Professional Cloud Architect Free Practice Questions — Page 7
Question 52
You are configuring the cloud network architecture for a newly created project in Google Cloud that will host applications in Compute Engine. Compute Engine virtual machine instances will be created in two different subnets (sub-a and sub-b) within a single region:
• Instances in sub-a will have public IP addresses.
• Instances in sub-b will have only private IP addresses.
To download updated packages, instances must connect to a public repository outside the boundaries of Google Cloud. You need to allow sub-b to access the external repository. What should you do?
A. Enable Private Google Access on sub-b.
B. Configure Cloud NAT and select sub-b in the NAT mapping section.
C. Configure a bastion host instance in sub-a to connect to instances in sub-b.
D. Enable Identity-Aware Proxy for TCP forwarding for instances in sub-b.
Show Answer
Correct Answer: B
Explanation: Instances in sub-b have no external IPs, so they cannot reach the public internet by default. Cloud NAT provides outbound internet access for private instances without exposing them to inbound connections. Private Google Access only applies to Google APIs, a bastion host is for administrative access, and IAP TCP forwarding is not for general internet egress.
Question 53
Your company is planning to migrate their Windows Server 2022 from their on-premises data center to Google Cloud. You need to bring the licenses that are currently in use in on-premises virtual machines into the target cloud environment. What should you do?
A. 1. Create an image of the on-premises virtual machines and upload into Cloud Storage. 2. Import the image as a virtual disk on Compute Engine.
B. 1. Create standard instances on Compute Engine. 2. Select as the OS the same Microsoft Windows version that is currently in use in the on-premises environment.
C. 1. Create an image of the on-premises virtual machine. 2. Import the image as a virtual disk on Compute Engine. 3. Create a standard instance on Compute Engine, selecting as the OS the same Microsoft Windows version that is currently in use in the on-premises environment. 4. Attach a data disk that includes data that matches the created image.
D. 1. Create an image of the on-premises virtual machines. 2. Import the image as a virtual disk on Compute Engine using --os=windows-2022-dc-v . 3. Create a sole-tenancy instance on Compute Engine that uses the imported disk as a boot disk.
Show Answer
Correct Answer: D
Explanation: To bring existing on‑premises Windows Server 2022 licenses (BYOL) into Google Cloud, you must comply with Microsoft licensing requirements. Windows Server licenses are not covered by standard License Mobility and therefore require dedicated hardware in Google Cloud. This is achieved by importing the on‑premises VM image as a Windows BYOL image and running it on a sole‑tenant node. Option D correctly includes importing the image with the appropriate Windows Server 2022 BYOL flag and creating a sole‑tenancy Compute Engine instance using that disk as the boot disk.
Question 54
You are deploying an application to Google Cloud. The application is part of a system. The application in Google Cloud must communicate over a private network with applications in a non-Google Cloud environment. The expected average throughput is 200 kbps. The business requires:
• 99.99% system availability
• cost optimization
You need to design the connectivity between the locations to meet the business requirements. What should you provision?
A. An HA Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.
B. A Classic Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.
C. Two HA Cloud VPN gateways connected to two on-premises VPN gateways. Configure each HA Cloud VPN gateway to have two tunnels, each connected to different on-premises VPN gateways.
D. A Classic Cloud VPN gateway connected with one tunnel to an on-premises VPN gateway.
Show Answer
Correct Answer: A
Explanation: The requirement is 99.99% availability with cost optimization and low throughput (200 kbps). HA Cloud VPN provides a 99.99% SLA when configured with two redundant tunnels to an on‑premises VPN gateway, which satisfies the availability requirement. Classic Cloud VPN does not meet the same SLA, and deploying additional gateways (option C) adds unnecessary cost for such low bandwidth. Therefore, a single HA Cloud VPN gateway with two tunnels is the most cost‑effective solution that meets the business requirements.
Question 55
Your company has an application running on App Engine that allows users to upload music files and share them with other people. You want to allow users to upload files directly into Cloud Storage from their browser session. The payload should not be passed through the backend. What should you do?
A. 1. Set a CORS configuration in the target Cloud Storage bucket where the base URL of the App Engine application is an allowed origin. 2. Use the Cloud Storage Signed URL feature to generate a POST URL.
B. 1. Set a CORS configuration in the target Cloud Storage bucket where the base URL of the App Engine application is an allowed origin. 2. Assign the Cloud Storage WRITER role to users who upload files.
C. 1. Use the Cloud Storage Signed URL feature to generate a POST URL. 2. Use App Engine default credentials to sign requests against Cloud Storage.
D. 1. Assign the Cloud Storage WRITER role to users who upload files. 2. Use App Engine default credentials to sign requests against Cloud Storage.
Show Answer
Correct Answer: A
Explanation: The requirement is for users to upload files directly from their browser to Cloud Storage without routing the payload through the App Engine backend. This is best achieved by using Cloud Storage signed URLs, which allow temporary, limited permission uploads directly from the client. Because the upload is initiated from a browser running on a different origin (App Engine app) than Cloud Storage, a CORS configuration on the bucket is required to allow that origin. Granting broad IAM roles to end users or relying on App Engine default credentials would either expose credentials or still involve the backend, violating the requirement.
Question 56
You are deploying an application to Google Cloud. The application is part of a system. The application in Google Cloud must communicate over a private network with applications in a non-Google Cloud environment. The expected average throughput is 200 kbps. The business requires:
✑ as close to 100% system availability as possible
✑ cost optimization
You need to design the connectivity between the locations to meet the business requirements. What should you provision?
A. An HA Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway
B. Two Classic Cloud VPN gateways connected to two on-premises VPN gateways Configure each Classic Cloud VPN gateway to have two tunnels, each connected to different on-premises VPN gateways
C. Two HA Cloud VPN gateways connected to two on-premises VPN gateways Configure each HA Cloud VPN gateway to have two tunnels, each connected to different on-premises VPN gateways
D. A single Cloud VPN gateway connected to an on-premises VPN gateway
Show Answer
Correct Answer: A
Explanation: The requirements call for very high availability (as close to 100% as possible) while optimizing cost, with only modest throughput (200 kbps). HA Cloud VPN is specifically designed for this use case and provides a 99.99% SLA when configured with two tunnels. Option A provisions a single HA Cloud VPN gateway with two tunnels to the on‑premises VPN gateway, meeting the availability requirement without unnecessary extra gateways. Option C adds additional HA gateways and on‑prem redundancy, which increases cost beyond what is required. Options B and D either rely on legacy Classic VPN or lack sufficient redundancy. Therefore, Option A best balances high availability and cost optimization.
Question 57
You want to store critical business information in Cloud Storage buckets. The information is regularly changed, but previous versions need to be referenced on a regular basis. You want to ensure that there is a record of all changes to any information in these buckets. You want to ensure that accidental edits or deletions can be easily rolled back. Which feature should you enable?
A. Bucket Lock
B. Object Versioning
C. Object change notification
D. Object Lifecycle Management
Show Answer
Correct Answer: B
Explanation: Object Versioning in Cloud Storage keeps multiple historical versions of each object whenever it is overwritten or deleted. This provides a complete record of changes and allows easy rollback to previous versions after accidental edits or deletions, which directly matches the requirements.
Question 58
Your company has a Google Cloud project that uses BigQuery for data warehousing on a pay-per-use basis. You want to monitor queries in real time to discover the most costly queries and which users spend the most. What should you do?
A. 1. In the BigQuery dataset that contains all the tables to be queried, add a label for each user that can launch a query. 2. Open the Billing page of the project. 3. Select Reports. 4. Select BigQuery as the product and filter by the user you want to check.
B. 1. Create a Cloud Logging sink to export BigQuery data access logs to BigQuery. 2. Perform a BigQuery query on the generated table to extract the information you need.
C. 1. Create a Cloud Logging sink to export BigQuery data access logs to Cloud Storage. 2. Develop a Dataflow pipeline to compute the cost of queries split by users.
D. 1. Activate billing export into BigQuery. 2. Perform a BigQuery query on the billing table to extract the information you need.
Show Answer
Correct Answer: B
Explanation: The requirement is to monitor BigQuery queries in (near) real time to identify the most expensive queries and the users running them. Exporting BigQuery data access logs to BigQuery via a Cloud Logging sink provides per-query details such as user, job ID, and bytes processed almost immediately, which allows you to calculate query cost on the fly. Billing export to BigQuery (option D) is authoritative for charges but is delayed and not suitable for real-time monitoring. Therefore, B best meets the real-time monitoring requirement.
Question 59
Your company recently acquired a company that has infrastructure in Google Cloud. Each company has its own Google Cloud organization. Each company is using a Shared Virtual Private Cloud (VPC) to provide network connectivity for its applications. Some of the subnets used by both companies overlap. In order for both businesses to integrate, the applications need to have private network connectivity. These applications are not on overlapping subnets. You want to provide connectivity with minimal re-engineering. What should you do?
A. Set up VPC peering and peer each Shared VPC together.
B. Migrate the projects from the acquired company into your company's Google Cloud organization. Re-launch the instances in your companies Shared VPC.
C. Set up a Cloud VPN gateway in each Shared VPC and peer Cloud VPNs.
D. Configure SSH port forwarding on each application to provide connectivity between applications in the different Shared VPCs.
Show Answer
Correct Answer: C
Explanation: VPC Network Peering cannot be established when there is any overlapping IP range between the two VPCs or their peered networks, even if the specific applications are on non-overlapping subnets. Migrating projects or readdressing networks would require significant re-engineering. Cloud VPN allows private connectivity between the two Shared VPCs while selectively advertising only the non-overlapping application subnets, making it the minimal-change and supported solution.
Question 61
You are managing several projects on Google Cloud and need to interact on a daily basis with BigQuery, Bigtable, and Kubernetes Engine using the gcloud CL tool. You are travelling a lot and work on different workstations during the week. You want to avoid having to manage the gcloud CLI manually. What should you do?
A. Use Google Cloud Shell in the Google Cloud Console to interact with Google Cloud.
B. Create a Compute Engine instance and install gcloud on the instance. Connect to this instance via SSH to always use the same gcloud installation when interacting with Google Cloud.
C. Install gcloud on all of your workstations. Run the command gcloud components auto-update on each workstation
D. Use a package manager to install gcloud on your workstations instead of installing it manually.
Show Answer
Correct Answer: A
Explanation: Google Cloud Shell provides a browser-based environment with the gcloud CLI and common tools (BigQuery, Bigtable, GKE) preinstalled and maintained by Google. It is accessible from any workstation without local installation or updates, avoiding manual management of the gcloud CLI while persisting configuration and home directory across sessions.
Question 62
You have a Compute Engine managed instance group that adds and removes Compute Engine instances from the group in response to the load on your application. The instances have a shutdown script that removes REDIS database entries associated with the instance. You see that many database entries have not been removed, and you suspect that the shutdown script is the problem. You need to ensure that the commands in the shutdown script are run reliably every time an instance is shut down. You create a Cloud Function to remove the database entries. What should you do next?
A. Modify the shutdown script to wait for 30 seconds before triggering the Cloud Function.
B. Do not use the Cloud Function. Modify the shutdown script to restart if it has not completed in 30 seconds.
C. Set up a Cloud Monitoring sink that triggers the Cloud Function after an instance removal log message arrives in Cloud Logging.
D. Modify the shutdown script to wait for 30 seconds and then publish a message to a Pub/Sub queue.
Show Answer
Correct Answer: C
Explanation: Shutdown scripts on Compute Engine are not guaranteed to complete, especially during managed instance group scale-in. To ensure reliable cleanup, trigger the logic outside the VM lifecycle. Export instance deletion/removal logs from Cloud Logging (via a sink, typically to Pub/Sub) and use them to invoke a Cloud Function that removes the Redis entries. This ensures the cleanup runs based on the authoritative deletion event, even if the VM terminates immediately.
$19
Get all 305 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.