Google PCA Design and plan a cloud solution architecture Practice Test 7 — 15 Questions

Question 1

A company is designing a hybrid cloud architecture where on-premises applications need to access data stored in a Cloud Storage bucket. The company requires that traffic between on-premises and Google Cloud does not traverse the public internet and must be encrypted. They also need dedicated bandwidth. Which Google Cloud service should the solutions architect use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Interconnect with Dedicated Interconnect.. Dedicated Interconnect offers a private, dedicated connection between on-premises and Google Cloud, avoiding the public internet and providing consistent bandwidth. It supports encryption through MACsec or higher-layer protocols. This satisfies the requirements for private, encrypted, and dedicated connectivity for accessing Cloud Storage data.

Answer

VPC Network Peering between on-premises and Google Cloud.

Answer

Cloud CDN with private origin access.

Answer

Cloud VPN with HA VPN.

Question 2

A retail company operates a global e-commerce platform on Google Cloud. Their architects need to choose a load balancing solution that terminates TLS at the edge, provides a single global anycast IP address, and automatically routes users to the closest healthy backend. Which Google Cloud load balancing product should they select?

Accepted Answer

Global external Application Load Balancer (HTTP(S)). The global external Application Load Balancer is built for internet-facing global services: it provides a single anycast IP, terminates TLS at Google's edge, and uses Google's global network to send each user to the nearest healthy backend. A regional load balancer cannot give one global IP, and layer 4 passthrough options do not terminate TLS or perform HTTP-aware global routing.

Answer

Internal Application Load Balancer (HTTP(S))

Answer

Regional external Application Load Balancer (HTTP(S))

Answer

External passthrough Network Load Balancer

Question 3

A financial services firm must design a data residency solution. Regulators require that customer personal data never leaves the country of origin, but the firm wants to use a single centralized analytics project for aggregated, non-personal reporting. Which Google Cloud architecture best satisfies both requirements?

Accepted Answer

Store personal data in regional Cloud Storage buckets and BigQuery datasets located only in the required country, and use VPC Service Controls perimeters to prevent data egress, while aggregating anonymized metrics into the central analytics project.. Data residency is about where bytes are physically stored and replicated, so the architecture must pin personal data to regionally scoped datasets and buckets in the required country and use VPC Service Controls to stop egress. Encryption keys and network topology do not constrain physical location. Only anonymized aggregates may cross into the central analytics project.

Answer

Deploy a Shared VPC host project spanning multiple regions and use firewall rules to restrict which regions instances can reach, keeping all data logically within one network.

Answer

Store all data in a multi-region Cloud Storage bucket and rely on customer-managed encryption keys to satisfy residency, aggregating data in the central project.

Answer

Use a global BigQuery dataset with column-level security and authorized views, then copy personal data into the central analytics project for processing.

Question 4

A startup is deploying a new web application on Google Cloud. They want to minimize infrastructure management and focus on writing code. The application consists of a frontend and a backend API, and they expect variable traffic. They also want to pay only for what they use. Which Google Cloud service should the solutions architect recommend for deploying the application?

Accepted Answer

Cloud Run.. Cloud Run is a serverless compute platform that runs stateless containers, scales automatically with traffic, and charges only for resources consumed during request processing. It eliminates infrastructure management, letting the startup focus on code. Its ability to scale to zero and handle variable traffic makes it ideal for a frontend and backend API with unpredictable load.

Answer

Google Kubernetes Engine (GKE) with Autopilot.

Answer

App Engine standard environment.

Answer

Compute Engine with managed instance groups.

Question 5

An online retailer is deploying a new order-processing system on Google Cloud. The system consists of a regional managed instance group (MIG) of Compute Engine VMs that read from and write to a Cloud SQL for MySQL instance. The database must tolerate the loss of an entire zone within the region with minimal downtime and no manual failover steps, while keeping costs predictable. Which Cloud SQL configuration should the architect recommend?

Accepted Answer

A Cloud SQL instance configured with high availability (regional) and a standby instance in a second zone.. Zone-level resilience for Cloud SQL comes from high availability mode, which maintains a standby in a separate zone and performs automatic failover without operator intervention. Read replicas address regional disasters and require manual promotion, while zonal deployments and vertical scaling leave the database exposed to a single-zone failure. The regional HA configuration matches the availability and operational requirements at a predictable cost.

Answer

A Cloud SQL read replica in a second region that the application promotes to primary during an outage.

Answer

A zonal Cloud SQL instance with automated backups and binary logging enabled, restored manually during an outage.

Answer

A Cloud SQL instance with a larger machine type and increased storage to improve throughput and resilience.

Question 6

A healthcare company needs to run a stateful, containerized electronic medical records application that requires a stable network identity and persistent disk storage per replica. The operations team is already fluent with Kubernetes. Which Google Cloud service should they choose?

Accepted Answer

Google Kubernetes Engine with a StatefulSet. Stateful containerized workloads requiring stable identity and persistent storage per replica map directly to Kubernetes StatefulSets, and the team's existing Kubernetes skills make GKE the natural fit. Serverless container and function platforms abstract away the instance, so they cannot provide per-replica persistent disks or stable network identities.

Answer

Cloud Functions

Answer

App Engine flexible environment

Answer

Cloud Run

Question 7

A financial services firm is designing a new analytics platform on Google Cloud. Regulatory requirements mandate that data must never be replicated or processed outside the European Union, and the company wants to prevent accidental resource creation in non-EU regions regardless of which engineer is deploying. Which mechanism should the architect use to enforce this constraint?

Accepted Answer

Organization Policy constraints that restrict resource locations to approved EU regions.. Organization Policy constraints enforce location restrictions centrally and deny non-compliant resource creation before it happens, independent of user permissions. IAM governs identity, VPC Service Controls govern API access and exfiltration, and Asset Inventory provides detection after the fact. Only the organization policy provides the preventive, organization-wide geographic guarantee the regulation demands.

Answer

IAM roles that grant project creators permissions only in EU projects.

Answer

VPC Service Controls perimeters around each project to block data exfiltration.

Answer

Cloud Asset Inventory alerts that notify security teams when non-EU resources appear.

Question 8

A financial services company runs a regulated trading platform in a single Google Cloud region. Regulators require that the platform survive the loss of an entire region with a recovery point objective of zero and a recovery time objective of under one minute. The database is Cloud Spanner, and the application tier runs on Google Kubernetes Engine. Which design should the architect choose?

Accepted Answer

Deploy Cloud Spanner as a multi-region instance and run GKE regional clusters in two regions behind a global external Application Load Balancer. Zero recovery point objective demands synchronous cross-region replication, which only a multi-region Cloud Spanner instance provides. Sub-minute recovery demands application compute already running in a second region with automated traffic failover. Combining a multi-region Spanner instance with regional GKE clusters in two regions behind a global external Application Load Balancer satisfies both constraints simultaneously.

Answer

Deploy Cloud Spanner as a regional instance and take scheduled backups exported to a Cloud Storage bucket in another region

Answer

Deploy Cloud Spanner as a multi-region instance and run a single GKE zonal cluster with node pools spread across three zones in the primary region

Answer

Deploy Cloud Spanner as a regional instance with read replicas in a second region and use change streams to replay writes into the second region after failover

Question 9

A retail company runs a Java-based order service on Compute Engine. The service currently reads its database credentials from a plaintext file on the boot disk. A security review requires that the credentials be removed from disk, be automatically rotated every 30 days, and be retrievable by the application through a single API call. You want the least operational overhead. What should you do?

Accepted Answer

Store the credential as a version in Secret Manager, grant the VM's service account roles/secretmanager.secretAccessor on that secret, and configure a rotation schedule that publishes to a Pub/Sub topic.. The requirements point to a managed secret store with per-secret IAM and built-in rotation. Secret Manager keeps the credential off disk, lets the application retrieve it with one API call, and supports a rotation schedule that notifies a Pub/Sub topic so an automated workflow can update the underlying database password. Object storage, metadata, and KMS-wrapped files all leave the credential materialized on the instance or require custom rotation logic.

Answer

Encrypt the credentials file with a Cloud KMS key, keep it on the boot disk, and grant the VM's service account roles/cloudkms.cryptoKeyDecrypter so the application can decrypt it at startup.

Answer

Store the credentials in a Cloud Storage bucket with uniform bucket-level access and grant the VM's service account roles/storage.objectViewer, then have the application download the file at startup.

Answer

Store the credential in a custom metadata key on the instance and grant the VM's service account the compute.instanceAdmin.v1 role so it can read its own metadata.

Question 10

A multinational enterprise is designing its Google Cloud resource hierarchy. They want to enforce centrally managed policies, delegate administration to regional business units, and isolate billing. Which two design choices should the architects make? (Choose two.)

Accepted Answer

Create folders per business unit under the organization node and apply organization policies at the appropriate folder level.. Folders under the organization node enable policy inheritance and delegated administration, letting central teams set guardrails while business units own their projects. Separate Cloud Billing accounts per business unit isolate costs and budgets. Labels, over-broad organization roles, and networking alone do not deliver the required policy control and billing separation.

Answer

Create a single project for all business units and use labels to separate their resources.

Answer

Use a single Shared VPC in the organization host project for all business units without folders.

Answer

Grant every business unit administrator the Organization Administrator role so they can manage their own projects.

Question 11

A healthcare company is designing a new patient-records API on Google Cloud. The API must serve read-heavy traffic globally with low latency, tolerate the failure of an entire region, and keep operational overhead low. The data is stored in Cloud Spanner. Which design should the architect recommend?

Accepted Answer

Deploy a multi-region Cloud Spanner instance and run the API on a global external Application Load Balancer with serverless NEGs pointing to Cloud Run services in multiple regions.. Global external Application Load Balancers route HTTP traffic to the nearest healthy backend across regions and support serverless NEGs for Cloud Run, while multi-region Cloud Spanner provides strongly consistent, automatically replicated data with regional failover. Together they meet the global latency, regional resilience, and low-overhead goals. Regional load balancers, proxy network load balancers, and DNS-based routing each fall short on at least one requirement.

Answer

Deploy a regional Cloud Spanner instance and run the API on Compute Engine managed instance groups in two zones behind a regional external Application Load Balancer.

Answer

Deploy a multi-region Cloud Spanner instance and use Cloud DNS with a geoproximity routing policy that resolves clients to a regional external Application Load Balancer in the closest region.

Answer

Deploy a multi-region Cloud Spanner instance and run the API on Compute Engine VMs in two regions, using a global external proxy Network Load Balancer with a single global backend service.

Question 12

A healthcare analytics company ingests continuous streams of device telemetry that must be processed in near real time, enriched with reference data from a Cloud SQL for MySQL instance, and written into BigQuery for analyst queries. The team wants minimal operational overhead and wants to use managed Google Cloud services. Which combination should the architect select?

Accepted Answer

Pub/Sub for ingestion, Dataflow for stream processing and enrichment, BigQuery for storage and analytics. The pipeline needs durable stream ingestion, managed stream processing with enrichment, and a warehouse for analyst SQL. Pub/Sub absorbs bursts and decouples producers, Dataflow handles autoscaling stream transforms and joins, and BigQuery stores and queries the results. Alternatives either require cluster management, cannot run analytics at scale, or use services not intended for continuous streaming.

Answer

Cloud Tasks for ingestion, Cloud Functions for processing, Cloud SQL for storage and analytics

Answer

Pub/Sub for ingestion, Dataproc with Spark Streaming for processing, Cloud Storage for storage and analytics

Answer

Pub/Sub for ingestion, Dataflow for stream processing, Bigtable for storage and analytics

Question 13

A financial services firm is designing the network for a new payment processing platform on Google Cloud. Regulatory rules require that no workload can reach the public internet, that all egress to an on-premises fraud-detection system stay off the public internet, and that Google APIs such as Cloud Storage and BigQuery remain reachable without exposing the workloads. The platform runs on Compute Engine VMs in a single VPC. Which two design elements must the architect include? (Choose two.)

Accepted Answer

Create the subnet with the --enable-private-ip-google-access option so the VMs can reach Google APIs and services without external IP addresses.. Two independent constraints must be satisfied: Google APIs stay reachable while workloads have no public addresses, and on-premises traffic stays off the internet. Private Google Access on the subnet handles the first by routing API traffic internally, and a Cloud VPN or Interconnect link with Cloud Router BGP handles the second by providing private connectivity to the fraud-detection system. Cloud NAT, external IPs, and proxy VMs all push traffic onto the public internet.

Answer

Configure a Cloud NAT gateway with a manual IP address allocation on the VPC so the VMs can reach the fraud-detection system.

Answer

Deploy a Squid proxy on a VM with an external IP and route all VPC egress through it using a custom route with the proxy as the next hop.

Answer

Assign ephemeral external IP addresses to the VMs and protect them with a firewall rule that allows only the fraud-detection system's source range.

Question 14

A logistics company is planning to migrate a batch ETL pipeline from on-premises Hadoop to Google Cloud. The pipeline processes several terabytes nightly, and the team wants to minimize infrastructure management while keeping the ability to tune the cluster for cost and performance. The data currently resides in an on-premises HDFS cluster. Which combination of services should the architect recommend?

Accepted Answer

Cloud Storage for durable object storage and Dataproc clusters created per job for processing.. Separating storage from compute with Cloud Storage and using ephemeral Dataproc clusters lets the team process nightly data without paying for idle infrastructure, while still selecting machine types and cluster sizes per job. Persistent clusters, self-managed Hadoop, and a full BigQuery rewrite each fail at least one requirement around management overhead or preserving existing Spark logic.

Answer

BigQuery for storage and analysis, replacing the Spark jobs entirely with SQL.

Answer

Persistent Dataproc clusters with local HDFS storage that run continuously and process jobs on a schedule.

Answer

Compute Engine VMs running a self-managed Hadoop distribution with Cloud Storage FUSE for input and output.

Question 15

A logistics company runs a latency-sensitive order-tracking service on Compute Engine instances spread across three zones in one region. They need the architecture to survive the loss of an entire zone while keeping inter-instance latency low, and they want automatic failover without manual intervention. Which design should the architects implement?

Accepted Answer

Deploy a managed instance group with regional distribution across the three zones, front it with a regional external Application Load Balancer, and configure health checks with autoscaling.. Spreading a regional managed instance group across three zones means a zone outage only removes a fraction of capacity, and health-checked load balancing automatically diverts traffic from failed instances and restores it on recovery. This delivers unattended, in-region failover with low latency, unlike single-zone groups, unmanaged instances, or global routing that can add distance.

Answer

Deploy a managed instance group in each of the three zones separately, and place a global external Application Load Balancer in front of all three groups.

Answer

Deploy standalone Compute Engine instances in each of the three zones with static external IPs and use DNS round-robin to distribute client traffic.

Answer

Deploy a managed instance group in a single zone, front it with a global external Application Load Balancer, and rely on the load balancer to fail over across regions.