Professional Cloud Architect Free Practice Questions — Page 8
Question 58
Your organization has a significant amount of log data stored in Cloud Logging. The data engineering team is accustomed to using SQL for analysis and wants the ability to create insightful dashboards for visualizing log trends and patterns. You want to follow the recommendations of the Google Cloud Well-Architected Framework to provide a solution for the data engineering team. What should you do?
A. Create a log sink, and export the data to BigQuery using Pub/Sub. Run queries and visualize the data with Cloud Monitoring dashboards.
B. Enable log analytics and run queries in Cloud Monitoring. Visualize the data using Vertex AI workbench.
C. Enable log analytics and run queries in the linked log dataset in BigQuery. Visualize the data with Looker Studio dashboards.
D. Create a log sink, and export the data to a storage bucket. Create an external table in BigQuery for the data in the bucket. Run queries and visualize the data with Cloud Monitoring dashboards.
Show Answer
Correct Answer: C
Explanation: Log Analytics is the recommended modern approach for analyzing Cloud Logging data with SQL. By enabling Log Analytics and using the linked BigQuery dataset, the team can query logs with BigQuery SQL without exporting or duplicating data. Looker Studio integrates natively with BigQuery to build dashboards, aligning with Google Cloud Well-Architected guidance to use managed, low-overhead services.
Question 59
You are creating a migration plan to move your organization’s infrastructure from on-premises to Google Cloud. You want to understand and manage costs effectively after the migration is complete. Which strategies should you include in the migration plan? (Choose two.)
A. Enable Backup and DR Service.
B. Configure labels and tags for the resources provisioned in Google Cloud.
C. Create a Cloud Scheduler job to export billing data to Cloud SQL.
D. Create service alerts using Cloud Monitoring.
E. Adopt infrastructure as code (IaC) for the cloud resources.
Show Answer
Correct Answer: B, E
Explanation: Configuring labels and tags enables cost allocation, reporting, and analysis across teams, applications, or environments, which is fundamental for understanding post-migration cloud costs. Adopting infrastructure as code (IaC) improves governance, standardization, and lifecycle management, helping prevent resource sprawl and unnecessary spending. Backup and DR is for resilience, Cloud Scheduler exporting billing data to Cloud SQL is not the standard billing export approach, and Cloud Monitoring alerts are primarily for operational monitoring rather than cost management.
Question 60
Your company has a Google Cloud project that uses BigOuery for data warehousing. The VPN tunnel between the on-premises environment and Google Cloud is configured with Cloud VPN. Your security team wants to avoid data exfiltration by malicious insiders, compromised code, and accidental oversharing. What should you do?
A. Configure Private Service Connect.
B. Configure VPC Service Controls and configure Private Google Access for on-promises hosts.
C. Create a service account, grant the BigQuery JobUser role and Storage Object Viewer role to the service account, and remove all other Identity and Access Management (IAM) access from the project.
D. Configure Private Google Access.
Show Answer
Correct Answer: B
Explanation: VPC Service Controls create a security perimeter around supported Google Cloud services such as BigQuery to help prevent data exfiltration from malicious insiders, compromised credentials, or accidental data movement. Private Google Access for on-premises hosts allows on-premises systems to privately access Google APIs over Cloud VPN/Cloud Interconnect without traversing the public internet. Private Service Connect alone does not provide exfiltration protection, and IAM role changes alone do not address the stated threat model. Private Google Access by itself also does not prevent data exfiltration.
Question 62
Your company has decided to make a major revision of their API in order to create better experiences for their developers. They need to keep the old version of the API available and deployable, while allowing new customers and testers to try out the new API. They want to keep the same SSL and DNS records in place to serve both APIs.
What should they do?
A. Configure a new load balancer for the new version of the API
B. Reconfigure old clients to use a new endpoint for the new API
C. Have the old API forward traffic to the new API based on the path
D. Use separate backend pools for each API path behind the load balancer
Show Answer
Correct Answer: D
Explanation: Using a single load balancer with path-based routing and separate backend pools allows both API versions to be served under the same DNS name and SSL certificate. Requests can be routed by URL path (for example, /v1 and /v2) to different backend services, keeping the old API available while exposing the new API for testing and new customers without changing the public endpoint.
Question 63
You are working at a financial institution that stores mortgage loan approval documents on Cloud Storage. Any change to these approval documents must be uploaded as a separate approval file. You need to ensure that these documents cannot be deleted or overwritten for the next 5 years. What should you do?
A. Create a retention policy on the bucket for the duration of 5 years. Create a lock on the retention policy.
B. Create a retention policy organizational constraint constraints/storage.retentionPolicySeconds at the organization level. Set the duration to 5 years.
C. Use a customer-managed key for the encryption of the bucket. Rotate the key after 5 years.
D. Create a retention policy organizational constraint constraints/storage.retentionPolicySeconds at the project level. Set the duration to 5 years.
Show Answer
Correct Answer: A
Explanation: Cloud Storage retention policies prevent objects from being deleted or overwritten until the retention period expires. Locking the retention policy makes it immutable, ensuring the 5-year retention requirement cannot be bypassed. Organization policy constraints are not the correct mechanism for enforcing immutable retention on specific approval documents, and encryption key rotation does not provide write-once or retention guarantees.
Question 64
Your company wants to migrate their 10-TB on-premises database export into Cloud Storage. You want to minimize the time it takes to complete this activity and the overall cost. The bandwidth between the on-premises environment and Google Cloud is 1 Gbps. You want to follow Google-recommended practices. What should you do?
A. Develop a Dataflow job to read data directly from the database and write it into Cloud Storage.
B. Use the Data Transfer appliance to perform an offline migration.
C. Use a commercial partner ETL solution to extract the data from the on-premises database and upload it into Cloud Storage.
D. Upload the data with gcloud storage cp.
Show Answer
Correct Answer: D
Explanation: A 10 TB transfer over a dedicated 1 Gbps link takes roughly 22–24 hours under ideal conditions, well under the typical threshold where Google recommends using Transfer Appliance (generally when network transfer would take more than about a week or is impractical). Transfer Appliance adds shipping time and appliance costs. Dataflow and third-party ETL are unnecessary for an existing database export. Using gcloud storage cp is the recommended straightforward online upload method for this dataset size and bandwidth.
Question 65
You are configuring the cloud network architecture for a newly created project in Google Cloud that will host applications in Compute Engine. Compute Engine virtual machine instances will be created in two different subnets (sub-a and sub-b) within a single region:
• Instances in sub-a will have public IP addresses.
• Instances in sub-b will have only private IP addresses.
To download updated packages, instances must connect to a public repository outside the boundaries of Google Cloud. You need to allow sub-b to access the external repository. What should you do?
A. Enable Private Google Access on sub-b.
B. Configure Cloud NAT and select sub-b in the NAT mapping section.
C. Configure a bastion host instance in sub-a to connect to instances in sub-b.
D. Enable Identity-Aware Proxy for TCP forwarding for instances in sub-b.
Show Answer
Correct Answer: B
Explanation: Instances without external IP addresses need Cloud NAT to initiate outbound connections to the public internet while remaining unreachable from inbound internet traffic. Private Google Access only enables access to Google APIs and services, not arbitrary public repositories. A bastion host is for administrative access, and IAP TCP forwarding is also for secure administrative connectivity, not outbound internet access.
Question 66
Your company is planning to migrate their Windows Server 2022 from their on-premises data center to Google Cloud. You need to bring the licenses that are currently in use in on-premises virtual machines into the target cloud environment. What should you do?
A. 1. Create an image of the on-premises virtual machines and upload into Cloud Storage. 2. Import the image as a virtual disk on Compute Engine.
B. 1. Create standard instances on Compute Engine. 2. Select as the OS the same Microsoft Windows version that is currently in use in the on-premises environment.
C. 1. Create an image of the on-premises virtual machine. 2. Import the image as a virtual disk on Compute Engine. 3. Create a standard instance on Compute Engine, selecting as the OS the same Microsoft Windows version that is currently in use in the on-premises environment. 4. Attach a data disk that includes data that matches the created image.
D. 1. Create an image of the on-premises virtual machines. 2. Import the image as a virtual disk on Compute Engine using --os=windows-2022-dc-v . 3. Create a sole-tenancy instance on Compute Engine that uses the imported disk as a boot disk.
Show Answer
Correct Answer: D
Explanation: Bringing your own Windows Server 2022 licenses to Google Cloud requires a Windows BYOL image and deployment on sole-tenant nodes to satisfy Microsoft's BYOL licensing requirements. The correct process is to import the on-premises Windows image with the appropriate Windows OS designation and then create a sole-tenancy VM using the imported disk as the boot disk.
Question 67
You are deploying an application to Google Cloud. The application is part of a system. The application in Google Cloud must communicate over a private network with applications in a non-Google Cloud environment. The expected average throughput is 200 kbps. The business requires:
• 99.99% system availability
• cost optimization
You need to design the connectivity between the locations to meet the business requirements. What should you provision?
A. An HA Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.
B. A Classic Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.
C. Two HA Cloud VPN gateways connected to two on-premises VPN gateways. Configure each HA Cloud VPN gateway to have two tunnels, each connected to different on-premises VPN gateways.
D. A Classic Cloud VPN gateway connected with one tunnel to an on-premises VPN gateway.
Show Answer
Correct Answer: A
Explanation: HA Cloud VPN is the recommended option for high availability. A single HA Cloud VPN gateway with two tunnels to a redundant on-premises VPN gateway configuration provides the 99.99% HA VPN SLA while minimizing cost. Classic Cloud VPN does not provide the same high-availability SLA, and deploying two HA Cloud VPN gateways (option C) adds unnecessary cost for a very low throughput requirement (200 kbps).
Question 68
Your company has an application running on App Engine that allows users to upload music files and share them with other people. You want to allow users to upload files directly into Cloud Storage from their browser session. The payload should not be passed through the backend. What should you do?
A. 1. Set a CORS configuration in the target Cloud Storage bucket where the base URL of the App Engine application is an allowed origin. 2. Use the Cloud Storage Signed URL feature to generate a POST URL.
B. 1. Set a CORS configuration in the target Cloud Storage bucket where the base URL of the App Engine application is an allowed origin. 2. Assign the Cloud Storage WRITER role to users who upload files.
C. 1. Use the Cloud Storage Signed URL feature to generate a POST URL. 2. Use App Engine default credentials to sign requests against Cloud Storage.
D. 1. Assign the Cloud Storage WRITER role to users who upload files. 2. Use App Engine default credentials to sign requests against Cloud Storage.
Show Answer
Correct Answer: A
Explanation: Direct browser uploads to Cloud Storage require the bucket to allow the application's origin via CORS, and a signed POST URL (or signed upload URL) lets the browser upload directly without routing the file through the App Engine backend. Granting users Storage Writer is overly broad, and App Engine default credentials are not used by the browser to sign upload requests.
$19
Get all 307 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.