cloud Run to reach a private AlloyDB endpoint, you must enable VPC egress so traffic is routed into the VPC. Direct VPC egress is the fastest and simplest way to achieve this, making it the quickest resolution. Other options either don’t fix the networking path or are incorrect for AlloyDB defaults.
Question 34
You are managing a few hundred Ubuntu and Red Hat Enterprise Linux virtual machines running on Google Compute Engine (GCE). You need to patch the operating systems for those VMs periodically in a secure and scalable way. What should you do?
A. Create a Cloud Scheduler job to run a Bash script that securely connects to each VM and applies the patches.
B. Configure Config Sync, and install the Ops Agent on each VM. Schedule a patch job to apply patches on each VM.
C. Schedule a Cloud Build job, and use Cloud Deploy to run a patch job that applies patches on each VM.
D. Set up VM Manager, and install the OS Config agent on each VM. Schedule a patch job to apply patches on each VM.
Show Answer
Correct Answer: D
Explanation: For patching hundreds of Ubuntu and RHEL VMs on GCE securely and at scale, the native solution is VM Manager (OS Config). By installing the OS Config agent on each VM, you can centrally schedule patch deployments, automate reboots, and monitor patch compliance. This approach is designed specifically for VM OS management, scales to large fleets, and uses Google Cloud’s secure control plane. The other options are either manual, not intended for VM OS patching, or designed for Kubernetes/CI/CD rather than VM fleet management.
Question 35
You are designing a new insurance claims processing application that will be deployed on Google Kubernetes Engine (GKE) Your company’s compliance team requires a complete and non-repudiable audit trail for all administrative actions from day one. Your application must capture who deploys a new container image, who modifies the GKE cluster's configuration, and who interacts with running pods or Kubernetes secrets using kubectl. What should you do?
A. Enable Binary Authorization on the GKE cluster, and create a policy that requires all deployed container images to be signed by a trusted attestor.
B. Deploy a DaemonSet to every node in the GKE cluster that runs a logging agent to collect and forward all container logs to Cloud Logging.
C. Enable GKE Audit Logging to send Kubernetes API server logs to Cloud Logging, and ensure Cloud Audit Logs are enabled for the project.
D. Activate the Security Command Center Premium tier to analyze GKE logs and detect threats, vulnerabilities, and misconfigurations in real time.
Show Answer
Correct Answer: C
Explanation: The requirement is a complete, non-repudiable audit trail of all administrative actions: who deploys images, who changes cluster configuration, and who accesses pods or secrets via kubectl. GKE Audit Logging records all Kubernetes API server requests, including kubectl interactions with pods, secrets, and deployments. Cloud Audit Logs record Google Cloud administrative actions such as cluster configuration changes and IAM activity. Together they provide an authoritative, tamper-evident record of who did what and when from day one. The other options focus on image trust, application logs, or security analysis, not comprehensive auditing.
Question 36
You are designing the network architecture for a public-facing, containerized web application deployed on Cloud Run. All incoming traffic must be inspected by a Cloud Armor web application firewall (WAF) before reaching the application You plan to use an Application Load Balancer, which will have the Cloud Armor policy attached. You must ensure that all public requests pass through the load balancer and any attempt to access the Cloud Run service directly through its default *.run.app URL is blocked. What should you do?
A. Enable Identity-Aware Proxy (IAP) directly on the Cloud Run service to intercept and validate all incoming requests
B. Create a DNS entry to route traffic to Cloud Armor. Configure Cloud Armor to deny traffic from unknown IP addresses
C. Set the Cloud Run ingress to Allow internal traffic and Cloud Load Balancing, and use a serverless NEG backend on the load balancer
D. Configure a VPC firewall rule with a high priority to deny all traffic that does not originate from the load balancer
Show Answer
Correct Answer: C
Explanation: To ensure all traffic is inspected by Cloud Armor and prevent bypassing the load balancer, the Cloud Run service must not be publicly accessible via its default *.run.app URL. Setting Cloud Run ingress to "Internal and Cloud Load Balancing" blocks direct public access while still allowing traffic from an external Application Load Balancer. Using a serverless Network Endpoint Group (NEG) is required to connect the load balancer to Cloud Run, ensuring that all requests flow through the load balancer where the Cloud Armor WAF policy is enforced.
Question 37
Your organization uses separate Google Cloud projects for shared services, development, testing, and production.
• The shared services project hosts your private CI/CD runners and a central Artifact Registry
• The development, testing, and production projects host the GKE clusters where applications are deployed.
You need to design an architecture that allows the CI/CD runners to connect to the GKE clusters and the clusters to pull images from Artifact Registry, all using private IP addresses. However, direct network traffic between the development, testing, and production environments must be strictly prohibited. What should you do?
A. Create a separate VPC in each of the four projects. Connect each environment's VPC to the shared services VPC through VPC Network Peering.
B. Expose the resources in the shared services project using an external load balancer. Implement a firewall rule to limit access.
C. Create a separate VPC in each project. Use VPC Network Peering to create a full mesh, connecting every VPC directly to every other VP
D. Configure the shared services project as a Shared VPC host. Create a single VPC in this host project and attach the environment projects as service projects.
Show Answer
Correct Answer: A
Explanation: Each project should have its own VPC to enforce isolation between development, testing, and production. By peering each of those VPCs individually with the shared services VPC, CI/CD runners and Artifact Registry can be reached over private IPs, while there is no direct connectivity between the environment VPCs themselves. This meets the private access requirement and strictly prohibits inter-environment traffic.
Question 38
You are architecting a new application feature for a healthcare provider based in Qatar. The feature needs to summarize sensitive patient notes that are submitted by clinicians. A critical requirement is that the content of these patient notes must never be processed outside of Qatar's borders. You want to use a powerful, pre-trained generative model for the summarization task while strictly adhering to the data residency constraint. What should you do?
A. Write application code that sends the patient notes explicitly to the Gemini API endpoint in Qatar for summarization. Protect the API by VPC-Service Controls.
B. Use Vertex AI Model Garden to select a Gemma model. Deploy this model to a Vertex AI Endpoint within a Google Cloud region located in Qatar.
C. Use the Cloud Natural Language API to analyze the text and configure it to generate a summary of the patient notes.
D. Gather a large, anonymized dataset of medical notes. Use Vertex AI Training to train a custom summarization model from scratch, deploying it in a Qatar region.
Show Answer
Correct Answer: B
Explanation: The requirement is to use a powerful pre-trained generative model while ensuring all data processing stays within Qatar. Open models like Gemma can be deployed on Vertex AI Endpoints in a specific region (such as a Qatar region), guaranteeing data residency. Managed Gemini APIs do not currently allow strict regional processing guarantees per customer, Cloud Natural Language does not provide generative summarization, and training a custom model from scratch is unnecessary and inefficient given the availability of suitable pre-trained models.
Question 39
You are designing the storage architecture for a financial analytics platform. The platform ingests and stores terabytes of transactional data daily, which is used for both real-time fraud detection and long-term historical analysis. Transaction data from the last 30 days must be accessible with very low latency for the fraud detection engine. Data older than 30 days is accessed infrequently for quarterly reports, where retrieval times of a few seconds are acceptable. All data must be retained for five years to meet compliance regulations. You need to design a solution as cost-effective as possible. What should you do?
A. Store all transaction data in a Cloud Storage bucket using the Standard storage class for the entire five-year retention period.
B. Ingest all data into BigQuery using time-partitioned tables, and rely on BigQuery’s automatic long-term storage pricing for data older than 90 days.
C. Configure a Cloud Storage bucket with an Object Lifecycle Management policy to transition data from the Standard class to the Archive class after 30 days.
D. Configure a Cloud Storage bucket with an Object Lifecycle Management policy to transition data from the Standard class to the Coldline class after 30 days.
Show Answer
Correct Answer: D
Explanation: Recent data (last 30 days) needs very low latency, which is satisfied by Standard storage. Older data is accessed infrequently with tolerance for seconds of latency and should be stored cheaply. Coldline is designed for data accessed about once per quarter, offers retrieval in seconds, and has much lower storage cost than Standard while avoiding the very high retrieval latency and costs of Archive. Option C fails because Archive retrieval can take minutes to hours and is expensive to read. A is too costly, and B does not align with the 30‑day hot data requirement or real‑time access needs.
Question 40
Your company uses Salesforce for customer relationship management (CRM). ServiceNow for IT service management, and a Cloud SQL database to store customer transaction data You need to seamlessly connect, map. and transform data between these systems to ensure data consistency and enable real-time reporting. You want to follow Google-recommended practices. What should you do?
A. Leverage Workflows to connect the services and transform the data.
B. Leverage Application Integration to connect the services and transform the data.
C. Leverage Pub/Sub and BigQuery to connect the services and transform the data.
D. Leverage Pub/Sub and Datastream to connect the services and transform the data.
Show Answer
Correct Answer: B
Explanation: Google-recommended practice for integrating SaaS applications (Salesforce, ServiceNow) with Cloud SQL, including data mapping, transformation, and real-time synchronization, is to use Application Integration (iPaaS). It provides prebuilt connectors, transformation logic, orchestration, and managed connectivity designed specifically for enterprise application integration. Workflows is for orchestration, not deep integration; Pub/Sub with BigQuery or Datastream targets streaming/analytics or CDC, not end-to-end app integration and transformation.
Question 41
Your company is building containerized applications as part of their CI/CD pipeline. To improve the security and maintainability of the build process, you need to:
• Identify potential vulnerabilities within your container images.
• Generate verifiable metadata about the builds for auditing and compliance.
• Create a comprehensive inventory of your application’s dependencies
What should you do?
A. Use Cloud Build to build container images, and then trigger Artifact Analysis on images pushed to Artifact Registry.
B. Use Cloud Build to build container images, trigger Binary Authorization, and use Cloud Asset Inventory for tracking and analysis.
C. Use Cloud Build to build container images, push the images to Artifact Registry, and use Security Command Center for tracking and analysis.
D. Use Cloud Build to build container images, trigger Binary Authorization, and use Security Command Center for tracking and analysis.
Show Answer
Correct Answer: A
Explanation: The requirements map directly to Artifact Analysis (Container Analysis) capabilities. Cloud Build builds the images, and when images are pushed to Artifact Registry, Artifact Analysis automatically performs vulnerability scanning, generates SBOMs (dependency inventory), and produces verifiable metadata/attestations for auditing and compliance. Binary Authorization focuses on deployment policy enforcement, not dependency inventory, and Security Command Center is a higher-level aggregation service and (for image scanning) relies on Artifact Analysis rather than replacing it.
$19
Get all 305 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.