Professional Cloud Architect

Question 1

A financial services company must satisfy a regulator's requirement that any access to their data by the cloud provider's support and engineering staff be logged, justified, and subject to explicit customer approval before the access occurs. The compliance team also wants near-real-time visibility into these provider-initiated access events. Which combination of Google Cloud capabilities best satisfies this requirement?

Accepted Answer

Enable Access Transparency logs and configure Access Approval to require explicit customer approval for Google support access.

Answer

Enable Cloud Audit Logs (Admin Activity and Data Access) and rely on them to capture Google staff access.

Answer

Apply VPC Service Controls perimeters around all data resources and enable Access Context Manager policies.

Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud HSM so Google cannot access the data without customer keys.

Question 2

A development team reports that a newly deployed application running on a Compute Engine VM in a custom VPC cannot reach a Cloud SQL instance over a private IP. Before making any changes, they ask you, the architect, how they can programmatically confirm whether the network path and firewall rules actually permit the traffic without generating live application requests. Which Google Cloud approach should you advise them to use first?

Accepted Answer

Run a Network Intelligence Center Connectivity Test specifying the VM as the source and the Cloud SQL private IP and port as the destination.

Answer

SSH into the VM and repeatedly run curl against the Cloud SQL endpoint until a connection succeeds.

Answer

Enable VPC Flow Logs on the subnet and wait for traffic samples to appear in Cloud Logging before analyzing them.

Answer

Temporarily create an allow-all ingress firewall rule and observe whether the application connects.

Question 3

A development team runs an automated shell script in Cloud Shell to create resources across several projects. The script relies on the default gcloud project configured in the active configuration. During a nightly batch run, resources were accidentally created in the wrong project because a teammate had earlier changed the active gcloud config. As the cloud architect, what should you advise the team to do to make the script safe and unambiguous regardless of the active configuration?

Accepted Answer

Explicitly pass the --project flag on every gcloud command in the script so the target project is never inferred from the active configuration.

Answer

Add a 'gcloud config set project' command at the start of the script so the active configuration is updated before resources are created.

Answer

Instruct all team members to avoid changing the active gcloud configuration while any batch job might be running.

Answer

Set the CLOUDSDK_CORE_PROJECT environment variable once in the user's shell profile so all sessions share the same default project.

Question 4

A platform team is about to update the autoscaling and machine-type configuration of a production managed instance group via a shell script during a maintenance window. The team lead is nervous about applying an incorrect change and asks you how to let engineers preview exactly what the gcloud command would do—without actually modifying any resources—before running it for real. What do you advise?

Accepted Answer

Run the gcloud command with the --dry-run flag first, then re-run it without the flag once the previewed changes look correct.

Answer

Add the --quiet flag so gcloud suppresses prompts and reports the intended changes before applying them.

Answer

Set the --verbosity=debug flag so the command prints the API calls it would make instead of executing them.

Answer

Run the command with --format=json so the output can be inspected and the change can be rolled back if incorrect.

Question 5

A development team writes an automation script that repeatedly runs 'gcloud projects add-iam-policy-binding' to grant a service account the roles/storage.objectViewer role across dozens of projects. During a code review, an operations engineer warns that concurrent executions of this command against the same project could silently overwrite each other's changes and lose bindings. As the cloud architect, what should you advise the team to do to make these IAM updates safe under concurrency?

Accepted Answer

Advise the team to use 'gcloud projects set-iam-policy' after fetching the policy with an etag, so updates are rejected if the policy changed since it was read.

Answer

Advise the team to keep using 'add-iam-policy-binding' but add a '--quiet' flag so the command skips confirmation prompts and completes faster.

Answer

Advise the team to wrap the calls in a retry loop with exponential backoff, which fully eliminates the possibility of lost updates.

Answer

Advise the team to grant the role at the organization level once so no per-project binding scripts are ever needed.

Question 6

A developer on your team needs to run a one-off gcloud command to list objects in a Cloud Storage bucket that only a specific service account (data-reader@project.iam.gserviceaccount.com) has permission to access. The developer's own user account has been granted the Service Account Token Creator role on that service account, but no direct access to the bucket. Company policy prohibits creating and downloading service account keys. What is the recommended way for the developer to execute the command using the service account's permissions?

Accepted Answer

Add the --impersonate-service-account=data-reader@project.iam.gserviceaccount.com flag to the gcloud storage ls command.

Answer

Run gcloud auth activate-service-account after generating a JSON key file for the service account.

Answer

Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a downloaded key file, then run the command.

Answer

Grant the developer's user account the Storage Object Viewer role directly on the bucket and run the command as themselves.

Question 7

A platform team is writing a shell script that runs on a scheduled Compute Engine VM to inventory all VM instances across several projects. The script must extract specific fields (instance name, zone, and machine type) from the gcloud command output and feed them into a downstream tool that only accepts structured input it can parse reliably. The team currently parses the default human-readable table output using tools like grep and awk, but the script breaks whenever gcloud changes column spacing or adds columns. As the architect, what should you advise them to do to make the parsing robust?

Accepted Answer

Use the '--format' flag with a JSON or projection specification (e.g., '--format=json' or '--format="value(name,zone,machineType)"') so the output is machine-readable and stable.

Answer

Add the '--quiet' flag to all commands so gcloud suppresses formatting changes and returns only the raw values.

Answer

Pipe the default table output through 'sort' and 'sed' to normalize spacing before passing it to awk.

Answer

Set the 'core/disable_prompts' property in the gcloud configuration so the CLI output format never changes between releases.

Question 8

A development team writes a Bash script that runs 'gcloud compute instances create' as part of a nightly automated job to ensure a set of standard utility VMs exists in a project. Occasionally the job fails because some of the VMs already exist from a previous run, causing the entire script to exit with an error and skip the creation of the remaining VMs. As the cloud architect, what should you advise the team to do to make the automation reliable and idempotent while still using the Cloud SDK?

Accepted Answer

Before each create command, run a 'gcloud compute instances describe' check for the instance and only invoke 'create' when the describe command returns a not-found result, allowing the script to skip existing VMs and continue.

Answer

Add the '--quiet' flag to every 'gcloud compute instances create' command so that the CLI suppresses prompts and errors and always returns a success exit code.

Answer

Wrap the whole script in a single 'gcloud compute instances create' call with multiple instance names and rely on the API to ignore any that already exist.

Answer

Schedule the script to first delete all utility VMs with 'gcloud compute instances delete', then recreate them from scratch on every run.

Question 9

A development team building a batch job that runs on an on-premises VM needs to authenticate to Google Cloud APIs. A junior developer asks you to help them create and download a service account JSON key so the application can call the APIs. Your organization enforces an org policy that blocks service account key creation. As the cloud architect advising the team, what should you recommend they implement for the on-premises workload?

Accepted Answer

Configure Workload Identity Federation with an external identity provider so the on-premises workload obtains short-lived Google Cloud credentials without a downloaded key.

Answer

Request a temporary exception to the org policy so a single downloadable key can be generated and stored in the application's config file.

Answer

Have the developer run 'gcloud auth login' with their personal Google account on the on-premises VM and reuse those user credentials in the batch job.

Answer

Enable the Compute Engine default service account and attach it to the on-premises VM through the metadata server.

Question 10

A DevOps team has a deployment script that creates a Compute Engine managed instance group and then immediately runs a smoke test against the group's instances. The script frequently fails because the instances are not yet running when the smoke test executes. The team asks you how to make the script reliably proceed only after the instances are fully ready, without hardcoding arbitrary sleep timers. What do you advise?

Accepted Answer

Use 'gcloud compute instance-groups managed wait-until --stable' to block until the group reaches a stable, fully provisioned state before running the smoke test.

Answer

Insert a fixed 'sleep 300' command after the create step to guarantee the instances have time to boot before testing.

Answer

Wrap the smoke test in a retry loop that re-runs the entire deployment from scratch each time it fails.

Answer

Add '--async' to the instance group create command so the script continues immediately and the instances self-register when ready.

Question 11

A development team manages all production infrastructure with Terraform, but recent outages were traced to manual changes made directly in the Google Cloud Console that were later overwritten by an automated pipeline. As the cloud architect, you must advise the team on a process that both prevents unreviewed changes from reaching production and surfaces any out-of-band modifications before they cause conflicts. Which recommendation best addresses this?

Accepted Answer

Require that every change be submitted as a pull request that runs `terraform plan` in CI, block merges without approval, and schedule a periodic `terraform plan` job to detect drift from the actual state.

Answer

Grant developers only read-only Console access and require all changes to be made exclusively through the gcloud CLI.

Answer

Enable an organization policy that disables the Google Cloud Console entirely for the production project.

Answer

Increase the frequency of the automated `terraform apply` pipeline so manual changes are corrected faster.

Question 12

Your operations team currently manages all Google Cloud infrastructure using Deployment Manager templates. Leadership has asked you, as the cloud architect, to advise the team on adopting a widely supported infrastructure-as-code tool that supports multi-cloud state management and a large community module ecosystem, while ensuring the team can programmatically preview changes before applying them. Which recommendation should you give the team?

Accepted Answer

Migrate the infrastructure definitions to Terraform, use remote state in a Cloud Storage backend, and adopt 'terraform plan' as a required step before every apply.

Answer

Continue using Deployment Manager and add gcloud shell scripts to preview changes, since Deployment Manager is Google's strategic IaC direction.

Answer

Replace all IaC with manually documented gcloud commands stored in a runbook so operators can execute them consistently.

Answer

Use the Cloud Console's import feature to recreate resources manually and disable automated deployments to reduce configuration drift.

Question 13

A media company runs a data analytics platform on Google Cloud with a stable baseline of Compute Engine instances that operate 24/7 for at least the next three years. During monthly reporting periods, the workload spikes with additional short-lived instances that run for a few hours. The finance team wants to minimize total compute cost while keeping the architecture simple and avoiding upfront lump-sum payments. Which pricing strategy should the architect recommend?

Accepted Answer

Purchase 3-year committed use discounts for the steady-state baseline and rely on standard on-demand pricing for the monthly reporting spikes.

Answer

Run the entire workload, including the baseline, on Spot VMs to achieve the deepest possible discount.

Answer

Purchase 3-year committed use discounts sized to cover both the baseline and the peak reporting capacity.

Answer

Rely entirely on sustained use discounts for both the baseline and the reporting spikes without any commitments.

Question 14

A retail company builds container images in a CI pipeline. Currently, each environment (dev, staging, production) rebuilds the image from source using its own environment-specific Dockerfile. The team frequently discovers that code passing all staging tests fails in production due to subtle differences in the built artifacts. As the architect, what change should you recommend to the SDLC process to eliminate these environment-specific defects?

Accepted Answer

Build the image once in CI, store it in Artifact Registry with an immutable digest, and promote that same artifact through dev, staging, and production.

Answer

Add more integration tests in each environment so defects are caught before the image reaches production.

Answer

Standardize on a single base OS image across all environment-specific Dockerfiles while continuing to rebuild in each environment.

Answer

Run production builds on larger machine types to ensure the compiler behaves consistently with staging.

Question 15

A US-based defense contractor is migrating a workload to Google Cloud that must comply with FedRAMP High and IL4 requirements. The security team mandates that the environment enforce data residency in US regions, restrict Google support personnel to US persons, and continuously monitor for configuration drift away from the compliance baseline. They want a Google-managed solution that packages these controls rather than assembling individual org policies and IAM constraints manually. Which approach best meets these requirements?

Accepted Answer

Deploy the workload into an Assured Workloads environment configured for the FedRAMP High / IL4 compliance regime

Answer

Create a folder and apply org policy constraints for resource location, plus custom monitoring scripts to detect drift

Answer

Enable VPC Service Controls perimeters around all projects and rely on Access Transparency logs for support personnel tracking

Answer

Purchase a dedicated Cloud Interconnect and host the workload in a Sovereign Controls partner region

Question 16

A logistics company is building a new fleet-management backend on Google Cloud. The application must store structured shipment records with a well-defined relational schema, support ACID transactions across multiple tables, and serve a moderate but steady workload from a single region. The engineering team wants a fully managed database and expects data to grow to a few hundred gigabytes, with no requirement for global distribution or horizontal write scaling beyond a single primary. Which storage service best meets these requirements at the lowest operational and licensing overhead?

Accepted Answer

Cloud SQL for PostgreSQL with a regional high-availability configuration

Answer

Cloud Spanner with a multi-region instance configuration

Answer

Firestore in Native mode with composite indexes

Answer

Bigtable with a single-cluster instance

Question 17

A genomics research startup runs nightly batch pipelines that process large datasets on Compute Engine. The jobs are fault-tolerant, can be checkpointed, and can restart if interrupted. They currently run on 200 standard on-demand n2 instances and take about 6 hours. Leadership wants to reduce compute cost as much as possible without missing the 10-hour nightly processing window, and the workload has no strict per-instance uptime requirement. Which compute design best meets these business and technical requirements?

Accepted Answer

Run the pipeline on Spot VMs (preemptible) in a managed instance group, relying on checkpointing to resume interrupted work.

Answer

Purchase 3-year committed use discounts for 200 on-demand n2 instances to lock in the lowest rate.

Answer

Migrate the workload to a single large sole-tenant node to guarantee no interruptions.

Answer

Keep the on-demand instances but enable a regional managed instance group with autoscaling to add capacity.

Question 18

A logistics company runs a nightly analytics pipeline composed of several dependent steps: extracting data from Cloud SQL, transforming it with a Dataflow job, loading results into BigQuery, and finally triggering a report-generation Cloud Run service. The steps must execute in strict order, with automatic retries on transient failures and clear visibility into which step failed. The team currently chains these steps with brittle cron jobs and shell scripts that offer no dependency management or observability. As the cloud architect, which Google Cloud service should you recommend to orchestrate this multi-step, dependency-aware workflow?

Accepted Answer

Cloud Workflows to define the ordered steps as a serverless orchestration with built-in retries and error handling

Answer

Cloud Scheduler with multiple independent cron jobs, one per pipeline step, spaced by fixed time intervals

Answer

Pub/Sub topics between each step so that completing one step publishes a message that triggers the next

Answer

A single large Cloud Run job that sequentially calls each step inside application code

Question 19

A logistics company is deploying a Cloud Bigtable cluster to store real-time vehicle tracking events. Each record includes a vehicle ID, a timestamp, and GPS coordinates. During load testing with millions of concurrent writes, engineers observe that most traffic is hitting a single node while others remain nearly idle, causing high write latency. The current row key is a monotonically increasing timestamp prefix. What is the most appropriate change to resolve the throughput bottleneck?

Accepted Answer

Redesign the row key to lead with a hashed or field-promoted value such as vehicle ID, followed by a reverse timestamp, to distribute writes evenly across tablets.

Answer

Increase the number of nodes in the Bigtable cluster to spread the write load across more compute resources.

Answer

Enable Bigtable replication to a second cluster so that write traffic is split between the two clusters.

Answer

Switch the table to use column families with garbage collection policies to reduce the size of each row.

Question 20

A financial services company runs microservices on GKE and must satisfy an auditor requirement that only container images built and scanned by the approved CI/CD pipeline can be deployed to production clusters. Developers must not be able to run arbitrary or manually pushed images. Which Google Cloud approach best enforces this control at deploy time?

Accepted Answer

Enable Binary Authorization on the production clusters with a policy requiring attestations signed by the trusted build and scan attestors before any image can be deployed.

Answer

Restrict IAM so that only the CI/CD service account has the Kubernetes Engine Developer role on the production namespace.

Answer

Enable vulnerability scanning in Artifact Registry and configure alerts when images with critical CVEs are pushed.

Answer

Use a VPC Service Controls perimeter around the GKE clusters to prevent images from outside the organization being pulled.

Question 21

A mid-sized company has migrated several projects to Google Cloud. The finance team is frustrated because they only discover budget overruns weeks later when the invoice arrives, and engineering teams have no visibility into their spending until it is too late to react. Leadership wants a process where teams are automatically notified as they approach their monthly spending thresholds, and wants the option to programmatically trigger automated responses (such as capping non-critical workloads) when a threshold is exceeded. Which approach best meets these business process requirements?

Accepted Answer

Configure Cloud Billing budgets with alert thresholds per project, sending notifications via email and publishing to a Pub/Sub topic that can trigger Cloud Functions for automated responses.

Answer

Export detailed billing data to BigQuery and have the finance team run a scheduled monthly query to review spending after each billing cycle closes.

Answer

Set organization policy constraints to hard-limit the number of resources each project can create, preventing any spending above the budget.

Answer

Enable Cloud Monitoring dashboards showing resource utilization and ask engineering leads to manually check them daily for signs of overspending.

Question 22

A large enterprise runs dozens of teams' workloads across several projects in a single Google Cloud organization. The finance department wants to hold each business unit accountable for its actual cloud spend and produce monthly internal invoices per team. Engineering leadership also wants dashboards showing cost trends by application and environment (prod, staging, dev). What is the most effective approach to enable accurate cost allocation and reporting across the organization?

Accepted Answer

Apply a consistent set of resource labels (e.g., team, application, environment) and cost allocation tags, export detailed Cloud Billing data to BigQuery, and build reports and dashboards grouped by those labels.

Answer

Create a separate billing account for every team and manually reconcile spend at the end of each month using exported PDF invoices.

Answer

Rely on the default Cloud Billing reports in the console and filter by project, assigning one project per resource so costs can be traced.

Answer

Enable budgets and budget alerts on each project so finance receives an email whenever a team exceeds its allocated threshold.

Question 23

A financial services company runs a Cloud Build CI/CD pipeline that deploys to production several times a day. An external auditor requires that every production deployment be traceable to a specific approved change request, and that the identity of the approver, the artifact version, and the timestamp be independently verifiable and retained for seven years. The engineering team wants to satisfy this requirement while keeping deployments fully automated where possible. Which approach best meets the audit and process requirements?

Accepted Answer

Introduce a manual approval gate in the release pipeline that records approver identity, then export Cloud Build and Cloud Audit Logs of each deployment to a retention-locked Cloud Storage bucket for the required period.

Answer

Require developers to email a manager before each deployment and keep the email threads in a shared inbox as the audit record.

Answer

Enable verbose logging in Cloud Build and rely on the 400-day default log retention in Cloud Logging to provide the deployment history.

Answer

Grant the auditor the Cloud Build Editor role so they can inspect build triggers and configurations whenever a review is needed.

Question 24

A retail company deploys its customer-facing web application to Google Kubernetes Engine several times per day. After a recent release caused a checkout outage that went undetected until customer complaints arrived, the release engineering team wants a deployment strategy that automatically exposes new versions to a small subset of live traffic, monitors error rates and latency against defined thresholds, and rolls back automatically if metrics degrade—without requiring a full duplicate production environment. Which approach best meets these requirements?

Accepted Answer

Use a canary deployment managed by Cloud Deploy with automated rollback triggered by Cloud Monitoring SLO-based alerting on error rate and latency.

Answer

Provision a full parallel blue-green environment and cut over 100% of traffic to the green environment after manual smoke testing.

Answer

Adopt a recreate deployment strategy that terminates all old pods before starting new ones to guarantee version consistency.

Answer

Deploy all changes directly to production during a nightly maintenance window and rely on daily database backups for recovery.

Question 25

A pharmaceutical company is designing a data platform for clinical trial results. Regulators require that all raw trial data be retained for 15 years and remain retrievable within a few hours if audited. Only the most recent 90 days of data is queried frequently by analysts; older data is accessed at most once or twice a year. The company wants to minimize total storage cost while satisfying the retention and retrievability requirements. Which storage design should the architect recommend?

Accepted Answer

Store recent data in Cloud Storage Standard, and use Object Lifecycle Management to transition objects to Nearline after 90 days and to Archive after one year, with a bucket retention policy of 15 years.

Answer

Store all data in Cloud Storage Standard class and rely on a 15-year retention policy to prevent deletion.

Answer

Load all trial data into BigQuery and use long-term storage pricing for partitions older than 90 days.

Answer

Store recent data in Cloud Storage Standard and move older data to Coldline immediately after 90 days, deleting objects manually after 15 years.

Question 26

A development team uses Cloud Build to run their CI/CD pipelines. Their build steps need to run integration tests against a Cloud SQL instance and a Memorystore instance that are only reachable through private IP addresses inside their VPC. The default Cloud Build workers cannot reach these private resources. As the architect, what should you advise the team to implement so the builds can connect to the private resources with the least operational overhead?

Accepted Answer

Configure a Cloud Build private pool (private worker pool) with a peered VPC connection to the team's network so build workers can reach the private IP resources.

Answer

Assign external IP addresses to the Cloud SQL and Memorystore instances and restrict access with authorized networks pointing at Cloud Build IP ranges.

Answer

Run a self-managed Jenkins server on a Compute Engine VM inside the VPC and migrate all pipelines off Cloud Build.

Answer

Create a Serverless VPC Access connector and attach it to the default Cloud Build worker pool to route traffic into the VPC.

Question 27

A development team maintains a single Cloud Build pipeline that must deploy the same application to three GKE clusters (dev, staging, and prod) in different projects. They want to avoid maintaining three separate cloudbuild.yaml files and instead pass the target project ID, cluster name, and image tag at build-submission time without hardcoding values. As the architect, what approach should you advise the team to adopt?

Accepted Answer

Use user-defined substitution variables in the cloudbuild.yaml and pass their values with --substitutions at build submission (or via triggers).

Answer

Create three copies of the build config, one per environment, and edit the hardcoded values in each before submitting the build.

Answer

Store the environment values as build artifacts in Cloud Storage and have each build step download them at runtime.

Answer

Encode the environment-specific values directly into the container image and select behavior with a startup flag.

Question 28

A media streaming company serves premium video segments (thousands of small HLS chunk files per title) from a Cloud Storage bucket fronted by an external HTTP(S) load balancer with Cloud CDN enabled. Only authenticated, paying subscribers may access these files, and each subscriber's session grants access to many files under a common URL path prefix. The security team wants to avoid generating and managing a separate token for every individual file request. Which access-control mechanism should the architect configure?

Accepted Answer

Cloud CDN signed cookies, restricting access to a URL path prefix for the subscriber's session

Answer

Cloud Storage signed URLs generated per file for each chunk request

Answer

A VPC Service Controls perimeter around the Cloud Storage bucket

Answer

Uniform bucket-level IAM bindings granting each subscriber the Storage Object Viewer role

Question 29

A development team currently uses hand-written shell scripts invoked from a Cloud Build step to promote container images through dev, staging, and production GKE clusters. Promotions are error-prone, lack a consistent approval step, and offer no easy way to roll back to a previously deployed release. As the architect, you must advise the team on a Google Cloud managed service that provides a declarative delivery pipeline with defined promotion sequences between targets, approval gates, and one-command rollback, while minimizing custom scripting. What do you recommend?

Accepted Answer

Adopt Cloud Deploy, defining a delivery pipeline with ordered targets for dev, staging, and production, using its built-in promotion, approvals, and rollback.

Answer

Continue with Cloud Build but move the shell scripts into a reusable custom builder image stored in Artifact Registry.

Answer

Use Config Sync to reconcile each cluster against a Git repository, relying on directory structure to represent each environment.

Answer

Deploy directly with kubectl apply from a Cloud Scheduler job that runs on a fixed nightly cadence for each cluster.

Question 30

A financial services company must generate and store the cryptographic signing keys used for their digital document-signing service. Regulatory auditors require that all key material be generated and stored in hardware validated to FIPS 140-2 Level 3, and the company wants to avoid managing physical hardware while still using Cloud KMS APIs. Which Google Cloud solution meets these requirements with the least operational overhead?

Accepted Answer

Use Cloud HSM to create hardware-backed keys, which are generated and stored in FIPS 140-2 Level 3 validated HSMs managed by Google.

Answer

Use Cloud KMS software-protected keys and enable automatic key rotation to satisfy the auditors.

Answer

Deploy your own HSM appliances on Compute Engine VMs and integrate them with Cloud KMS via a custom connector.

Answer

Use Cloud External Key Manager (EKM) to store keys with a third-party key management partner outside Google Cloud.

Question 31

A financial services company runs a production trading platform in Google Cloud and requires a private, high-throughput connection to its on-premises data center. The network team demands a connectivity architecture that qualifies for the 99.99% availability SLA from Google. They plan to use Dedicated Interconnect. Which configuration must the architect implement to meet the 99.99% SLA requirement?

Accepted Answer

Provision at least four Dedicated Interconnect connections across two metropolitan areas, with two connections in separate edge availability domains within each metro.

Answer

Provision four Dedicated Interconnect connections in a single metropolitan area (metro) attached to a single Cloud Router.

Answer

Provision two Dedicated Interconnect connections in a single edge availability domain, each terminating on separate Cloud Routers.

Answer

Provision a single 100 Gbps Dedicated Interconnect connection with a Partner Interconnect connection as a backup path.

Question 32

A retail company runs multiple microservices on GKE and Compute Engine. The analytics team wants to run ad hoc SQL queries across the last 18 months of application and audit logs to identify usage trends and correlate errors with business events. Logs are currently retained only in Cloud Logging's default buckets. The platform team needs a low-maintenance, cost-effective way to make this historical log data queryable at scale without impacting the running services. What should they recommend?

Accepted Answer

Create an aggregated log sink at the organization level that exports the relevant logs to a BigQuery dataset, and set an appropriate table partition expiration for 18-month retention.

Answer

Increase the retention period of the default Cloud Logging bucket to 18 months and have analysts use the Logs Explorer query interface for SQL-style analysis.

Answer

Export logs to Cloud Storage via a log sink and have analysts download and parse the JSON files with a custom script whenever they need to run analysis.

Answer

Install the Ops Agent on every VM and node to forward logs to a self-managed Elasticsearch cluster on Compute Engine for querying.

Question 33

A financial services company centralizes all application and audit logs in Cloud Logging. Their compliance team requires that audit logs be retained for 7 years and remain queryable within Cloud Logging, while high-volume debug logs from development workloads only need 14 days of retention to minimize cost. The platform team wants to manage these retention differences without exporting logs to external systems or writing custom deletion scripts. What should they do?

Accepted Answer

Route audit logs to a dedicated log bucket with a 7-year custom retention period, and route debug logs to a separate log bucket with a 14-day retention period using log sinks with inclusion filters.

Answer

Keep all logs in the _Default log bucket and set its retention to 7 years, then create a scheduled Cloud Function to delete debug log entries older than 14 days.

Answer

Export all logs to Cloud Storage buckets and apply Object Lifecycle Management rules to enforce the different retention windows for each log type.

Answer

Export audit logs to BigQuery with a 7-year table expiration and keep debug logs only in the _Required bucket, relying on its default retention.

Question 34

A payments team runs a critical API on GKE. They receive frequent false-positive pages: alerts fire whenever CPU briefly spikes, even though the service remains healthy and responsive. The team wants to only be paged when the service is genuinely degraded — specifically, when high request latency AND an elevated error rate occur together over a sustained window. What is the most appropriate way to configure this in Cloud Monitoring?

Accepted Answer

Create a single alerting policy with multiple conditions joined by a logical AND, using a rolling window (e.g., 5 minutes) on the latency and error-rate metrics so the policy triggers only when both conditions are simultaneously met.

Answer

Create two separate alerting policies — one for latency and one for error rate — each with its own notification channel, so both pages arrive together.

Answer

Create a single alerting policy with the latency and error-rate conditions joined by a logical OR so any signal of trouble triggers a page.

Answer

Lower the CPU alerting threshold and add a longer duration window so transient CPU spikes are filtered out before paging.

Question 35

Your SRE team manages a customer-facing payments API running on GKE. Leadership has approved a 99.9% availability SLO measured over a rolling 28-day window. The team wants an automated, low-noise way to be alerted while there is still enough error budget remaining to react, rather than only after the SLO is already breached. Which approach in Google Cloud Observability best meets this requirement?

Accepted Answer

Configure a Cloud Monitoring SLO with multi-window, multi-burn-rate alerting policies that fire on fast and slow error-budget consumption.

Answer

Create a single threshold alert that fires whenever the 28-day availability metric drops below 99.9%.

Answer

Set up an uptime check that pings the API every minute and pages the on-call engineer on any single failed probe.

Answer

Build a Cloud Monitoring dashboard showing request success rate and have engineers visually review it during business hours.

Question 36

A retail company runs dozens of microservices across several GKE clusters and Compute Engine instances, all managed by different teams under a single Google Cloud project. The SRE team wants a way to organize related resources so that dashboards, alerting policies, and health views can be scoped to specific applications (e.g., 'checkout', 'catalog') without manually listing every resource each time infrastructure is added or removed. New instances are created and destroyed frequently by autoscaling. What is the most operationally efficient approach in Cloud Monitoring?

Accepted Answer

Create Cloud Monitoring resource groups defined by dynamic membership criteria such as labels, tags, or naming patterns, then scope dashboards and alerts to those groups.

Answer

Manually add each resource to a static list in each dashboard and alerting policy, updating the list whenever autoscaling changes the fleet.

Answer

Export all metrics to BigQuery and build per-application views using scheduled queries that join on resource IDs.

Answer

Split each application into its own Google Cloud project so that monitoring is naturally scoped per project.

Question 37

A retail company runs several microservices on Cloud Run. During a recent outage, the SRE team spent hours manually correlating request logs by trace ID because they had to export logs to BigQuery first and wait for the scheduled sink to run. The team wants the ability to run ad hoc SQL-style queries directly against their existing Cloud Logging log buckets during incidents, without setting up an export pipeline or duplicating storage. Which approach best meets this requirement?

Accepted Answer

Upgrade the relevant log buckets to use Log Analytics, then query them using the SQL interface in the Log Analytics page or a linked BigQuery dataset.

Answer

Create a new aggregated log sink that continuously streams all logs to a dedicated BigQuery dataset for real-time querying.

Answer

Enable Cloud Trace sampling at 100% so all request logs are automatically indexed and searchable during incidents.

Answer

Increase the log bucket retention period to 400 days so historical logs remain queryable through the Logs Explorer search bar.

Question 38

A payment processing service runs on a Managed Instance Group behind an internal load balancer. Latency spikes occur when the queue of pending transactions grows, but CPU utilization stays low because the bottleneck is a downstream dependency, not compute. The operations team wants the MIG to scale based on the actual pending-transaction backlog rather than CPU. What should they implement to drive autoscaling on this business signal?

Accepted Answer

Publish the pending-transaction count as a custom metric to Cloud Monitoring and configure the MIG autoscaler to scale on that custom metric.

Answer

Increase the CPU target utilization threshold on the existing CPU-based autoscaling policy so instances scale sooner.

Answer

Configure an uptime check against the service and add instances manually whenever the check reports elevated latency.

Answer

Enable predictive autoscaling based on historical CPU patterns to add capacity before latency spikes occur.

Question 39

A company runs 12 separate Google Cloud projects, one per business unit, each with its own Compute Engine and Cloud SQL workloads. The central SRE team needs a single place to build dashboards and alerting policies that span metrics from all 12 projects, without duplicating configuration in each project. They also want to keep each project's IAM and billing independent. What is the recommended approach?

Accepted Answer

Create a metrics scope in a dedicated scoping project and add all 12 projects as monitored projects, then build dashboards and alerts from that scoping project.

Answer

Configure a log sink in each project that exports metrics to a central BigQuery dataset and build dashboards from BigQuery.

Answer

Move all 12 projects under a single parent project so their metrics are automatically merged into one monitoring view.

Answer

Enable a Cloud Monitoring workspace in each project and manually replicate the same dashboards and alert policies across all 12.

Question 40

A retail company runs a payment API on Google Kubernetes Engine. During recent incidents, on-call engineers received alerts but wasted valuable time searching wikis and chat threads to find the correct diagnostic steps for each specific alert. The SRE lead wants each Cloud Monitoring alert notification to arrive already containing a direct link to the specific troubleshooting documentation for that alerting condition, without building a custom middleware service. What should the SRE lead do?

Accepted Answer

Add the documentation content and a URL to the alerting policy's Documentation field so the runbook link is included automatically in every notification for that policy.

Answer

Create a Pub/Sub notification channel and write a Cloud Function that appends the relevant runbook URL before forwarding the alert to email.

Answer

Configure a log-based metric that captures the runbook URL as a label and attach it to the alerting policy's threshold condition.

Answer

Store the runbook links in a Cloud Storage bucket and grant on-call engineers Viewer access so they can look them up when an alert fires.

Question 41

You operate a customer-facing payments API on Cloud Run and have defined a 99.9% availability SLO over a rolling 30-day window. Your on-call team complains that they receive too many pages for tiny, transient dips that self-resolve, yet they occasionally miss slow-burning degradations until customers report problems. You want an alerting strategy that pages urgently for fast burns and creates lower-priority tickets for slow burns while minimizing false pages. Which approach should you configure in Cloud Monitoring?

Accepted Answer

Configure multiwindow, multi-burn-rate alerting policies on the SLO error budget — a fast-burn policy over short windows for urgent paging and a slow-burn policy over longer windows for ticketing.

Answer

Create a single threshold alert that fires whenever the request error rate exceeds 0.1% for one minute.

Answer

Set an uptime check every 60 seconds against the API and page the on-call team whenever a single check fails.

Answer

Alert only when the remaining 30-day error budget drops below 10%, paging the on-call team immediately when that occurs.

Question 42

A payments team is defining an SLO for their checkout API using Cloud Monitoring service monitoring. Their stated reliability goal is that 99.5% of requests should complete in under 400 ms, measured over a rolling 28-day period. The team wants the SLO configuration to accurately reflect this goal so error budget calculations and burn-rate alerts behave as expected. Which SLO configuration correctly represents this objective?

Accepted Answer

A request-based, latency-threshold SLI with a 400 ms threshold, a 99.5% goal, and a rolling 28-day compliance period.

Answer

A windows-based availability SLI with a 99.5% goal and a calendar-month compliance period, using uptime checks as the signal.

Answer

A request-based availability SLI counting HTTP 2xx responses with a 99.5% goal and a rolling 7-day compliance period.

Answer

A windows-based latency SLI with a 400 ms threshold, a 99.5% goal, and a calendar 28-day compliance period.

Question 43

Your company runs a customer-facing payment API on Cloud Run. The operations team wants alerts routed differently based on severity: warning-level conditions should create a ticket in their incident management tool, while critical outages must page the on-call engineer immediately via SMS and PagerDuty. Currently all Cloud Monitoring alerting policies send email to a shared distribution list, and minor issues are being missed among the noise. What is the most appropriate way to implement tiered alert routing in Cloud Monitoring?

Accepted Answer

Create separate alerting policies for warning and critical conditions, and attach different notification channels (webhook to the ticketing tool for warnings; SMS and PagerDuty channels for critical) to each policy.

Answer

Keep a single alerting policy for all conditions and configure the shared email distribution list to filter messages into folders based on subject line.

Answer

Export all alert events to a Pub/Sub topic and write a Cloud Function that parses each message and forwards it to the correct destination based on custom logic.

Answer

Increase the alerting policy's duration threshold so that only sustained critical outages generate any notification, reducing the volume of minor alerts.

Question 44

A financial analytics company runs hundreds of Compute Engine instances across multiple subnets in a Shared VPC. These instances have no external IP addresses but must make frequent outbound HTTPS calls to a third-party market-data provider's public API. During peak trading hours, engineers observe connection failures and log entries indicating dropped outbound connections, while off-peak traffic works fine. Investigation shows the instances are hitting a limit on simultaneous outbound connections to the same destination endpoint. What is the most appropriate action to resolve this?

Accepted Answer

Increase the minimum number of ports per VM (or enable dynamic port allocation) on the Cloud NAT gateway and add more external NAT IP addresses.

Answer

Assign external IP addresses to each instance so outbound connections bypass the NAT gateway entirely.

Answer

Replace Cloud NAT with a VPC peering connection to the third-party provider's network.

Answer

Enable Private Google Access on the subnets so the instances can reach the third-party API privately.

Question 45

A payments microservice running on Compute Engine has gradually increased its CPU utilization over the past three release cycles, driving up costs and occasionally triggering autoscaling that adds instances during peak traffic. The engineering team suspects inefficient code paths but cannot reproduce the behavior in staging, where load patterns differ. They need continuous, low-overhead visibility into which functions consume the most CPU and heap in the live production environment, correlated across releases, without redeploying instrumented builds each time. Which Google Cloud Observability capability should the architect recommend?

Accepted Answer

Enable Cloud Profiler with the profiling agent to capture statistical CPU and heap profiles continuously from production

Answer

Instrument the service with Cloud Trace to capture end-to-end request latency spans and analyze them per release

Answer

Create log-based metrics from application logs to count expensive function invocations and alert on thresholds

Answer

Configure a Cloud Monitoring dashboard tracking per-instance CPU utilization metrics and compare across releases

Question 46

A platform engineer keeps a collection of operational bash scripts and gcloud helper aliases that they use daily from Cloud Shell to administer several Google Cloud projects. They report that after a few weeks of inactivity, some files they saved appear to be missing, while others in their home directory remain. They want to understand the behavior so they can reliably store their tooling. Which statement correctly describes Cloud Shell persistence and the recommended practice?

Accepted Answer

Files stored in the $HOME directory persist in a 5 GB user-scoped disk, but the disk is deleted after 120 days of inactivity, so scripts should be committed to a source repository for durable storage.

Answer

Cloud Shell provides no persistent storage at all; any file must be re-uploaded each session, so scripts should be pasted into the terminal manually every time.

Answer

The entire VM including installed system packages persists indefinitely, so no external backup is ever required for anything stored in Cloud Shell.

Answer

Only files outside $HOME persist across sessions, so scripts should be saved to /tmp or /usr/local to survive session recycling.

Question 47

A logistics company runs a globally distributed inventory system on Cloud Spanner. During regional promotional events, read and write throughput spikes unpredictably, and engineers currently adjust the instance's node count manually. This has led to over-provisioning during quiet periods and latency violations when they react too slowly to spikes. They want the database capacity to adjust to load automatically while keeping utilization within target thresholds. What should the architect recommend?

Accepted Answer

Enable the Cloud Spanner Autoscaler by configuring managed autoscaling with minimum and maximum processing units and a target utilization percentage.

Answer

Migrate the workload to Cloud SQL with read replicas and enable the built-in storage autoscaling feature.

Answer

Create a Cloud Scheduler job that increases node count every morning and decreases it every night regardless of live traffic.

Answer

Enable Spanner's point-in-time recovery and increase the default query timeout to absorb the latency spikes.

Question 48

A retail company runs a Compute Engine application tier in a custom-mode VPC. They are provisioning a new Cloud SQL for PostgreSQL instance and require that all traffic between the application VMs and the database stay on Google's internal network, with no public IP exposure on the database. The application VMs must connect using a private IP address. What must the architect configure to enable this connectivity?

Accepted Answer

Enable a private services access connection by allocating an internal IP range and creating a VPC peering with the Google-managed services producer network, then create the Cloud SQL instance with private IP only.

Answer

Deploy the Cloud SQL Auth Proxy on each VM and connect over the instance's public IP, relying on the proxy's TLS tunnel to keep traffic internal.

Answer

Create a Serverless VPC Access connector in the VPC and attach it to the Cloud SQL instance so VMs route database traffic through the connector.

Answer

Configure Cloud NAT in the VPC and disable the public IP on the Cloud SQL instance so outbound traffic is translated to a private path.

Question 49

A retail analytics company runs a reporting application backed by a single Cloud SQL for PostgreSQL instance in us-central1. The primary instance handles all transactional writes, but a growing team of analysts in Europe runs heavy read-only dashboards that are now causing CPU contention and slow queries on the primary. Leadership wants to reduce read load on the primary and improve dashboard response times for the European users, while keeping operational overhead low and avoiding application rewrites. What should the architect do?

Accepted Answer

Create a cross-region read replica in europe-west1 and direct the analysts' read-only dashboard queries to the replica's connection endpoint.

Answer

Enable high availability (regional) on the primary instance so the standby in another zone can serve the analysts' read queries.

Answer

Migrate the database to a single larger machine type with more vCPUs and memory to absorb the additional read traffic.

Answer

Export the database nightly to Cloud Storage and have the European analysts query the exported files with BigQuery external tables.

Question 50

A retail company runs a microservices platform on GKE and has enabled Cloud Trace to diagnose latency. During a major sales event, engineers report that traces for many slow requests are missing, making it hard to find the bottleneck. The default automatic sampling is capturing only a small fraction of requests under high load. The team wants to increase the likelihood of capturing traces for the slowest requests without a massive increase in ingestion cost or code changes across all services. What should the architect recommend?

Accepted Answer

Configure custom sampling in the instrumentation (e.g., OpenTelemetry) to increase the sampling rate and apply tail-based sampling that prioritizes high-latency and error spans.

Answer

Disable Cloud Trace and rely on Cloud Logging structured logs with latency fields to reconstruct request timing manually.

Answer

Increase the number of GKE nodes so that each service has spare CPU to emit 100% of traces during the event.

Answer

Export all traces to BigQuery and query them there to find slow requests after the event ends.

Question 51

A financial services company stores all encryption keys in a dedicated 'security-keys' project managed by the central security team. An application team's project runs Compute Engine VMs whose persistent disks must be encrypted with a customer-managed encryption key (CMEK) from a key ring in the security-keys project. When the application team tries to create a disk referencing the key, disk creation fails with a permission error. What is the correct way to resolve this while maintaining centralized key management?

Accepted Answer

Grant the Compute Engine service agent of the application project the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key or key ring in the security-keys project.

Answer

Copy the CMEK material from the security-keys project into the application project's own key ring so the service agent can access it locally.

Answer

Grant the application team's users the Cloud KMS Admin role on the security-keys project so they can manage the key during disk creation.

Answer

Disable CMEK for the disks and rely on Google-managed default encryption, then re-enable CMEK once IAM propagates.

Question 52

A financial services company stores customer records in Cloud Storage buckets encrypted with customer-managed encryption keys (CMEK) in Cloud KMS. To comply with a data protection regulation, when a customer requests deletion of their data, the company must guarantee that all copies—including any that may persist in backups or replicated storage—become permanently unrecoverable, and must be able to prove the data is cryptographically inaccessible. What is the most effective approach to meet this requirement?

Accepted Answer

Store each customer's data under a dedicated CMEK key and destroy that key version in Cloud KMS when the customer requests deletion (crypto-shredding).

Answer

Delete the customer's objects from the bucket and rely on Cloud Storage soft delete and object versioning to purge older copies after the retention window.

Answer

Rotate the single shared CMEK key used for all customers so the old key version is no longer primary, then delete the customer's objects.

Answer

Disable the CMEK key temporarily and set an object lifecycle rule to delete the customer's objects after 30 days.

Question 53

A multinational bank must store customer records in Cloud Storage and BigQuery. A new regulatory requirement mandates that the bank retain sole control of the encryption keys outside of Google Cloud, so that Google can never access key material even under a lawful access request. The security team also needs the ability to instantly and permanently revoke Google's ability to decrypt the data. Which encryption approach satisfies these requirements?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with keys held in an approved external key management partner controlled by the bank.

Answer

Use Google-managed default encryption and rely on Google's data residency guarantees for the region.

Answer

Use customer-managed encryption keys (CMEK) with keys stored in Cloud KMS in the same region as the data.

Answer

Use customer-supplied encryption keys (CSEK) uploaded to Cloud KMS and rotated automatically by Google.

Question 54

A financial services company stores highly sensitive customer records in Cloud Storage buckets encrypted with Cloud KMS customer-managed encryption keys (CMEK). Regulators require that any decryption of this data by cloud provider personnel or automated processes be explicitly justified and, in certain cases, blocked unless the organization approves the reason. The security team wants a mechanism where each request to use the key includes a reason code, and the organization can define policies that automatically deny key access for unapproved justification categories. Which capability should the architect implement?

Accepted Answer

Enable Key Access Justifications (KAJ) on the CMEK keys and configure a justification policy that denies unapproved reason codes.

Answer

Turn on Access Transparency logs and manually review each key-usage entry after the fact.

Answer

Rotate the CMEK keys more frequently and restrict IAM roles on the key ring to a small group.

Answer

Move the keys to Cloud HSM and enable audit logging on the key ring.

Question 55

A financial services company must comply with a regulation requiring that the team managing encryption keys be different from the team that operates the applications consuming those keys. Application workloads run on Compute Engine and store data in Cloud Storage encrypted with Cloud KMS. Security auditors require proof that developers cannot administer or destroy keys, while applications can still perform encrypt/decrypt operations. Which IAM design best satisfies these separation-of-duties requirements?

Accepted Answer

Grant the security team the Cloud KMS Admin role on the key ring and grant the application service accounts the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific keys.

Answer

Grant both the security team and the application service accounts the Cloud KMS Admin role, and rely on audit logs to detect misuse after the fact.

Answer

Grant developers the Owner role on the project so they can manage keys and applications together, and enable Cloud Audit Logs for key operations.

Answer

Grant the application service accounts the Cloud KMS Admin role and grant the security team the Cloud KMS CryptoKey Encrypter/Decrypter role for oversight.

Question 56

A financial services company has grown from 5 to 40 developers committing to a shared repository. Recently, several production incidents were traced to code merged directly to the main branch without review, and to merges that bypassed the automated test suite. The engineering leadership wants a repeatable technical process that enforces peer review and prevents untested code from reaching main, while minimizing custom tooling. What should the architect recommend?

Accepted Answer

Configure branch protection rules on the main branch requiring at least one approving pull request review and passing CI status checks before merges are permitted.

Answer

Add a nightly Cloud Scheduler job that scans the main branch for commits lacking review metadata and emails the offending developers a warning.

Answer

Grant only senior engineers write access to main and require all other developers to submit patches by email for manual application.

Answer

Move each developer to a separate repository and have a release manager manually cherry-pick approved commits into a central repository weekly.

Question 57

A financial services company runs a fleet of Compute Engine VMs supporting a customer-facing trading platform. Analysis of the last 18 months shows a stable baseline of 40 n2-standard-8 instances running 24/7, with occasional bursts to 65 instances during market volatility. The finance team wants to reduce Compute Engine spend without sacrificing the ability to scale during bursts, and they want the commitment strategy to survive changes in machine family if engineering later re-architects onto a different VM type. Which approach best optimizes cost while preserving flexibility?

Accepted Answer

Purchase spend-based (flexible) committed use discounts covering the baseline compute spend, and let burst capacity run on on-demand pricing.

Answer

Purchase resource-based committed use discounts (CUDs) for 40 n2-standard-8 instances for 3 years, and let burst capacity above the baseline run on on-demand pricing.

Answer

Run the entire fleet, including the baseline, on Spot VMs to maximize discount rates.

Answer

Purchase resource-based CUDs sized for the peak of 65 n2-standard-8 instances for 1 year to guarantee coverage of all usage.

Question 58

A European financial services company is building a new customer-facing platform on Google Cloud. Under GDPR and their national banking regulator's rules, all personally identifiable customer data must remain physically stored within the European Union, and the company must be able to demonstrate this to auditors. The application also requires low-latency access for users concentrated in Germany and France. As the cloud architect, which design approach best satisfies these business and compliance requirements while minimizing latency?

Accepted Answer

Deploy compute and use Cloud Storage in EU regions (e.g., europe-west3, europe-west9) with regional or dual-region resource locations, and enable Organization Policy constraints to restrict resource creation to approved EU regions.

Answer

Use a multi-region bucket set to the 'us' location for durability, and encrypt all PII with customer-managed encryption keys stored in an EU-based Cloud KMS key ring.

Answer

Deploy all resources in a single global load-balanced footprint and rely on Cloud CDN edge caching in Europe to keep data close to users.

Answer

Store PII in Firestore in Native mode using the default 'nam5' multi-region location and apply IAM conditions to limit access to EU-based employees only.

Question 59

A financial services company is migrating a customer-records application to Google Cloud. Their regulator requires that the company retain sole control over the encryption keys protecting customer data at rest, including the ability to revoke Google's access to decrypt the data at any time, while still using Google-managed storage services. The security team also wants to avoid operating and patching their own on-premises key infrastructure. Which encryption key management approach best satisfies these requirements?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS, and use IAM and key state controls to manage and revoke access.

Answer

Rely on Google's default encryption at rest, which automatically encrypts all data with Google-managed keys.

Answer

Store the encryption keys in a self-hosted HashiCorp Vault cluster running on Compute Engine VMs and reference them from storage services.

Answer

Use customer-supplied encryption keys (CSEK) generated and stored on the company's on-premises hardware security modules for all services.

Question 60

A media startup runs an internal-facing content approval portal that receives no traffic overnight and on weekends, then bursts to a few hundred concurrent editors during weekday business hours. The application is a stateless containerized web service with unpredictable request patterns. Leadership wants to minimize idle cost while ensuring the service scales rapidly during peaks, and the team wants to avoid managing node infrastructure. Which compute platform best meets these requirements?

Accepted Answer

Deploy the container to Cloud Run, which scales to zero when idle and automatically scales out with concurrent requests.

Answer

Deploy to a Compute Engine managed instance group with autoscaling based on CPU utilization and a minimum of two instances.

Answer

Deploy to a GKE Standard cluster with a cluster autoscaler and a fixed pool of always-on nodes.

Answer

Deploy to a single large Compute Engine VM sized for peak concurrency to guarantee capacity.

Question 61

A financial services company is designing a real-time fraud detection service on Google Cloud. The model is a deep neural network that requires GPU acceleration to meet a strict 50 ms p99 inference latency target. Traffic is highly variable: near-zero overnight and peaking at 30,000 requests per second during business hours. The architecture team must minimize cost while meeting the latency SLA and avoiding manual capacity management. Which compute design should the architect recommend?

Accepted Answer

Deploy the model to Vertex AI online prediction endpoints with GPU-backed nodes and configure autoscaling with a minimum and maximum node count tied to utilization.

Answer

Deploy the model on a fixed fleet of Compute Engine instances with attached GPUs, sized for peak traffic and left running 24/7 for predictable performance.

Answer

Run the model as a Cloud Run service without GPUs, relying on high concurrency and horizontal scaling to absorb peak load.

Answer

Batch incoming requests and process them on a Dataproc cluster with GPU workers scheduled to run during business hours.

Question 62

An automotive company collects sensor readings from a fleet of connected vehicles. Each vehicle emits several thousand timestamped metrics per second, and analysts need to run range queries over time windows (for example, all engine temperature readings for a vehicle over the past 30 days) with single-digit millisecond read latency at massive scale. The dataset grows to petabytes and writes are extremely high-throughput. Which Google Cloud storage service best meets these requirements?

Accepted Answer

Cloud Bigtable, using a row key that combines vehicle ID with a reversed or bucketed timestamp

Answer

Cloud SQL with read replicas and partitioned tables by timestamp

Answer

BigQuery with ingestion-time partitioned tables

Answer

Firestore in Native mode with composite indexes on vehicle ID and timestamp

Question 63

A software company is designing the CI/CD foundation for a greenfield migration to Google Cloud. Their build pipeline produces both Docker container images and language-specific packages (Maven and npm). Compliance requires that every artifact be scanned for known vulnerabilities before deployment and that deployments be blocked if an image contains a critical CVE. They want a single Google-managed service that stores all artifact types and integrates natively with vulnerability scanning and admission control. Which design should the architect recommend?

Accepted Answer

Store images and packages in Artifact Registry, enable Artifact Analysis (Container Scanning API), and enforce Binary Authorization policies in the deployment cluster.

Answer

Store images in Container Registry (gcr.io), keep Maven and npm packages in a self-managed Nexus VM, and run a nightly Cloud Function that scans images.

Answer

Store all artifacts in a Cloud Storage bucket with object versioning, and use a Cloud Build step that runs a third-party scanner before uploading.

Answer

Store images in Artifact Registry and use Cloud Armor security policies to block deployment of images that contain critical vulnerabilities.

Question 64

A software company runs about 60 non-production (development and QA) VM-based environments on Compute Engine. Developers work standard business hours (roughly 9 AM to 6 PM, Monday to Friday) in a single time zone, but the environments currently run 24/7, driving up costs. Management wants to significantly reduce spend on these environments without requiring developers to change how they access or provision the machines, and the environments must retain their disk state between sessions. Which approach best meets these requirements?

Accepted Answer

Use Cloud Scheduler with a Cloud Function (or an instance schedule) to automatically stop the instances outside business hours and start them before the workday begins.

Answer

Migrate all non-production workloads to Spot VMs to take advantage of the lowest available pricing.

Answer

Purchase three-year committed use discounts for the non-production instance families to lower the hourly rate.

Answer

Delete the environments at the end of each day and recreate them from Terraform each morning.

Exam domain	Exam weight	Practice
Designing and planning a cloud solution architecture	25%	Practice this topic
Managing and provisioning a cloud solution infrastructure	17.5%	Practice this topic
Designing for security and compliance	17.5%	Practice this topic
Analyzing and optimizing technical and business processes	15%	Practice this topic
Managing implementation	12.5%	Practice this topic
Ensuring solution and operations excellence	12.5%	Practice this topic

Professional Cloud Architect (PCA) practice exam & study guide

Start studying PCA

All PCA study resources

PCA exam domains

Sample PCA questions

Key PCA terms

PCA frequently asked questions

Designing and planning a cloud solution architecture (25%)

Managing and provisioning a cloud solution infrastructure (17.5%)

Designing for security and compliance (17.5%)

Analyzing and optimizing technical and business processes (15%)

Managing implementation (12.5%)

Ensuring solution and operations excellence (12.5%)