Professional Cloud Architect Free Practice Questions — Page 7
Question 48
You are designing a new insurance claims processing application that will be deployed on Google Kubernetes Engine (GKE) Your company’s compliance team requires a complete and non-repudiable audit trail for all administrative actions from day one. Your application must capture who deploys a new container image, who modifies the GKE cluster's configuration, and who interacts with running pods or Kubernetes secrets using kubectl. What should you do?
A. Enable Binary Authorization on the GKE cluster, and create a policy that requires all deployed container images to be signed by a trusted attestor.
B. Deploy a DaemonSet to every node in the GKE cluster that runs a logging agent to collect and forward all container logs to Cloud Logging.
C. Enable GKE Audit Logging to send Kubernetes API server logs to Cloud Logging, and ensure Cloud Audit Logs are enabled for the project.
D. Activate the Security Command Center Premium tier to analyze GKE logs and detect threats, vulnerabilities, and misconfigurations in real time.
Show Answer
Correct Answer: C
Explanation: GKE Audit Logging captures Kubernetes API server audit events, including deployments, cluster configuration changes, and kubectl interactions with resources such as Pods and Secrets. Cloud Audit Logs records administrative actions at the Google Cloud project level, providing the required audit trail and non-repudiation for compliance.
Question 49
You are designing the network architecture for a public-facing, containerized web application deployed on Cloud Run. All incoming traffic must be inspected by a Cloud Armor web application firewall (WAF) before reaching the application You plan to use an Application Load Balancer, which will have the Cloud Armor policy attached. You must ensure that all public requests pass through the load balancer and any attempt to access the Cloud Run service directly through its default *.run.app URL is blocked. What should you do?
A. Enable Identity-Aware Proxy (IAP) directly on the Cloud Run service to intercept and validate all incoming requests
B. Create a DNS entry to route traffic to Cloud Armor. Configure Cloud Armor to deny traffic from unknown IP addresses
C. Set the Cloud Run ingress to Allow internal traffic and Cloud Load Balancing, and use a serverless NEG backend on the load balancer
D. Configure a VPC firewall rule with a high priority to deny all traffic that does not originate from the load balancer
Show Answer
Correct Answer: C
Explanation: To ensure Cloud Armor cannot be bypassed, configure the Cloud Run service ingress to allow only internal traffic and Cloud Load Balancing ('Internal and Cloud Load Balancing'). Then place the service behind an Application Load Balancer using a serverless Network Endpoint Group (NEG). This blocks direct access via the default *.run.app URL while allowing traffic forwarded by the load balancer, where the Cloud Armor WAF policy is enforced.
Question 50
Your organization uses separate Google Cloud projects for shared services, development, testing, and production.
• The shared services project hosts your private CI/CD runners and a central Artifact Registry
• The development, testing, and production projects host the GKE clusters where applications are deployed.
You need to design an architecture that allows the CI/CD runners to connect to the GKE clusters and the clusters to pull images from Artifact Registry, all using private IP addresses. However, direct network traffic between the development, testing, and production environments must be strictly prohibited. What should you do?
A. Create a separate VPC in each of the four projects. Connect each environment's VPC to the shared services VPC through VPC Network Peering.
B. Expose the resources in the shared services project using an external load balancer. Implement a firewall rule to limit access.
C. Create a separate VPC in each project. Use VPC Network Peering to create a full mesh, connecting every VPC directly to every other VP
D. Configure the shared services project as a Shared VPC host. Create a single VPC in this host project and attach the environment projects as service projects.
Show Answer
Correct Answer: A
Explanation: A hub-and-spoke topology with a dedicated VPC in the shared services project peered individually to the development, testing, and production VPCs allows private connectivity from CI/CD runners to each GKE cluster and from each cluster to the central Artifact Registry. VPC Network Peering is non-transitive, so the environment VPCs cannot communicate with each other through the shared services VPC, satisfying the requirement to prohibit direct traffic between development, testing, and production. Shared VPC would place all projects on a single VPC, enabling inter-environment communication unless further restricted, and a full mesh would explicitly connect environments to each other. External load balancers would not meet the private-IP-only requirement.
Question 51
You are architecting a new application feature for a healthcare provider based in Qatar. The feature needs to summarize sensitive patient notes that are submitted by clinicians. A critical requirement is that the content of these patient notes must never be processed outside of Qatar's borders. You want to use a powerful, pre-trained generative model for the summarization task while strictly adhering to the data residency constraint. What should you do?
A. Write application code that sends the patient notes explicitly to the Gemini API endpoint in Qatar for summarization. Protect the API by VPC-Service Controls.
B. Use Vertex AI Model Garden to select a Gemma model. Deploy this model to a Vertex AI Endpoint within a Google Cloud region located in Qatar.
C. Use the Cloud Natural Language API to analyze the text and configure it to generate a summary of the patient notes.
D. Gather a large, anonymized dataset of medical notes. Use Vertex AI Training to train a custom summarization model from scratch, deploying it in a Qatar region.
Show Answer
Correct Answer: B
Explanation: The requirement is to use a powerful pre-trained generative model while ensuring patient notes are never processed outside Qatar. Deploying a pre-trained open Gemma model from Vertex AI Model Garden to a Vertex AI Endpoint in the Qatar region (me-central1, Doha) keeps inference within the specified region. The Gemini API is a managed service and VPC Service Controls do not guarantee regional processing. Cloud Natural Language API does not provide generative summarization, and training a custom model from scratch is unnecessary because the requirement is to use a pre-trained model.
Question 52
You are designing the storage architecture for a financial analytics platform. The platform ingests and stores terabytes of transactional data daily, which is used for both real-time fraud detection and long-term historical analysis. Transaction data from the last 30 days must be accessible with very low latency for the fraud detection engine. Data older than 30 days is accessed infrequently for quarterly reports, where retrieval times of a few seconds are acceptable. All data must be retained for five years to meet compliance regulations. You need to design a solution as cost-effective as possible. What should you do?
A. Store all transaction data in a Cloud Storage bucket using the Standard storage class for the entire five-year retention period.
B. Ingest all data into BigQuery using time-partitioned tables, and rely on BigQuery’s automatic long-term storage pricing for data older than 90 days.
C. Configure a Cloud Storage bucket with an Object Lifecycle Management policy to transition data from the Standard class to the Archive class after 30 days.
D. Configure a Cloud Storage bucket with an Object Lifecycle Management policy to transition data from the Standard class to the Coldline class after 30 days.
Show Answer
Correct Answer: D
Explanation: Use Cloud Storage Standard for the hot 30-day window, then automatically transition objects to Coldline with Object Lifecycle Management. Coldline is designed for infrequently accessed data (such as quarterly access), provides low-latency access, and is more cost-effective than keeping everything in Standard. Archive has lower storage cost but is intended for very infrequent access with higher retrieval costs and longer minimum storage duration, making it a poorer fit for recurring quarterly reads over five years. BigQuery is not the most cost-effective primary archival solution for this pattern.
Question 53
Your company uses Salesforce for customer relationship management (CRM). ServiceNow for IT service management, and a Cloud SQL database to store customer transaction data You need to seamlessly connect, map. and transform data between these systems to ensure data consistency and enable real-time reporting. You want to follow Google-recommended practices. What should you do?
A. Leverage Workflows to connect the services and transform the data.
B. Leverage Application Integration to connect the services and transform the data.
C. Leverage Pub/Sub and BigQuery to connect the services and transform the data.
D. Leverage Pub/Sub and Datastream to connect the services and transform the data.
Show Answer
Correct Answer: B
Explanation: Application Integration is Google Cloud's managed integration platform designed to connect SaaS applications such as Salesforce and ServiceNow with Google Cloud services including Cloud SQL. It provides prebuilt connectors, data mapping, transformation, orchestration, and real-time integration, matching the requirement to seamlessly connect, map, and transform data following Google-recommended practices.
Question 54
Your company is building containerized applications as part of their CI/CD pipeline. To improve the security and maintainability of the build process, you need to:
• Identify potential vulnerabilities within your container images.
• Generate verifiable metadata about the builds for auditing and compliance.
• Create a comprehensive inventory of your application’s dependencies
What should you do?
A. Use Cloud Build to build container images, and then trigger Artifact Analysis on images pushed to Artifact Registry.
B. Use Cloud Build to build container images, trigger Binary Authorization, and use Cloud Asset Inventory for tracking and analysis.
C. Use Cloud Build to build container images, push the images to Artifact Registry, and use Security Command Center for tracking and analysis.
D. Use Cloud Build to build container images, trigger Binary Authorization, and use Security Command Center for tracking and analysis.
Show Answer
Correct Answer: A
Explanation: Artifact Analysis (formerly Container Analysis) integrated with Artifact Registry provides vulnerability scanning, Software Bill of Materials (SBOM) generation for dependency inventory, and build provenance/attestations for verifiable metadata. Cloud Build builds the images, and pushing them to Artifact Registry enables Artifact Analysis. Binary Authorization enforces deployment policies rather than performing scanning or inventory, while Security Command Center aggregates security findings but is not the primary service for these build-specific requirements.
Question 55
You are deploying a critical application with a stateless, containerized frontend on Cloud Run and a Cloud SQL for PostgreSQL backend. The application experiences unpredictable traffic spikes, and the business requires the ability to immediately roll back a failed deployment to the last known good state. You need to apply a deployment strategy that aligns with Site Reliability Engineering (SRE) principles for both the application code and the database schema updates, while meeting the business's requirements. What should you do?
A. Package the database schema migration script within the container to be executed on every container startup before the application process begins.
B. Configure the CI/CD pipeline to use the :latest container tag for deployments, with database schema changes applied manually as needed.
C. Separate CI/CD pipelines for database schema migrations from application deployments. When deploying a new Cloud Run revision, use gradual traffic split.
D. Use a single CI/CD pipeline that first applies database schema changes and then deploys the new Cloud Run revision.
Show Answer
Correct Answer: C
Explanation: A stateless Cloud Run service should not run schema migrations on every container startup because multiple instances may start concurrently and rollbacks become unsafe. Using the :latest tag in production is poor practice because it weakens versioning and rollback. Separating database schema migrations from application deployments allows controlled, versioned schema changes, and deploying a new Cloud Run revision with gradual traffic splitting follows SRE practices by reducing blast radius and enabling rapid rollback to the previous revision. A single pipeline that always migrates the database before deploying the app can make application rollback difficult if the schema change is not backward compatible.
Question 56
Your product team is building a critical, customer-facing application on Google Cloud. The development team wants to use Spanner for their database to take advantage of its horizontal scalability and low operational overhead However, the FinOps team is concerned about the direct monthly cost of Spanner and proposed using a self-managed PostgreSQL database on Compute Engine VMs instead. You need to resolve this conflict and ensure the project moves forward with an architecturally sound database choice that balances technical requirements with financial constraints. What should you do?
A. Provide the development team with a reference architecture for deploying a highly available PostgreSQL cluster on a regional managed instance group (MIG).
B. Suggest using Cloud SQL for PostgreSQL as a compromise to get a managed service at a lower cost than Spanner.
C. Develop a total cost of ownership (TCO) analysis that includes operational overhead, and present it in a workshop to facilitate a decision.
D. Cite the reliability and performance optimization pillars of the Google Cloud Well-Architected Framework to formally justify the use of Spanner.
Show Answer
Correct Answer: C
Explanation: A total cost of ownership (TCO) analysis compares not only direct infrastructure costs but also operational overhead, reliability, staffing, maintenance, and downtime risk. Since the disagreement is between technical suitability and apparent monthly cost, a TCO analysis presented to both engineering and FinOps is the appropriate architectural approach to enable an informed decision. The other options either prematurely choose a database solution or justify Spanner based only on architecture without addressing the financial concern.
Question 57
You are designing the architecture for a global social media site on Google Cloud. The site serves dynamic API content, static assets such as CSS. JS. images, and user-uploaded videos for streaming. You need to minimize latency for all content types for users worldwide. What should you do? (Choose two.)
A. Use an external Application Load Balancer to serve your application APIs.
B. Use Cloud CDN to serve static assets of your application.
C. Use Media CDN to serve static assets of your application
D. Use Memorystore to serve your web application.
E. Use a multi-region Cloud Storage bucket to serve your entire web application.
Show Answer
Correct Answer: A, B
Explanation: Use an external Application Load Balancer for globally distributed, low-latency delivery of dynamic API traffic. Use Cloud CDN to cache and serve static assets (CSS, JavaScript, images) from Google's edge locations worldwide. Media CDN is intended for large-scale media/video streaming rather than general website static assets, and the question specifically pairs static assets with Cloud CDN. Memorystore is an in-memory cache, not a content delivery solution, and serving an entire application from Cloud Storage is not suitable for dynamic APIs.
$19
Get all 307 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.