Professional Cloud Architect Free Practice Questions — Page 7
Question 61
You have a Compute Engine application that you want to autoscale when total memory usage exceeds 80%. You have installed the Cloud Monitoring agent and configured the autoscaling policy as follows:
You observe that the application does not scale under high load. You want to resolve this. What should you do?
A. Change the Target type to DELTA_PER_MINUTE.
B. Change the Metric identifier to agent.googleapis.com/memory/bytes_used.
C. Change the filter to metric.label.state = ‘used’.
D. Change the filter to metric.label.state = ‘free’ and the Target utilization to 20.
Show Answer
Correct Answer: C
Explanation: The autoscaler filter is incorrectly combining multiple memory state labels with AND. Each time series has only one state label, so such a filter matches nothing and prevents scaling. For percent_used memory autoscaling, filter on the 'used' state only. Changing the metric type or target type does not address the filtering issue, and using 'free' with a 20% target is a different approach but not the documented fix for this configuration.
Question 62
Your company has decided to make a major revision of their API in order to create better experiences for their developers. They need to keep the old version of the API available and deployable, while allowing new customers and testers to try out the new API. They want to keep the same SSL and DNS records in place to serve both APIs.
What should they do?
A. Configure a new load balancer for the new version of the API
B. Reconfigure old clients to use a new endpoint for the new API
C. Have the old API forward traffic to the new API based on the path
D. Use separate backend pools for each API path behind the load balancer
Show Answer
Correct Answer: D
Explanation: Using a single load balancer with path-based routing and separate backend pools allows both API versions to be served under the same DNS name and SSL certificate. Requests can be routed by URL path (for example, /v1 and /v2) to different backend services, keeping the old API available while exposing the new API for testing and new customers without changing the public endpoint.
Question 63
You are working at a financial institution that stores mortgage loan approval documents on Cloud Storage. Any change to these approval documents must be uploaded as a separate approval file. You need to ensure that these documents cannot be deleted or overwritten for the next 5 years. What should you do?
A. Create a retention policy on the bucket for the duration of 5 years. Create a lock on the retention policy.
B. Create a retention policy organizational constraint constraints/storage.retentionPolicySeconds at the organization level. Set the duration to 5 years.
C. Use a customer-managed key for the encryption of the bucket. Rotate the key after 5 years.
D. Create a retention policy organizational constraint constraints/storage.retentionPolicySeconds at the project level. Set the duration to 5 years.
Show Answer
Correct Answer: A
Explanation: Cloud Storage retention policies prevent objects from being deleted or overwritten until the retention period expires. Locking the retention policy makes it immutable, ensuring the 5-year retention requirement cannot be bypassed. Organization policy constraints are not the correct mechanism for enforcing immutable retention on specific approval documents, and encryption key rotation does not provide write-once or retention guarantees.
Question 64
Your company wants to migrate their 10-TB on-premises database export into Cloud Storage. You want to minimize the time it takes to complete this activity and the overall cost. The bandwidth between the on-premises environment and Google Cloud is 1 Gbps. You want to follow Google-recommended practices. What should you do?
A. Develop a Dataflow job to read data directly from the database and write it into Cloud Storage.
B. Use the Data Transfer appliance to perform an offline migration.
C. Use a commercial partner ETL solution to extract the data from the on-premises database and upload it into Cloud Storage.
D. Upload the data with gcloud storage cp.
Show Answer
Correct Answer: D
Explanation: A 10 TB transfer over a dedicated 1 Gbps link takes roughly 22–24 hours under ideal conditions, well under the typical threshold where Google recommends using Transfer Appliance (generally when network transfer would take more than about a week or is impractical). Transfer Appliance adds shipping time and appliance costs. Dataflow and third-party ETL are unnecessary for an existing database export. Using gcloud storage cp is the recommended straightforward online upload method for this dataset size and bandwidth.
Question 65
You are configuring the cloud network architecture for a newly created project in Google Cloud that will host applications in Compute Engine. Compute Engine virtual machine instances will be created in two different subnets (sub-a and sub-b) within a single region:
• Instances in sub-a will have public IP addresses.
• Instances in sub-b will have only private IP addresses.
To download updated packages, instances must connect to a public repository outside the boundaries of Google Cloud. You need to allow sub-b to access the external repository. What should you do?
A. Enable Private Google Access on sub-b.
B. Configure Cloud NAT and select sub-b in the NAT mapping section.
C. Configure a bastion host instance in sub-a to connect to instances in sub-b.
D. Enable Identity-Aware Proxy for TCP forwarding for instances in sub-b.
Show Answer
Correct Answer: B
Explanation: Instances without external IP addresses need Cloud NAT to initiate outbound connections to the public internet while remaining unreachable from inbound internet traffic. Private Google Access only enables access to Google APIs and services, not arbitrary public repositories. A bastion host is for administrative access, and IAP TCP forwarding is also for secure administrative connectivity, not outbound internet access.
Question 66
Your company is planning to migrate their Windows Server 2022 from their on-premises data center to Google Cloud. You need to bring the licenses that are currently in use in on-premises virtual machines into the target cloud environment. What should you do?
A. 1. Create an image of the on-premises virtual machines and upload into Cloud Storage. 2. Import the image as a virtual disk on Compute Engine.
B. 1. Create standard instances on Compute Engine. 2. Select as the OS the same Microsoft Windows version that is currently in use in the on-premises environment.
C. 1. Create an image of the on-premises virtual machine. 2. Import the image as a virtual disk on Compute Engine. 3. Create a standard instance on Compute Engine, selecting as the OS the same Microsoft Windows version that is currently in use in the on-premises environment. 4. Attach a data disk that includes data that matches the created image.
D. 1. Create an image of the on-premises virtual machines. 2. Import the image as a virtual disk on Compute Engine using --os=windows-2022-dc-v . 3. Create a sole-tenancy instance on Compute Engine that uses the imported disk as a boot disk.
Show Answer
Correct Answer: D
Explanation: Bringing your own Windows Server 2022 licenses to Google Cloud requires a Windows BYOL image and deployment on sole-tenant nodes to satisfy Microsoft's BYOL licensing requirements. The correct process is to import the on-premises Windows image with the appropriate Windows OS designation and then create a sole-tenancy VM using the imported disk as the boot disk.
Question 67
You are deploying an application to Google Cloud. The application is part of a system. The application in Google Cloud must communicate over a private network with applications in a non-Google Cloud environment. The expected average throughput is 200 kbps. The business requires:
• 99.99% system availability
• cost optimization
You need to design the connectivity between the locations to meet the business requirements. What should you provision?
A. An HA Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.
B. A Classic Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.
C. Two HA Cloud VPN gateways connected to two on-premises VPN gateways. Configure each HA Cloud VPN gateway to have two tunnels, each connected to different on-premises VPN gateways.
D. A Classic Cloud VPN gateway connected with one tunnel to an on-premises VPN gateway.
Show Answer
Correct Answer: A
Explanation: HA Cloud VPN is the recommended option for high availability. A single HA Cloud VPN gateway with two tunnels to a redundant on-premises VPN gateway configuration provides the 99.99% HA VPN SLA while minimizing cost. Classic Cloud VPN does not provide the same high-availability SLA, and deploying two HA Cloud VPN gateways (option C) adds unnecessary cost for a very low throughput requirement (200 kbps).
Question 68
Your company has an application running on App Engine that allows users to upload music files and share them with other people. You want to allow users to upload files directly into Cloud Storage from their browser session. The payload should not be passed through the backend. What should you do?
A. 1. Set a CORS configuration in the target Cloud Storage bucket where the base URL of the App Engine application is an allowed origin. 2. Use the Cloud Storage Signed URL feature to generate a POST URL.
B. 1. Set a CORS configuration in the target Cloud Storage bucket where the base URL of the App Engine application is an allowed origin. 2. Assign the Cloud Storage WRITER role to users who upload files.
C. 1. Use the Cloud Storage Signed URL feature to generate a POST URL. 2. Use App Engine default credentials to sign requests against Cloud Storage.
D. 1. Assign the Cloud Storage WRITER role to users who upload files. 2. Use App Engine default credentials to sign requests against Cloud Storage.
Show Answer
Correct Answer: A
Explanation: Direct browser uploads to Cloud Storage require the bucket to allow the application's origin via CORS, and a signed POST URL (or signed upload URL) lets the browser upload directly without routing the file through the App Engine backend. Granting users Storage Writer is overly broad, and App Engine default credentials are not used by the browser to sign upload requests.
Question 69
You are deploying an application to Google Cloud. The application is part of a system. The application in Google Cloud must communicate over a private network with applications in a non-Google Cloud environment. The expected average throughput is 200 kbps. The business requires:
✑ as close to 100% system availability as possible
✑ cost optimization
You need to design the connectivity between the locations to meet the business requirements. What should you provision?
A. An HA Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway
B. Two Classic Cloud VPN gateways connected to two on-premises VPN gateways Configure each Classic Cloud VPN gateway to have two tunnels, each connected to different on-premises VPN gateways
C. Two HA Cloud VPN gateways connected to two on-premises VPN gateways Configure each HA Cloud VPN gateway to have two tunnels, each connected to different on-premises VPN gateways
D. A single Cloud VPN gateway connected to an on-premises VPN gateway
Show Answer
Correct Answer: A
Explanation: HA Cloud VPN is the recommended option for high availability. A single HA Cloud VPN gateway with two tunnels to a properly configured on-premises VPN gateway (using two external interfaces/IPs) provides the 99.99% SLA while minimizing cost. Option C adds extra on-premises gateway redundancy but increases cost beyond the stated optimization requirement. Classic VPN options are legacy and less appropriate, and a single non-HA VPN gateway does not meet the availability goal.
Question 70
You want to store critical business information in Cloud Storage buckets. The information is regularly changed, but previous versions need to be referenced on a regular basis. You want to ensure that there is a record of all changes to any information in these buckets. You want to ensure that accidental edits or deletions can be easily rolled back. Which feature should you enable?
A. Bucket Lock
B. Object Versioning
C. Object change notification
D. Object Lifecycle Management
Show Answer
Correct Answer: B
Explanation: Object Versioning stores multiple generations of an object, preserving previous versions whenever an object is overwritten or deleted. This provides a complete history of changes and allows easy rollback after accidental edits or deletions. Bucket Lock enforces retention policies, Object Change Notification only notifies about changes, and Object Lifecycle Management automates object transitions/deletions rather than preserving versions.
$19
Get all 306 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.