Professional Cloud Architect

Question 1

A financial services company must satisfy a regulator's requirement that any access to their data by the cloud provider's support and engineering staff be logged, justified, and subject to explicit customer approval before the access occurs. The compliance team also wants near-real-time visibility into these provider-initiated access events. Which combination of Google Cloud capabilities best satisfies this requirement?

Accepted Answer

Enable Access Transparency logs and configure Access Approval to require explicit customer approval for Google support access.

Answer

Enable Cloud Audit Logs (Admin Activity and Data Access) and rely on them to capture Google staff access.

Answer

Apply VPC Service Controls perimeters around all data resources and enable Access Context Manager policies.

Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud HSM so Google cannot access the data without customer keys.

Question 2

A development team reports that a newly deployed application running on a Compute Engine VM in a custom VPC cannot reach a Cloud SQL instance over a private IP. Before making any changes, they ask you, the architect, how they can programmatically confirm whether the network path and firewall rules actually permit the traffic without generating live application requests. Which Google Cloud approach should you advise them to use first?

Accepted Answer

Run a Network Intelligence Center Connectivity Test specifying the VM as the source and the Cloud SQL private IP and port as the destination.

Answer

SSH into the VM and repeatedly run curl against the Cloud SQL endpoint until a connection succeeds.

Answer

Enable VPC Flow Logs on the subnet and wait for traffic samples to appear in Cloud Logging before analyzing them.

Answer

Temporarily create an allow-all ingress firewall rule and observe whether the application connects.

Question 3

A development team runs an automated shell script in Cloud Shell to create resources across several projects. The script relies on the default gcloud project configured in the active configuration. During a nightly batch run, resources were accidentally created in the wrong project because a teammate had earlier changed the active gcloud config. As the cloud architect, what should you advise the team to do to make the script safe and unambiguous regardless of the active configuration?

Accepted Answer

Explicitly pass the --project flag on every gcloud command in the script so the target project is never inferred from the active configuration.

Answer

Add a 'gcloud config set project' command at the start of the script so the active configuration is updated before resources are created.

Answer

Instruct all team members to avoid changing the active gcloud configuration while any batch job might be running.

Answer

Set the CLOUDSDK_CORE_PROJECT environment variable once in the user's shell profile so all sessions share the same default project.

Question 4

A platform team is about to update the autoscaling and machine-type configuration of a production managed instance group via a shell script during a maintenance window. The team lead is nervous about applying an incorrect change and asks you how to let engineers preview exactly what the gcloud command would do—without actually modifying any resources—before running it for real. What do you advise?

Accepted Answer

Run the gcloud command with the --dry-run flag first, then re-run it without the flag once the previewed changes look correct.

Answer

Add the --quiet flag so gcloud suppresses prompts and reports the intended changes before applying them.

Answer

Set the --verbosity=debug flag so the command prints the API calls it would make instead of executing them.

Answer

Run the command with --format=json so the output can be inspected and the change can be rolled back if incorrect.

Question 5

A development team writes an automation script that repeatedly runs 'gcloud projects add-iam-policy-binding' to grant a service account the roles/storage.objectViewer role across dozens of projects. During a code review, an operations engineer warns that concurrent executions of this command against the same project could silently overwrite each other's changes and lose bindings. As the cloud architect, what should you advise the team to do to make these IAM updates safe under concurrency?

Accepted Answer

Advise the team to use 'gcloud projects set-iam-policy' after fetching the policy with an etag, so updates are rejected if the policy changed since it was read.

Answer

Advise the team to keep using 'add-iam-policy-binding' but add a '--quiet' flag so the command skips confirmation prompts and completes faster.

Answer

Advise the team to wrap the calls in a retry loop with exponential backoff, which fully eliminates the possibility of lost updates.

Answer

Advise the team to grant the role at the organization level once so no per-project binding scripts are ever needed.

Question 6

A developer on your team needs to run a one-off gcloud command to list objects in a Cloud Storage bucket that only a specific service account (data-reader@project.iam.gserviceaccount.com) has permission to access. The developer's own user account has been granted the Service Account Token Creator role on that service account, but no direct access to the bucket. Company policy prohibits creating and downloading service account keys. What is the recommended way for the developer to execute the command using the service account's permissions?

Accepted Answer

Add the --impersonate-service-account=data-reader@project.iam.gserviceaccount.com flag to the gcloud storage ls command.

Answer

Run gcloud auth activate-service-account after generating a JSON key file for the service account.

Answer

Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a downloaded key file, then run the command.

Answer

Grant the developer's user account the Storage Object Viewer role directly on the bucket and run the command as themselves.

Question 7

A platform team is writing a shell script that runs on a scheduled Compute Engine VM to inventory all VM instances across several projects. The script must extract specific fields (instance name, zone, and machine type) from the gcloud command output and feed them into a downstream tool that only accepts structured input it can parse reliably. The team currently parses the default human-readable table output using tools like grep and awk, but the script breaks whenever gcloud changes column spacing or adds columns. As the architect, what should you advise them to do to make the parsing robust?

Accepted Answer

Use the '--format' flag with a JSON or projection specification (e.g., '--format=json' or '--format="value(name,zone,machineType)"') so the output is machine-readable and stable.

Answer

Add the '--quiet' flag to all commands so gcloud suppresses formatting changes and returns only the raw values.

Answer

Pipe the default table output through 'sort' and 'sed' to normalize spacing before passing it to awk.

Answer

Set the 'core/disable_prompts' property in the gcloud configuration so the CLI output format never changes between releases.

Question 8

A development team writes a Bash script that runs 'gcloud compute instances create' as part of a nightly automated job to ensure a set of standard utility VMs exists in a project. Occasionally the job fails because some of the VMs already exist from a previous run, causing the entire script to exit with an error and skip the creation of the remaining VMs. As the cloud architect, what should you advise the team to do to make the automation reliable and idempotent while still using the Cloud SDK?

Accepted Answer

Before each create command, run a 'gcloud compute instances describe' check for the instance and only invoke 'create' when the describe command returns a not-found result, allowing the script to skip existing VMs and continue.

Answer

Add the '--quiet' flag to every 'gcloud compute instances create' command so that the CLI suppresses prompts and errors and always returns a success exit code.

Answer

Wrap the whole script in a single 'gcloud compute instances create' call with multiple instance names and rely on the API to ignore any that already exist.

Answer

Schedule the script to first delete all utility VMs with 'gcloud compute instances delete', then recreate them from scratch on every run.

Question 9

A media company runs a data analytics platform on Google Cloud with a stable baseline of Compute Engine instances that operate 24/7 for at least the next three years. During monthly reporting periods, the workload spikes with additional short-lived instances that run for a few hours. The finance team wants to minimize total compute cost while keeping the architecture simple and avoiding upfront lump-sum payments. Which pricing strategy should the architect recommend?

Accepted Answer

Purchase 3-year committed use discounts for the steady-state baseline and rely on standard on-demand pricing for the monthly reporting spikes.

Answer

Run the entire workload, including the baseline, on Spot VMs to achieve the deepest possible discount.

Answer

Purchase 3-year committed use discounts sized to cover both the baseline and the peak reporting capacity.

Answer

Rely entirely on sustained use discounts for both the baseline and the reporting spikes without any commitments.

Question 10

A retail company builds container images in a CI pipeline. Currently, each environment (dev, staging, production) rebuilds the image from source using its own environment-specific Dockerfile. The team frequently discovers that code passing all staging tests fails in production due to subtle differences in the built artifacts. As the architect, what change should you recommend to the SDLC process to eliminate these environment-specific defects?

Accepted Answer

Build the image once in CI, store it in Artifact Registry with an immutable digest, and promote that same artifact through dev, staging, and production.

Answer

Add more integration tests in each environment so defects are caught before the image reaches production.

Answer

Standardize on a single base OS image across all environment-specific Dockerfiles while continuing to rebuild in each environment.

Answer

Run production builds on larger machine types to ensure the compiler behaves consistently with staging.

Question 11

A US-based defense contractor is migrating a workload to Google Cloud that must comply with FedRAMP High and IL4 requirements. The security team mandates that the environment enforce data residency in US regions, restrict Google support personnel to US persons, and continuously monitor for configuration drift away from the compliance baseline. They want a Google-managed solution that packages these controls rather than assembling individual org policies and IAM constraints manually. Which approach best meets these requirements?

Accepted Answer

Deploy the workload into an Assured Workloads environment configured for the FedRAMP High / IL4 compliance regime

Answer

Create a folder and apply org policy constraints for resource location, plus custom monitoring scripts to detect drift

Answer

Enable VPC Service Controls perimeters around all projects and rely on Access Transparency logs for support personnel tracking

Answer

Purchase a dedicated Cloud Interconnect and host the workload in a Sovereign Controls partner region

Question 12

A logistics company is building a new fleet-management backend on Google Cloud. The application must store structured shipment records with a well-defined relational schema, support ACID transactions across multiple tables, and serve a moderate but steady workload from a single region. The engineering team wants a fully managed database and expects data to grow to a few hundred gigabytes, with no requirement for global distribution or horizontal write scaling beyond a single primary. Which storage service best meets these requirements at the lowest operational and licensing overhead?

Accepted Answer

Cloud SQL for PostgreSQL with a regional high-availability configuration

Answer

Cloud Spanner with a multi-region instance configuration

Answer

Firestore in Native mode with composite indexes

Answer

Bigtable with a single-cluster instance

Question 13

A genomics research startup runs nightly batch pipelines that process large datasets on Compute Engine. The jobs are fault-tolerant, can be checkpointed, and can restart if interrupted. They currently run on 200 standard on-demand n2 instances and take about 6 hours. Leadership wants to reduce compute cost as much as possible without missing the 10-hour nightly processing window, and the workload has no strict per-instance uptime requirement. Which compute design best meets these business and technical requirements?

Accepted Answer

Run the pipeline on Spot VMs (preemptible) in a managed instance group, relying on checkpointing to resume interrupted work.

Answer

Purchase 3-year committed use discounts for 200 on-demand n2 instances to lock in the lowest rate.

Answer

Migrate the workload to a single large sole-tenant node to guarantee no interruptions.

Answer

Keep the on-demand instances but enable a regional managed instance group with autoscaling to add capacity.

Question 14

A logistics company runs a nightly analytics pipeline composed of several dependent steps: extracting data from Cloud SQL, transforming it with a Dataflow job, loading results into BigQuery, and finally triggering a report-generation Cloud Run service. The steps must execute in strict order, with automatic retries on transient failures and clear visibility into which step failed. The team currently chains these steps with brittle cron jobs and shell scripts that offer no dependency management or observability. As the cloud architect, which Google Cloud service should you recommend to orchestrate this multi-step, dependency-aware workflow?

Accepted Answer

Cloud Workflows to define the ordered steps as a serverless orchestration with built-in retries and error handling

Answer

Cloud Scheduler with multiple independent cron jobs, one per pipeline step, spaced by fixed time intervals

Answer

Pub/Sub topics between each step so that completing one step publishes a message that triggers the next

Answer

A single large Cloud Run job that sequentially calls each step inside application code

Question 15

A logistics company is deploying a Cloud Bigtable cluster to store real-time vehicle tracking events. Each record includes a vehicle ID, a timestamp, and GPS coordinates. During load testing with millions of concurrent writes, engineers observe that most traffic is hitting a single node while others remain nearly idle, causing high write latency. The current row key is a monotonically increasing timestamp prefix. What is the most appropriate change to resolve the throughput bottleneck?

Accepted Answer

Redesign the row key to lead with a hashed or field-promoted value such as vehicle ID, followed by a reverse timestamp, to distribute writes evenly across tablets.

Answer

Increase the number of nodes in the Bigtable cluster to spread the write load across more compute resources.

Answer

Enable Bigtable replication to a second cluster so that write traffic is split between the two clusters.

Answer

Switch the table to use column families with garbage collection policies to reduce the size of each row.

Question 16

A financial services company runs microservices on GKE and must satisfy an auditor requirement that only container images built and scanned by the approved CI/CD pipeline can be deployed to production clusters. Developers must not be able to run arbitrary or manually pushed images. Which Google Cloud approach best enforces this control at deploy time?

Accepted Answer

Enable Binary Authorization on the production clusters with a policy requiring attestations signed by the trusted build and scan attestors before any image can be deployed.

Answer

Restrict IAM so that only the CI/CD service account has the Kubernetes Engine Developer role on the production namespace.

Answer

Enable vulnerability scanning in Artifact Registry and configure alerts when images with critical CVEs are pushed.

Answer

Use a VPC Service Controls perimeter around the GKE clusters to prevent images from outside the organization being pulled.

Question 17

A mid-sized company has migrated several projects to Google Cloud. The finance team is frustrated because they only discover budget overruns weeks later when the invoice arrives, and engineering teams have no visibility into their spending until it is too late to react. Leadership wants a process where teams are automatically notified as they approach their monthly spending thresholds, and wants the option to programmatically trigger automated responses (such as capping non-critical workloads) when a threshold is exceeded. Which approach best meets these business process requirements?

Accepted Answer

Configure Cloud Billing budgets with alert thresholds per project, sending notifications via email and publishing to a Pub/Sub topic that can trigger Cloud Functions for automated responses.

Answer

Export detailed billing data to BigQuery and have the finance team run a scheduled monthly query to review spending after each billing cycle closes.

Answer

Set organization policy constraints to hard-limit the number of resources each project can create, preventing any spending above the budget.

Answer

Enable Cloud Monitoring dashboards showing resource utilization and ask engineering leads to manually check them daily for signs of overspending.

Question 18

A large enterprise runs dozens of teams' workloads across several projects in a single Google Cloud organization. The finance department wants to hold each business unit accountable for its actual cloud spend and produce monthly internal invoices per team. Engineering leadership also wants dashboards showing cost trends by application and environment (prod, staging, dev). What is the most effective approach to enable accurate cost allocation and reporting across the organization?

Accepted Answer

Apply a consistent set of resource labels (e.g., team, application, environment) and cost allocation tags, export detailed Cloud Billing data to BigQuery, and build reports and dashboards grouped by those labels.

Answer

Create a separate billing account for every team and manually reconcile spend at the end of each month using exported PDF invoices.

Answer

Rely on the default Cloud Billing reports in the console and filter by project, assigning one project per resource so costs can be traced.

Answer

Enable budgets and budget alerts on each project so finance receives an email whenever a team exceeds its allocated threshold.

Question 19

A financial services company runs a Cloud Build CI/CD pipeline that deploys to production several times a day. An external auditor requires that every production deployment be traceable to a specific approved change request, and that the identity of the approver, the artifact version, and the timestamp be independently verifiable and retained for seven years. The engineering team wants to satisfy this requirement while keeping deployments fully automated where possible. Which approach best meets the audit and process requirements?

Accepted Answer

Introduce a manual approval gate in the release pipeline that records approver identity, then export Cloud Build and Cloud Audit Logs of each deployment to a retention-locked Cloud Storage bucket for the required period.

Answer

Require developers to email a manager before each deployment and keep the email threads in a shared inbox as the audit record.

Answer

Enable verbose logging in Cloud Build and rely on the 400-day default log retention in Cloud Logging to provide the deployment history.

Answer

Grant the auditor the Cloud Build Editor role so they can inspect build triggers and configurations whenever a review is needed.

Question 20

A retail company deploys its customer-facing web application to Google Kubernetes Engine several times per day. After a recent release caused a checkout outage that went undetected until customer complaints arrived, the release engineering team wants a deployment strategy that automatically exposes new versions to a small subset of live traffic, monitors error rates and latency against defined thresholds, and rolls back automatically if metrics degrade—without requiring a full duplicate production environment. Which approach best meets these requirements?

Accepted Answer

Use a canary deployment managed by Cloud Deploy with automated rollback triggered by Cloud Monitoring SLO-based alerting on error rate and latency.

Answer

Provision a full parallel blue-green environment and cut over 100% of traffic to the green environment after manual smoke testing.

Answer

Adopt a recreate deployment strategy that terminates all old pods before starting new ones to guarantee version consistency.

Answer

Deploy all changes directly to production during a nightly maintenance window and rely on daily database backups for recovery.

Question 21

A pharmaceutical company is designing a data platform for clinical trial results. Regulators require that all raw trial data be retained for 15 years and remain retrievable within a few hours if audited. Only the most recent 90 days of data is queried frequently by analysts; older data is accessed at most once or twice a year. The company wants to minimize total storage cost while satisfying the retention and retrievability requirements. Which storage design should the architect recommend?

Accepted Answer

Store recent data in Cloud Storage Standard, and use Object Lifecycle Management to transition objects to Nearline after 90 days and to Archive after one year, with a bucket retention policy of 15 years.

Answer

Store all data in Cloud Storage Standard class and rely on a 15-year retention policy to prevent deletion.

Answer

Load all trial data into BigQuery and use long-term storage pricing for partitions older than 90 days.

Answer

Store recent data in Cloud Storage Standard and move older data to Coldline immediately after 90 days, deleting objects manually after 15 years.

Question 22

A media streaming company serves premium video segments (thousands of small HLS chunk files per title) from a Cloud Storage bucket fronted by an external HTTP(S) load balancer with Cloud CDN enabled. Only authenticated, paying subscribers may access these files, and each subscriber's session grants access to many files under a common URL path prefix. The security team wants to avoid generating and managing a separate token for every individual file request. Which access-control mechanism should the architect configure?

Accepted Answer

Cloud CDN signed cookies, restricting access to a URL path prefix for the subscriber's session

Answer

Cloud Storage signed URLs generated per file for each chunk request

Answer

A VPC Service Controls perimeter around the Cloud Storage bucket

Answer

Uniform bucket-level IAM bindings granting each subscriber the Storage Object Viewer role

Question 23

A financial services company must generate and store the cryptographic signing keys used for their digital document-signing service. Regulatory auditors require that all key material be generated and stored in hardware validated to FIPS 140-2 Level 3, and the company wants to avoid managing physical hardware while still using Cloud KMS APIs. Which Google Cloud solution meets these requirements with the least operational overhead?

Accepted Answer

Use Cloud HSM to create hardware-backed keys, which are generated and stored in FIPS 140-2 Level 3 validated HSMs managed by Google.

Answer

Use Cloud KMS software-protected keys and enable automatic key rotation to satisfy the auditors.

Answer

Deploy your own HSM appliances on Compute Engine VMs and integrate them with Cloud KMS via a custom connector.

Answer

Use Cloud External Key Manager (EKM) to store keys with a third-party key management partner outside Google Cloud.

Question 24

A financial services company runs a production trading platform in Google Cloud and requires a private, high-throughput connection to its on-premises data center. The network team demands a connectivity architecture that qualifies for the 99.99% availability SLA from Google. They plan to use Dedicated Interconnect. Which configuration must the architect implement to meet the 99.99% SLA requirement?

Accepted Answer

Provision at least four Dedicated Interconnect connections across two metropolitan areas, with two connections in separate edge availability domains within each metro.

Answer

Provision four Dedicated Interconnect connections in a single metropolitan area (metro) attached to a single Cloud Router.

Answer

Provision two Dedicated Interconnect connections in a single edge availability domain, each terminating on separate Cloud Routers.

Answer

Provision a single 100 Gbps Dedicated Interconnect connection with a Partner Interconnect connection as a backup path.

Question 25

A retail company runs multiple microservices on GKE and Compute Engine. The analytics team wants to run ad hoc SQL queries across the last 18 months of application and audit logs to identify usage trends and correlate errors with business events. Logs are currently retained only in Cloud Logging's default buckets. The platform team needs a low-maintenance, cost-effective way to make this historical log data queryable at scale without impacting the running services. What should they recommend?

Accepted Answer

Create an aggregated log sink at the organization level that exports the relevant logs to a BigQuery dataset, and set an appropriate table partition expiration for 18-month retention.

Answer

Increase the retention period of the default Cloud Logging bucket to 18 months and have analysts use the Logs Explorer query interface for SQL-style analysis.

Answer

Export logs to Cloud Storage via a log sink and have analysts download and parse the JSON files with a custom script whenever they need to run analysis.

Answer

Install the Ops Agent on every VM and node to forward logs to a self-managed Elasticsearch cluster on Compute Engine for querying.

Question 26

A financial services company centralizes all application and audit logs in Cloud Logging. Their compliance team requires that audit logs be retained for 7 years and remain queryable within Cloud Logging, while high-volume debug logs from development workloads only need 14 days of retention to minimize cost. The platform team wants to manage these retention differences without exporting logs to external systems or writing custom deletion scripts. What should they do?

Accepted Answer

Route audit logs to a dedicated log bucket with a 7-year custom retention period, and route debug logs to a separate log bucket with a 14-day retention period using log sinks with inclusion filters.

Answer

Keep all logs in the _Default log bucket and set its retention to 7 years, then create a scheduled Cloud Function to delete debug log entries older than 14 days.

Answer

Export all logs to Cloud Storage buckets and apply Object Lifecycle Management rules to enforce the different retention windows for each log type.

Answer

Export audit logs to BigQuery with a 7-year table expiration and keep debug logs only in the _Required bucket, relying on its default retention.

Question 27

A payments team runs a critical API on GKE. They receive frequent false-positive pages: alerts fire whenever CPU briefly spikes, even though the service remains healthy and responsive. The team wants to only be paged when the service is genuinely degraded — specifically, when high request latency AND an elevated error rate occur together over a sustained window. What is the most appropriate way to configure this in Cloud Monitoring?

Accepted Answer

Create a single alerting policy with multiple conditions joined by a logical AND, using a rolling window (e.g., 5 minutes) on the latency and error-rate metrics so the policy triggers only when both conditions are simultaneously met.

Answer

Create two separate alerting policies — one for latency and one for error rate — each with its own notification channel, so both pages arrive together.

Answer

Create a single alerting policy with the latency and error-rate conditions joined by a logical OR so any signal of trouble triggers a page.

Answer

Lower the CPU alerting threshold and add a longer duration window so transient CPU spikes are filtered out before paging.

Question 28

Your SRE team manages a customer-facing payments API running on GKE. Leadership has approved a 99.9% availability SLO measured over a rolling 28-day window. The team wants an automated, low-noise way to be alerted while there is still enough error budget remaining to react, rather than only after the SLO is already breached. Which approach in Google Cloud Observability best meets this requirement?

Accepted Answer

Configure a Cloud Monitoring SLO with multi-window, multi-burn-rate alerting policies that fire on fast and slow error-budget consumption.

Answer

Create a single threshold alert that fires whenever the 28-day availability metric drops below 99.9%.

Answer

Set up an uptime check that pings the API every minute and pages the on-call engineer on any single failed probe.

Answer

Build a Cloud Monitoring dashboard showing request success rate and have engineers visually review it during business hours.

Question 29

A retail company runs dozens of microservices across several GKE clusters and Compute Engine instances, all managed by different teams under a single Google Cloud project. The SRE team wants a way to organize related resources so that dashboards, alerting policies, and health views can be scoped to specific applications (e.g., 'checkout', 'catalog') without manually listing every resource each time infrastructure is added or removed. New instances are created and destroyed frequently by autoscaling. What is the most operationally efficient approach in Cloud Monitoring?

Accepted Answer

Create Cloud Monitoring resource groups defined by dynamic membership criteria such as labels, tags, or naming patterns, then scope dashboards and alerts to those groups.

Answer

Manually add each resource to a static list in each dashboard and alerting policy, updating the list whenever autoscaling changes the fleet.

Answer

Export all metrics to BigQuery and build per-application views using scheduled queries that join on resource IDs.

Answer

Split each application into its own Google Cloud project so that monitoring is naturally scoped per project.

Question 30

A retail company runs several microservices on Cloud Run. During a recent outage, the SRE team spent hours manually correlating request logs by trace ID because they had to export logs to BigQuery first and wait for the scheduled sink to run. The team wants the ability to run ad hoc SQL-style queries directly against their existing Cloud Logging log buckets during incidents, without setting up an export pipeline or duplicating storage. Which approach best meets this requirement?

Accepted Answer

Upgrade the relevant log buckets to use Log Analytics, then query them using the SQL interface in the Log Analytics page or a linked BigQuery dataset.

Answer

Create a new aggregated log sink that continuously streams all logs to a dedicated BigQuery dataset for real-time querying.

Answer

Enable Cloud Trace sampling at 100% so all request logs are automatically indexed and searchable during incidents.

Answer

Increase the log bucket retention period to 400 days so historical logs remain queryable through the Logs Explorer search bar.

Question 31

A payment processing service runs on a Managed Instance Group behind an internal load balancer. Latency spikes occur when the queue of pending transactions grows, but CPU utilization stays low because the bottleneck is a downstream dependency, not compute. The operations team wants the MIG to scale based on the actual pending-transaction backlog rather than CPU. What should they implement to drive autoscaling on this business signal?

Accepted Answer

Publish the pending-transaction count as a custom metric to Cloud Monitoring and configure the MIG autoscaler to scale on that custom metric.

Answer

Increase the CPU target utilization threshold on the existing CPU-based autoscaling policy so instances scale sooner.

Answer

Configure an uptime check against the service and add instances manually whenever the check reports elevated latency.

Answer

Enable predictive autoscaling based on historical CPU patterns to add capacity before latency spikes occur.

Question 32

A financial analytics company runs hundreds of Compute Engine instances across multiple subnets in a Shared VPC. These instances have no external IP addresses but must make frequent outbound HTTPS calls to a third-party market-data provider's public API. During peak trading hours, engineers observe connection failures and log entries indicating dropped outbound connections, while off-peak traffic works fine. Investigation shows the instances are hitting a limit on simultaneous outbound connections to the same destination endpoint. What is the most appropriate action to resolve this?

Accepted Answer

Increase the minimum number of ports per VM (or enable dynamic port allocation) on the Cloud NAT gateway and add more external NAT IP addresses.

Answer

Assign external IP addresses to each instance so outbound connections bypass the NAT gateway entirely.

Answer

Replace Cloud NAT with a VPC peering connection to the third-party provider's network.

Answer

Enable Private Google Access on the subnets so the instances can reach the third-party API privately.

Question 33

A logistics company runs a globally distributed inventory system on Cloud Spanner. During regional promotional events, read and write throughput spikes unpredictably, and engineers currently adjust the instance's node count manually. This has led to over-provisioning during quiet periods and latency violations when they react too slowly to spikes. They want the database capacity to adjust to load automatically while keeping utilization within target thresholds. What should the architect recommend?

Accepted Answer

Enable the Cloud Spanner Autoscaler by configuring managed autoscaling with minimum and maximum processing units and a target utilization percentage.

Answer

Migrate the workload to Cloud SQL with read replicas and enable the built-in storage autoscaling feature.

Answer

Create a Cloud Scheduler job that increases node count every morning and decreases it every night regardless of live traffic.

Answer

Enable Spanner's point-in-time recovery and increase the default query timeout to absorb the latency spikes.

Question 34

A retail company runs a Compute Engine application tier in a custom-mode VPC. They are provisioning a new Cloud SQL for PostgreSQL instance and require that all traffic between the application VMs and the database stay on Google's internal network, with no public IP exposure on the database. The application VMs must connect using a private IP address. What must the architect configure to enable this connectivity?

Accepted Answer

Enable a private services access connection by allocating an internal IP range and creating a VPC peering with the Google-managed services producer network, then create the Cloud SQL instance with private IP only.

Answer

Deploy the Cloud SQL Auth Proxy on each VM and connect over the instance's public IP, relying on the proxy's TLS tunnel to keep traffic internal.

Answer

Create a Serverless VPC Access connector in the VPC and attach it to the Cloud SQL instance so VMs route database traffic through the connector.

Answer

Configure Cloud NAT in the VPC and disable the public IP on the Cloud SQL instance so outbound traffic is translated to a private path.

Question 35

A retail analytics company runs a reporting application backed by a single Cloud SQL for PostgreSQL instance in us-central1. The primary instance handles all transactional writes, but a growing team of analysts in Europe runs heavy read-only dashboards that are now causing CPU contention and slow queries on the primary. Leadership wants to reduce read load on the primary and improve dashboard response times for the European users, while keeping operational overhead low and avoiding application rewrites. What should the architect do?

Accepted Answer

Create a cross-region read replica in europe-west1 and direct the analysts' read-only dashboard queries to the replica's connection endpoint.

Answer

Enable high availability (regional) on the primary instance so the standby in another zone can serve the analysts' read queries.

Answer

Migrate the database to a single larger machine type with more vCPUs and memory to absorb the additional read traffic.

Answer

Export the database nightly to Cloud Storage and have the European analysts query the exported files with BigQuery external tables.

Question 36

A financial services company stores all encryption keys in a dedicated 'security-keys' project managed by the central security team. An application team's project runs Compute Engine VMs whose persistent disks must be encrypted with a customer-managed encryption key (CMEK) from a key ring in the security-keys project. When the application team tries to create a disk referencing the key, disk creation fails with a permission error. What is the correct way to resolve this while maintaining centralized key management?

Accepted Answer

Grant the Compute Engine service agent of the application project the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key or key ring in the security-keys project.

Answer

Copy the CMEK material from the security-keys project into the application project's own key ring so the service agent can access it locally.

Answer

Grant the application team's users the Cloud KMS Admin role on the security-keys project so they can manage the key during disk creation.

Answer

Disable CMEK for the disks and rely on Google-managed default encryption, then re-enable CMEK once IAM propagates.

Question 37

A financial services company stores customer records in Cloud Storage buckets encrypted with customer-managed encryption keys (CMEK) in Cloud KMS. To comply with a data protection regulation, when a customer requests deletion of their data, the company must guarantee that all copies—including any that may persist in backups or replicated storage—become permanently unrecoverable, and must be able to prove the data is cryptographically inaccessible. What is the most effective approach to meet this requirement?

Accepted Answer

Store each customer's data under a dedicated CMEK key and destroy that key version in Cloud KMS when the customer requests deletion (crypto-shredding).

Answer

Delete the customer's objects from the bucket and rely on Cloud Storage soft delete and object versioning to purge older copies after the retention window.

Answer

Rotate the single shared CMEK key used for all customers so the old key version is no longer primary, then delete the customer's objects.

Answer

Disable the CMEK key temporarily and set an object lifecycle rule to delete the customer's objects after 30 days.

Question 38

A multinational bank must store customer records in Cloud Storage and BigQuery. A new regulatory requirement mandates that the bank retain sole control of the encryption keys outside of Google Cloud, so that Google can never access key material even under a lawful access request. The security team also needs the ability to instantly and permanently revoke Google's ability to decrypt the data. Which encryption approach satisfies these requirements?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with keys held in an approved external key management partner controlled by the bank.

Answer

Use Google-managed default encryption and rely on Google's data residency guarantees for the region.

Answer

Use customer-managed encryption keys (CMEK) with keys stored in Cloud KMS in the same region as the data.

Answer

Use customer-supplied encryption keys (CSEK) uploaded to Cloud KMS and rotated automatically by Google.

Question 39

A financial services company stores highly sensitive customer records in Cloud Storage buckets encrypted with Cloud KMS customer-managed encryption keys (CMEK). Regulators require that any decryption of this data by cloud provider personnel or automated processes be explicitly justified and, in certain cases, blocked unless the organization approves the reason. The security team wants a mechanism where each request to use the key includes a reason code, and the organization can define policies that automatically deny key access for unapproved justification categories. Which capability should the architect implement?

Accepted Answer

Enable Key Access Justifications (KAJ) on the CMEK keys and configure a justification policy that denies unapproved reason codes.

Answer

Turn on Access Transparency logs and manually review each key-usage entry after the fact.

Answer

Rotate the CMEK keys more frequently and restrict IAM roles on the key ring to a small group.

Answer

Move the keys to Cloud HSM and enable audit logging on the key ring.

Question 40

A financial services company must comply with a regulation requiring that the team managing encryption keys be different from the team that operates the applications consuming those keys. Application workloads run on Compute Engine and store data in Cloud Storage encrypted with Cloud KMS. Security auditors require proof that developers cannot administer or destroy keys, while applications can still perform encrypt/decrypt operations. Which IAM design best satisfies these separation-of-duties requirements?

Accepted Answer

Grant the security team the Cloud KMS Admin role on the key ring and grant the application service accounts the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific keys.

Answer

Grant both the security team and the application service accounts the Cloud KMS Admin role, and rely on audit logs to detect misuse after the fact.

Answer

Grant developers the Owner role on the project so they can manage keys and applications together, and enable Cloud Audit Logs for key operations.

Answer

Grant the application service accounts the Cloud KMS Admin role and grant the security team the Cloud KMS CryptoKey Encrypter/Decrypter role for oversight.

Question 41

A financial services company has grown from 5 to 40 developers committing to a shared repository. Recently, several production incidents were traced to code merged directly to the main branch without review, and to merges that bypassed the automated test suite. The engineering leadership wants a repeatable technical process that enforces peer review and prevents untested code from reaching main, while minimizing custom tooling. What should the architect recommend?

Accepted Answer

Configure branch protection rules on the main branch requiring at least one approving pull request review and passing CI status checks before merges are permitted.

Answer

Add a nightly Cloud Scheduler job that scans the main branch for commits lacking review metadata and emails the offending developers a warning.

Answer

Grant only senior engineers write access to main and require all other developers to submit patches by email for manual application.

Answer

Move each developer to a separate repository and have a release manager manually cherry-pick approved commits into a central repository weekly.

Question 42

A financial services company runs a fleet of Compute Engine VMs supporting a customer-facing trading platform. Analysis of the last 18 months shows a stable baseline of 40 n2-standard-8 instances running 24/7, with occasional bursts to 65 instances during market volatility. The finance team wants to reduce Compute Engine spend without sacrificing the ability to scale during bursts, and they want the commitment strategy to survive changes in machine family if engineering later re-architects onto a different VM type. Which approach best optimizes cost while preserving flexibility?

Accepted Answer

Purchase spend-based (flexible) committed use discounts covering the baseline compute spend, and let burst capacity run on on-demand pricing.

Answer

Purchase resource-based committed use discounts (CUDs) for 40 n2-standard-8 instances for 3 years, and let burst capacity above the baseline run on on-demand pricing.

Answer

Run the entire fleet, including the baseline, on Spot VMs to maximize discount rates.

Answer

Purchase resource-based CUDs sized for the peak of 65 n2-standard-8 instances for 1 year to guarantee coverage of all usage.

Question 43

A European financial services company is building a new customer-facing platform on Google Cloud. Under GDPR and their national banking regulator's rules, all personally identifiable customer data must remain physically stored within the European Union, and the company must be able to demonstrate this to auditors. The application also requires low-latency access for users concentrated in Germany and France. As the cloud architect, which design approach best satisfies these business and compliance requirements while minimizing latency?

Accepted Answer

Deploy compute and use Cloud Storage in EU regions (e.g., europe-west3, europe-west9) with regional or dual-region resource locations, and enable Organization Policy constraints to restrict resource creation to approved EU regions.

Answer

Use a multi-region bucket set to the 'us' location for durability, and encrypt all PII with customer-managed encryption keys stored in an EU-based Cloud KMS key ring.

Answer

Deploy all resources in a single global load-balanced footprint and rely on Cloud CDN edge caching in Europe to keep data close to users.

Answer

Store PII in Firestore in Native mode using the default 'nam5' multi-region location and apply IAM conditions to limit access to EU-based employees only.

Question 44

A financial services company is migrating a customer-records application to Google Cloud. Their regulator requires that the company retain sole control over the encryption keys protecting customer data at rest, including the ability to revoke Google's access to decrypt the data at any time, while still using Google-managed storage services. The security team also wants to avoid operating and patching their own on-premises key infrastructure. Which encryption key management approach best satisfies these requirements?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS, and use IAM and key state controls to manage and revoke access.

Answer

Rely on Google's default encryption at rest, which automatically encrypts all data with Google-managed keys.

Answer

Store the encryption keys in a self-hosted HashiCorp Vault cluster running on Compute Engine VMs and reference them from storage services.

Answer

Use customer-supplied encryption keys (CSEK) generated and stored on the company's on-premises hardware security modules for all services.

Question 45

A media startup runs an internal-facing content approval portal that receives no traffic overnight and on weekends, then bursts to a few hundred concurrent editors during weekday business hours. The application is a stateless containerized web service with unpredictable request patterns. Leadership wants to minimize idle cost while ensuring the service scales rapidly during peaks, and the team wants to avoid managing node infrastructure. Which compute platform best meets these requirements?

Accepted Answer

Deploy the container to Cloud Run, which scales to zero when idle and automatically scales out with concurrent requests.

Answer

Deploy to a Compute Engine managed instance group with autoscaling based on CPU utilization and a minimum of two instances.

Answer

Deploy to a GKE Standard cluster with a cluster autoscaler and a fixed pool of always-on nodes.

Answer

Deploy to a single large Compute Engine VM sized for peak concurrency to guarantee capacity.

Question 46

A financial services company is designing a real-time fraud detection service on Google Cloud. The model is a deep neural network that requires GPU acceleration to meet a strict 50 ms p99 inference latency target. Traffic is highly variable: near-zero overnight and peaking at 30,000 requests per second during business hours. The architecture team must minimize cost while meeting the latency SLA and avoiding manual capacity management. Which compute design should the architect recommend?

Accepted Answer

Deploy the model to Vertex AI online prediction endpoints with GPU-backed nodes and configure autoscaling with a minimum and maximum node count tied to utilization.

Answer

Deploy the model on a fixed fleet of Compute Engine instances with attached GPUs, sized for peak traffic and left running 24/7 for predictable performance.

Answer

Run the model as a Cloud Run service without GPUs, relying on high concurrency and horizontal scaling to absorb peak load.

Answer

Batch incoming requests and process them on a Dataproc cluster with GPU workers scheduled to run during business hours.

Question 47

An automotive company collects sensor readings from a fleet of connected vehicles. Each vehicle emits several thousand timestamped metrics per second, and analysts need to run range queries over time windows (for example, all engine temperature readings for a vehicle over the past 30 days) with single-digit millisecond read latency at massive scale. The dataset grows to petabytes and writes are extremely high-throughput. Which Google Cloud storage service best meets these requirements?

Accepted Answer

Cloud Bigtable, using a row key that combines vehicle ID with a reversed or bucketed timestamp

Answer

Cloud SQL with read replicas and partitioned tables by timestamp

Answer

BigQuery with ingestion-time partitioned tables

Answer

Firestore in Native mode with composite indexes on vehicle ID and timestamp

Question 48

A software company is designing the CI/CD foundation for a greenfield migration to Google Cloud. Their build pipeline produces both Docker container images and language-specific packages (Maven and npm). Compliance requires that every artifact be scanned for known vulnerabilities before deployment and that deployments be blocked if an image contains a critical CVE. They want a single Google-managed service that stores all artifact types and integrates natively with vulnerability scanning and admission control. Which design should the architect recommend?

Accepted Answer

Store images and packages in Artifact Registry, enable Artifact Analysis (Container Scanning API), and enforce Binary Authorization policies in the deployment cluster.

Answer

Store images in Container Registry (gcr.io), keep Maven and npm packages in a self-managed Nexus VM, and run a nightly Cloud Function that scans images.

Answer

Store all artifacts in a Cloud Storage bucket with object versioning, and use a Cloud Build step that runs a third-party scanner before uploading.

Answer

Store images in Artifact Registry and use Cloud Armor security policies to block deployment of images that contain critical vulnerabilities.

Question 49

A software company runs about 60 non-production (development and QA) VM-based environments on Compute Engine. Developers work standard business hours (roughly 9 AM to 6 PM, Monday to Friday) in a single time zone, but the environments currently run 24/7, driving up costs. Management wants to significantly reduce spend on these environments without requiring developers to change how they access or provision the machines, and the environments must retain their disk state between sessions. Which approach best meets these requirements?

Accepted Answer

Use Cloud Scheduler with a Cloud Function (or an instance schedule) to automatically stop the instances outside business hours and start them before the workday begins.

Answer

Migrate all non-production workloads to Spot VMs to take advantage of the lowest available pricing.

Answer

Purchase three-year committed use discounts for the non-production instance families to lower the hourly rate.

Answer

Delete the environments at the end of each day and recreate them from Terraform each morning.

Question 50

A logistics company runs a nightly ETL job on a self-managed Hadoop cluster hosted on Compute Engine VMs. The cluster is only fully utilized for about 3 hours each night but runs 24/7, and the operations team spends significant time patching and tuning it. Leadership wants to cut both infrastructure spend and operational overhead while keeping the existing Spark and Hive jobs running with minimal code changes. Which approach best meets these business requirements?

Accepted Answer

Migrate the jobs to ephemeral Dataproc clusters that are created before each nightly job and deleted after completion, storing data in Cloud Storage.

Answer

Resize the existing Compute Engine cluster to smaller machine types and add a cron job to power the VMs off during idle hours.

Answer

Rewrite all Spark and Hive jobs as Dataflow pipelines running continuously on a managed streaming service.

Answer

Move the persistent Hadoop cluster to a committed use discount contract to lower the hourly compute rate.

Question 51

A rapidly growing SaaS company hires several new development teams each quarter. Currently, a central operations team manually creates GCP projects, configures networking, applies IAM bindings, and provisions baseline resources for each new team. This process takes days, produces inconsistent configurations, and is becoming a bottleneck. Leadership wants to standardize and accelerate team onboarding while ensuring every new environment complies with organizational security baselines. Which approach best improves this business process?

Accepted Answer

Create standardized, version-controlled infrastructure-as-code templates (e.g., Terraform blueprints) combined with a project factory pipeline that enforces org policies, networking, and IAM baselines automatically.

Answer

Give each new development team Owner role at the organization level so they can self-provision projects and resources without waiting on the operations team.

Answer

Document the manual steps in a detailed runbook and assign additional operations staff to reduce the provisioning backlog.

Answer

Export an existing project's configuration and have the operations team clone it manually for each new team.

Question 52

A financial services company runs its core banking application on Compute Engine in the us-central1 region. Regulators require the ability to recover from a full regional outage with a Recovery Time Objective (RTO) of 30 minutes and a Recovery Point Objective (RPO) of 5 minutes. The company wants to minimize ongoing costs while still meeting these targets. Which disaster recovery strategy should the architect design?

Accepted Answer

Implement a warm standby in us-east1 with a scaled-down set of instances kept running, combined with asynchronous database replication that meets the 5-minute RPO, scaling up on failover

Answer

Deploy a full active-active configuration with equal capacity in us-central1 and us-east1, load-balanced by a global HTTPS load balancer

Answer

Take daily snapshots of persistent disks and store them in a multi-region bucket, restoring instances in us-east1 only when an outage occurs

Answer

Use a cold standby with pre-built instance templates in us-east1 and rely on Cloud SQL automated backups restored on demand during a disaster

Question 53

A visual effects studio is building a rendering farm on Compute Engine consisting of 300 VMs that must simultaneously read and write to a shared POSIX-compliant file system. The workload requires sustained aggregate throughput of several GB/s and low-latency access to a 50 TB working set. The team wants a fully managed service and prefers not to operate their own file server cluster. Which storage option best meets these requirements?

Accepted Answer

Create a Cloud Filestore instance using the High Scale or Enterprise tier and mount it via NFS on all rendering VMs

Answer

Store the working set in a Cloud Storage bucket and access it from each VM using gcsfuse

Answer

Attach a single 50 TB regional persistent disk to a controller VM and export it over NFS to the rendering VMs

Answer

Provision a Cloud Filestore Basic HDD instance and mount it via NFS on all rendering VMs

Question 54

A subscription media company wants to predict customer churn using two years of historical account data stored in BigQuery. The data science team is small and lacks deep expertise in building and tuning custom neural network architectures, but they need an accurate classification model deployed as an online prediction endpoint within a few weeks. They want to minimize the amount of custom modeling code they write while still leveraging their structured tabular data. Which approach on the Gemini Enterprise Agent / Vertex AI platform best meets these requirements?

Accepted Answer

Use Vertex AI AutoML for tabular data to train a classification model directly from the BigQuery dataset, then deploy it to a Vertex AI online prediction endpoint.

Answer

Write a custom TensorFlow model, containerize it, and run distributed training on Vertex AI custom training jobs before deploying to an endpoint.

Answer

Call the prebuilt Natural Language API to score each customer record and aggregate the sentiment results to infer churn likelihood.

Answer

Export the BigQuery data to Cloud Storage and use the Vision API to classify customer behavior patterns into churn categories.

Question 55

A legal services company wants to build an internal application where staff upload contract PDFs and receive concise summaries plus answers to natural-language questions about each document. The team has no ML engineers and wants to minimize custom model development and infrastructure management while grounding responses in the uploaded documents. Which approach best meets these requirements?

Accepted Answer

Use the Gemini Enterprise Agent Platform with a grounded generative agent connected to the uploaded documents as a data store, exposing summarization and Q&A through the platform's managed APIs.

Answer

Train a custom transformer model on Vertex AI using the company's historical contracts, then deploy it to a GPU-backed endpoint for inference.

Answer

Store the PDFs in Cloud Storage and run a nightly Dataproc Spark job that extracts text and applies open-source summarization libraries.

Answer

Use the Cloud Vision API to extract text from the PDFs and store the raw extracted text in BigQuery for staff to query with SQL.

Professional Cloud Architect (PCA) full-length practice exam

How this timed PCA mock exam works

What your PCA results show

How to get the most out of it

Ready for the full PCA mock exam?