Professional Cloud Architect Free Practice Questions — Page 9
Question 73
Your company has an application running on Google Cloud that is collecting data from thousands of physical devices that are globally distributed. Data is published to Pub/Sub and streamed in real time into an SSD Cloud Bigtable cluster via a Dataflow pipeline. The operations team informs you that your Cloud
Bigtable cluster has a hotspot, and queries are taking longer than expected. You need to resolve the problem and prevent it from happening in the future. What should you do?
A. Advise your clients to use HBase APIs instead of NodeJS APIs.
B. Delete records older than 30 days.
C. Review your RowKey strategy and ensure that keys are evenly spread across the alphabet.
D. Double the number of nodes you currently have.
Show Answer
Correct Answer: C
Explanation: Cloud Bigtable hotspots are most commonly caused by poor row key design, where sequential or skewed keys send most reads/writes to a small range of tablets. Reviewing and redesigning the RowKey to evenly distribute keys across the keyspace ensures load is balanced across nodes, resolving current hotspots and preventing future ones. Adding nodes may mask the issue temporarily but does not fix the root cause; the other options are unrelated to hotspot behavior.
Question 74
Your company has just recently activated Cloud Identity to manage users. The Google Cloud Organization has been configured as well. The security team needs to secure projects that will be part of the Organization. They want to prohibit IAM users outside the domain from gaining permissions from now on. What should they do?
A. Configure an organization policy to restrict identities by domain.
B. Configure an organization policy to block creation of service accounts.
C. Configure Cloud Scheduler to trigger a Cloud Function every hour that removes all users that don't belong to the Cloud Identity domain from all projects.
D. Create a technical user (e.g., [email protected] ), and give it the project owner role at root organization level. Write a bash script that: ג€¢ Lists all the IAM rules of all projects within the organization. ג€¢ Deletes all users that do not belong to the company domain. Create a Compute Engine instance in a project within the Organization and configure gcloud to be executed with technical user credentials. Configure a cron job that executes the bash script every hour.
Show Answer
Correct Answer: A
Explanation: To prevent IAM principals outside the company domain from gaining permissions going forward, the correct approach is to enforce an Organization Policy that restricts identities by domain. The `constraints/iam.allowedPolicyMemberDomains` policy ensures that only users and groups from the approved Cloud Identity domain can be granted IAM roles across all projects in the organization. This is a native, preventive, and centrally managed control. The other options are either ineffective, overly complex, or do not address the requirement of proactively restricting external identities.
Question 76
You want to allow your operations team to store logs from all the production projects in your Organization, without including logs from other projects. All of the production projects are contained in a folder. You want to ensure that all logs for existing and new production projects are captured automatically. What should you do?
A. Create an aggregated export on the Production folder. Set the log sink to be a Cloud Storage bucket in an operations project.
B. Create an aggregated export on the Organization resource. Set the log sink to be a Cloud Storage bucket in an operations project.
C. Create log exports in the production projects. Set the log sinks to be a Cloud Storage bucket in an operations project.
D. Create log exports in the production projects. Set the log sinks to be BigQuery datasets in the production projects, and grant IAM access to the operations team to run queries on the datasets.
Show Answer
Correct Answer: A
Explanation: An aggregated log sink created at the folder level captures logs from all projects under that folder, including any new projects added in the future, while excluding projects outside the folder. Pointing the sink to a Cloud Storage bucket in an operations project centralizes access for the operations team. Organization-level sinks would include non-production projects, and per-project exports would not automatically cover new projects.
Question 77
You are working with a data warehousing team that performs data analysis. The team needs to process data from external partners, but the data contains personally identifiable information (PII). You need to process and store the data without storing any of the PIIE data. What should you do?
A. Create a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline, use the Cloud Data Loss Prevention (Cloud DLP) API to remove any PII data. Store the result in BigQuery.
B. Create a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline, store all non-PII data in BigQuery and store all PII data in a Cloud Storage bucket that has a retention policy set.
C. Ask the external partners to upload all data on Cloud Storage. Configure Bucket Lock for the bucket. Create a Dataflow pipeline to read the data from the bucket. As part of the pipeline, use the Cloud Data Loss Prevention (Cloud DLP) API to remove any PII data. Store the result in BigQuery.
D. Ask the external partners to import all data in your BigQuery dataset. Create a dataflow pipeline to copy the data into a new table. As part of the Dataflow bucket, skip all data in columns that have PII data
Show Answer
Correct Answer: A
Explanation: The requirement is to process data containing PII without storing any PII. Using a Dataflow pipeline with the Cloud DLP API allows PII to be detected and removed in-flight before persistence. Storing only the de-identified results in BigQuery satisfies the requirement. Other options either store PII temporarily (Cloud Storage or BigQuery), rely on retention/locking rather than removal, or skip columns without proper PII detection.
Question 78
The operations team in your company wants to save Cloud VPN log events for one year. You need to configure the cloud infrastructure to save the logs. What should you do?
A. Set up a filter in Cloud Logging and a Cloud Storage bucket as an export target for the logs you want to save.
B. Enable the Compute Engine API, and then enable logging on the firewall rules that match the traffic you want to save.
C. Set up a Cloud Logging Dashboard titled Cloud VPN Logs, and then add a chart that queries for the VPN metrics over a one-year time period.
D. Set up a filter in Cloud Logging and a topic in Pub/Sub to publish the logs.
Show Answer
Correct Answer: A
Explanation: Cloud VPN logs are generated in Cloud Logging, which has a limited default retention. To retain logs for one year, you must export them to a long-term storage service. Creating a log sink with a filter in Cloud Logging and exporting to a Cloud Storage bucket allows durable, cost-effective archival (for example using Coldline or Archive classes). Other options either do not provide long-term retention or do not store logs at all.
Question 79
Your company has an application running on Compute Engine that allows users to play their favorite music. There are a fixed number of instances. Files are stored in Cloud Storage, and data is streamed directly to users. Users are reporting that they sometimes need to attempt to play popular songs multiple times before they are successful. You need to improve the performance of the application. What should you do?
A. 1. Mount the Cloud Storage bucket using gcsfuse on all backend Compute Engine instances. 2. Serve music files directly from the backend Compute Engine instance.
B. 1. Create a Cloud Filestore NFS volume and attach it to the backend Compute Engine instances. 2. Download popular songs in Cloud Filestore. 3. Serve music files directly from the backend Compute Engine instance.
C. 1. Copy popular songs into CloudSQL as a blob. 2. Update application code to retrieve data from CloudSQL when Cloud Storage is overloaded.
D. 1. Create a managed instance group with Compute Engine instances. 2. Create a global load balancer and configure it with two backends: ג—‹ Managed instance group ג—‹ Cloud Storage bucket 3. Enable Cloud CDN on the bucket backend.
Show Answer
Correct Answer: D
Explanation: The performance issue is caused by repeatedly streaming popular static content directly from Cloud Storage through a fixed number of Compute Engine instances. The correct improvement is to offload and cache static content delivery. Using a managed instance group with a global HTTP(S) load balancer allows scalable request handling, and configuring Cloud Storage as a backend with Cloud CDN caches popular songs at edge locations close to users. This reduces repeated fetches from Cloud Storage, lowers backend load, and significantly improves reliability and latency for popular songs. The other options misuse storage services or introduce performance and scalability limitations.
Question 80
Your company has a Google Workspace account and Google Cloud Organization. Some developers in the company have created Google Cloud projects outside of the Google Cloud Organization.
You want to create an Organization structure that allows developers to create projects, but prevents them from modifying production projects. You want to manage policies for all projects centrally and be able to set more restrictive policies for production projects.
You want to minimize disruption to users and developers when business needs change in the future. You want to follow Google-recommended practices. Now should you design the Organization structure?
A. 1. Create a second Google Workspace account and Organization. 2. Grant all developers the Project Creator IAM role on the new Organization. 3. Move the developer projects into the new Organization. 4. Set the policies for all projects on both Organizations. 5. Additionally, set the production policies on the original Organization.
B. 1. Create a folder under the Organization resource named ג€Production.ג€ 2. Grant all developers the Project Creator IAM role on the new Organization. 3. Move the developer projects into the new Organization. 4. Set the policies for all projects on the Organization. 5. Additionally, set the production policies on the ג€Productionג€ folder.
C. 1. Create folders under the Organization resource named ג€Developmentג€ and ג€Production.ג€ 2. Grant all developers the Project Creator IAM role on the ג€Developmentג€ folder. 3. Move the developer projects into the ג€Developmentג€ folder. 4. Set the policies for all projects on the Organization. 5. Additionally, set the production policies on the ג€Productionג€ folder.
D. 1. Designate the Organization for production projects only. 2. Ensure that developers do not have the Project Creator IAM role on the Organization. 3. Create development projects outside of the Organization using the developer Google Workspace accounts. 4. Set the policies for all projects on the Organization. 5. Additionally, set the production policies on the individual production projects.
Show Answer
Correct Answer: C
Explanation: Use a single Organization with folders to separate environments. Creating Development and Production folders lets you grant Project Creator only in Development, centrally manage org-level policies, and apply stricter policies to Production via folder-level constraints. This follows Google best practices, avoids multiple organizations, allows easy project movement between environments, and minimizes future disruption.
Question 81
For this question, refer to the Helicopter Racing League (HRL) case study. Your team is in charge of creating a payment card data vault for card numbers used to bill tens of thousands of viewers, merchandise consumers, and season ticket holders. You need to implement a custom card tokenization service that meets the following requirements:
* It must provide low latency at minimal cost.
* It must be able to identify duplicate credit cards and must not store plaintext card numbers.
* It should support annual key rotation.
Which storage approach should you adopt for your tokenization service?
A. Store the card data in Secret Manager after running a query to identify duplicates.
B. Encrypt the card data with a deterministic algorithm stored in Firestore using Datastore mode.
C. Encrypt the card data with a deterministic algorithm and shard it across multiple Memorystore instances.
D. Use column-level encryption to store the data in Cloud SQL.
Show Answer
Correct Answer: B
Explanation: The service needs deterministic tokenization to identify duplicate cards without storing plaintext data, low latency at scale, minimal operational cost, and support for key rotation. Deterministic encryption allows the same card input to always produce the same token, enabling deduplication. Firestore in Datastore mode is designed for massive scale, low-latency key-based access, and cost efficiency compared to relational databases. It integrates well with KMS for annual key rotation and aligns with Google’s reference PCI tokenization architectures. Other options either misuse services (Secret Manager), add unnecessary complexity and duplication risk (Memorystore sharding), or incur higher cost and latency (Cloud SQL).
Question 82
You are responsible for the Google Cloud environment in your company. Multiple departments need access to their own projects, and the members within each department will have the same project responsibilities. You want to structure your Google Cloud environment for minimal maintenance and maximum overview of
IAM permissions as each department's projects start and end. You want to follow Google-recommended practices. What should you do?
A. Grant all department members the required IAM permissions for their respective projects.
B. Create a Google Group per department and add all department members to their respective groups. Create a folder per department and grant the respective group the required IAM permissions at the folder level. Add the projects under the respective folders.
C. Create a folder per department and grant the respective members of the department the required IAM permissions at the folder level. Structure all projects for each department under the respective folders.
D. Create a Google Group per department and add all department members to their respective groups. Grant each group the required IAM permissions for their respective projects.
Show Answer
Correct Answer: B
Explanation: Google-recommended practice is to manage access through Google Groups and apply IAM at higher levels of the resource hierarchy. Creating a folder per department and granting IAM roles to a department Google Group at the folder level ensures consistent permissions across all projects, simplifies onboarding/offboarding, and provides clear visibility and minimal maintenance as projects are added or removed.
Question 83
Your company wants to migrate their 10-TB on-premises database export into Cloud Storage. You want to minimize the time it takes to complete this activity, the overall cost, and database load. The bandwidth between the on-premises environment and Google Cloud is 1 Gbps. You want to follow Google-recommended practices. What should you do?
A. Develop a Dataflow job to read data directly from the database and write it into Cloud Storage.
B. Use the Data Transfer appliance to perform an offline migration.
C. Use a commercial partner ETL solution to extract the data from the on-premises database and upload it into Cloud Storage.
D. Compress the data and upload it with gsutil -m to enable multi-threaded copy.
Show Answer
Correct Answer: B
Explanation: The dataset is large (10 TB). Google‑recommended practices state that gsutil is best for smaller transfers (typically under ~1 TB), while large datasets should use Storage Transfer Service or an offline option. Since Storage Transfer Service is not an option here, the Data Transfer (Transfer) Appliance is the recommended choice. It minimizes database load, avoids saturating the 1‑Gbps network for days, and aligns with Google guidance for large on‑premises migrations, even if shipping adds some latency.
$19
Get all 305 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.