Professional Cloud Architect Free Practice Questions — Page 8
Question 63
Your company and one of its partners each have a Google Cloud project in separate organizations. Your company's project (prj-a) runs in Virtual Private Cloud
(vpc-a). The partner's project (prj-b) runs in vpc-b. There are two instances running on vpc-a and one instance running on vpc-b. Subnets defined in both VPCs are not overlapping. You need to ensure that all instances communicate with each other via internal IPs, minimizing latency and maximizing throughput. What should you do?
A. Set up a network peering between vpc-a and vpc-b.
B. Set up a VPN between vpc-a and vpc-b using Cloud VPN.
C. Configure IAP TCP forwarding on the instance in vpc-b, and then launch the following gcloud command from one of the instances in vpc-a gcloud: gcloud compute start-iap-tunnel INSTANCE_NAME_IN_VPC_8 22 \ --local-host-port=localhost:22
D. 1. Create an additional instance in vpc-a. 2. Create an additional instance in vpc-b. 3. Install OpenVPN in newly created instances. 4. Configure a VPN tunnel between vpc-a and vpc-b with the help of OpenVPN.
Show Answer
Correct Answer: A
Explanation: VPC Network Peering provides direct, private connectivity between VPCs using Google’s internal network. It allows instances in different projects and even different organizations to communicate using internal IP addresses with low latency and high throughput, as long as subnet CIDR ranges do not overlap. This exactly matches the requirement. Cloud VPN or OpenVPN add encryption overhead and higher latency, and IAP TCP forwarding is for administrative access, not full network connectivity.
Question 64
Your company uses Google Kubernetes Engine (GKE) as a platform for all workloads. Your company has a single large GKE cluster that contains batch, stateful, and stateless workloads. The GKE cluster is configured with a single node pool with 200 nodes. Your company needs to reduce the cost of this cluster but does not want to compromise availability. What should you do?
A. Create a second GKE cluster for the batch workloads only. Allocate the 200 original nodes across both clusters.
B. Configure CPU and memory limits on the namespaces in the cluster. Configure all Pods to have a CPU and memory limits.
C. Configure a HorizontalPodAutoscaler for all stateless workloads and for all compatible stateful workloads. Configure the cluster to use node auto scaling.
D. Change the node pool to use preemptible VMs.
Show Answer
Correct Answer: C
Explanation: Using Horizontal Pod Autoscalers scales workloads based on demand, and enabling cluster (node) autoscaling scales the number of nodes accordingly. Together, they reduce costs during low usage while maintaining availability during peaks. Other options either don’t reduce node count, risk availability, or are unsuitable for all workload types.
Question 65
Your company has an application running as a Deployment in a Google Kubernetes Engine (GKE) cluster. When releasing new versions of the application via a rolling deployment, the team has been causing outages. The root cause of the outages is misconfigurations with parameters that are only used in production. You want to put preventive measures for this in the platform to prevent outages. What should you do?
A. Configure liveness and readiness probes in the Pod specification.
B. Configure health checks on the managed instance group.
C. Create a Scheduled Task to check whether the application is available.
D. Configure an uptime alert in Cloud Monitoring.
Show Answer
Correct Answer: A
Explanation: The outages occur during rolling deployments due to production-only misconfigurations. Readiness probes ensure that new Pods do not receive traffic until they are fully started and correctly configured, preventing broken Pods from serving requests while old Pods are still running. Liveness probes help restart Pods that enter a bad state. Together, these Kubernetes-native mechanisms are preventive and directly address rollout-related outages. The other options only detect or alert after failures, or are not applicable to GKE.
Question 66
You are managing several internal applications that are deployed on Compute Engine. Business users inform you that an application has become very slow over the past few days. You want to find the underlying cause in order to solve the problem. What should you do first?
A. Inspect the logs and metrics from the instances in Cloud Logging and Cloud Monitoring.
B. Change the Compute Engine Instances behind the application to a machine type with more CPU and memory.
C. Restore a backup of the application database from a time before the application became slow.
D. Deploy the applications on a managed instance group with autoscaling enabled. Add a load balancer in front of the managed instance group, and have the users connect to the IP of the load balancer.
Show Answer
Correct Answer: A
Explanation: The goal is to find the underlying cause of the performance degradation. The correct first step is to gather evidence by inspecting logs and metrics using Cloud Logging and Cloud Monitoring. This allows you to identify resource bottlenecks, errors, or abnormal behavior before making architectural or capacity changes. The other options attempt to fix symptoms without first diagnosing the root cause.
Question 67
Your customer runs a web service used by e-commerce sites to offer product recommendations to users. The company has begun experimenting with a machine learning model on Google Cloud Platform to improve the quality of results.
What should the customer do to improve their model's results over time?
A. Export Cloud Machine Learning Engine performance metrics from Stackdriver to BigQuery, to be used to analyze the efficiency of the model.
B. Build a roadmap to move the machine learning model training from Cloud GPUs to Cloud TPUs, which offer better results.
C. Monitor Compute Engine announcements for availability of newer CPU architectures, and deploy the model to them as soon as they are available for additional performance.
D. Save a history of recommendations and results of the recommendations in BigQuery, to be used as training data.
Show Answer
Correct Answer: D
Explanation: Improving model results over time primarily depends on better and more representative training data. Storing a history of recommendations and their outcomes creates labeled feedback data that can be reused to retrain and refine the model. The other options focus on infrastructure performance or monitoring, which do not directly improve prediction quality.
Question 68
You are designing an application for use only during business hours. For the minimum viable product release, you'd like to use a managed product that automatically `scales to zero` so you don't incur costs when there is no activity.
Which primary compute resource should you choose?
A. Cloud Functions
B. Compute Engine
C. Google Kubernetes Engine
D. AppEngine flexible environment
Show Answer
Correct Answer: A
Explanation: The requirement is a managed compute service that can automatically scale to zero so there is no cost when idle. Cloud Functions is a fully managed serverless offering that scales down to zero when there are no invocations. Compute Engine always incurs costs unless manually stopped, GKE has ongoing control-plane costs and does not truly scale all components to zero, and App Engine flexible environment requires at least one running instance. Therefore, Cloud Functions best meets the requirement.
Question 69
For this question, refer to the Helicopter Racing League (HRL) case study. Recently HRL started a new regional racing league in Cape Town, South Africa. In an effort to give customers in Cape Town a better user experience, HRL has partnered with the Content Delivery Network provider, Fastly. HRL needs to allow traffic coming from all of the Fastly IP address ranges into their Virtual Private Cloud network (VPC network). You are a member of the HRL security team and you need to configure the update that will allow only the Fastly IP address ranges through the External HTTP(S) load balancer. Which command should you use?
A.
B.
C.
D.
Show Answer
Correct Answer: D
Explanation: To allow only Fastly traffic through an External HTTP(S) Load Balancer in GCP, you must use Cloud Armor, which attaches to the load balancer and controls external traffic. Cloud Armor provides a preconfigured source IP list for Fastly that is referenced with evaluatePreconfiguredExpr('sourceiplist-fastly') in a security policy rule. VPC firewall rules do not control traffic at the HTTP(S) load balancer edge, so the correct command is the one that creates a Cloud Armor security policy rule using the Fastly source IP list.
Question 70
Your company is using BigQuery as its enterprise data warehouse. Data is distributed over several Google Cloud projects. All queries on BigQuery need to be billed on a single project. You want to make sure that no query costs are incurred on the projects that contain the data. Users should be able to query the datasets, but not edit them.
How should you configure users' access roles?
A. Add all users to a group. Grant the group the role of BigQuery user on the billing project and BigQuery dataViewer on the projects that contain the data.
B. Add all users to a group. Grant the group the roles of BigQuery dataViewer on the billing project and BigQuery user on the projects that contain the data.
C. Add all users to a group. Grant the group the roles of BigQuery jobUser on the billing project and BigQuery dataViewer on the projects that contain the data.
D. Add all users to a group. Grant the group the roles of BigQuery dataViewer on the billing project and BigQuery jobUser on the projects that contain the data.
Show Answer
Correct Answer: C
Explanation: To ensure all query costs are billed to a single billing project, users must be able to run BigQuery jobs only in that billing project. Granting BigQuery jobUser on the billing project allows users to submit query jobs there without broader administrative permissions. On the projects that contain the data, granting BigQuery dataViewer allows users to read/query the datasets but not modify them, and it prevents query jobs (and thus costs) from being run in those data projects. This satisfies cost control and least-privilege requirements.
Question 71
Your operations team currently stores 10 TB of data in an object storage service from a third-party provider. They want to move this data to a Cloud Storage bucket as quickly as possible, following Google-recommended practices. They want to minimize the cost of this data migration. Which approach should they use?
A. Use the gsutil mv command to move the data.
B. Use the Storage Transfer Service to move the data.
C. Download the data to a Transfer Appliance, and ship it to Google.
D. Download the data to the on-premises data center, and upload it to the Cloud Storage bucket.
Show Answer
Correct Answer: B
Explanation: The data is already in a third-party object storage service and the goal is to migrate it to Cloud Storage as quickly as possible while minimizing cost and following Google-recommended practices. Google recommends using Storage Transfer Service for online data transfers from other cloud or object storage providers. It is optimized for large datasets (such as 10 TB), supports direct cloud-to-cloud transfers without intermediate downloads, and avoids extra egress, hardware, or operational costs. Other options are slower, more manual, or more expensive.
Question 72
Your company has a Google Cloud project that uses BigQuery for data warehousing. There are some tables that contain personally identifiable information (PII).
Only the compliance team may access the PII. The other information in the tables must be available to the data science team. You want to minimize cost and the time it takes to assign appropriate access to the tables. What should you do?
A. 1. From the dataset where you have the source data, create views of tables that you want to share, excluding PII. 2. Assign an appropriate project-level IAM role to the members of the data science team. 3. Assign access controls to the dataset that contains the view.
B. 1. From the dataset where you have the source data, create materialized views of tables that you want to share, excluding PII. 2. Assign an appropriate project-level IAM role to the members of the data science team. 3. Assign access controls to the dataset that contains the view.
C. 1. Create a dataset for the data science team. 2. Create views of tables that you want to share, excluding PII. 3. Assign an appropriate project-level IAM role to the members of the data science team. 4. Assign access controls to the dataset that contains the view. 5. Authorize the view to access the source dataset.
D. 1. Create a dataset for the data science team. 2. Create materialized views of tables that you want to share, excluding PII. 3. Assign an appropriate project-level IAM role to the members of the data science team. 4. Assign access controls to the dataset that contains the view. 5. Authorize the view to access the source dataset.
Show Answer
Correct Answer: C
Explanation: The correct approach is to use authorized views in BigQuery. Creating a separate dataset for the data science team and placing views (that exclude PII) in that dataset allows you to grant them access only to non-PII data, without exposing the underlying tables. Authorizing the views to access the source dataset is required so the views can read the protected tables. This follows BigQuery best practices, minimizes ongoing access management effort, avoids duplicating data, and does not add storage cost. Materialized views are unnecessary and more expensive.
$19
Get all 305 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.