Professional Cloud Architect Free Practice Questions — Page 6
Question 51
You are architecting a new application feature for a healthcare provider based in Qatar. The feature needs to summarize sensitive patient notes that are submitted by clinicians. A critical requirement is that the content of these patient notes must never be processed outside of Qatar's borders. You want to use a powerful, pre-trained generative model for the summarization task while strictly adhering to the data residency constraint. What should you do?
A. Write application code that sends the patient notes explicitly to the Gemini API endpoint in Qatar for summarization. Protect the API by VPC-Service Controls.
B. Use Vertex AI Model Garden to select a Gemma model. Deploy this model to a Vertex AI Endpoint within a Google Cloud region located in Qatar.
C. Use the Cloud Natural Language API to analyze the text and configure it to generate a summary of the patient notes.
D. Gather a large, anonymized dataset of medical notes. Use Vertex AI Training to train a custom summarization model from scratch, deploying it in a Qatar region.
Show Answer
Correct Answer: B
Explanation: The requirement is to use a powerful pre-trained generative model while ensuring patient notes are never processed outside Qatar. Deploying a pre-trained open Gemma model from Vertex AI Model Garden to a Vertex AI Endpoint in the Qatar region (me-central1, Doha) keeps inference within the specified region. The Gemini API is a managed service and VPC Service Controls do not guarantee regional processing. Cloud Natural Language API does not provide generative summarization, and training a custom model from scratch is unnecessary because the requirement is to use a pre-trained model.
Question 52
You are designing the storage architecture for a financial analytics platform. The platform ingests and stores terabytes of transactional data daily, which is used for both real-time fraud detection and long-term historical analysis. Transaction data from the last 30 days must be accessible with very low latency for the fraud detection engine. Data older than 30 days is accessed infrequently for quarterly reports, where retrieval times of a few seconds are acceptable. All data must be retained for five years to meet compliance regulations. You need to design a solution as cost-effective as possible. What should you do?
A. Store all transaction data in a Cloud Storage bucket using the Standard storage class for the entire five-year retention period.
B. Ingest all data into BigQuery using time-partitioned tables, and rely on BigQuery’s automatic long-term storage pricing for data older than 90 days.
C. Configure a Cloud Storage bucket with an Object Lifecycle Management policy to transition data from the Standard class to the Archive class after 30 days.
D. Configure a Cloud Storage bucket with an Object Lifecycle Management policy to transition data from the Standard class to the Coldline class after 30 days.
Show Answer
Correct Answer: D
Explanation: Use Cloud Storage Standard for the hot 30-day window, then automatically transition objects to Coldline with Object Lifecycle Management. Coldline is designed for infrequently accessed data (such as quarterly access), provides low-latency access, and is more cost-effective than keeping everything in Standard. Archive has lower storage cost but is intended for very infrequent access with higher retrieval costs and longer minimum storage duration, making it a poorer fit for recurring quarterly reads over five years. BigQuery is not the most cost-effective primary archival solution for this pattern.
Question 53
Your company uses Salesforce for customer relationship management (CRM). ServiceNow for IT service management, and a Cloud SQL database to store customer transaction data You need to seamlessly connect, map. and transform data between these systems to ensure data consistency and enable real-time reporting. You want to follow Google-recommended practices. What should you do?
A. Leverage Workflows to connect the services and transform the data.
B. Leverage Application Integration to connect the services and transform the data.
C. Leverage Pub/Sub and BigQuery to connect the services and transform the data.
D. Leverage Pub/Sub and Datastream to connect the services and transform the data.
Show Answer
Correct Answer: B
Explanation: Application Integration is Google Cloud's managed integration platform designed to connect SaaS applications such as Salesforce and ServiceNow with Google Cloud services including Cloud SQL. It provides prebuilt connectors, data mapping, transformation, orchestration, and real-time integration, matching the requirement to seamlessly connect, map, and transform data following Google-recommended practices.
Question 54
Your company is building containerized applications as part of their CI/CD pipeline. To improve the security and maintainability of the build process, you need to:
• Identify potential vulnerabilities within your container images.
• Generate verifiable metadata about the builds for auditing and compliance.
• Create a comprehensive inventory of your application’s dependencies
What should you do?
A. Use Cloud Build to build container images, and then trigger Artifact Analysis on images pushed to Artifact Registry.
B. Use Cloud Build to build container images, trigger Binary Authorization, and use Cloud Asset Inventory for tracking and analysis.
C. Use Cloud Build to build container images, push the images to Artifact Registry, and use Security Command Center for tracking and analysis.
D. Use Cloud Build to build container images, trigger Binary Authorization, and use Security Command Center for tracking and analysis.
Show Answer
Correct Answer: A
Explanation: Artifact Analysis (formerly Container Analysis) integrated with Artifact Registry provides vulnerability scanning, Software Bill of Materials (SBOM) generation for dependency inventory, and build provenance/attestations for verifiable metadata. Cloud Build builds the images, and pushing them to Artifact Registry enables Artifact Analysis. Binary Authorization enforces deployment policies rather than performing scanning or inventory, while Security Command Center aggregates security findings but is not the primary service for these build-specific requirements.
Question 55
You are deploying a critical application with a stateless, containerized frontend on Cloud Run and a Cloud SQL for PostgreSQL backend. The application experiences unpredictable traffic spikes, and the business requires the ability to immediately roll back a failed deployment to the last known good state. You need to apply a deployment strategy that aligns with Site Reliability Engineering (SRE) principles for both the application code and the database schema updates, while meeting the business's requirements. What should you do?
A. Package the database schema migration script within the container to be executed on every container startup before the application process begins.
B. Configure the CI/CD pipeline to use the :latest container tag for deployments, with database schema changes applied manually as needed.
C. Separate CI/CD pipelines for database schema migrations from application deployments. When deploying a new Cloud Run revision, use gradual traffic split.
D. Use a single CI/CD pipeline that first applies database schema changes and then deploys the new Cloud Run revision.
Show Answer
Correct Answer: C
Explanation: A stateless Cloud Run service should not run schema migrations on every container startup because multiple instances may start concurrently and rollbacks become unsafe. Using the :latest tag in production is poor practice because it weakens versioning and rollback. Separating database schema migrations from application deployments allows controlled, versioned schema changes, and deploying a new Cloud Run revision with gradual traffic splitting follows SRE practices by reducing blast radius and enabling rapid rollback to the previous revision. A single pipeline that always migrates the database before deploying the app can make application rollback difficult if the schema change is not backward compatible.
Question 56
Your product team is building a critical, customer-facing application on Google Cloud. The development team wants to use Spanner for their database to take advantage of its horizontal scalability and low operational overhead However, the FinOps team is concerned about the direct monthly cost of Spanner and proposed using a self-managed PostgreSQL database on Compute Engine VMs instead. You need to resolve this conflict and ensure the project moves forward with an architecturally sound database choice that balances technical requirements with financial constraints. What should you do?
A. Provide the development team with a reference architecture for deploying a highly available PostgreSQL cluster on a regional managed instance group (MIG).
B. Suggest using Cloud SQL for PostgreSQL as a compromise to get a managed service at a lower cost than Spanner.
C. Develop a total cost of ownership (TCO) analysis that includes operational overhead, and present it in a workshop to facilitate a decision.
D. Cite the reliability and performance optimization pillars of the Google Cloud Well-Architected Framework to formally justify the use of Spanner.
Show Answer
Correct Answer: C
Explanation: A total cost of ownership (TCO) analysis compares not only direct infrastructure costs but also operational overhead, reliability, staffing, maintenance, and downtime risk. Since the disagreement is between technical suitability and apparent monthly cost, a TCO analysis presented to both engineering and FinOps is the appropriate architectural approach to enable an informed decision. The other options either prematurely choose a database solution or justify Spanner based only on architecture without addressing the financial concern.
Question 57
You are designing the architecture for a global social media site on Google Cloud. The site serves dynamic API content, static assets such as CSS. JS. images, and user-uploaded videos for streaming. You need to minimize latency for all content types for users worldwide. What should you do? (Choose two.)
A. Use an external Application Load Balancer to serve your application APIs.
B. Use Cloud CDN to serve static assets of your application.
C. Use Media CDN to serve static assets of your application
D. Use Memorystore to serve your web application.
E. Use a multi-region Cloud Storage bucket to serve your entire web application.
Show Answer
Correct Answer: A, B
Explanation: Use an external Application Load Balancer for globally distributed, low-latency delivery of dynamic API traffic. Use Cloud CDN to cache and serve static assets (CSS, JavaScript, images) from Google's edge locations worldwide. Media CDN is intended for large-scale media/video streaming rather than general website static assets, and the question specifically pairs static assets with Cloud CDN. Memorystore is an in-memory cache, not a content delivery solution, and serving an entire application from Cloud Storage is not suitable for dynamic APIs.
Question 58
Your organization has a significant amount of log data stored in Cloud Logging. The data engineering team is accustomed to using SQL for analysis and wants the ability to create insightful dashboards for visualizing log trends and patterns. You want to follow the recommendations of the Google Cloud Well-Architected Framework to provide a solution for the data engineering team. What should you do?
A. Create a log sink, and export the data to BigQuery using Pub/Sub. Run queries and visualize the data with Cloud Monitoring dashboards.
B. Enable log analytics and run queries in Cloud Monitoring. Visualize the data using Vertex AI workbench.
C. Enable log analytics and run queries in the linked log dataset in BigQuery. Visualize the data with Looker Studio dashboards.
D. Create a log sink, and export the data to a storage bucket. Create an external table in BigQuery for the data in the bucket. Run queries and visualize the data with Cloud Monitoring dashboards.
Show Answer
Correct Answer: C
Explanation: Log Analytics is the recommended modern approach for analyzing Cloud Logging data with SQL. By enabling Log Analytics and using the linked BigQuery dataset, the team can query logs with BigQuery SQL without exporting or duplicating data. Looker Studio integrates natively with BigQuery to build dashboards, aligning with Google Cloud Well-Architected guidance to use managed, low-overhead services.
Question 59
You are creating a migration plan to move your organization’s infrastructure from on-premises to Google Cloud. You want to understand and manage costs effectively after the migration is complete. Which strategies should you include in the migration plan? (Choose two.)
A. Enable Backup and DR Service.
B. Configure labels and tags for the resources provisioned in Google Cloud.
C. Create a Cloud Scheduler job to export billing data to Cloud SQL.
D. Create service alerts using Cloud Monitoring.
E. Adopt infrastructure as code (IaC) for the cloud resources.
Show Answer
Correct Answer: B, E
Explanation: Configuring labels and tags enables cost allocation, reporting, and analysis across teams, applications, or environments, which is fundamental for understanding post-migration cloud costs. Adopting infrastructure as code (IaC) improves governance, standardization, and lifecycle management, helping prevent resource sprawl and unnecessary spending. Backup and DR is for resilience, Cloud Scheduler exporting billing data to Cloud SQL is not the standard billing export approach, and Cloud Monitoring alerts are primarily for operational monitoring rather than cost management.
Question 60
Your company has a Google Cloud project that uses BigOuery for data warehousing. The VPN tunnel between the on-premises environment and Google Cloud is configured with Cloud VPN. Your security team wants to avoid data exfiltration by malicious insiders, compromised code, and accidental oversharing. What should you do?
A. Configure Private Service Connect.
B. Configure VPC Service Controls and configure Private Google Access for on-promises hosts.
C. Create a service account, grant the BigQuery JobUser role and Storage Object Viewer role to the service account, and remove all other Identity and Access Management (IAM) access from the project.
D. Configure Private Google Access.
Show Answer
Correct Answer: B
Explanation: VPC Service Controls create a security perimeter around supported Google Cloud services such as BigQuery to help prevent data exfiltration from malicious insiders, compromised credentials, or accidental data movement. Private Google Access for on-premises hosts allows on-premises systems to privately access Google APIs over Cloud VPN/Cloud Interconnect without traversing the public internet. Private Service Connect alone does not provide exfiltration protection, and IAM role changes alone do not address the stated threat model. Private Google Access by itself also does not prevent data exfiltration.
$19
Get all 306 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.