CCNA Fundamental Cloud Concepts Questions

Vertex AI Training is a fully managed service designed specifically for custom ML training, handling infrastructure provisioning, job scheduling, and scaling automatically. It supports hardware accelerators like GPUs and TPUs, and provides pre-built containers for TensorFlow, PyTorch, and scikit-learn. This lets the data scientist focus on model code rather than cluster management, making it the correct choice.

A managed instance group (MIG) is a Google Compute Engine resource that manages a collection of VM instances created from an instance template. It supports autoscaling to add or remove instances based on load, but more importantly it supports autohealing: when you configure a health check, the MIG continuously monitors each instance and automatically deletes and recreates any instance that fails that health check. This makes the MIG the correct enabling service because it provides the instance-management layer that can actually replace unhealthy VMs, keeping the e-commerce site resilient without manual intervention.

SaaS (Software-as-a-Service) is a software distribution model where applications are hosted and managed by a vendor, delivered over the internet, typically with a subscription fee, and require no local installation or infrastructure management. Google Workspace epitomizes SaaS: Google provides Gmail, Google Docs, Drive, and Meet as consistent, always-current services with high availability, data redundancy, and centralized admin controls, while subscribers use them directly. The user is not responsible for servers, operating systems, or application upkeep—exactly the SaaS value proposition.

Cloud Run is a fully managed serverless container platform that automatically scales instances from zero, handles load balancing and security, and requires no cluster or node management. Developers can deploy any stateless container and pay only for the CPU and memory used during requests, making it the best fit for a fully managed deployment without infrastructure operations.

Cloud Load Balancing uses a single anycast IPv4/IPv6 address to route traffic via Google's global network to the closest region with available backend capacity, enabling global load distribution. Cloud CDN then caches static and dynamic content at over 100 edge locations worldwide, drastically reducing latency and offloading requests from the origin. The global external HTTP(S) load balancer automatically handles failover across regions, scales to millions of QPS, and integrates with CDN for cacheable content — making this the correct choice for a global web app.

IaaS provides virtualized compute resources (e.g., Compute Engine) where the customer selects the OS image, manages OS patches, and has full administrative control, including kernel tuning. This allows the legacy application to run with its required OS version and dependencies. Google only manages the physical hardware and hypervisor, not the guest OS. Thus IaaS is the right choice.

The Viewer role at the project level is a predefined IAM role that grants read-only access to all resources and configurations within that project, including metadata, permissions, and runtime states, while preventing any modification or deletion. This makes it the ideal choice for a third-party auditor because it provides comprehensive visibility with zero write capability, adhering to the principle of least privilege. It is the correct answer because it fully satisfies the review requirement without exposing any administrative control.

Resource pooling is one of the five essential characteristics in NIST SP 800-145. It means the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where physical and virtual resources are dynamically assigned and reassigned according to consumer demand. A critical aspect is location independence: consumers generally have no control or knowledge over the exact resource location, but they may be able to specify at a higher level of abstraction, such as country, state, or datacenter. This pooling enables economies of scale and is foundational to cloud's flexibility.

Cloud Run is a fully managed serverless platform that executes stateless containers and automatically scales from zero to handle each incoming request. For a legacy monolith, you can package it as a container and deploy without managing servers, with built-in request-driven autoscaling and pay-per-use billing. It supports any language and integrates with Cloud SQL for your persistent data, making it the lowest-operational-overhead option for a migrate-to-containers strategy.

Creating a Cloud Spanner clone from the production instance uses storage-level snapshot technology to produce an independent copy of the database in a separate instance, allowing tests to run against near-current data without consuming production resources. This is the recommended approach for development and integration testing because it takes only minutes even for large databases, and the clone is fully isolated with its own compute and storage allocation.

Standard on-demand VMs provide guaranteed availability for as long as you need them, with no upfront commitment or termination risk. You can select an instance size matching your transformation's requirements, run the job, and then delete the VM immediately afterward, paying only for the precise compute time consumed. This approach offers direct control over the environment, simplifies debugging, and is cost-effective for a one-time workload because there are no hidden service fees or prolonged obligations. For a job that must complete reliably once, a standard VM that is deleted after use is the most straightforward and dependable choice.

Cloud Storage buckets serve immutable static assets (HTML, CSS, images) with native HTTP(S) support, and Cloud CDN caches those objects at Google's edge points of presence, minimizing latency and origin load for global users. Dynamic or personalized content—shopping carts, product recommendations, checkout logic—is handled by managed Compute Engine instance groups deployed across regions, fronted by HTTP(S) Load Balancing, which provides a global anycast IP, health checking, and autoscaling. This separation lets each layer scale independently: static delivery is cheap and cacheable, while dynamic backends only process uncached requests.

Preemptible VMs are Compute Engine instances that are computationally identical to standard VMs but are offered at a significantly lower price (typically up to 60-80% cheaper) because Google can terminate them at any time should it need the capacity for other workloads. They are ideal for batch processing jobs that can be restarted or that use checkpointing, because a termination simply means the job can be resumed from the last saved state. For a nightly data processing job that is inherently fault-tolerant and can tolerate occasional interruptions, preemptible VMs provide the most cost-effective solution without sacrificing correctness if designed with retry logic.

On-demand self-service is the essential characteristic where a consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with the service provider. This capability is the key differentiator because it directly enables the agility, elasticity, and perception of unlimited resources that organizations expect from cloud computing. It shifts control to the consumer, making it the defining trait in NIST's cloud model.

HIPAA is a U.S. federal law, not merely a standard, that directly governs the use, disclosure, and storage of protected health information (PHI) by covered entities (e.g., healthcare providers, health plans, clearinghouses) and their business associates. It mandates administrative, physical, and technical safeguards, privacy rule requirements, breach notification protocols, and the use of business associate agreements, making it the definitive regulatory framework for confidential healthcare data in the United States. Choosing HIPAA ensures the storage solution aligns with legal obligations for PHI.

Cloud Service Mesh (Anthos Service Mesh) is the recommended service mesh for GKE, built on Istio and offered as a fully managed service with a Google-managed control plane. It provides end-to-end mTLS, fine-grained traffic management, policy enforcement, and telemetry via Cloud Monitoring and Logging. This makes it the ideal choice for microservices communication, as it directly addresses service-to-service security, reliability, and observability within the cluster without requiring you to manage the control plane infrastructure.

Cloud CDN uses Google's globally distributed edge points of presence to cache static and dynamic content close to users. It intercepts HTTP(S) requests via the load balancing infrastructure and serves cached responses when possible, which reduces latency and cuts compute engine instance load. For a global e-commerce platform, caching product catalogs and media dramatically accelerates page rendering and improves customer experience.

In the shared responsibility model, Google Cloud operates and secures the physical infrastructure layer, including data centers, servers, storage, networking hardware, and the hypervisor. The customer retains responsibility for what they control: their data, identity and access management (IAM) policies, and configuration of services such as encryption, firewalls, and OS-level hardening. This split ensures that each party focuses on the components it is best positioned to protect.

The Global external HTTP(S) load balancer is correct because it provides a single global anycast IP address, leveraging Google's global network and advanced routing to direct each request to the closest region with available capacity. It supports HTTP(S) traffic, can be integrated with Cloud CDN, and routes to backend services across multiple regions, making it ideal for a global application requiring low latency and one entry point.

Running the application in multiple GCP regions, such as europe-west1 and europe-west4, places compute capacity near EU users, cutting round-trip time. It also enables active-active or active-passive failover, so if one region fails traffic can be served from another, improving availability.

Cloud Run runs stateless containers on a fully managed serverless platform, automatically scaling from zero based on incoming requests and charging only for CPU and memory used during request processing. Since you simply provide a container image that implements an HTTP server, a containerized web app can be deployed with zero infrastructure provisioning, making it the lowest-friction, pay-per-use option for a startup.

9 minutes (540 seconds) is the correct maximum timeout for 1st gen Cloud Functions. This is a platform-enforced hard limit; you can configure the timeout field to any value between 1 and 540 seconds, but values above that are not accepted.

Autoscaling automatically adjusts the number of VM instances in a managed instance group based on demand metrics such as CPU utilization, requests per second, or queue depth. When traffic spikes, autoscaling proactively or reactively provisions additional instances to maintain performance, then scales down during lulls to control cost. This makes it the correct mechanism for handling unpredictable e-commerce traffic spikes.

The defining characteristic of PaaS is that the vendor owns and operates the entire stack below your application code, including the operating system, runtime interpreter, and middleware libraries. You are responsible only for uploading and deploying your application, while the provider handles patching, security, and infrastructure scaling. This abstraction eliminates the operational burden of OS administration, which is why this is considered a key benefit.

Dataproc is Google Cloud's managed service for running Apache Spark and Hadoop clusters, providing native Spark support with custom cluster configurations, autoscaling, and integration with cloud storage. Dataproc Serverless further allows teams to run Spark jobs without provisioning or managing any cluster infrastructure at all. This makes Dataproc the straightforward choice for a team already using Spark.

Multi-region deployment ensures availability if one region fails.

Measured service is the cloud attribute whereby the provider continuously meters, monitors, and controls resource usage (compute, storage, networking) to provide transparent, pay-per-use billing. This metering enables cost optimization by allowing customers to align spending with actual consumption, and it is a core NIST essential characteristic that distinguishes cloud from traditional IT.

Customers retain responsibility for encrypting their data both at rest and in transit, as well as for defining and enforcing access control through IAM policies. This includes managing encryption keys (via Cloud KMS or customer-supplied keys), configuring identity and role-based access, and applying organizational policies. Since these are direct customer actions within the cloud console and APIs, this is the correct choice.

BigQuery is a serverless data warehouse with automatic scaling and pay-per-query pricing.

Patching the hypervisor is a Google responsibility because the hypervisor is a core component of the infrastructure that hosts all customer virtual machines and is fully managed by Google. Google performs security patches and updates to the hypervisor without customer involvement, ensuring that vulnerabilities in the virtualization layer are addressed. This is a clear example of where the cloud provider, not the customer, maintains the security of the foundational compute environment.

Cloud CDN caches content at edge locations for low-latency delivery.

Dataproc is the managed Spark service.

A regional managed instance group (MIG) automatically distributes your frontend VM instances across multiple zones within a region, providing zone-level fault tolerance for the stateless web tier. It integrates with regional external load balancing to route traffic away from failed instances and can autoscale based on load. If an entire zone goes down, the MIG continues serving requests from healthy instances in other zones, ensuring high availability without manual intervention.

europe-west1 is located in St. Ghislain, Belgium, placing it in close geographic proximity to major European population centers such as London, Paris, and Frankfurt. This region benefits from Google's low-latency European backbone and multiple availability zones, enabling round-trip times in the tens of milliseconds for users across Western Europe. Deploying workloads here minimizes network hops and intercontinental cable crossings, directly addressing the goal of reducing latency for users in Europe.

A custom role with storage.buckets.* permissions is the correct choice because it allows you to define a precise set of bucket-level operations—such as storage.buckets.create, storage.buckets.get, storage.buckets.update, and storage.buckets.delete—while explicitly excluding all object-related permissions (e.g., storage.objects.*). This granularity enforces least privilege by ensuring the developer can manage the bucket lifecycle but cannot view, upload, or delete any objects stored within those buckets. Unlike predefined roles that couple bucket and object access, this custom role minimizes the attack surface and aligns with security best practices for infrastructure management.

Read replicas are asynchronous copies of the primary instance that support only read-only traffic. By routing SELECT queries to read replicas, you reduce the read load on the primary and increase overall scalability. This is the correct approach for offloading reads, though applications must be configured to use the replica endpoints, and data may experience a slight replication lag.

Cloud Key Management Service (Cloud KMS) is the core service for customer-managed encryption keys (CMEK), allowing you to create, import, rotate, disable, and destroy keys that control the encryption of data in Google Cloud services like Cloud Storage, Compute Engine, and BigQuery. When you use CMEK, each service requests the key from Cloud KMS to perform envelope encryption, and Cloud KMS enforces IAM-based permissions and audit logging on every key operation. This gives customers the ability to manage the full key lifecycle, making Cloud KMS the correct choice for the stated requirement.

Cloud Run runs stateless containers in a fully managed, serverless environment, automatically scaling instances from zero to thousands based on incoming request traffic. It abstracts away infrastructure, patching, and capacity planning, letting you deploy a containerized monolith with just an image and a port. Per-request billing and scale-to-zero capability make it a cost-effective choice for intermittent or variable workloads that still need to run a complete application.

Cloud Run is a fully managed serverless compute platform that executes stateless HTTP-driven containers, automatically scaling to zero when idle and scaling up instantly to handle incoming requests. It supports any container image that listens on a port, making it an ideal fit for deploying a containerized microservice without managing infrastructure, and you pay only while the container is processing requests.

Preemptible VMs cost up to 70-80% less than standard VMs and are killed by Google Compute Engine within 24 hours, making them ideal for fault-tolerant batch tasks. By splitting the pipeline into CPU-based preprocessing and GPU-based alignment on separate preemptible VM groups, you avoid mixing resource types and can automatically restart interrupted tasks from checkpointed state. This minimizes compute spend while still completing the analysis, and is the most cost-effective approach for a finite workload.

Rehosting on Compute Engine with a custom image of the current OS is a classic 'lift-and-shift' strategy that preserves the exact kernel, libraries, and configuration of the legacy environment. Because no code changes or architectural changes are required, this approach minimizes migration risk and time-to-completion, allowing the team to move the application as-is. The custom image ensures parity with the on-premises OS, avoiding issues with unsupported or altered system dependencies.

A regional managed instance group automatically distributes instances across zones within europe-west1, protecting against a single-zone failure and enabling managed instance group health checking and autohealing. The external HTTP(S) load balancer uses Google's global anycast IP to terminate the user's connection at the closest Google edge PoP, then forwards the request over Google's backbone to a healthy backend in europe-west1. This combination minimizes user latency for European traffic while maintaining the existing single global endpoint for DNS.

Retention policy (Bucket Lock) makes objects immutable for the specified duration, satisfying compliance.

The Carbon Footprint dashboard in the Google Cloud Console is the correct tool. It provides a per-project and per-service breakdown of gross carbon emissions (in metric tons of CO2e) associated with your GCP resource usage. The dashboard uses Google's region-specific carbon intensity data and includes monthly trends, making it the primary interface for customers to measure their gross operational carbon footprint.

A single-region configuration stores all data and all replicas within the chosen region, using zonal redundancy to protect against zone failures while keeping every copy inside the required geographic boundary. This satisfies data residency mandates because no data is replicated outside the specified region. It is the correct choice when the compliance requirement prohibits storing data in any other region.

App Engine is a fully managed Platform-as-a-Service (PaaS) that abstracts away the underlying infrastructure and runtime. Developers simply upload their source code, and App Engine handles provisioning, load balancing, autoscaling, and health checks. It supports standard environments such as Python, Java, Node.js, Go, and PHP, making it the lowest-effort option for migrating an existing web application without requiring containerization or cluster management.

Customers must implement Cloud IAM policies to enforce least privilege and restrict access to healthcare data to authorized users and services. This involves creating custom roles, binding roles to principals, and applying organizational policies to define who can view or modify sensitive datasets. In the shared responsibility model, data access governance is explicitly a customer obligation; Google only provides the underlying identity management infrastructure. For healthcare data, this is critical for HIPAA compliance and to meet data access audit requirements.

Preemptible VMs are a cost-effective choice for fault-tolerant batch jobs because they are priced up to 80% lower than standard VMs and can run for up to 24 hours, which fits the job's duration. The key requirement is that the batch job must handle preemption events gracefully—using checkpoints, retries, or restarting from the last saved state—which ensures uninterrupted processing of large files despite possible interruptions. Given the explicit tolerance for interruptions, preemptible VMs reduce cost without compromising completion, making them the optimal compute service for this use case.

VPC firewall rules act as the first line of defense by controlling ingress/egress traffic at the network layer. In GCP, every VM or GKE node's interface can be governed by hierarchical or tag-based rules, enabling segmentation between microservice tiers. Restricting traffic to only the required ports and source/destination CIDRs or service tags dramatically reduces the attack surface and limits lateral movement during a breach.

Elasticity is the cloud attribute that provisions and releases IT resources automatically to match current demand, often via auto-scaling policies or real-time monitoring. For an e-commerce site, this means adding virtual servers during a flash sale and removing them after the surge, preventing both over-provisioning and performance degradation. This dynamic, bidirectional scaling is exactly what addresses unpredictable traffic spikes.

IAM configuration is the customer's responsibility.

Organization policies with location restrictions specifically enforce data residency by using constraints such as `gcp.resource-locations` to limit where cloud resources can be created. These policies are applied hierarchically at the organization, folder, or project level, and any resource creation request that specifies a region outside the allowed list is denied. This is a preventive control that stops non-compliant infrastructure from being provisioned in the first place, making it the correct mechanism for the company's data location requirements.

Cloud HSM provides a cloud-based hardware security module that holds your encryption keys in tamper-resistant hardware, validated to FIPS 140-2 Level 3. It integrates with Cloud KMS, so you can generate, store, and use keys inside the HSM while retaining customer-managed control. This dedicated HSM meets the strict hardware protection required for sensitive financial services data, making it the correct choice.

Cloud Audit Logs are the definitive record of 'who did what, where, and when' in Google Cloud. For HIPAA-covered entities, enabling Data Access audit logs is mandatory to capture every read, write, and deletion of patient records, providing the auditable trail required by the Security Rule. Admin Activity logs track configuration changes, and System Event logs record system-level actions, all of which support security monitoring and incident forensics.

By binding VMs to a dedicated physical server, sole-tenant nodes ensure that no other Google Cloud customer's VMs run on that hardware. This direct physical isolation meets PCI DSS's requirement for secure hosting and data segregation, simplifying audit evidence. The tenant gains exclusive control over server provisioning, maintenance, and placement, which is impossible with standard multi-tenant VMs.

A managed database service like Cloud SQL High Availability writes data synchronously to a primary and standby instance in different zones within the same region. In the event of a zonal outage or instance failure, the service automatically promotes the standby to primary, preserving data durability and maintaining application availability without manual intervention.

Carbon-intelligent load shifting exploits the fact that the carbon intensity of grid electricity fluctuates throughout the day as renewable sources like wind and solar come online and offline. By scheduling batch jobs, data pipelines, or other latency-tolerant workloads during hours when the regional energy mix is cleanest, the same compute tasks produce significantly less CO2 without any efficiency changes. This is an operational, time-based strategy that directly targets the emissions-per-kilowatt-hour of the power consumed.

Cloud Run is a fully managed, serverless container platform that executes your container only when requests arrive, scaling up automatically to handle traffic and scaling down to zero when idle, so you are billed only for the time during which a request is being processed (measured to 100ms granularity). It leverages Knative on Google Kubernetes Engine under the hood but removes all cluster management from your purview, letting you deploy a container image directly to a URL. For a startup running a containerized web app, this delivers the lowest operational overhead and the most cost-efficient pay-per-request model while supporting any container runtime that listens on HTTP.

On-demand self-service is the cloud characteristic that lets a user directly provision and configure computing resources—such as virtual machines, storage, and applications—through a web portal or API, without requiring manual approval or interaction with the provider's staff. This unmediated, automated provisioning is the fundamental enabler of the question's described action, as it gives the user immediate control over resource creation and scaling. It is the defining feature that differentiates cloud computing from traditional IT procurement, where human intervention and long lead times are common.

Cloud Run is a serverless container execution service that automatically scales to zero instances when no requests are in-flight. You are billed only for the exact time your container processes a request, down to 100-millisecond increments, with no cost for idle periods. Its HTTP-triggered, pull-based model makes it ideal for a containerized web application that experiences variable or low traffic.

This is exactly the NIST characteristic in question: a consumer can unilaterally provision computing capabilities, such as server time and network storage, automatically without requiring human interaction with each service provider. This means the user accesses a self-service interface or API, supplies the configuration, and receives the resource immediately — no phone call, ticket, or manual approval needed. It is the defining trait that distinguishes cloud computing from traditional IT procurement and is the answer to the question.

Dataflow is Google's fully managed, unified programming model for batch and stream processing, built on Apache Beam. It provides exactly-once processing guarantees, intelligent watermarks, and automatic handling of out-of-order data, along with built-in windowing and triggering for time-based aggregations. Its native connectors to BigQuery and Pub/Sub allow the team to read streaming events, transform them in real time, and write results directly into BigQuery for analysis without managing any infrastructure.

App Engine is a fully managed platform-as-a-service that accepts your source code and runtime configuration directly, without requiring you to build or manage containers. It automatically provisions underlying compute resources, performs health checks, balances load across instances, and scales from zero to many based on traffic. Patches and infrastructure maintenance are handled by Google, making it the most operationally lightweight choice for deploying a web application.

Compute Engine is a true Infrastructure-as-a-Service offering, giving you full administrative control over a Windows Server VM. You can install custom patches, enable and configure IIS, alter registry settings, and manage the OS exactly as required by your legacy application. This is the only option that provides direct OS-level access, making it the correct choice for a lift-and-shift migration of a Windows workload that cannot be refactored.

Persistent Disk is a network-attached block storage service that can be attached to a single VM as a raw device, providing durable and high-performance storage. It is independent of the VM lifecycle, so data persists even when the VM is stopped or terminated, and it supports snapshots and regional replication for added durability. This makes it the correct choice for a stateful application that needs reliable block storage while allowing the VM to be restarted or migrated.