CCNA Google Cloud Products and Services Questions

Cloud Monitoring is Google Cloud's primary service for operational visibility and alerting. It ingests metrics from GCP and external sources, stores them in a time-series database, and evaluates alerting policies that can trigger notifications via email, SMS, Pub/Sub, or webhooks. It also offers built-in dashboards and the Metrics Explorer for real-time and historical performance analysis, making it the correct answer for monitoring and alerting.

Cloud Spanner is the only Google Cloud relational database that combines global scalability with strong consistency and ACID transactions, using synchronous replication and Paxos consensus across regions. It is specifically designed to deliver 99.999% availability SLA, meeting the financial services requirement for a globally distributed, strongly consistent relational database. With horizontal scaling and automatic sharding, it can handle massive transaction loads while maintaining external consistency.

AlloyDB satisfies the AI-optimised and high-performance constraints while remaining wire-compatible with PostgreSQL tooling. Its columnar engine and integrated Vertex AI extensions deliver the required analytical and AI capabilities, unlike standard Cloud SQL, which lacks these optimisations.

Vertex AI is the correct choice because it is Google Cloud's unified platform for building, training, and deploying ML models at scale. It provides a custom training service where you can launch training jobs with your own code, containers, and hardware accelerator configurations, and it manages compute clusters and automatically handles node provisioning. It also offers persistent online prediction endpoints, batch prediction, and integration with Vertex AI Pipelines for orchestration, making it ideal for a data scientist who needs full control.

Cloud Armor is a managed edge security service that works directly with external HTTP(S) load balancers to protect applications from DDoS attacks and web-based threats. It provides a customizable Web Application Firewall (WAF) with OWASP Top 10 rules, IP allow/deny lists, rate limiting, IP reputation filters, and geography-based access control, making it the appropriate choice for blocking malicious traffic and enforcing regional access policies on a global web application.

Preemptible VMs on Compute Engine are the right choice for a nightly batch process because they are up to 80% cheaper than standard VMs, which directly reduces operational cost for a recurring, interruptible workload. Since batch jobs are inherently fault-tolerant—they can be checkpointed or simply rerun from the start—the risk of preemption is acceptable, and Google Cloud automatically restarts the VM if capacity is available. For a simple scheduled job, a preemptible VM is a low-complexity, high-savings solution.

Cloud Run is a fully managed serverless container platform that can run any containerized HTTP service, including a Flask web application. It automatically scales from zero to handle traffic, scaling up as requests increase and scaling down to zero when idle, so you only pay for resources used during request processing. Unlike GKE, Cloud Run abstracts away cluster management entirely, making it ideal for a containerized Flask app that needs automatic scaling with minimal operational effort.

Vertex AI Training is a fully managed service that runs arbitrary custom training code in containers, with support for distributed training, GPU/TPU accelerators, hyperparameter tuning, and job orchestration. It lets the data scientist define their own model architecture using any ML framework (TensorFlow, PyTorch, JAX) and scale seamlessly from a single VM to large clusters. This directly fulfills the requirement of training a custom model with full control, while offloading infrastructure management to Vertex AI.

A VPC-native cluster assigns pod IPs directly from the VPC subnet, allowing the `networking.gke.io/static-ip` annotation to reserve a specific internal IP for a pod. This annotation binds that IP to the pod's network interface, ensuring the pod keeps the same address even after rescheduling. The reservation is managed by GKE and persists until the annotation is removed, making it ideal for workloads that require a fixed internal endpoint.

The Archive storage class is designed for data accessed less than once a year, with a minimum 180-day retention period that aligns with the 10-year requirement. Its retrieval cost is high, but the lowest storage price among classes makes it most cost-effective when access is rare, satisfying the constraint of infrequent retrieval.

Pub/Sub + Dataflow + BigQuery is the correct streaming pipeline. Pub/Sub is a fully managed, durable message ingestion service that decouples producers from consumers and supports exactly-once delivery semantics in combination with Dataflow. Dataflow (Apache Beam runner) provides unified batch and stream processing with built-in windowing, stateful aggregations, and exactly-once guarantees, enabling real-time click aggregation. BigQuery is a serverless, columnar data warehouse optimized for scanning large volumes of data with high concurrency, making it ideal for serving a live dashboard with sub-second SQL queries on aggregated results.

Cloud Functions is a serverless execution environment that runs backend logic in response to Firestore and Cloud Storage events, so you can handle message processing, profile updates, and media metadata without provisioning servers. It naturally complements the mobile backend by creating a scalable, event-driven pipeline that charges only when code runs, and it provides a secure way to perform privileged operations that should not run on the client device.

Pub/Sub is a fully managed, globally distributed messaging and ingestion service built for real-time event streaming. It reliably captures high-volume data from IoT devices via pull or push subscriptions, decouples producers from downstream consumers, and provides at-least-once delivery without requiring any server provisioning. As the entry point in a streaming data pipeline, it buffers and routes telemetry so that downstream systems like Dataflow can process it without data loss.

Cloud Functions is Google Cloud's fully managed, event-driven serverless compute platform designed specifically for single-purpose functions that respond to Cloud Storage events, HTTP triggers, Pub/Sub messages, and other event sources. It automatically scales to zero when no events occur, eliminating idle cost, and executes code only when a trigger fires, making it the ideal lightweight choice for a developer who wants to run a snippet of code without provisioning or managing infrastructure. Its runtime model directly matches the requirement for a serverless function triggered by a Cloud Storage upload.

Cloud Dataflow is a fully managed, serverless service that unifies stream and batch data processing using the Apache Beam model. It auto-scales, provides exactly-once semantics, and natively integrates with BigQuery, Pub/Sub, and other GCP services. Its support for event-time processing, watermarks, and stateful aggregations makes it the correct choice for building scalable, real-time stream processing pipelines.

Cloud SQL for PostgreSQL is the correct target because it is Google Cloud's fully managed relational database service that is natively compatible with the PostgreSQL engine. This means your existing schema, queries, stored procedures, and database tools can be used with minimal modification, providing a straightforward lift-and-shift path from on-premises PostgreSQL to a managed cloud environment. It also offers automated backups, high availability, and scaling, which are key benefits for production migrations.

Persistent Disk snapshots are the direct, native mechanism for backing up Compute Engine disks. A snapshot captures the exact state of a disk at a specific time, and subsequent snapshots are incremental, storing only changed blocks for cost efficiency. You can automate snapshot creation with Cloud Scheduler and the Cloud Pub/Sub notifications, or use the Backup and DR service, and these snapshots can be restored to create new disks or be used to migrate the VM to another region.

Cloud SQL for MySQL is a fully managed relational database service that provides automated backups, failover, read replicas, and vertical/horizontal scaling. It is specifically engineered to be compatible with standard MySQL clients and tools, offering a familiar SQL interface and transactional guarantees. This makes it the ideal choice for teams that want a managed MySQL database without operational overhead.

Enabling Private Google Access on the VM's subnet allows instances with only internal IPs to reach Google APIs and services, including Cloud Storage, through the VPC's internal routing and the default gateway. VPC Service Controls add a security perimeter that explicitly restricts bucket access to the VPC network, preventing access from the public internet or other networks within the organization. Together they enforce the requirement: the VMs remain without public IPs, and the bucket's access is limited to the VPC, not just any Google-authenticated identity.

BigQuery is a fully managed, serverless data warehouse that separates compute from storage, enabling petabyte-scale SQL analytics without provisioning infrastructure. It uses a columnar storage format and a distributed query engine that dynamically allocates slots, making it ideal for interactive BI and large data aggregations. BigQuery also includes built-in features like partitioning, clustering, and automatic recompression of data, and it supports standard SQL, which is why it is the correct answer for a serverless analytics warehouse.

Cloud Armor is Google Cloud's web application firewall (WAF) that provides configurable security policies for HTTP(S) load balancing. It includes pre-configured rules from the ModSecurity Core Rule Set to block SQL injection, cross-site scripting, and other OWASP Top 10 threats. Cloud Armor also supports IP allow/deny lists, geo-based access controls, and rate limiting, making it the precise service to protect a web application from the stated attacks.

BigQuery is Google Cloud's serverless, fully managed analytics warehouse that runs ANSI SQL over petabyte-scale datasets using its Dremel engine and columnar storage, with no clusters to provision or tune. This directly satisfies the stem's no-infrastructure-management constraint.

Cloud Bigtable is a NoSQL wide-column database engineered for high-throughput, low-latency writes of millions of rows per second when scaling with CPU and storage nodes. Its distributed storage engine appends writes to SSTables with memtable buffering, giving consistent single-digit-millisecond latencies and linear write scaling across a cluster without a single bottleneck. For a real-time leaderboard, Bigtable's row-key design (like inverted scores or user IDs) paired with its massive write capacity makes it a proven choice for globally hot update streams.

Archive is the correct answer because it is Google Cloud's lowest-cost storage class, explicitly intended for data accessed less than once a year. It has the cheapest storage price but charges high retrieval fees and requires a minimum storage duration of 365 days. This matches the described access pattern of archival data, making it the most cost-effective option.

Cloud Build natively supports build triggers tied to GitHub events, including tag push events, making it ideal for automatically building a Docker image when a tag is pushed. The built image can then be securely pushed to Artifact Registry, which is the fully managed, regional container registry with IAM integration, vulnerability scanning, and support for Docker and OCI artifacts. This combination is the recommended, maintainable CI/CD approach for tag-driven image builds.

Cloud Armor is Google Cloud's web application firewall (WAF) and DDoS protection service, which integrates with Cloud Load Balancing to protect services at the edge. It enables fine-grained security policies based on IP addresses, geographic location, and preconfigured or custom rules that filter OWASP Top 10 threats like SQL injection and cross-site scripting. Cloud Armor also mitigates volumetric DDoS attacks with adaptive protection and scale, making it the correct service for applying security policies.

Cloud Armor is Google Cloud's distributed denial-of-service (DDoS) protection and web application firewall (WAF) service. It attaches to an HTTP(S) Load Balancer and filters incoming traffic based on preconfigured or custom rules, mitigating OWASP Top 10 threats, IP-based blocklists, and rate-limiting before requests hit backend services. This makes it the decisive security layer for a containerized microservices application exposed to the internet, blocking malicious traffic at the edge.

AlloyDB is a fully managed, PostgreSQL-compatible database service architected for high performance, delivering up to 4x faster transactional throughput and up to 100x faster analytical queries compared to standard PostgreSQL. It includes AlloyDB AI with vector similarity search, predictive autoscaling, and columnar engine, making it ideal for migrating Oracle workloads while adding artificial intelligence features. This aligns exactly with the requirement for a managed, compatible database with built-in AI.

Looker is an enterprise business intelligence and data analytics platform that provides a semantic modeling layer (LookML) to define business logic, enabling consistent and reusable metrics across the organization. It allows analysts to explore large datasets through a governed interface and create interactive dashboards, and it ties into cloud data warehouses like BigQuery for query execution. Looker is designed specifically for large-scale business analytics and is a correct choice for this use case.

Memorystore delivers fully managed Redis and Memcached engines on Google Cloud, removing patching, failover and scaling overhead. It satisfies the stem's requirement for a managed in-memory data store serving caching and low-latency access, unlike persistent disk or relational alternatives.

Cloud Run is a fully managed, Knative-based serverless platform that executes stateless containers in a scale-to-zero model: when there are no incoming requests, it shuts down all instances and you pay nothing. Each request is billed in 100-millisecond increments of compute time plus a minimal per-request charge, and it automatically scales to handle variable traffic, including bursting to thousands of concurrent requests. It accepts any container image that uses an HTTP server, which directly matches the need to deploy a containerised web application without managing any underlying nodes or clusters.

Cloud Run is a fully managed serverless compute platform that executes stateless containers delivered via a requests URL. It automatically scales your container from zero to whatever number of instances are needed to handle incoming traffic, and you are billed only for the resources consumed during request processing—when idle, you pay nothing. This makes it exceptionally well-suited for unpredictable traffic patterns without requiring any cluster or infrastructure management.

Cloud CDN offloads static content delivery to Google's global edge cache, absorbing sudden spikes in traffic and reducing origin load. Cloud Armor enforces security policies at the edge, offering HTTP(S) L3-7 DDoS protection, WAF rules, and per-user rate limits. Together, they provide both acceleration and protection: Cloud CDN handles legitimate cacheable content at scale, while Cloud Armor filters out attack traffic before it reaches Cloud CDN or the backend.

Dataflow is a fully managed, unified stream and batch data processing service based on Apache Beam. It performs real-time stream processing, including event-time windowing, aggregation, and anomaly detection with exactly-once semantics, auto-scaling, and low latency. It is the correct choice for the processing stage because it can consume from Pub/Sub, apply transformations (including anomaly detection), and write results to Bigtable.

Cloud Run is a fully managed serverless container platform that executes your container only when a request arrives. It automatically scales down to zero instances during idle periods, meaning you pay nothing when there is no traffic, and it scales up instantly to handle incoming requests. Because it directly supports container images and abstracts all infrastructure, it is the simplest and most cost-efficient choice for deploying a containerized web application.

Gemini for Workspace, formerly Duet AI, is the generative AI assistant natively integrated into Google Workspace applications such as Gmail, Docs, Sheets, and Meet. It leverages the Gemini model family and is grounded in the user's Workspace content to summarize threads, draft documents, and automate tasks, while inheriting Workspace's enterprise-grade security and data governance. It is designed specifically as the AI companion for Workspace users, requiring no custom ML development.

BigQuery is a fully managed, serverless data warehouse that separates storage from compute, enabling interactive SQL queries over petabytes of data via a high-speed columnar execution engine. Its architecture, using the Dremel query engine, distributes queries across thousands of nodes, delivering sub-second to seconds response times on massive datasets without requiring infrastructure provisioning. This makes it the ideal choice for running ad-hoc, interactive analytics on petabyte-scale data.

Document AI is the correct choice because it provides purpose-built pre-trained processors such as the Invoice Parser, which are specifically designed to extract structured fields like vendor name, invoice number, due date, and line items from scanned or digital documents. These processors combine OCR with a domain-aware NLP model, so they understand document layouts and key-value pair conventions unique to invoices without any custom training.

Firestore is a mobile-first document database with built-in offline persistence: data is stored locally on the device, enabling reads and writes without connectivity. When the device reconnects, Firestore automatically synchronizes local changes to the server and resolves conflicts using deterministic rules (e.g., last-write-wins by server timestamp). Its SDK offers real-time listeners that push updates to clients, making it ideal for chat, collaboration, and other interactive mobile features. Firestore's security rules and transaction support further streamline mobile backend development.

Looker is Google Cloud's enterprise BI platform, purpose-built for interactive dashboards and governed reporting directly on BigQuery. It uses LookML, a semantic modeling language that defines business logic and metrics in a central repository, ensuring consistent, version-controlled definitions across all dashboard consumers. With embedded analytics, scheduled reports, and row-level security, Looker is the correct fit for this analyst's requirements.

Lowering `max_connections` caps the number of concurrent client sessions, and each session reserves per-thread memory for sort buffers, join buffers, and temporary tables. Reducing this flag therefore directly bounds the aggregate connection-level memory consumption on the instance, preventing memory exhaustion and out-of-memory restarts. It is the correct remediation because the symptom is memory pressure, not disk capacity or query routing.

Cloud Run is a serverless compute platform that executes stateless HTTP-driven containers on demand. When no requests are in flight, the service scales down to zero instances, so you are not billed for idle resources. It automatically provisions and scales instances up to handle spikes, supports any language and arbitrary Docker images, and only charges for the exact number of requests processed, making it a natural fit for a containerized microservice with intermittent traffic.

Cloud Armor is Google Cloud's Web Application Firewall (WAF) service that provides edge-based protection against application-layer attacks such as SQL injection and cross-site scripting (XSS). It uses pre-configured rules, including the OWASP Top 10 rule set, as well as custom rules in Common Expression Language (CEL) to filter malicious traffic before it reaches backend instances. Cloud Armor integrates with Cloud Load Balancing and can also provide DDoS protection with adaptive protection and rate limiting. This makes it the correct choice for blocking common web attacks.

Dataflow, Google Cloud's fully managed stream and batch processing service, runs the job in batch mode using Apache Beam, automatically scaling workers based on input size and processing needs. It reads from Cloud Storage, applies the required transformation logic, writes to BigQuery with exactly-once semantics, and then scales to zero after completion, so you only pay for the active compute during those 2 hours.

App Engine Standard Environment is a serverless platform that automatically scales your Node.js application from zero instances during idle periods to many during traffic spikes. It fully manages the underlying infrastructure, including load balancing, health checks, and runtime isolation, so you only pay for the resources your app actually consumes. This aligns perfectly with the startup's need for zero server management and cost efficiency under variable traffic.

Cloud Functions is a purpose-built, event-driven serverless compute platform that natively responds to GCP events, including Cloud Storage object finalization (e.g., the 'google.storage.object.finalize' trigger). When an object is uploaded, Cloud Functions automatically invokes the function with the event metadata, scaling to zero when idle and managing all infrastructure transparently. This aligns exactly with the requirement to trigger a single-purpose serverless function on a storage event, without needing a container runtime, a web server, or an intermediary like Pub/Sub.

Cloud Armor is the correct answer because it is Google Cloud's managed Web Application Firewall (WAF) service that provides application-layer (L7) protection for services behind Cloud Load Balancing. It includes pre-configured rules from the OWASP ModSecurity Core Rule Set, which specifically detects and blocks SQL injection and cross-site scripting patterns in HTTP headers, query parameters, and request bodies. Cloud Armor also offers adaptive protection, rate limiting, and geo-based access controls, making it the appropriate tool for defending a web application against these common web exploits.

Firestore is Google Cloud's fully managed, scalable NoSQL document database designed for mobile and web applications, offering real-time listeners, offline persistence, and automatic multi-region replication. Data is stored in documents organized into collections, with flexible schema and powerful querying, making it ideal for user profiles, chat messages, and other semi-structured data. Its serverless scaling and client SDKs are optimized for direct app-to-database access, which distinguishes it from the alternatives.

This pipeline uses Pub/Sub for asynchronous ingestion, then Dataflow (the fully managed Apache Beam runner) to read the unbounded stream, apply transforms, and write to two complementary sinks: Cloud Storage for durable raw data or archives, and BigQuery for interactive analytics. Dataflow handles the challenges of streaming—windowing, triggering, exactly-once processing, and auto-scaling—so all services are purpose-built for their roles and form a complete, production-ready architecture.

Cloud Run is a fully managed serverless container platform that executes stateless HTTP/S containers on demand, automatically scaling from zero to handle traffic spikes and back down to zero when requests stop. It accepts any container image that listens on HTTP/HTTPS, pulled from Artifact Registry or Container Registry, and you are billed only for the resources used during request processing (increments of 100ms) with no charge for idle instances. This makes it a direct fit for a containerized web application that needs elastic scaling and pay-per-use pricing without the need to manage clusters or nodes.

Cloud Build ingests source code from GitHub and executes a series of build steps, including compiling code and building a Docker image using a Dockerfile. Because it is a managed service, it scales automatically and can trigger builds on commits or PRs, making it the core automation engine of this CI/CD pipeline.

Cloud Run runs stateless containers on a fully managed, serverless platform that automatically scales from zero to thousands of instances based on incoming traffic, and you pay only for the processing time during active requests. It eliminates infrastructure management entirely—no cluster, VMs, or capacity planning—and supports fine-grained revisioning and traffic splitting. This makes it the ideal choice for a containerized web app that must scale to zero during idle periods.

Cloud Functions is the serverless compute layer that runs the Python code when a file is uploaded; the Cloud Storage event (object.finalize) triggers the function with event metadata like bucket and object name. It automatically scales to zero when idle, handles the processing synchronously or asynchronously, and integrates seamlessly with GCP services. Since the requirement specifies running Python code in an event-driven way, Cloud Functions is the correct service for executing the logic.

Cloud Run is a fully managed serverless compute platform that executes stateless containers from a Docker image, automatically scaling each instance in response to incoming HTTP requests. It scales to zero when there is no traffic, meaning you pay only for requests actually being processed, with no cluster or VM to manage. This makes it ideal for a startup's containerized web application, providing built-in HTTPS, high availability, and request-based billing without any underlying infrastructure to operate.

Pub/Sub is the correct foundational service for ingesting streaming events because it is a scalable, durable, asynchronous messaging middleware that decouples event producers from consumers. It provides at-least-once delivery, supports push and pull subscriptions, and can buffer spikes in event volume, ensuring that events are not lost before downstream processing. As the entry point of a data pipeline, Pub/Sub is specifically designed to receive high-throughput event streams and make them available to streaming processors like Dataflow.

Looker Studio (formerly Data Studio) is a free, self-service BI and data visualization platform that lets analysts build interactive dashboards and reports entirely through a drag-and-drop interface, with no code required. It connects directly to data sources such as BigQuery, Google Sheets, and many other databases, and supports shared, embeddable, and scheduled reports. Because the analyst explicitly wants to avoid writing code, Looker Studio's WYSIWYG editor and pre-built connectors make it the correct choice for this requirement.

A bucket lifecycle rule supports an age-based Delete action, which automatically removes objects after a specified number of days from their creation time. By setting 'age: 30' in the Delete action, Cloud Storage will delete the objects exactly at the 30-day mark during its daily lifecycle evaluation. This is the native, recommended mechanism for automatic object expiration and directly fulfills the requirement.

Memorystore for Redis is a fully managed in-memory data store compatible with the Redis protocol, offering sub-millisecond latency for key-value lookups—exactly what session state requires. Cloud Run instances are stateless and ephemeral, scaling to zero when idle, so placing sessions in a shared cache like Memorystore ensures user state survives individual instance lifecycles and remains accessible across autoscaled replicas. Furthermore, Redis-native features such as TTLs, atomic increments, and SETNX are ideal for session expiry, rotation, and concurrency control, making it the correct choice for low-latency session persistence.

AlloyDB is purpose-built for PostgreSQL workloads and is fully PostgreSQL-compatible, enabling most applications to migrate without changing code or SQL syntax. It delivers enterprise-grade high availability and performance with a columnar engine that speeds up analytical queries, adaptive indexes that learn from access patterns, and AI-driven optimization features that automatically fine-tune database settings—capabilities that Cloud SQL and other managed PostgreSQL services lack, making it the correct answer for this scenario.

Cloud Spanner is a fully managed relational database that combines the semantics of traditional SQL with horizontal scaling across regions. Using TrueTime, it provides external consistency (strong global consistency) while replicating data across continents, and it offers a 99.999% multi-region SLA. For an e-commerce platform needing global transactions on relational tables, Spanner uniquely satisfies both relational constraints and global distribution.

Regional Persistent Disk synchronously replicates data across two zones in the selected region, providing zone-failure resilience with write-consistent, read-after-write semantics. This makes it the correct choice for a critical stateful application because VM instances can be recreated or failed over to another zone while retaining the same disk data. It supports live migration, snapshots, and resizing, and is the recommended block storage for applications that require high availability without sacrificing durability.

Cloud Functions is Google Cloud's serverless compute service, executing code in response to HTTP requests and events from other Google Cloud services without server management. It satisfies the stem's event-driven, serverless requirement directly, pairing with Memorystore for in-memory session data.

Cloud Functions is Google Cloud's event-driven serverless compute platform that runs Python code in response to specific triggers, including Cloud Storage events like object finalization. With a Storage trigger, the function is automatically invoked with the object metadata, eliminating the need to manage infrastructure or a web server. This matches the requirement to react to file uploads with low operational overhead and automatic scaling.

Pub/Sub ingests the IoT data stream durably and asynchronously, Dataflow (Apache Beam) processes it in a fully managed, autoscaling manner with sub-second latency, exactly-once semantics, and support for event-time windows, filters, and enrichments, then writes results to BigQuery using the Storage Write API. BigQuery is a fully managed, serverless, columnar data warehouse that provides native SQL analytics over the streamed data, making this combination the canonical GCP architecture for real-time streaming SQL.

Vertex AI is a fully managed machine learning platform that supports custom container training, allowing you to bring your own model code and dependencies while leveraging managed GPU and TPU clusters. It provides automatic scaling, hyperparameter tuning, and integrated MLOps tools like model versioning, monitoring, and Vertex Pipelines, which drastically reduce operational overhead compared to raw compute. This makes it the ideal choice for running custom ML models at scale without manually provisioning infrastructure.

Vertex AI provides a unified managed platform that covers the full ML lifecycle: training with custom or pre-built containers on GPU/TPU, versioning in a Model Registry, and deployment to prediction endpoints with built-in autoscaling based on traffic. It eliminates the need to manually configure infrastructure, allows custom model serving for any framework, and offers MLOps capabilities like monitoring and drift detection. This makes it the recommended service for training and serving TensorFlow models.

Cloud SQL for MySQL is Google Cloud's fully managed service that is natively compatible with the MySQL engine, including support for MySQL 5.7, 8.0, and 8.4. It provides the same SQL syntax, stored procedures, triggers, and InnoDB storage engine, so existing applications can connect with standard MySQL drivers and require minimal to no code changes. With automated backups, high availability, read replicas, and straightforward import tools, it is the correct and lowest-risk choice for migrating an on-premises MySQL database.

AlloyDB is a fully managed, PostgreSQL-compatible database service engineered for high performance and scalability, with AI-driven optimizations such as adaptive caching and an integrated columnar engine. It provides up to 4x faster transactional performance and 10x faster analytical queries than standard PostgreSQL, and its compatibility layer supports Oracle-like data types, functions, and SQL syntax, easing migration from Oracle. These capabilities directly align with the company's requirement for a PostgreSQL-compatible database with intelligent performance enhancements.

Preemptible VMs (now called spot VMs in Google Cloud) provide a significantly discounted price (typically 60-80% off on-demand pricing) for worker nodes in a Dataflow batch pipeline. Because Dataflow is designed to handle worker loss through checkpointing and automatic restart of tasks, batch jobs are generally resilient to the occasional termination that preemptible VMs may undergo. This directly reduces the compute cost of the worker pool without changing the pipeline logic or delivery time, making it the most straightforward way to cut costs for a recurring batch job.

Cloud Monitoring is the correct service because it is purpose-built to ingest and store numeric time-series metrics, such as CPU utilization and memory usage, from resources like Compute Engine and Kubernetes. It provides alerting policies that trigger notifications when these metrics cross user-defined thresholds, and offers dashboards and querying via MQL or PromQL. This is the standard GCP tool for real-time infrastructure observability, not just logging or error tracking.

Vertex AI is Google Cloud's unified, end-to-end managed ML platform that covers the full model lifecycle, from data preparation and feature engineering to AutoML or custom training, hyperparameter tuning, model validation, deployment, and continuous monitoring. It provides a single API and workflow that integrates with Cloud Storage, BigQuery, and other Google Cloud services, while also offering advanced MLOps components like Vertex AI Pipelines, Model Registry, and Vertex AI Feature Store. As a fully managed service, Vertex AI abstracts infrastructure management, enabling automated autoscaling for prediction endpoints, security policies, and versioning, making it the correct answer to the question.

BigQuery is Google Cloud's serverless, highly scalable, SQL-based data warehouse. It automatically manages infrastructure and scales compute and storage independently, using a columnar storage format and a distributed query engine (Dremel) to run analytics on petabytes of data. With a pay-per-query pricing model and no clusters to provision, BigQuery is the definitive choice for a fully managed data warehouse on Google Cloud.

Unlike standard Compute Engine VMs, which benefit from live migration during infrastructure maintenance, preemptible VMs are not live-migrated. If the underlying host needs maintenance or Google reclaims capacity, the VM is immediately terminated within 30 seconds of the preemption notice. This means the VM's state is lost unless you have explicitly saved it elsewhere.

Cloud CDN caches content at Google's global edge points of presence, absorbing volumetric traffic before it reaches your GKE backends. This directly satisfies the DDoS protection constraint: attack requests terminate at edge locations rather than consuming cluster resources, while also reducing origin load and latency for externally exposed HTTPS services.

Cloud Pub/Sub provides the durable, globally scalable messaging layer that ingests streaming telemetry from IoT devices, decoupling producers from consumers. It satisfies the ingestion stage of the pipeline, buffering events until Dataflow processes them with low latency.