90 free Google Professional Cloud Architect practice questions from the CertStash pack of 360, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 90 free here, all 360 in the pack, and each step includes the one before it.
Get all 360 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Your company has decided to make a major revision of their API in order to create better experiences for their developers. They need to keep the old version of the API available and deployable, while allowing new customers and testers to try out the new API. They want to keep the same SSL and DNS records in place to serve both APIs. What should they do?
Show answer and explanation
Correct answer: D. Use separate backend pools for each API path behind the load balancer
Using separate backend pools for each API path behind a single load balancer allows the company to serve both old and new API versions from the same SSL certificate and DNS record. The load balancer can route requests to different backend pools based on the request path, keeping the same endpoint while supporting both API versions simultaneously.
Why the other options are wrong
- A. A new load balancer would require separate DNS/SSL records, contradicting the requirement to keep these unchanged.
- B. Reconfiguring old clients defeats the purpose of maintaining backward compatibility with the same endpoint.
- C. Having the old API forward to the new API would not allow running both versions independently and could cause compatibility issues.
Question 2
Your company plans to migrate a multi-petabyte data set to the cloud. The data set must be available 24hrs a day. Your business analysts have experience only with using a SQL interface. How should you store the data to optimize it for ease of analysis?
Show answer and explanation
Correct answer: A. Load data into Google BigQuery
Google BigQuery is a fully managed data warehouse optimized for large-scale analytical queries. It provides SQL interface for business analysts, handles multi-petabyte datasets efficiently, offers 24/7 availability, and is purpose-built for analysis and reporting scenarios like this.
Why the other options are wrong
- B. Cloud SQL is designed for transactional databases, not analytical workloads, and has limitations for multi-petabyte datasets.
- C. Cloud Storage with flat files lacks the query capability and SQL interface needed by business analysts.
- D. Cloud Datastore is a NoSQL document database unsuitable for analytical queries and not optimized for this use case.
Question 3
The operations manager asks you for a list of recommended practices that she should consider when migrating a J2EE application to the cloud. Which three practices should you recommend? (Choose three.)
Show answer and explanation
Correct answer: C, D, E. Instrument the application with a monitoring tool like Stackdriver Debugger; Select an automation framework to reliably provision the cloud infrastructure; Deploy a continuous integration tool with automated testing in a staging environment
The three recommended practices are: (C) Instrumenting with monitoring tools like Stackdriver Debugger provides visibility into application performance and debugging; (D) Automation frameworks reliably provision infrastructure consistently; and (E) Continuous integration with automated testing in staging catches errors before production. These address operational excellence, reliability, and quality assurance in cloud migrations.
Why the other options are wrong
- A. Porting to App Engine is an implementation choice that may not fit all J2EE applications and isn't universally recommended for migration strategy.
- B. Cloud Dataflow is for data pipeline processing, not a general recommendation for application migration monitoring needs.
Question 4
A news feed web service has the following code running on Google App Engine. During peak load, users report that they can see news articles they already viewed. What is the most likely cause of this problem?
Show answer and explanation
Correct answer: A. The session variable is local to just a single instance
The code stores session data in a local Python dictionary (`sessions = {}`), which exists only in memory on a single App Engine instance. During peak load, Google App Engine automatically scales by creating multiple instances to handle requests. When users are routed to different instances (due to load balancing), their session data is not available on the new instance because each instance has its own separate in-memory dictionary. This causes previously viewed articles to reappear since the viewing history is lost when the user hits a different instance.
Why the other options are wrong
- B. The code does not use Cloud Datastore for session storage; it only uses a local in-memory dictionary, so overwriting in Datastore is not the issue.
- C. The problem is not related to URL caching or API endpoint design; it's a session persistence issue across multiple instances.
- D. HTTP Expires headers control browser caching of responses, not the server-side session persistence problem of tracking viewed articles across instances.
Question 5
An application development team believes their current logging tool will not meet their needs for their new cloud-based product. They want a better tool to capture errors and help them analyze their historical log data. You want to help them find a solution that meets their needs. What should you do?
Show answer and explanation
Correct answer: C. Help them define their requirements and assess viable logging tools
The best approach is to help the team define their specific requirements and assess viable solutions. This consultative approach ensures the selected tool actually meets their needs for error capture and historical log analysis, rather than immediately prescribing a specific product or assuming the current tool can be fixed.
Why the other options are wrong
- A. Directing them to install Stackdriver immediately skips the requirements assessment phase and may not be the right tool.
- B. Providing generic resources doesn't address their specific problem of finding the right tool for their needs.
- D. Upgrading their current tool assumes it can be fixed, but they've already determined it won't meet their needs.
Question 6
You need to reduce the number of unplanned rollbacks of erroneous production deployments in your company's web hosting platform. Improvement to the QA/ Test processes accomplished an 80% reduction. Which additional two approaches can you take to further reduce the rollbacks? (Choose two.)
Show answer and explanation
Correct answer: A, C. Introduce a green-blue deployment model; Fragment the monolithic platform into microservices
Blue-green deployment (A) allows testing the new version completely before switching traffic, reducing rollback risk. Canary releases (B as the alternative) gradually roll out changes to detect issues. Fragmenting into microservices (C) reduces the blast radius of failed deployments by limiting impact to single services rather than the entire platform.
Why the other options are wrong
- B. Replacing QA with canary releases eliminates testing, creating more risk rather than reducing it.
- D. Reducing relational database dependencies doesn't directly address deployment rollback issues.
- E. Switching database types doesn't reduce deployment-related rollbacks.
Question 7
To reduce costs, the Director of Engineering has required all developers to move their development infrastructure resources from on-premises virtual machines (VMs) to Google Cloud Platform. These resources go through multiple start/stop events during the day and require state to persist. You have been asked to design the process of running a development environment in Google Cloud while providing cost visibility to the finance department. Which two steps should you take? (Choose two.)
Show answer and explanation
Correct answer: A, D. Use the - -no-auto-delete flag on all persistent disks and stop the VM; Use Google BigQuery billing export and labels to associate cost to groups
Using the --no-auto-delete flag (A) preserves persistent disks when stopping VMs, allowing state to persist and VMs to restart without recreating disks. This reduces costs since stopped VMs are cheaper than running ones. Using BigQuery billing export with labels (D) provides cost visibility to the finance department by associating resource usage with developer groups.
Why the other options are wrong
- B. Auto-delete flag terminates persistent disks, losing state that needs to persist.
- C. Labels alone don't provide sufficient cost tracking without the billing export mechanism.
- E. Local SSDs are ephemeral and lost on termination; this doesn't persist state.
- F. Terminating VMs contradicts the requirement to preserve state and enable cost-effective restart.
Question 8
Your company wants to track whether someone is present in a meeting room reserved for a scheduled meeting. There are 1000 meeting rooms across 5 offices on 3 continents. Each room is equipped with a motion sensor that reports its status every second. The data from the motion detector includes only a sensor ID and several different discrete items of information. Analysts will use this data, together with information about account owners and office locations. Which database type should you use?
Show answer and explanation
Correct answer: B. NoSQL
NoSQL databases are ideal for this scenario because the data is high-volume time-series sensor data (1000 rooms × continuous readings), has flexible schema (sensor ID plus discrete information items), and needs to be joined with other data sources (account owners, office locations) during analysis. NoSQL handles high-velocity IoT data efficiently and scales horizontally across continents.
Why the other options are wrong
- A. Flat files are inefficient for 1000 rooms generating continuous data and querying with related datasets.
- C. Relational databases can work but are less efficient for high-velocity sensor data and have scaling challenges.
- D. Blobstore is for unstructured binary data, not structured sensor readings that need querying and analysis.
Question 9
You set up an autoscaling instance group to serve web traffic for an upcoming launch. After configuring the instance group as a backend service to an HTTP(S) load balancer, you notice that virtual machine (VM) instances are being terminated and re-launched every minute. The instances do not have a public IP address. You have verified the appropriate web response is coming from each instance using the curl command. You want to ensure the backend is configured correctly. What should you do?
Show answer and explanation
Correct answer: C. Ensure that a firewall rule exists to allow load balancer health checks to reach the instances in the instance group.
VMs are terminating and relaunching every minute because health checks are failing. Since curl commands work from the instances themselves, the application is responding correctly. The issue is that the load balancer's health check probes cannot reach the instances because a firewall rule is blocking the health check traffic. Allowing health check source traffic (typically from Google's health check IP ranges) to the instances solves this.
Why the other options are wrong
- A. Firewall rules for HTTP/HTTPS to the load balancer don't address the internal health check communication issue.
- B. Public IPs aren't necessary for instances behind a load balancer; this wastes resources and isn't the root cause.
- D. Creating tags with the load balancer name doesn't configure proper health check firewall rules and is incorrectly specified.
Question 10
You write a Python script to connect to Google BigQuery from a Google Compute Engine virtual machine. The script is printing errors that it cannot connect to BigQuery. What should you do to fix the script?
Show answer and explanation
Correct answer: B. Run your script on a new virtual machine with the BigQuery access scope enabled
Google Compute Engine instances require the appropriate OAuth scopes to access BigQuery. A VM created without the BigQuery access scope enabled cannot authenticate to the BigQuery API, regardless of client library installation or service account configuration. Creating a new VM with the BigQuery scope enabled (or adding the scope to an existing VM) is the fundamental requirement for BigQuery access from GCE.
Why the other options are wrong
- A. Installing the client library is necessary but insufficient without proper authentication scopes on the VM.
- C. While service accounts can be used, the VM itself must have the BigQuery scope enabled to use any credentials.
- D. The bq CLI component is optional tooling and does not resolve the underlying authentication scope problem.
What people say about the full Professional Cloud Architect pack 5.0 from 11
PCA went as planned, passed easy
This is my fourth certification with Cert Stash’s help and they never disappoint. Each time, the materials are spot-on! Thanks Cert Stash.
Passed PCA, no complaints
Question 11
Your company has an application deployed on Anthos clusters (formerly Anthos GKE) that is running multiple microservices. The cluster has both Anthos Service Mesh and Anthos Config Management configured. End users inform you that the application is responding very slowly. You want to identify the microservice that is causing the delay. What should you do?
Show answer and explanation
Correct answer: A. Use the Service Mesh visualization in the Cloud Console to inspect the telemetry between the microservices.
Anthos Service Mesh (Istio) provides built-in telemetry and visualization capabilities directly in the Cloud Console. The Service Mesh visualization dashboard displays request flows, latencies, and error rates between microservices, making it the ideal tool to identify which microservice is causing the slowdown. Options B and C involve Anthos Config Management, which manages configurations but doesn't provide performance telemetry. Option D requires unnecessary Istio reinstallation when telemetry is already available in an existing installation.
Why the other options are wrong
- B. Anthos Config Management is for configuration management, not performance diagnostics between services
- C. Anthos Config Management selectors manage configurations, not performance telemetry analysis
- D. Reinstalling Istio is unnecessary and causes disruption when the existing installation already collects telemetry
Question 12
The database administration team has asked you to help them improve the performance of their new database server running on Google Compute Engine. The database is for importing and normalizing their performance statistics and is built with MySQL running on Debian Linux. They have an n1-standard-8 virtual machine with 80 GB of SSD persistent disk. What should they change to get better performance from this system?
Show answer and explanation
Correct answer: C. Dynamically resize the SSD persistent disk to 500 GB
The n1-standard-8 machine already has 30 GB of memory (sufficient for most database operations), but only 80 GB of SSD storage. For a database handling import and normalization of performance statistics with ongoing growth, increasing the persistent disk from 80 GB to 500 GB addresses I/O bottlenecks and provides capacity for data growth, which is the most likely performance constraint.
Why the other options are wrong
- A. The n1-standard-8 already includes 30 GB of memory, which is adequate; increasing to 64 GB would be excessive and expensive for a normalization database.
- B. Switching database engines is a major migration with no guarantee of performance improvement and introduces operational risk.
- D. BigQuery is an analytical data warehouse, not appropriate for transactional database operations and real-time performance statistics ingestion.
- E. While bulk inserts help, they address only one aspect of performance; the storage constraint is more fundamental.
Question 13
A development manager is building a new application. He asks you to review his requirements and identify what cloud technologies he can use to meet them. The application must: 1. Be based on open-source technology for cloud portability 2. Dynamically scale compute capacity based on demand 3. Support continuous software delivery 4. Run multiple segregated copies of the same application stack 5. Deploy application bundles using dynamic templates 6. Route network traffic to specific services based on URL Which combination of technologies will meet all of his requirements?
Show answer and explanation
Correct answer: D. Google Kubernetes Engine, Jenkins, and Cloud Load Balancing
Google Kubernetes Engine (GKE) meets requirements 1-4 and 6: it uses open-source Kubernetes for portability, dynamically scales compute, supports continuous delivery through container orchestration, runs multiple segregated application copies via pods/deployments, and uses Services with load balancing for URL-based routing. Jenkins (requirement 3) provides continuous software delivery pipelines. Cloud Load Balancing (requirement 6) enables URL-based routing to specific services. Helm is not necessary because requirement 5 (dynamic templates) is adequately handled by Kubernetes manifests and GKE's native capabilities.
Why the other options are wrong
- A. While Helm provides dynamic templates, Jenkins and Helm together don't address load balancing for URL-based traffic routing (requirement 6) as directly as the chosen answer.
- B. Lacks continuous software delivery capability (requirement 3) and doesn't address dynamic template deployment (requirement 5).
- C. Cloud Deployment Manager only supports Google Cloud resources and doesn't provide continuous delivery (requirement 3) or URL-based routing (requirement 6) natively.
Question 14
Your company has an application running on multiple Compute Engine instances. You need to ensure that the application can communicate with an on-premises service that requires high throughput via internal IPs, while minimizing latency. What should you do?
Show answer and explanation
Correct answer: D. Configure a Cloud Dedicated Interconnect connection between the on-premises environment and Google Cloud.
For high throughput with minimal latency between Google Cloud and on-premises environments, Cloud Dedicated Interconnect provides dedicated physical connections with guaranteed bandwidth and lower latency than VPN. While VPN or peering could work, the requirement for high throughput and internal IP communication specifically points to Dedicated Interconnect as the optimal solution that meets the performance requirements.
Why the other options are wrong
- A. OpenVPN adds overhead and encryption processing that increases latency; it also does not guarantee the throughput needed for high-performance applications.
- B. Direct Peering is for public IP traffic and connecting to Google's network edge; it does not provide internal IP connectivity needed for this use case.
- C. Cloud VPN operates over the public internet, introducing variable latency and bandwidth constraints that may not meet high-throughput requirements effectively.
Question 15
Your BigQuery project has several users. For audit purposes, you need to see how many queries each user ran in the last month. What should you do?
Show answer and explanation
Correct answer: B. In the BigQuery interface, execute a query on the JOBS table to get the required information.
BigQuery maintains a JOBS table (in the `region-us.INFORMATION_SCHEMA.JOBS_BY_PROJECT` view) that contains job metadata. By querying this table to filter by user and job creation time, you can determine exactly how many queries each user ran in the last month. This is the most direct and accurate method for obtaining audit information about query execution.
Why the other options are wrong
- A. Data Studio is a visualization tool; while it can display data, it's not the source of BigQuery job audit information.
- C. The 'bq show' and 'bq ls' commands are for listing datasets and tables, not querying job execution history.
- D. Cloud Audit Logging tracks administrative actions and access, not individual query execution counts; the JOBS table is the correct source for query audit data.
Question 16
You need to deploy a stateful workload on Google Cloud. The workload can scale horizontally, but each instance needs to read and write to the same POSIX filesystem. At high load, the stateful workload needs to support up to 100 MB/s of writes. What should you do?
Show answer and explanation
Correct answer: C. Create a Cloud Filestore instance and mount it in each instance.
Cloud Filestore provides a managed NFS service supporting POSIX compliance and handles 100 MB/s write throughput at scale, making it ideal for multiple instances requiring shared filesystem access. Persistent disks (options A and B) cannot be simultaneously attached to multiple instances. While Cloud Storage with gcsfuse (option D) is technically mountable, it has throughput limitations and is not optimized for POSIX-compliance or write-heavy workloads at 100 MB/s scale.
Why the other options are wrong
- A. Standard persistent disks cannot be attached to multiple instances simultaneously
- B. Regional persistent disks cannot be attached to multiple instances simultaneously
- D. Cloud Storage with gcsfuse lacks the throughput performance and POSIX compliance needed for 100 MB/s writes
Question 17
Your company has a support ticketing solution that uses App Engine Standard. The project that contains the App Engine application already has a Virtual Private Cloud (VPC) network fully connected to the company's on-premises environment through a Cloud VPN tunnel. You want to enable the App Engine application to communicate with a database that is running in the company's on-premises environment. What should you do?
Show answer and explanation
Correct answer: D. Configure serverless VPC access.
Option D is correct because Serverless VPC Access is the Google Cloud native solution that allows App Engine Standard to access resources in a VPC network. Since the VPC is already connected to on-premises via Cloud VPN, configuring Serverless VPC Access on App Engine enables communication with the on-premises database through the existing VPN tunnel. This is the recommended approach for serverless services needing VPC access.
Why the other options are wrong
- A. Private Google Access for on-premises only is not a valid configuration option.
- B. Private Google Access enables access only to Google Cloud services, not to resources in the VPC or on-premises.
- C. Private Services Access is for accessing managed services like Cloud SQL, not for accessing custom on-premises databases.
Question 18
You have an outage in your Compute Engine managed instance group: all instances keep restarting after 5 seconds. You have a health check configured, but autoscaling is disabled. Your colleague, who is a Linux expert, offered to look into the issue. You need to make sure that he can access the VMs. What should you do?
Show answer and explanation
Correct answer: C. Disable the health check for the instance group. Add his SSH key to the project-wide SSH Keys
To allow the Linux expert colleague to SSH into the restarting VMs, the health check must be disabled to prevent instances from being terminated during investigation. Then adding his SSH key to project-wide SSH keys grants him access to all instances in the project. This allows direct investigation of why instances are restarting every 5 seconds. Disabling the health check is necessary because the continuous restart cycle would prevent meaningful troubleshooting.
Why the other options are wrong
- A. Project Viewer role provides read-only access and does not include SSH permissions needed to access and troubleshoot the instances.
- B. A rolling restart would not help diagnose the root cause and would continue the restart cycle, providing no debugging opportunity.
- D. Autoscaling is already disabled per the question; this option addresses the wrong problem and doesn't solve the access issue.
Question 19
Your operations team currently stores 10 TB of data in an object storage service from a third-party provider. They want to move this data to a Cloud Storage bucket as quickly as possible, following Google-recommended practices. They want to minimize the cost of this data migration. Which approach should they use?
Show answer and explanation
Correct answer: B. Use the Storage Transfer Service to move the data.
Storage Transfer Service is Google's recommended solution for migrating data from third-party cloud providers to Cloud Storage. It handles network optimization, retry logic, and monitoring automatically. For 10 TB from a third-party provider, it's faster, more reliable, and follows Google best practices compared to manual approaches.
Why the other options are wrong
- A. The gsutil mv command is for local file operations and isn't optimized for large-scale cloud-to-cloud transfers from third-party providers.
- C. Transfer Appliance is designed for petabyte-scale on-premises data centers, not for 10 TB cloud-to-cloud transfers, making it unnecessarily complex and expensive.
- D. Downloading to on-premises data center and re-uploading is slower, more expensive in bandwidth costs, and doesn't follow Google-recommended practices.
Question 20
A development team at your company has created a dockerized HTTPS web application. You need to deploy the application on Google Kubernetes Engine (GKE) and make sure that the application scales automatically. How should you deploy to GKE?
Show answer and explanation
Correct answer: B. Use the Horizontal Pod Autoscaler and enable cluster autoscaling on the Kubernetes cluster. Use a Service resource of type LoadBalancer to load-balance the HTTPS traffic.
For automatic scaling in GKE, use the Horizontal Pod Autoscaler (HPA) to scale pods based on metrics and enable cluster autoscaling to scale the underlying nodes. For HTTPS load balancing, a LoadBalancer Service is the appropriate Kubernetes-native resource that creates a Google Cloud Load Balancer with HTTPS support. This approach uses GKE's native capabilities rather than managing Compute Engine instance groups directly.
Why the other options are wrong
- A. While Ingress can handle HTTPS, it's better suited for Layer 7 routing; a LoadBalancer Service is more appropriate for straightforward HTTPS load balancing across the cluster.
- C. Managing Compute Engine instance group autoscaling is lower-level and not the recommended approach when using GKE, which abstracts this complexity.
- D. Manually managing Compute Engine instance groups contradicts using GKE's native autoscaling capabilities and is not the recommended practice.
Question 21
You are working at an institution that processes medical data. You are migrating several workloads onto Google Cloud. Company policies require all workloads to run on physically separated hardware, and workloads from different clients must also be separated. You created a sole-tenant node group and added a node for each client. You need to deploy the workloads on these dedicated hosts. What should you do?
Show answer and explanation
Correct answer: D. Use node affinity labels based on the node name when creating Compute Engine instances in order to host each workload on the correct node.
Node affinity labels are the correct mechanism in Google Cloud to ensure instances run on specific nodes. Since the requirement specifies workload separation at the individual node level (one node per client), you must use node affinity labels based on the node name. This ensures each client's workload runs on its dedicated node. Network tags are used for firewall rules, not for placement constraints. Node group affinity would only guarantee placement within a group, not on a specific node.
Why the other options are wrong
- A. Network tags are firewall constructs, not placement directives for nodes.
- B. Network tags cannot be used to enforce node placement or affinity.
- C. Node group affinity is insufficient; you need to target specific nodes, not just the group, since each client requires its own dedicated node.
Question 22
An application development team has come to you for advice. They are planning to write and deploy an HTTP(S) API using Go 1.12. The API will have a very unpredictable workload and must remain reliable during peaks in traffic. They want to minimize operational overhead for this application. Which approach should you recommend?
Show answer and explanation
Correct answer: B. Develop the application for App Engine standard environment.
App Engine standard environment is the optimal choice for this scenario because it automatically handles unpredictable workloads through built-in autoscaling, requires minimal operational overhead with fully managed infrastructure, and provides native support for Go 1.12. It abstracts away all infrastructure concerns while delivering the reliability and scalability needed for traffic peaks.
Why the other options are wrong
- A. GKE requires significantly more operational overhead for cluster management, node configuration, and maintenance despite offering container flexibility.
- C. Managed Instance Groups still require manual configuration of scaling policies and instance management, increasing operational burden.
- D. App Engine flexible environment has more operational overhead than standard and is better suited for applications requiring custom runtime features not available in standard.
Question 23
Your company has just acquired another company, and you have been asked to integrate their existing Google Cloud environment into your company's data center. Upon investigation, you discover that some of the RFC 1918 IP ranges being used in the new company's Virtual Private Cloud (VPC) overlap with your data center IP space. What should you do to enable connectivity and make sure that there are no routing conflicts when connectivity is established?
Show answer and explanation
Correct answer: A. Create a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply new IP addresses so there is no overlapping IP space.
When RFC 1918 ranges overlap between a VPC and on-premises infrastructure, the only viable solution is to reassign IP addresses to eliminate the overlap before establishing connectivity. Cloud VPN with Cloud Router provides the secure connection mechanism, but routing will fail if overlapping IP space exists. NAT (option B) cannot reliably handle bidirectional traffic between overlapping ranges. Firewall rules (option D) cannot prevent routing conflicts. Custom route advertisement blocking (option C) would prevent connectivity entirely rather than resolve the issue.
Why the other options are wrong
- B. NAT cannot properly handle overlapping RFC 1918 ranges for bidirectional communication
- C. Blocking routes prevents connectivity rather than resolving the overlap issue
- D. Firewall rules cannot resolve routing conflicts caused by overlapping IP space
Question 24
You have developed a non-critical update to your application that is running in a managed instance group, and have created a new instance template with the update that you want to release. To prevent any possible impact to the application, you don't want to update any running instances. You want any new instances that are created by the managed instance group to contain the new update. What should you do?
Show answer and explanation
Correct answer: D. Start a new rolling update. Select the Opportunistic update mode.
Opportunistic update mode applies updates only to new instances created after the template change, without modifying existing running instances. This perfectly matches the requirement to leave running instances untouched while ensuring new instances get the update. Proactive mode (option C) actively replaces existing instances, which violates the constraint of not updating running instances. Rolling replace and rolling restart operations modify existing instances, making them unsuitable.
Why the other options are wrong
- A. Rolling restart restarts existing instances, which disrupts running applications
- B. Rolling replace terminates and recreates existing instances, causing service disruption
- C. Proactive update mode actively updates existing instances, contradicting the requirement to leave them untouched
Question 25
You need to develop procedures to test a disaster plan for a mission-critical application. You want to use Google-recommended practices and native capabilities within GCP. What should you do?
Show answer and explanation
Correct answer: B. Use Deployment Manager to automate service provisioning. Use Stackdriver to monitor and debug your tests.
Deployment Manager is Google's recommended tool for infrastructure-as-code automation to provision services for disaster recovery testing. Stackdriver (now Cloud Operations) is Google's recommended monitoring and debugging platform for observing and troubleshooting your applications and infrastructure during these tests. This combination represents Google's native, best-practice approach.
Why the other options are wrong
- A. Activity Logs (Audit Logs) are primarily for compliance and auditing, not for real-time monitoring and debugging of application performance during disaster recovery tests.
- C. gcloud scripts are lower-level command-line tools; Deployment Manager is the recommended best practice for infrastructure automation.
- D. gcloud scripts are not the recommended approach; Deployment Manager provides better infrastructure-as-code practices for repeatable disaster recovery testing.
Question 26
You are migrating your on-premises solution to Google Cloud in several phases. You will use Cloud VPN to maintain a connection between your on-premises systems and Google Cloud until the migration is completed. You want to make sure all your on-premise systems remain reachable during this period. How should you organize your networking in Google Cloud?
Show answer and explanation
Correct answer: C. Use an IP range on Google Cloud that does not overlap with the range you use on-premises
When using Cloud VPN to connect on-premises systems to Google Cloud, the IP ranges must not overlap. Using overlapping IP ranges would cause routing conflicts and make it impossible for on-premises systems to reach resources in Google Cloud with the same IP range, breaking connectivity. Non-overlapping ranges allow the VPN gateway to route traffic correctly between the two networks. This is a fundamental requirement for site-to-site VPN connectivity.
Why the other options are wrong
- A. Using the same IP range on both sides creates routing conflicts and prevents proper VPN communication.
- B. While secondary ranges could be non-overlapping, using the same primary range creates the same routing problem as option A.
- D. Using the same IP range for the secondary range on-premises still creates conflicts with the on-premises primary range and is unnecessarily complex.
Question 27
You are deploying an application on App Engine that needs to integrate with an on-premises database. For security purposes, your on-premises database must not be accessible through the public internet. What should you do?
Show answer and explanation
Correct answer: D. Deploy your application on App Engine flexible environment and use Cloud VPN to limit access to the on-premises database.
App Engine flexible environment supports VPC connector integration, enabling secure communication with on-premises resources via Cloud VPN without exposing the database to the public internet. App Engine firewall rules alone cannot create a secure tunnel to on-premises systems. Standard environment does not support VPC connectors for on-premises connectivity. Cloud VPN establishes an encrypted tunnel that keeps the on-premises database completely isolated from public internet access while allowing authenticated application traffic.
Why the other options are wrong
- A. App Engine firewall rules do not provide secure on-premises connectivity; they only filter traffic within GCP.
- B. Standard environment lacks VPC connector support needed for secure on-premises database access.
- C. While flexible environment is correct, App Engine firewall rules alone cannot secure on-premises database connectivity without a VPN tunnel.
Question 28
Your customer support tool logs all email and chat conversations to Cloud Bigtable for retention and analysis. What is the recommended approach for sanitizing this data of personally identifiable information or payment card information before initial storage?
Show answer and explanation
Correct answer: C. De-identify the data with the Cloud Data Loss Prevention API
The Cloud Data Loss Prevention API (C) is purpose-built for detecting and de-identifying PII and payment card information at scale before storage. It uses machine learning and pattern matching to identify sensitive data types and apply appropriate redaction, masking, or tokenization, the recommended approach for sanitizing sensitive data.
Why the other options are wrong
- A. Hashing is one-way and irreversible; it doesn't sanitize data for storage and analysis where the original data needs to be recovered.
- B. Encryption secures data but doesn't de-identify or sanitize it; encrypted PII is still PII and poses compliance risks.
- D. Regular expressions are brittle, error-prone, and miss many PII patterns; they lack the sophistication of a dedicated DLP service.
Question 29
Your company's user-feedback portal comprises a standard LAMP stack replicated across two zones. It is deployed in the us-central1 region and uses autoscaled managed instance groups on all layers, except the database. Currently, only a small group of select customers have access to the portal. The portal meets a 99,99% availability SLA under these conditions. However next quarter, your company will be making the portal available to all users, including unauthenticated users. You need to develop a resiliency testing strategy to ensure the system maintains the SLA once they introduce additional user load. What should you do?
Show answer and explanation
Correct answer: B. Create synthetic random user input, replay synthetic load until autoscale logic is triggered on at least one layer, and introduce "chaos" to the system by terminating random resources on both zones
Effective resiliency testing requires both realistic load simulation and failure injection. Option B uses synthetic load to verify autoscaling behavior across layers and introduces chaos engineering (random resource termination in both zones) to test actual failover capabilities. This comprehensive approach validates the system can maintain 99.99% SLA under increased load with real failures occurring.
Why the other options are wrong
- A. Using only captured existing user load is insufficient to test new user scale; terminating resources in only one zone doesn't fully test cross-zone resilience.
- C. Exposing real unauthenticated users to untested infrastructure is risky and doesn't provide controlled testing conditions.
- D. Reactive resource deployment based on 80% utilization doesn't test autoscaling triggers; 200% over-provisioning masks real scalability issues rather than validating them.
Question 30
You want to allow your operations team to store logs from all the production projects in your Organization, without including logs from other projects. All of the production projects are contained in a folder. You want to ensure that all logs for existing and new production projects are captured automatically. What should you do?
Show answer and explanation
Correct answer: A. Create an aggregated export on the Production folder. Set the log sink to be a Cloud Storage bucket in an operations project.
Creating an aggregated export at the folder level automatically captures logs from all projects within that folder, including new projects added in the future. This satisfies the requirement to capture existing and new production projects without manually configuring each project. A folder-level export is more scalable and maintainable than managing individual project exports.
Why the other options are wrong
- B. Organization-level export would capture logs from all projects in the organization, including non-production projects, violating the requirement to exclude logs from other projects.
- C. While individual project exports would work, they don't automatically capture new production projects and require manual configuration for each project.
- D. BigQuery datasets in production projects don't provide centralized storage in an operations project, and this approach requires manual per-project setup.
Question 31
Your company has successfully migrated to the cloud and wants to analyze their data stream to optimize operations. They do not have any existing code for this analysis, so they are exploring all their options. These options include a mix of batch and stream processing, as they are running some hourly jobs and live-processing some data as it comes in. Which technology should they use for this?
Show answer and explanation
Correct answer: B. Google Cloud Dataflow
Google Cloud Dataflow is a unified stream and batch processing service built on Apache Beam. It handles both streaming data processing (live data as it arrives) and batch processing (hourly jobs) within a single framework, making it ideal for mixed workloads. Unlike other options, Dataflow is specifically designed for both processing paradigms without requiring separate tools.
Why the other options are wrong
- A. Dataproc is designed for Hadoop and Spark batch processing; it is not optimized for stream processing.
- C. Container Engine with Bigtable requires custom code development and lacks the built-in processing abstractions of Dataflow.
- D. Compute Engine with BigQuery separates storage from processing and is not a stream processing solution.
Question 32
Auditors visit your teams every 12 months and ask to review all the Google Cloud Identity and Access Management (Cloud IAM) policy changes in the previous 12 months. You want to streamline and expedite the analysis and audit process. What should you do?
Show answer and explanation
Correct answer: B. Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor
Exporting Cloud IAM policy change logs to BigQuery enables efficient querying, analysis, and filtering of audit data. BigQuery's ACLs and views allow you to create custom views that scope the data shared with auditors to only relevant IAM policy changes, making the audit process streamlined and expedited while maintaining security and data governance. This approach is auditor-friendly, searchable, and supports complex queries across 12 months of data.
Why the other options are wrong
- A. Custom Stackdriver alerts are designed for real-time monitoring notifications, not for historical audit log analysis or review.
- C. Cloud SQL is not optimized for large-scale log analysis and adds unnecessary ETL complexity compared to BigQuery's native log integration.
- D. GCS bucket exports lack the query and analysis capabilities needed for efficient audit log review; BigQuery is purpose-built for this use case.
Question 33
You are tasked with building an online analytical processing (OLAP) marketing analytics and reporting tool. This requires a relational database that can operate on hundreds of terabytes of data. What is the Google-recommended tool for such applications?
Show answer and explanation
Correct answer: D. BigQuery, because it is designed for large-scale processing of tabular data
BigQuery is Google's purpose-built data warehouse designed for large-scale analytical processing on massive datasets (hundreds of terabytes). It excels at OLAP workloads, supports SQL queries, and provides automatic scaling and cost efficiency for analytical reporting applications.
Why the other options are wrong
- A. Cloud Spanner is designed for globally distributed transactional workloads, not analytical processing at petabyte scale.
- B. Cloud SQL is suitable for transactional databases with operational workloads, not for OLAP on hundreds of terabytes of data.
- C. Cloud Firestore is a NoSQL document database designed for real-time synchronization, not for large-scale analytical processing.
Question 34
Your company has a Kubernetes application that pulls messages from Pub/Sub and stores them in Filestore. Because the application is simple, it was deployed as a single pod. The infrastructure team has analyzed Pub/Sub metrics and discovered that the application cannot process the messages in real time. Most of them wait for minutes before being processed. You need to scale the elaboration process that is I/O-intensive. What should you do?
Show answer and explanation
Correct answer: D. Configure a Kubernetes autoscaling deployment based on the subscription/num_undelivered_messages metric.
For an I/O-intensive application pulling messages from Pub/Sub, the optimal scaling metric is the number of undelivered messages (subscription/num_undelivered_messages). When messages queue up, this metric increases, triggering horizontal pod autoscaling to add more replicas to process messages faster. This metric directly reflects the application's workload and responsiveness.
Why the other options are wrong
- A. CPU-based autoscaling is unsuitable for I/O-intensive workloads that don't heavily use CPU; the application will scale too slowly based on irrelevant metrics.
- B. Push request latencies measure delivery latency from Pub/Sub, not the application's processing backlog, making it a poor scaling indicator.
- C. The --enable-autoscaling flag enables node autoscaling for the cluster itself, not pod-level autoscaling needed to scale the message processing workload.
Question 35
The operations team in your company wants to save Cloud VPN log events for one year. You need to configure the cloud infrastructure to save the logs. What should you do?
Show answer and explanation
Correct answer: A. Set up a filter in Cloud Logging and a Cloud Storage bucket as an export target for the logs you want to save.
To save Cloud VPN logs for a one-year retention period, you need to export them to persistent storage. Setting up a filter in Cloud Logging and exporting to a Cloud Storage bucket is the standard approach for long-term log retention. Cloud Storage provides durable, cost-effective storage with configurable retention policies, making it ideal for compliance and archival requirements.
Why the other options are wrong
- B. Enabling logging on firewall rules captures traffic logs but doesn't configure the export destination for one-year retention.
- C. A Cloud Logging Dashboard is for visualization and querying, not for persistent storage of logs over time.
- D. Pub/Sub is a message queue for real-time streaming, not a permanent storage solution for year-long log retention.
Question 36
Your company wants to try out the cloud with low risk. They want to archive approximately 100 TB of their log data to the cloud and test the analytics features available to them there, while also retaining that data as a long-term disaster recovery backup. Which two steps should you take? (Choose two.)
Show answer and explanation
Correct answer: A, E. Load logs into Google BigQuery; Upload log files into Google Cloud Storage
BigQuery (A) is the optimal choice for analytics on large datasets like logs, providing powerful querying and analysis capabilities. Cloud Storage (E) serves as the long-term, cost-effective disaster recovery backup for the 100 TB of log data. Together, they satisfy both requirements: analytics testing and archival backup with low risk and minimal upfront investment.
Why the other options are wrong
- B. Cloud SQL is designed for transactional databases, not for archiving 100 TB of unstructured log data or performing analytics at scale.
- C. Stackdriver (now Cloud Logging) is for log ingestion and management, not for the kind of analytics testing and long-term archival backup the company needs.
- D. Bigtable is a NoSQL database requiring significant operational overhead and is not the recommended approach for simple log archival or analytics compared to BigQuery and Cloud Storage.
Question 37
You are developing your microservices application on Google Kubernetes Engine. During testing, you want to validate the behavior of your application in case a specific microservice should suddenly crash. What should you do?
Show answer and explanation
Correct answer: B. Use Istio's fault injection on the particular microservice whose faulty behavior you want to simulate.
Istio's fault injection feature is the proper tool for chaos testing microservices by simulating failures like crashes, delays, and connection errors. This allows you to test application resilience without actually destroying infrastructure. Fault injection can inject faults into specific microservices to observe how the system handles failures in a controlled manner.
Why the other options are wrong
- A. Taints and pod anti-affinity prevent pod scheduling but don't simulate a crash or test failure behavior.
- C. Destroying a node is destructive and uncontrolled; it's not a proper testing methodology and could disrupt the actual application.
- D. Traffic management steers traffic away from services but doesn't simulate or validate the behavior when a microservice crashes.
Question 38
You want to establish a Compute Engine application in a single VPC across two regions. The application must communicate over VPN to an on-premises network. How should you deploy the VPN?
Show answer and explanation
Correct answer: D. Deploy Cloud VPN Gateway in each region. Ensure that each region has at least one VPN tunnel to the on-premises peer gateway.
For a single VPC spanning two regions with on-premises connectivity, the recommended approach is to deploy Cloud VPN Gateways in each region, with each having at least one tunnel to the on-premises peer gateway. This provides redundancy and ensures both regions can communicate with on-premises infrastructure. Cloud VPN is regional, so you need one gateway per region to serve that region's traffic.
Why the other options are wrong
- A. VPC Network Peering connects two VPCs; it cannot connect to on-premises networks, which require VPN or Interconnect.
- B. IAM and VPC Sharing are identity and access management tools, not networking solutions for on-premises connectivity.
- C. Cloud VPN Gateway is regional, not global; you cannot create a single global gateway to serve multiple regions.
Question 39
Your web application uses Google Kubernetes Engine to manage several workloads. One workload requires a consistent set of hostnames even after pod scaling and relaunches. Which feature of Kubernetes should you use to accomplish this?
Show answer and explanation
Correct answer: A. StatefulSets
StatefulSets in Kubernetes are specifically designed to manage stateful applications requiring stable, persistent hostnames. Each pod in a StatefulSet gets a unique, stable hostname that persists across pod restarts and scaling operations, following a predictable naming pattern (e.g., pod-0, pod-1). This is exactly what the workload requires for consistent hostnames after scaling and relaunches.
Why the other options are wrong
- B. RBAC controls who can access Kubernetes resources, not hostname consistency.
- C. Environment variables are set at pod creation and don't provide persistent, stable hostnames across pod lifecycle events.
- D. Persistent Volumes address storage persistence, not hostname consistency for pods.
Question 40
You are using a single Cloud SQL instance to serve your application from a specific zone. You want to introduce high availability. What should you do?
Show answer and explanation
Correct answer: D. Create a failover replica instance in the same region, but in a different zone
To introduce high availability while minimizing latency and network costs, a failover replica in the same region but different zone provides automatic failover capability without the overhead of cross-region replication. This maintains acceptable replication lag while ensuring zone-level failure tolerance.
Why the other options are wrong
- A. Read replicas across regions support read scaling but do not provide automatic failover for high availability.
- B. While a failover replica in a different region provides HA, it introduces unnecessary latency and complexity when same-region redundancy is sufficient.
- C. Read replicas do not provide automatic failover; they are designed for read scaling only.
Question 41
Your marketing department wants to send out a promotional email campaign. The development team wants to minimize direct operation management. They project a wide range of possible customer responses, from 100 to 500,000 click-through per day. The link leads to a simple website that explains the promotion and collects user information and preferences. Which infrastructure should you recommend? (Choose two.)
Show answer and explanation
Correct answer: A, C. Use Google App Engine to serve the website and Google Cloud Datastore to store user data; Use a managed instance group to serve the website and Google Cloud Bigtable to store user data.
App Engine (A) is a serverless platform that automatically scales from zero to handle traffic spikes without operational overhead, and Cloud Datastore is a fully managed NoSQL database that scales automatically. Cloud Storage (C) with a managed instance group or similar can also scale, but the combination of App Engine with Cloud Datastore is optimal for the variable load (100 to 500,000 requests per day) with minimal operations required.
Why the other options are wrong
- B. Container Engine requires managing the cluster and persistent disk has scaling and performance limitations for this variable load pattern.
- D. A single Compute Engine VM cannot scale horizontally and will fail under the projected maximum load of 500,000 requests per day.
Question 42
Your team will start developing a new application using microservices architecture on Kubernetes Engine. As part of the development lifecycle, any code change that has been pushed to the remote develop branch on your GitHub repository should be built and tested automatically. When the build and test are successful, the relevant microservice will be deployed automatically in the development environment. You want to ensure that all code deployed in the development environment follows this process. What should you do?
Show answer and explanation
Correct answer: C. Create a Cloud Build trigger based on the development branch that tests the code, builds the container, and stores it in Container Registry. Create a deployment pipeline that watches for new images and deploys the new image on the development cluster. Ensure only the deployment tool has access to deploy new versions.
Cloud Build trigger automatically tests and builds on code push to the develop branch, storing images in Container Registry. A separate deployment pipeline watches for new images and automatically deploys to the development cluster. This ensures all code follows the automated process and only the deployment tool can push to production, preventing manual deployments that bypass testing. This is the most robust and automated approach.
Why the other options are wrong
- A. Pre-commit hooks on developer workstations are not enforceable and rely on developers to follow the process; developers could still manually deploy or skip the hook.
- B. Post-commit hooks on the git repository still require manual deployment by developers, which is error-prone and doesn't enforce the automated process.
- D. While Cloud Build automates testing and building, relying on Vulnerability Scanning is not a substitute for actual code tests, and directly deploying from Cloud Build in the final step doesn't separate the build and deployment concerns.
Question 43
You want to make a copy of a production Linux virtual machine in the US-Central region. You want to manage and replace the copy easily if there are changes on the production virtual machine. You will deploy the copy as a new instance in a different project in the US-East region. What steps must you take?
Show answer and explanation
Correct answer: D. Create a snapshot of the root disk, create an image file in Google Cloud Storage from the snapshot, and create a new virtual machine instance in the US-East region using the image file the root disk.
To copy a VM across regions (US-Central to US-East) and different projects while maintaining manageability, Option D is correct: create a snapshot of the root disk, create an image from that snapshot in Cloud Storage, then use that image to instantiate the new VM in the target region and project. Snapshots alone are regional, so creating an image enables cross-region portability. This approach allows easy replacement and updates. Using dd/netcat (A) is manual and error-prone, snapshots alone (B) are regional and can't cross projects easily, and dd without image creation (C) lacks proper versioning and management.
Why the other options are wrong
- A. Manual dd/netcat copying is error-prone, difficult to manage, and lacks GCP-native version control.
- B. Snapshots are regional; they cannot easily be used across different projects and regions without conversion to an image.
- C. Creating an image via dd command on the instance is manual and doesn't leverage GCP's image management capabilities for cross-project portability.
Question 44
You are implementing a single Cloud SQL MySQL second-generation database that contains business-critical transaction data. You want to ensure that the minimum amount of data is lost in case of catastrophic failure. Which two features should you implement? (Choose two.)
Show answer and explanation
Correct answer: C, D. Binary logging; Automated backups
Binary logging (C) enables point-in-time recovery by recording all database changes, allowing you to recover to any moment before a failure. Automated backups (D) provide periodic snapshots for recovery from catastrophic failures. Together, these features minimize data loss: backups provide recovery points, and binary logs allow recovery between backup intervals. Sharding (A) distributes data but doesn't prevent loss. Read replicas (B) provide availability but not backup protection. Semisynchronous replication (E) improves durability for a single instance but isn't necessary for second-generation Cloud SQL with automated backups and binary logging.
Why the other options are wrong
- A. Sharding distributes data across multiple instances for performance and availability, not for disaster recovery or minimizing data loss.
- B. Read replicas provide high availability and read scaling but do not protect against data loss if the primary instance fails.
- E. Semisynchronous replication ensures replicas acknowledge writes before commit, useful for multi-instance setups but not the primary mechanism for minimizing loss in a single-instance deployment.
Question 45
Your company wants to start using Google Cloud resources but wants to retain their on-premises Active Directory domain controller for identity management. What should you do?
Show answer and explanation
Correct answer: B. Use Google Cloud Directory Sync to synchronize Active Directory usernames with cloud identities and configure SAML SSO.
Google Cloud Directory Sync synchronizes on-premises Active Directory users with Google Cloud Identity, allowing the company to maintain their existing AD infrastructure while enabling cloud resource access. Combined with SAML SSO configuration, this enables seamless authentication against the on-premises AD domain controller from Google Cloud resources.
Why the other options are wrong
- A. The Admin Directory API is for managing cloud identities, not for authenticating against on-premises Active Directory domain controllers.
- C. Cloud Identity-Aware Proxy is designed for application-level access control, not for synchronizing on-premises AD with cloud identities.
- D. Creating a replica AD domain controller defeats the purpose of retaining the on-premises domain controller for identity management.
Question 46
Your web application has several VM instances running within a VPC. You want to restrict communications between instances to only the paths and ports you authorize, but you don't want to rely on static IP addresses or subnets because the app can autoscale. How should you restrict communications?
Show answer and explanation
Correct answer: B. Use firewall rules based on network tags attached to the compute instances
Network tags attached to compute instances allow firewall rules to dynamically apply restrictions based on instance metadata rather than static IP addresses or subnets. This approach scales with autoscaling since new instances can be tagged appropriately, enabling fine-grained port and protocol restrictions without requiring static addressing.
Why the other options are wrong
- A. Separate VPCs would isolate instances but prevent communication between them, which is not the goal.
- C. Cloud DNS resolves hostnames to IP addresses but does not provide traffic restriction capabilities at the network level.
- D. Service accounts control API access to GCP resources, not inter-instance network communication policies.
Question 47
Your company has a Google Workspace account and Google Cloud Organization. Some developers in the company have created Google Cloud projects outside of the Google Cloud Organization. You want to create an Organization structure that allows developers to create projects, but prevents them from modifying production projects. You want to manage policies for all projects centrally and be able to set more restrictive policies for production projects. You want to minimize disruption to users and developers when business needs change in the future. You want to follow Google-recommended practices. Now should you design the Organization structure?
Show answer and explanation
Correct answer: C. 1. Create folders under the Organization resource named "Development" and "Production." 2. Grant all developers the Project Creator IAM role on the "Development" folder. 3. Move the developer projects into the "Development" folder. 4. Set the policies for all projects on the Organization. 5. Additionally, set the production policies on the "Production" folder.
Creating separate Development and Production folders under the Organization allows centralized policy management at the organization level while enabling production-specific policies on the Production folder. Granting developers Project Creator on the Development folder allows them to create projects without affecting production, and moving existing developer projects into Development provides minimal disruption while following Google's recommended practices of using folder hierarchies for policy separation.
Why the other options are wrong
- A. Creating a second Organization duplicates management overhead and prevents centralized policy management across all projects.
- B. Granting Project Creator on the Organization level allows developers to create production projects, which violates the goal of preventing modification of production resources.
- D. Leaving development projects outside the Organization prevents centralized policy management and creates operational complexity rather than minimizing disruption.
Question 48
You are creating an App Engine application that uses Cloud Datastore as its persistence layer. You need to retrieve several root entities for which you have the identifiers. You want to minimize the overhead in operations performed by Cloud Datastore. What should you do?
Show answer and explanation
Correct answer: A. Create the Key object for each Entity and run a batch get operation
To minimize overhead when retrieving multiple root entities by identifier, you should create Key objects for each entity and perform a single batch get operation. Batch operations are more efficient than multiple individual operations as they reduce network round-trips and API call overhead. Query filters (options C and D) are less efficient for known entity identifiers and incur additional query processing overhead compared to direct key-based lookups.
Why the other options are wrong
- B. Multiple individual get operations incur more overhead than a single batch operation.
- C. Query filters are less efficient than batch key lookups and incur query processing overhead.
- D. Multiple query operations are inefficient and incur more overhead than batch key operations.
Question 49
You are running a cluster on Kubernetes Engine (GKE) to serve a web application. Users are reporting that a specific part of the application is not responding anymore. You notice that all pods of your deployment keep restarting after 2 seconds. The application writes logs to standard output. You want to inspect the logs to find the cause of the issue. Which approach can you take?
Show answer and explanation
Correct answer: B. Review the Stackdriver logs for the specific GKE container that is serving the unresponsive part of the application.
When pods are continuously restarting and applications write logs to stdout, Stackdriver (Cloud Logging) automatically captures container logs. Viewing the Stackdriver logs specifically for the problematic GKE container provides direct access to the application's standard output, which will reveal the cause of the restart loop.
Why the other options are wrong
- A. Node-level logs would show system-level issues, not application output written to stdout within containers.
- C. Connecting to a restarting container is impractical since the pod restarts every 2 seconds, making it difficult to capture logs.
- D. Serial Port logs are for VM console output, not for application container logs running on Kubernetes.
Question 50
Your company has announced that they will be outsourcing operations functions. You want to allow developers to easily stage new versions of a cloud-based application in the production environment and allow the outsourced operations team to autonomously promote staged versions to production. You want to minimize the operational overhead of the solution. Which Google Cloud product should you migrate to?
Show answer and explanation
Correct answer: D. Google Kubernetes Engine
Google Kubernetes Engine (GKE) is the ideal choice for this scenario. It allows developers to easily stage new versions in production and enables the outsourced operations team to autonomously promote staged versions using Kubernetes deployment strategies (rolling updates, canary deployments, etc.). GKE minimizes operational overhead through managed Kubernetes, automated scaling, and built-in deployment tools. App Engine (A) is simpler but lacks the flexibility for staged deployments and autonomous operations control. GKE On-Prem (B) adds operational complexity. Compute Engine (C) requires manual instance management.
Why the other options are wrong
- A. App Engine abstracts infrastructure but provides less control for staging versions and autonomous promotion workflows that operations teams need.
- B. GKE On-Prem adds significant operational overhead compared to the managed GKE service.
- C. Compute Engine requires manual deployment and promotion processes, increasing operational overhead rather than minimizing it.
Question 51
You have deployed several instances on Compute Engine. As a security requirement, instances cannot have a public IP address. There is no VPN connection between Google Cloud and your office, and you need to connect via SSH into a specific machine without violating the security requirements. What should you do?
Show answer and explanation
Correct answer: C. Configure Identity-Aware Proxy (IAP) for the instance and ensure that you have the role of IAP-secured Tunnel User. Use the gcloud command line tool to ssh into the instance.
Identity-Aware Proxy (IAP) is Google Cloud's recommended solution for SSH access to instances without public IPs. IAP provides secure, authenticated tunneling through Google's infrastructure without requiring VPN or bastion hosts. With the IAP-secured Tunnel User role and gcloud CLI, you can SSH directly into the instance while maintaining the security requirement of no public IP addresses.
Why the other options are wrong
- A. Cloud NAT allows outbound internet access but doesn't provide inbound SSH connectivity to instances without public IPs.
- B. TCP Proxy Load Balancing is designed for load balancing traffic, not for providing SSH access to individual instances.
- D. While a bastion host works, it requires an additional instance and is not the Google-recommended best practice when IAP is available.
Question 52
Your company has sensitive data in Cloud Storage buckets. Data analysts have Identity Access Management (IAM) permissions to read the buckets. You want to prevent data analysts from retrieving the data in the buckets from outside the office network. What should you do?
Show answer and explanation
Correct answer: A. 1. Create a VPC Service Controls perimeter that includes the projects with the buckets. 2. Create an access level with the CIDR of the office network.
Option A uses VPC Service Controls to create a security perimeter around projects containing Cloud Storage buckets and defines an access level restricting data access to the office network CIDR. This prevents data analysts from reading bucket data from outside the office, even if they have IAM permissions. VPC Service Controls operates at the service level and is specifically designed for this use case. Option B applies firewall rules only to Compute Engine instances, not to Cloud Storage. Option C dynamically removes/adds IAM permissions, which is complex and doesn't prevent network-based access. Option D uses Cloud VPN and Private Google Access, which enable access rather than restrict it.
Why the other options are wrong
- B. Firewall rules apply to Compute Engine traffic, not to Cloud Storage API calls made by data analysts.
- C. Dynamically adding/removing IAM permissions based on time is operationally complex and doesn't prevent network-based access control.
- D. Cloud VPN and Private Google Access enable secure access from on-premises to Google Cloud services, which is the opposite of restricting access.
Question 53
You created a pipeline that can deploy your source code changes to your infrastructure in instance groups for self-healing. One of the changes negatively affects your key performance indicator. You are not sure how to fix it, and investigation could take up to a week. What should you do?
Show answer and explanation
Correct answer: B. Revert the source code change, and rerun the deployment pipeline
Reverting the source code change and rerunning the deployment pipeline (B) is the correct approach because it maintains infrastructure-as-code principles, ensures reproducibility, and quickly restores the system to a known good state. This follows best practices for continuous deployment and allows investigation to happen on non-production infrastructure without business impact.
Why the other options are wrong
- A. Manual iteration on a live server breaks the deployment pipeline principle and makes the infrastructure state untrackable and unreproducible.
- C. Manually swapping code on servers circumvents the deployment pipeline, violates infrastructure-as-code principles, and creates configuration drift.
- D. Changing the instance group template and deleting instances is cumbersome, slower than reverting code, and doesn't follow the principle of maintaining infrastructure through source control.
Question 54
Your company has a Google Cloud project that uses BigQuery for data warehousing. There are some tables that contain personally identifiable information (PII). Only the compliance team may access the PII. The other information in the tables must be available to the data science team. You want to minimize cost and the time it takes to assign appropriate access to the tables. What should you do?
Show answer and explanation
Correct answer: C. 1. Create a dataset for the data science team. 2. Create views of tables that you want to share, excluding PII. 3. Assign an appropriate project-level IAM role to the members of the data science team. 4. Assign access controls to the dataset that contains the view. 5. Authorize the view to access the source dataset.
Option C creates a separate dataset for the data science team with views that exclude PII columns. This approach provides proper access isolation: the compliance team retains access to the original dataset with full data, while the data science team accesses only the sanitized view. Authorizing the view to access the source dataset enables this separation with minimal configuration overhead.
Why the other options are wrong
- A. Using regular views in the source dataset doesn't provide proper access isolation; both the compliance team and data science team would need access to the same dataset.
- B. Materialized views create physical copies of data, which is more costly and requires more storage than regular views for this use case.
- D. Materialized views are unnecessarily expensive for this scenario since regular views provide the same logical separation at lower cost.
Question 55
You have an application that makes HTTP requests to Cloud Storage. Occasionally the requests fail with HTTP status codes of 5xx and 429. How should you handle these types of errors?
Show answer and explanation
Correct answer: B. Implement retry logic using a truncated exponential backoff strategy.
HTTP 5xx errors indicate server-side issues and 429 errors indicate rate limiting. Both are transient errors that should be retried. Implementing retry logic with truncated exponential backoff is the Google-recommended best practice for handling transient failures, as it allows the system to recover while avoiding overwhelming the service with immediate retries.
Why the other options are wrong
- A. Using gRPC instead of HTTP doesn't address the root cause of 5xx and 429 errors, which are service availability issues.
- C. Multi-regional redundancy doesn't prevent 429 rate-limiting errors or resolve transient 5xx failures from the service itself.
- D. Monitoring the status page is not a programmatic solution and doesn't handle individual request failures; the application should handle transient errors gracefully through retries.
Question 56
You need to set up Microsoft SQL Server on GCP. Management requires that there's no downtime in case of a data center outage in any of the zones within a GCP region. What should you do?
Show answer and explanation
Correct answer: D. Set up SQL Server Always On Availability Groups using Windows Failover Clustering. Place nodes in different zones.
For SQL Server on GCP with zone-level redundancy, you must use Compute Engine instances with Always On Availability Groups and Windows Failover Clustering distributed across different zones. This ensures automatic failover when a zone becomes unavailable. Cloud SQL (option A) is a managed service but doesn't support SQL Server with the same HA guarantees across zones. Cloud Spanner (option B) is not SQL Server. Option C places nodes in different subnets within the same zone, which doesn't protect against zone outages.
Why the other options are wrong
- A. Cloud SQL doesn't provide the zone-level redundancy required for SQL Server across multiple zones.
- B. Cloud Spanner is a different database product, not Microsoft SQL Server.
- C. Placing nodes in different subnets within the same zone doesn't protect against zone outages.
Question 57
Your company has just recently activated Cloud Identity to manage users. The Google Cloud Organization has been configured as well. The security team needs to secure projects that will be part of the Organization. They want to prohibit IAM users outside the domain from gaining permissions from now on. What should they do?
Show answer and explanation
Correct answer: A. Configure an organization policy to restrict identities by domain.
Organization policies provide the native Google Cloud mechanism to enforce security constraints across an organization. The domain restriction organization policy prevents IAM users outside the specified Cloud Identity domain from gaining permissions, directly addressing the security team's requirement. This is an automated, policy-based solution that scales across all projects.
Why the other options are wrong
- B. Restricting service account creation doesn't prevent external domain users from gaining permissions on existing accounts.
- D. While technically feasible, this manual scripting approach is unmaintainable, error-prone, and not a Google-recommended practice compared to native organization policies.
Question 58
You are creating a solution to remove backup files older than 90 days from your backup Cloud Storage bucket. You want to optimize ongoing Cloud Storage spend. What should you do?
Show answer and explanation
Correct answer: B. Write a lifecycle management rule in JSON and push it to the bucket with gsutil
Cloud Storage lifecycle management rules, defined in JSON format and pushed via gsutil, automatically delete objects matching specified criteria (such as age over 90 days) without requiring custom scripts or manual intervention. This is the proper, scalable, and cost-effective approach to managing backup retention policies.
Why the other options are wrong
- A. Lifecycle rules are defined in JSON, not XML, for Cloud Storage.
- C. The gsutil ls -lr syntax is incorrect and a cron script requires manual maintenance and monitoring.
- D. Custom cron scripts are inefficient, error-prone, and more expensive than built-in lifecycle rules.
Question 59
One of your primary business objectives is being able to trust the data stored in your application. You want to log all changes to the application data. How can you design your logging system to verify authenticity of your logs?
Show answer and explanation
Correct answer: C. Digitally sign each timestamp and log entry and store the signature
Digital signatures provide cryptographic proof that log entries have not been tampered with and confirm their authenticity. By signing each timestamp and log entry with a private key, you create an unforgeable record where any modification to the log would invalidate the signature, making tampering immediately detectable. This is the industry standard approach for ensuring log integrity and non-repudiation in security-critical systems.
Why the other options are wrong
- A. Writing logs in multiple locations does not verify authenticity; distributed copies can all be modified identically without detection.
- B. Access controls on a database only prevent unauthorized modifications by limiting permissions, but do not detect if an authorized user or compromised account alters logs.
- D. Storing JSON dumps in cloud storage provides backups but offers no mechanism to verify that logs have not been altered since creation.
Question 60
A recent audit revealed that a new network was created in your GCP project. In this network, a GCE instance has an SSH port open to the world. You want to discover this network's origin. What should you do?
Show answer and explanation
Correct answer: C. In the Logging section of the console, specify GCE Network as the logging section. Search for the Create Insert entry
The Cloud Logging section (formerly Stackdriver Logging) with GCE Network as the resource type will capture network creation events. Searching for 'Insert' entries in the logs will reveal when the network was created, including who created it and when. This is the proper forensic approach using Cloud's audit logs. The Activity page is for broader project-level actions, Stackdriver alerting is for alerts not historical audit, and SSH logs on the instance only show login activity, not network creation events which happen at the GCP API level.
Why the other options are wrong
- A. Stackdriver alerting is for setting up alerts on conditions, not for historical audit log searches.
- B. The Activity page shows Data Access and Admin Activity but is less granular than Cloud Logging for network-specific resource creation events.
- D. System login logs on the instance won't reveal when the network was created; that metadata is in GCP audit logs, not OS logs.
Question 61
You are deploying a PHP App Engine Standard service with Cloud SQL as the backend. You want to minimize the number of queries to the database. What should you do?
Show answer and explanation
Correct answer: A. Set the memcache service level to dedicated. Create a key from the hash of the query, and return database values from memcache before issuing a query to Cloud SQL.
To minimize database queries, use dedicated memcache (which is more reliable and performant for App Engine Standard) and implement cache-aside pattern: create cache keys from query hashes, check memcache first for results, and only query Cloud SQL if the key is not found. This approach leverages memcache for frequently-accessed data while maintaining cache validity.
Why the other options are wrong
- B. A cron task that populates cache every minute adds unnecessary database load and doesn't adapt to actual query patterns or data changes.
- C. Shared memcache is less reliable for production applications, and storing all queries in a single key defeats the purpose of caching individual results.
- D. Shared memcache lacks the reliability needed for consistent query caching, and the single key approach prevents efficient cache invalidation and doesn't leverage memcache's distributed nature.
Question 62
You are managing an application deployed on Cloud Run for Anthos, and you need to define a strategy for deploying new versions of the application. You want to evaluate the new code with a subset of production traffic to decide whether to proceed with the rollout. What should you do?
Show answer and explanation
Correct answer: A. Deploy a new revision to Cloud Run with the new version. Configure traffic percentage between revisions.
Cloud Run natively supports traffic splitting between revisions, allowing deployment of a new revision with traffic percentage configuration to direct a subset of production traffic to the new version for evaluation. This is the simplest, native Cloud Run feature for canary deployments. If the new version performs well, traffic can be gradually increased; if issues occur, traffic is rolled back to the stable revision.
Why the other options are wrong
- B. Deploying separate services and using Cloud Load Balancing adds unnecessary complexity when Cloud Run's native traffic splitting provides this capability.
- C. Cloud Build continuous deployment triggers are for automated builds and deployments, not for managing traffic percentages to existing revisions.
- D. Traffic Director is designed for advanced routing across global infrastructure; it is overkill for simple canary deployments on Cloud Run which has native support.
Question 63
A small number of API requests to your microservices-based application take a very long time. You know that each request to the API can traverse many services. You want to know which service takes the longest in those cases. What should you do?
Show answer and explanation
Correct answer: D. Instrument your application with Stackdriver Trace in order to break down the request latencies at each microservice
Stackdriver Trace (now Cloud Trace) instruments applications to capture end-to-end request latency across microservices, breaking down where time is spent at each service hop. This direct visibility into request flow through the service mesh is exactly what's needed to identify which service causes slowness in specific API requests.
Why the other options are wrong
- A. Setting timeouts fails requests faster but doesn't identify the problematic service causing the latency.
- B. Custom metrics to Monitoring show aggregate metrics but lack the per-request granularity needed to trace specific slow requests through services.
- C. Monitoring dashboards show when latencies are high but don't break down which service in the chain is responsible for delays.
Question 64
Your team needs to create a Google Kubernetes Engine (GKE) cluster to host a newly built application that requires access to third-party services on the internet. Your company does not allow any Compute Engine instance to have a public IP address on Google Cloud. You need to create a deployment strategy that adheres to these guidelines. What should you do?
Show answer and explanation
Correct answer: A. Configure the GKE cluster as a private cluster, and configure Cloud NAT Gateway for the cluster subnet.
Option A is correct because a private GKE cluster prevents Compute Engine instances from having public IP addresses, and Cloud NAT Gateway enables outbound internet access for third-party services without requiring public IPs. This configuration allows nodes and pods to communicate with external services while maintaining the requirement that no instance has a public IP address. The combination directly addresses both the security requirement and the functional need for internet access.
Why the other options are wrong
- B. Private Google Access only enables access to Google Cloud services, not third-party services on the internet.
- C. Route-based clusters are deprecated and don't provide the same level of security isolation as private clusters.
- D. Installing a NAT Proxy on a Compute Engine instance would require that instance to have internet connectivity, likely violating the no-public-IP policy.
Question 65
Your company has a networking team and a development team. The development team runs applications on Compute Engine instances that contain sensitive data. The development team requires administrative permissions for Compute Engine. Your company requires all network resources to be managed by the networking team. The development team does not want the networking team to have access to the sensitive data on the instances. What should you do?
Show answer and explanation
Correct answer: C. 1. Create a project with a Shared VPC and assign the Network Admin role to the networking team. 2. Create a second project without a VPC, configure it as a Shared VPC service project, and assign the Compute Admin role to the development team.
Shared VPC allows centralized network management by the networking team while isolating sensitive data. By making the development project a Shared VPC service project, the networking team (with Network Admin role in the host project) manages all network resources, while the development team (with Compute Admin role in the service project) manages instances and data without accessing the host project network controls. This enforces separation of concerns and protects data from network team access.
Why the other options are wrong
- A. Using separate projects with VPN doesn't enforce that the networking team cannot access the development project; Network Admin in one project still has significant permissions.
- B. Assigning both roles to the same project means the networking team would have both Network Admin and indirect access to Compute resources, violating the separation requirement.
- D. VPC Peering with separate projects still doesn't prevent the networking team from accessing or affecting the development project's resources through their Network Admin role.
Question 66
You have an application that runs in Google Kubernetes Engine (GKE). Over the last 2 weeks, customers have reported that a specific part of the application returns errors very frequently. You currently have no logging or monitoring solution enabled on your GKE cluster. You want to diagnose the problem, but you have not been able to replicate the issue. You want to cause minimal disruption to the application. What should you do?
Show answer and explanation
Correct answer: A. 1. Update your GKE cluster to use Cloud Operations for GKE. 2. Use the GKE Monitoring dashboard to investigate logs from affected Pods.
Updating the existing cluster to enable Cloud Operations for GKE provides immediate logging and monitoring capability with minimal disruption. This allows diagnosis of the intermittent errors through dashboard investigation. Option B unnecessarily creates a new cluster and migrates workloads, causing additional complexity and potential disruption. Option C adds Prometheus, which requires additional configuration and doesn't leverage Cloud Operations' native integration. Option D combines unnecessary cluster creation with additional tooling overhead.
Why the other options are wrong
- B. Creating a new cluster and migrating workloads causes unnecessary complexity and disruption
- C. Deploying Prometheus adds unnecessary complexity when Cloud Operations is already integrated with GKE
- D. Creating a new cluster is unnecessary and causes disruption when the existing cluster can be updated
Question 67
You want to automate the creation of a managed instance group. The VMs have many OS package dependencies. You want to minimize the startup time for new VMs in the instance group. What should you do?
Show answer and explanation
Correct answer: B. Create a custom VM image with all OS package dependencies. Use Deployment Manager to create the managed instance group with the VM image.
To minimize startup time for VMs with many OS package dependencies, the best approach is to create a custom VM image with all dependencies pre-installed. This eliminates the need for package installation during VM startup, dramatically reducing initialization time. Using Deployment Manager to orchestrate the managed instance group creation is a standard GCP approach. Startup scripts and configuration management tools like Puppet or Ansible add startup overhead by installing packages at runtime, defeating the goal of minimizing startup time.
Why the other options are wrong
- A. Startup scripts install packages at runtime, increasing startup time rather than minimizing it.
- C. Puppet would still need to install dependencies at runtime, adding significant startup delay.
- D. Ansible would also install dependencies at runtime, adding startup overhead similar to startup scripts.
Question 68
Your organization requires that metrics from all applications be retained for 5 years for future analysis in possible legal proceedings. Which approach should you use?
Show answer and explanation
Correct answer: B. Configure Stackdriver Monitoring for all Projects, and export to BigQuery
Stackdriver Monitoring with export to BigQuery provides 5-year retention capability. BigQuery's cost-effective storage, full queryability, and compliance with legal hold requirements make it suitable for long-term metrics retention and analysis. Exporting to BigQuery bypasses Stackdriver's default short-term retention policies (typically 30 days to 1 year) and enables archival of metrics across all projects for legal proceedings.
Why the other options are wrong
- A. Granting security team access to logs in each Project doesn't address retention duration or centralized storage for analysis.
- C. Default Stackdriver Monitoring retention is only 30 days to 1 year, insufficient for the required 5-year retention.
- D. While Cloud Storage can store data for 5 years economically, it lacks queryability for analysis and is less suited to structured metrics data than BigQuery.
Question 69
You are designing a Data Warehouse on Google Cloud and want to store sensitive data in BigQuery. Your company requires you to generate the encryption keys outside of Google Cloud. You need to implement a solution. What should you do?
Show answer and explanation
Correct answer: D. Import a key in Cloud KMS. Create a dataset in BigQuery using the customer-supplied key option and select the created key.
To generate encryption keys outside Google Cloud and use them with BigQuery, keys must be imported into Cloud KMS and then used with the customer-supplied key (CSEK) option when creating the BigQuery dataset. This allows the company to maintain key generation and management outside Google Cloud while leveraging BigQuery's native encryption capabilities directly without requiring intermediate Cloud Storage or Dataflow processing.
Why the other options are wrong
- A. This unnecessarily routes data through Cloud Storage and Dataflow for decryption, adding complexity and latency rather than using native BigQuery encryption.
- B. Cloud KMS-generated keys are Google-managed, not customer-generated outside Google Cloud as required.
- C. This approach stores data in Cloud Storage with unnecessary intermediate processing through Dataflow instead of directly encrypting the BigQuery dataset.
Question 70
You are developing a globally scaled frontend for a legacy streaming backend data API. This API expects events in strict chronological order with no repeat data for proper processing. Which products should you deploy to ensure guaranteed-once FIFO (first-in, first-out) delivery of data?
Show answer and explanation
Correct answer: B. Cloud Pub/Sub to Cloud Dataflow
Cloud Pub/Sub alone does not guarantee FIFO ordering or exactly-once delivery semantics. Cloud Dataflow, when configured properly, provides exactly-once processing guarantees and can enforce FIFO ordering through stateful processing. The combination of Pub/Sub for ingestion and Dataflow for ordered processing with deduplication ensures that events are delivered exactly once in strict chronological order to the legacy backend API.
Why the other options are wrong
- A. Cloud Pub/Sub provides at-least-once delivery but not guaranteed FIFO ordering or exactly-once semantics needed for this use case.
- C. Stackdriver (Cloud Logging) is a monitoring and logging service, not a message processing system; it cannot enforce FIFO or exactly-once delivery.
- D. Cloud SQL is a relational database; while it could store data, it is not designed for guaranteed-once FIFO message delivery from streaming sources.
Question 71
As part of implementing their disaster recovery plan, your company is trying to replicate their production MySQL database from their private data center to their GCP project using a Google Cloud VPN connection. They are experiencing latency issues and a small amount of packet loss that is disrupting the replication. What should they do?
Show answer and explanation
Correct answer: B. Configure a Google Cloud Dedicated Interconnect.
Configuring a Google Cloud Dedicated Interconnect (B) addresses the core issue: VPN connections have inherent latency and packet loss limitations due to their nature as encrypted tunnels over the internet. Dedicated Interconnect provides a private, high-bandwidth (up to 100 Gbps), low-latency connection between the data center and GCP, eliminating replication disruptions.
Why the other options are wrong
- A. UDP is unreliable and would worsen replication issues; database replication requires TCP's reliability guarantees.
- C. Cloud SQL restoration is a backup strategy, not a solution to the replication latency and packet loss problems.
- D. Multiple VPN connections don't solve the fundamental latency and packet loss issues inherent to VPN technology.
- E. Cloud Pub/Sub adds complexity and latency; it's not designed for synchronous database replication.
Question 72
You want your Google Kubernetes Engine cluster to automatically add or remove nodes based on CPU load. What should you do?
Show answer and explanation
Correct answer: A. Configure a HorizontalPodAutoscaler with a target CPU usage. Enable the Cluster Autoscaler from the GCP Console.
To automatically add or remove nodes based on CPU load in GKE, you need two components working together: HorizontalPodAutoscaler (HPA) scales pods based on target CPU usage, and Cluster Autoscaler scales the underlying nodes to accommodate the pods. HPA handles pod-level scaling, while Cluster Autoscaler handles node-level scaling. Both should be enabled for complete auto-scaling based on CPU load.
Why the other options are wrong
- B. Using 'gcloud' command for managed instance group autoscaling is the old approach; Cluster Autoscaler should be enabled through the GCP Console or gcloud, but using managed instance group scaling directly bypasses GKE's integrated autoscaling.
- C. maxUnavailable and maxSurge are deployment rolling update parameters, not autoscaling mechanisms; they don't enable automatic scaling based on CPU.
- D. maxUnavailable and maxSurge do not trigger autoscaling; these are only used for rolling updates and don't respond to CPU load.
Question 73
You are designing a mobile chat application. You want to ensure people cannot spoof chat messages, by providing a message were sent by a specific user. What should you do?
Show answer and explanation
Correct answer: C. Use public key infrastructure (PKI) to encrypt the message client side using the originating user's private key.
Using PKI to encrypt with the originating user's private key (C) provides cryptographic proof of message origin through digital signatures. Only the user with the private key could have created that encrypted message, preventing spoofing and providing non-repudiation, the recipient can verify the message came from the claimed sender.
Why the other options are wrong
- A. Client-side tagging can be spoofed; an attacker can simply tag a message with another user's identifier.
- B. Shared-key encryption doesn't prove who sent the message, only that it came from someone with the shared key.
- D. SSL connectivity secures the transport layer but doesn't authenticate the message content itself or prevent spoofing at the application level.
Question 74
Your customer runs a web service used by e-commerce sites to offer product recommendations to users. The company has begun experimenting with a machine learning model on Google Cloud Platform to improve the quality of results. What should the customer do to improve their model's results over time?
Show answer and explanation
Correct answer: D. Save a history of recommendations and results of the recommendations in BigQuery, to be used as training data.
To improve machine learning model results over time, you need quality training data. Saving a history of recommendations and their outcomes in BigQuery creates a feedback loop that provides real-world data for retraining and improving the model. This is a fundamental ML best practice for continuous model improvement based on actual user interactions and recommendation performance.
Why the other options are wrong
- A. Exporting performance metrics to BigQuery helps with analysis but doesn't directly improve model results without using that data for retraining.
- B. Moving from GPUs to TPUs is an infrastructure optimization that doesn't inherently improve model quality or results.
- C. Deploying to newer CPU architectures provides performance gains but doesn't improve the machine learning model's actual recommendations or accuracy.
Question 75
Your company acquired a healthcare startup and must retain its customers' medical information for up to 4 more years, depending on when it was created. Your corporate policy is to securely retain this data, and then delete it as soon as regulations allow. Which approach should you take?
Show answer and explanation
Correct answer: C. Store the data in Cloud Storage and use lifecycle management to delete files when they expire.
Cloud Storage with lifecycle management is the secure, scalable, and automated approach for retaining data for a variable duration (up to 4 years depending on creation date) and then deleting it. Lifecycle policies can be configured with object age conditions to automatically delete files when they expire, ensuring compliance with regulations while following the corporate policy of deleting data as soon as allowed.
Why the other options are wrong
- A. Google Drive is not designed for large-scale healthcare data retention, and manual deletion is error-prone and doesn't scale.
- B. Anonymizing data indefinitely defeats the purpose of the regulatory requirement to delete it; regulations typically require deletion, not anonymization.
- D. A nightly batch script is less reliable and maintainable than lifecycle management, which provides automatic, auditable deletion at scale.
Question 76
You have been asked to select the storage system for the click-data of your company's large portfolio of websites. This data is streamed in from a custom website analytics package at a typical rate of 6,000 clicks per minute. With bursts of up to 8,500 clicks per second. It must have been stored for future analysis by your data science and user experience teams. Which storage infrastructure should you choose?
Show answer and explanation
Correct answer: B. Google Cloud Bigtable
Google Cloud Bigtable is purpose-built for high-volume, low-latency time-series data ingestion and analysis. It handles the write rates of 6,000 clicks per minute with bursts to 8,500 clicks per second efficiently, scales automatically, and provides excellent query performance for analytical workloads. Bigtable is the standard choice for click-stream and similar analytics use cases.
Why the other options are wrong
- A. Cloud SQL is a relational database unsuitable for high-velocity click-stream data at this scale.
- C. Cloud Storage is for object storage, not for querying structured time-series data efficiently.
- D. Cloud Datastore is a document database not optimized for high-velocity time-series analytics at this scale.
Question 77
You are migrating third-party applications from optimized on-premises virtual machines to Google Cloud. You are unsure about the optimum CPU and memory options. The applications have a consistent usage pattern across multiple weeks. You want to optimize resource usage for the lowest cost. What should you do?
Show answer and explanation
Correct answer: D. Create a Compute Engine instance with CPU and memory options similar to your application's current on-premises virtual machine. Install the Cloud Monitoring agent, and deploy the third-party application. Run a load test with normal traffic levels on the application, and follow the Rightsizing Recommendations in the Cloud Console.
Option D is correct because it uses Cloud's Rightsizing Recommendations feature, which analyzes actual application performance metrics over time to provide data-driven optimization suggestions. By deploying the application with similar specs to on-premises, running a normal load test, and following Google's Rightsizing Recommendations in the Console, you get the most cost-effective configuration without over-engineering or unnecessary testing.
Why the other options are wrong
- A. Starting with the smallest machine type and autoscaling may result in poor performance and doesn't leverage Google's built-in rightsizing analysis.
- B. App Engine flexible environment is not suitable for legacy third-party applications requiring specific system-level configurations.
- C. Testing multiple configurations with high traffic is inefficient and costly compared to using Rightsizing Recommendations based on normal traffic patterns.
Question 78
Your company is running its application workloads on Compute Engine. The applications have been deployed in production, acceptance, and development environments. The production environment is business-critical and is used 24/7, while the acceptance and development environments are only critical during office hours. Your CFO has asked you to optimize these environments to achieve cost savings during idle times. What should you do?
Show answer and explanation
Correct answer: B. Use Cloud Scheduler to trigger a Cloud Function that will stop the development and acceptance environments after office hours and start them just before office hours.
Cloud Scheduler (B) paired with Cloud Functions provides the optimal solution: it automatically stops development and acceptance environments after office hours and starts them before office hours, reducing costs during idle times while ensuring readiness during work hours. This approach requires no modifications to instances and automates the entire process. Option A risks running on production instances and requires manual script management. Option C wastes resources since development/acceptance don't need autoscaling. Option D uses preemptible VMs, which are unpredictable and unsuitable for acceptance/development work during office hours.
Why the other options are wrong
- A. Running scripts from production instances creates operational risk and lacks automation; manual scheduling is error-prone.
- C. Autoscaling doesn't address idle time during non-office hours; instances will still consume resources unless stopped.
- D. Preemptible VMs can be interrupted without warning, making them unsuitable for acceptance and development environments that need reliability during office hours.
Question 79
Your company has an application running as a Deployment in a Google Kubernetes Engine (GKE) cluster. You have separate clusters for development, staging, and production. You have discovered that the team is able to deploy a Docker image to the production cluster without first testing the deployment in development and then staging. You want to allow the team to have autonomy but want to prevent this from happening. You want a Google Cloud solution that can be implemented quickly with minimal effort. What should you do?
Show answer and explanation
Correct answer: C. Configure binary authorization policies for the development, staging, and production clusters. Create attestations as part of the continuous integration pipeline.
Binary Authorization with attestations enforces that container images can only be deployed to production if they have been approved through the development and staging environments. Attestations are created as part of the CI/CD pipeline when images pass testing in earlier environments. This provides policy-driven enforcement directly in GKE without requiring architectural changes, implementing it quickly with minimal effort while maintaining team autonomy.
Why the other options are wrong
- A. Kubernetes lifecycle hooks do not provide the necessary policy enforcement for cross-cluster deployment approval workflows.
- B. Corporate policy alone is not enforceable at the technical level and relies on manual compliance without automated prevention.
- D. While a custom admissions controller could work, it requires significant development effort and is more complex than using the native Binary Authorization feature.
Question 80
During a high traffic portion of the day, one of your relational databases crashes, but the replica is never promoted to a master. You want to avoid this in the future. What should you do?
Show answer and explanation
Correct answer: D. Implement routinely scheduled failovers of your databases
Routinely scheduled failovers test and validate the replica promotion process before a real crisis occurs. Regular failover testing ensures the failover mechanism actually works, identifies operational gaps, and builds confidence that replicas will correctly promote when needed, preventing the scenario where a crashed master leaves the replica unpromotable.
Why the other options are wrong
- A. Changing databases doesn't solve the fundamental issue of untested failover processes.
- B. Larger instances improve capacity but don't address failover reliability or automation issues.
- C. More frequent snapshots improve recovery point objective (RPO) but don't prevent the replica promotion failure that occurred.
Question 81
Your company has a stateless web API that performs scientific calculations. The web API runs on a single Google Kubernetes Engine (GKE) cluster. The cluster is currently deployed in us-central1. Your company has expanded to offer your API to customers in Asia. You want to reduce the latency for users in Asia. What should you do?
Show answer and explanation
Correct answer: C. Create a second GKE cluster in asia-southeast1, and use kubemci to create a global HTTP(s) load balancer.
Option C is correct because it creates a second GKE cluster in asia-southeast1 to serve Asian customers with reduced latency, and uses kubemci (Kubernetes Multi-Cluster Ingress) to create a global HTTP(s) load balancer that routes traffic to the nearest cluster. This provides true multi-region redundancy and latency optimization for a stateless API serving global customers, with intelligent traffic routing.
Why the other options are wrong
- A. Using LoadBalancer services with DNS requires manual management and doesn't provide intelligent global routing or automatic failover.
- B. Cloud CDN caches responses but doesn't reduce latency for compute-heavy scientific calculations that require actual processing.
- D. Increasing CPU and memory on a single cluster doesn't reduce latency for geographically distant users in Asia.
Question 82
Your company is planning to upload several important files to Cloud Storage. After the upload is completed, they want to verify that the uploaded content is identical to what they have on-premises. You want to minimize the cost and effort of performing this check. What should you do?
Show answer and explanation
Correct answer: D. 1. Use gsutil -m to upload the files to Cloud Storage. 2. Use gsutil hash -c FILE_NAME to generate CRC32C hashes of all on-premises files. 3. Use gsutil ls -L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files. 4. Compare the hashes.
Option D is correct because it uses CRC32C hashes, which Cloud Storage natively computes and stores for every object. By generating CRC32C hashes of on-premises files using gsutil hash and comparing them with the hashes retrieved via gsutil ls -L, you verify data integrity with minimal cost and effort. This approach avoids downloading files (option A/C cost) or building custom applications (option B), and leverages Google's native hash support.
Why the other options are wrong
- A. Downloading files requires significant bandwidth and storage, making it costly and inefficient compared to using native CRC32C hashes.
- B. Developing a custom Java application is unnecessary effort when gsutil and Cloud Storage already provide CRC32C hash support.
- C. Using diff after downloading files is expensive in terms of bandwidth and storage costs, and less efficient than comparing pre-computed hashes.
Question 83
You need to deploy an application to Google Cloud. The application receives traffic via TCP and reads and writes data to the filesystem. The application does not support horizontal scaling. The application process requires full control over the data on the file system because concurrent access causes corruption. The business is willing to accept a downtime when an incident occurs, but the application must be available 24/7 to support their business operations. You need to design the architecture of this application on Google Cloud. What should you do?
Show answer and explanation
Correct answer: D. Use an unmanaged instance group with an active and standby instance in different zones, use a regional persistent disk, and use a network load balancer in front of the instances.
Since the application does not support horizontal scaling and requires exclusive filesystem access to prevent corruption, a managed instance group is inappropriate. An unmanaged instance group with active/standby instances in different zones provides high availability while preventing concurrent access issues. Regional persistent disks support failover between zones, allowing the standby instance to take over if the active fails. A network load balancer (Layer 4) is required for TCP traffic, not an HTTP load balancer (Layer 7).
Why the other options are wrong
- A. Managed instance groups with multiple active instances would violate the exclusive filesystem access requirement and cause data corruption.
- B. Multiple instances in a managed instance group still risks concurrent filesystem access; this architecture doesn't prevent the corruption problem.
- C. HTTP load balancer operates at Layer 7 and is designed for HTTP/HTTPS; TCP applications require a network load balancer at Layer 4.
Question 84
Your company is building a new architecture to support its data-centric business focus. You are responsible for setting up the network. Your company's mobile and web-facing applications will be deployed on-premises, and all data analysis will be conducted in GCP. The plan is to process and load 7 years of archived .csv files totaling 900 TB of data and then continue loading 10 TB of data daily. You currently have an existing 100-MB internet connection. What actions will meet your company's needs?
Show answer and explanation
Correct answer: B. Lease a Transfer Appliance, upload archived files to it, and send it to Google to transfer archived data to Cloud Storage. Establish a connection with Google using a Dedicated Interconnect or Direct Peering connection and use it to upload files daily.
For 900 TB of archived data with an existing 100-MB connection, Transfer Appliance is the optimal solution for initial bulk data transfer. For the 10 TB daily uploads, Dedicated Interconnect or Direct Peering provides the dedicated, high-throughput connection needed to reliably handle that volume without competing with regular internet traffic. This approach meets both the massive initial transfer requirement and the ongoing daily data load.
Why the other options are wrong
- A. Compression and gsutil alone cannot overcome the 100-MB connection bottleneck for 900 TB of data; this would take months.
- C. Cloud VPN over the public internet lacks the throughput needed for reliable 10 TB daily uploads and introduces unnecessary latency.
- D. Cloud VPN without the gsutil -m option is suboptimal; VPN also cannot provide the dedicated bandwidth that Interconnect/Peering offers.
Question 85
Your company wants you to build a highly reliable web application with a few public APIs as the backend. You don't expect a lot of user traffic, but traffic could spike occasionally. You want to leverage Cloud Load Balancing, and the solution must be cost-effective for users. What should you do?
Show answer and explanation
Correct answer: C. Store static content such as HTML and images in Cloud CDN. Use Cloud Run to host the APIs and save the user data in Cloud SQL.
Cloud Run provides serverless compute that scales automatically from zero to handle traffic spikes without paying for idle capacity, directly addressing the cost-effectiveness requirement for variable traffic. Cloud CDN caches static content globally, reducing origin requests. Cloud SQL is a managed relational database suitable for application data. This combination leverages Cloud Load Balancing with Cloud Run's pay-per-request model and automatic scaling, optimizing for both reliability and cost.
Why the other options are wrong
- A. App Engine has minimum instance requirements that increase costs during low-traffic periods; it's less cost-effective than Cloud Run for variable traffic.
- B. A zonal GKE cluster with worker nodes requires minimum running instances even during idle periods, significantly increasing baseline costs for a low-traffic application.
- D. While Cloud Functions and Firestore offer cost benefits, this option lacks Cloud CDN for static content caching, and Cloud Functions may have latency concerns for APIs compared to Cloud Run.
Question 86
You need to develop procedures to verify resilience of disaster recovery for remote recovery using GCP. Your production environment is hosted on-premises. You need to establish a secure, redundant connection between your on-premises network and the GCP network. What should you do?
Show answer and explanation
Correct answer: B. Verify that Dedicated Interconnect can replicate files to GCP. Verify that Cloud VPN can establish a secure connection between your networks if Dedicated Interconnect fails.
For resilience testing of disaster recovery with on-premises to GCP connectivity, Dedicated Interconnect provides the primary high-capacity, low-latency connection for data replication. Cloud VPN serves as the redundant failover connection, providing a secure IPsec tunnel that remains available if Dedicated Interconnect fails. This two-layer approach ensures continuous connectivity for disaster recovery procedures.
Why the other options are wrong
- A. Direct peering is not a secure or appropriate failover mechanism; it's primarily for large-scale traffic exchange and doesn't provide the security encryption needed for disaster recovery.
- C. Transfer Appliance is a one-time data migration tool, not suitable for ongoing replication; it cannot replicate files continuously.
- D. Transfer Appliance is not designed for continuous file replication; it's a physical data migration appliance for one-time bulk transfers.
Question 87
You are monitoring Google Kubernetes Engine (GKE) clusters in a Cloud Monitoring workspace. As a Site Reliability Engineer (SRE), you need to triage incidents quickly. What should you do?
Show answer and explanation
Correct answer: A. Navigate the predefined dashboards in the Cloud Monitoring workspace, and then add metrics and create alert policies.
For efficient SRE incident triage, the best practice is to start with Cloud Monitoring's predefined dashboards for GKE, which provide immediate visibility into cluster health and metrics. From there, customize by adding relevant metrics and creating targeted alert policies to catch issues proactively. This approach leverages Google's built-in expertise while allowing customization for specific needs.
Why the other options are wrong
- B. Custom metrics and external alerting software are unnecessary when Cloud Monitoring provides built-in metrics and native alert policies.
- C. Writing shell scripts to gather metrics and exporting to BigQuery/Data Studio introduces unnecessary complexity and delays when Cloud Monitoring provides real-time dashboards.
- D. Creating custom dashboards per incident is reactive and inefficient; starting with predefined dashboards and adding to them is more practical for rapid triage.
Question 88
Your company captures all web traffic data in Google Analytics 360 and stores it in BigQuery. Each country has its own dataset. Each dataset has multiple tables. You want analysts from each country to be able to see and query only the data for their respective countries. How should you configure the access rights?
Show answer and explanation
Correct answer: A. Create a group per country. Add analysts to their respective country-groups. Create a single group 'all_analysts', and add all country-groups as members. Grant the 'all_analysts' group the IAM role of BigQuery jobUser. Share the appropriate dataset with view access with each respective analyst country-group.
The correct approach uses dataset-level access control with the BigQuery jobUser role. Dataset-level sharing ensures analysts can only access their country's dataset (the appropriate level of granularity for this use case). The jobUser role allows analysts to run queries, which is the minimum permission needed. Granting dataViewer would give broader permissions than necessary. Table-level sharing would be inefficient when entire datasets need to be restricted by country.
Why the other options are wrong
- B. Table-level sharing is unnecessarily granular and cumbersome when full datasets should be isolated by country.
- C. DataViewer role grants read access to all dataset content but doesn't allow query execution; jobUser is required to run queries.
- D. DataViewer doesn't include query execution permissions, and table-level sharing is not the appropriate granularity for country-based access.
Question 89
Your web application must comply with the requirements of the European Union's General Data Protection Regulation (GDPR). You are responsible for the technical architecture of your web application. What should you do?
Show answer and explanation
Correct answer: D. Define a design for the security of data in your web application that meets GDPR requirements.
GDPR compliance is fundamentally a technical and organizational design responsibility that requires defining specific security and data handling measures tailored to your application's requirements. While Google provides compliant infrastructure and tools, you must architect your application to meet GDPR requirements such as data encryption, access controls, data retention policies, and breach notification procedures. No automated GCP setting can substitute for proper architectural design that accounts for data residency, processing, and user rights.
Why the other options are wrong
- A. Using only native GCP services does not guarantee GDPR compliance; you must still design and implement compliant data handling practices specific to your application.
- B. There is no single "GDPR compliance setting" in GCP Console; compliance requires intentional architectural design across services.
- C. Cloud Security Scanner detects security vulnerabilities but does not ensure GDPR compliance; it is a security tool, not a compliance tool.
Question 90
You have an application deployed on Google Kubernetes Engine using a Deployment named echo-deployment. The deployment is exposed using a Service called echo-service. You need to perform an update to the application with minimal downtime to the application. What should you do?
Show answer and explanation
Correct answer: A. Use kubectl set image deployment/echo-deployment <new-image>
kubectl set image is the standard kubectl command for performing rolling updates to a deployment, which automatically manages the gradual replacement of old pods with new ones, ensuring minimal downtime. The command natively handles the rolling update strategy defined in the deployment spec. This approach maintains service availability throughout the update process by keeping some pods running while others are being updated.
Why the other options are wrong
- B. Instance Group rolling updates are a lower-level GCP mechanism that bypasses Kubernetes orchestration; kubectl commands are the proper interface for Kubernetes deployments.
- C. Deleting and recreating a deployment causes downtime because all pods are terminated before new ones start; this is not a minimal downtime approach.
- D. Services expose applications but do not manage container images; updating the service definition does not update the running application code.
That was 90 of 360.
The full Google Professional Cloud Architect pack has all 360 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 180 free as one PDF by email. Get the Half Pack →