Courseiva

Google Professional Cloud Architect (PCA) — Questions 76150

955 questions total · 13pages · All types, answers revealed

Page 1

Page 2 of 13

Page 3
76
MCQeasy

Your company runs a critical application on Google Kubernetes Engine (GKE) with 5 nodes. The application experiences intermittent high latency every Friday afternoon. The team has ruled out infrastructure issues and suspects the application logic. You need to instrument the application to identify the root cause. Which approach should you take?

A.Use Cloud Monitoring to create custom metrics for application performance and investigate recent code changes.
B.Increase the number of nodes in the GKE cluster to handle the load.
C.Enable Cloud Logging and analyze logs for error messages during the latency periods.
D.Configure GKE usage metering to track resource consumption by namespace.
AnswerA

Custom metrics provide visibility into application logic performance, and correlating with code changes can pinpoint the cause.

Why this answer

The team has already ruled out infrastructure issues and suspects application logic. Creating custom metrics in Cloud Monitoring allows you to instrument the application with key performance indicators (e.g., request latency, error rates) and correlate them with recent code changes to pinpoint the root cause of intermittent high latency. This approach directly addresses the need to monitor application-level behavior rather than infrastructure metrics.

Exam trap

The trap here is that candidates often confuse operational logging (Option C) with performance monitoring, failing to recognize that intermittent latency without errors requires custom metrics to measure application-specific performance indicators.

How to eliminate wrong answers

Option B is wrong because increasing the number of nodes addresses infrastructure capacity, which has already been ruled out as the cause; it does not help identify application logic issues. Option C is wrong because while Cloud Logging can capture error messages, the problem is intermittent high latency without necessarily generating errors; analyzing logs alone may miss performance bottlenecks that require custom metrics. Option D is wrong because GKE usage metering tracks resource consumption by namespace for cost allocation, not application performance or latency issues.

77
MCQeasy

A company needs a relational database that can scale horizontally across multiple regions, supports ACID transactions, and provides strong global consistency. Which Google Cloud database should they choose?

A.BigQuery
B.Cloud SQL
C.Cloud Spanner
D.Firestore
AnswerC

Spanner is a globally distributed relational database with ACID transactions and strong consistency.

Why this answer

Cloud Spanner is the only Google Cloud database that offers horizontal scaling, ACID transactions, and strong global consistency across regions.

78
Matchingmedium

Match each IAM role type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Legacy roles like Owner, Editor, Viewer

Fine-grained roles managed by Google

User-defined roles with specific permissions

Another name for Basic roles

Identity for applications, not users

Why these pairings

In GCP, IAM roles are categorized into basic (broad), predefined (service-specific), and custom (user-defined). Common confusions arise between predefined and custom roles.

79
Multi-Selecthard

Which THREE are required to configure Workload Identity for a GKE cluster? (Choose 3)

Select 3 answers
A.Create a Google Cloud service account
B.Create a Kubernetes service account
C.Enable Workload Identity on the GKE cluster
D.Bind the Kubernetes service account to the Google Cloud service account using a Kubernetes RoleBinding
E.Use a node pool that has Workload Identity enabled
AnswersA, B, C

The GSA is used to grant permissions to the Kubernetes service account.

Why this answer

A Google Cloud service account (GSA) is required to authenticate to Google Cloud APIs from within GKE. Workload Identity maps a Kubernetes service account (KSA) to a GSA, allowing pods to inherit the GSA's IAM permissions without managing static keys. The GSA must be created first to define the identity that workloads will assume.

Exam trap

Google Cloud often tests the distinction between Kubernetes RoleBinding (for RBAC) and IAM policy binding (for Workload Identity), leading candidates to incorrectly select a RoleBinding as the binding mechanism.

80
MCQhard

A company runs a service on Cloud Run that needs to access a Cloud SQL instance via private IP. Both are in the same VPC network. The service cannot connect to the database. What is the most likely cause?

A.Cloud Run must be deployed in the same zone as Cloud SQL.
B.The IAM permissions for Cloud Run to access Cloud SQL are missing.
C.A firewall rule is blocking traffic.
D.Cloud Run needs a Serverless VPC Access connector.
E.The Cloud SQL instance needs a public IP assigned.
AnswerD

Correct. Serverless VPC Access enables Cloud Run to reach VPC resources.

Why this answer

Cloud Run services run in a Google-managed environment and cannot directly reach resources on a VPC network via private IP. A Serverless VPC Access connector is required to bridge the serverless environment to the VPC, enabling private IP connectivity to Cloud SQL. Without this connector, the Cloud Run service cannot route traffic to the Cloud SQL private IP, even if both are in the same VPC network.

Exam trap

Google Cloud often tests the misconception that being in the same VPC network automatically grants connectivity, but serverless services like Cloud Run require an explicit Serverless VPC Access connector to route traffic into the VPC.

How to eliminate wrong answers

Option A is wrong because Cloud Run is a serverless, zonal-agnostic service; it does not need to be in the same zone as Cloud SQL, and zone affinity does not affect private IP connectivity. Option B is wrong because IAM permissions (e.g., Cloud SQL Client role) control access to the Cloud SQL API for management operations, not network-level connectivity to the database's private IP; the issue is network routing, not authorization. Option C is wrong because firewall rules control traffic at the network layer, but Cloud Run cannot even send traffic into the VPC without a connector, so a firewall rule is not the primary cause.

Option E is wrong because the question specifies that the Cloud SQL instance uses private IP; assigning a public IP would expose the database to the internet and is unnecessary for private connectivity, and the problem is the lack of a routing path, not the IP type.

81
MCQmedium

An organization is using Cloud Interconnect to connect their on-premises network to Google Cloud. They need to ensure 99.99% availability for their connection. Which configuration meets this requirement?

A.A single Partner Interconnect connection at 1Gbps
B.Two Dedicated Interconnect connections from different edge locations
C.A single Dedicated Interconnect connection at 10Gbps
D.High Availability VPN (HA VPN) with two gateways and four tunnels
AnswerB

Two Dedicated Interconnect connections from different edge locations provide the necessary redundancy to meet the 99.99% SLA. This is a supported Cloud Interconnect configuration.

Why this answer

To achieve 99.99% availability with Cloud Interconnect, you need two Dedicated Interconnect connections from different edge locations. This provides redundancy and meets the SLA requirement. A single connection (Dedicated or Partner) does not meet the 99.99% SLA.

HA VPN is not a Cloud Interconnect solution; it's a separate VPN service that can also provide 99.99% SLA but is not Cloud Interconnect. Since the organization is using Cloud Interconnect, the correct configuration is two Dedicated Interconnect connections from different edge locations.

82
MCQeasy

After executing the command, a security review reveals that the service account sa-bucket-reader can also list buckets in the project, which was not intended. What is the most likely cause?

A.The etag was incorrect, causing a concurrent modification.
B.The service account has a project-level role that includes storage.list.
C.The policy update failed due to a missing condition.
D.The service account also has bucket-level IAM roles.
AnswerB

Project-level roles like roles/storage.objectAdmin or roles/viewer include storage.buckets.list.

Why this answer

The service account sa-bucket-reader was able to list buckets in the project, which requires the storage.buckets.list permission. This permission is included in several predefined project-level roles, such as roles/storage.objectViewer or roles/storage.legacyBucketReader. If the service account was granted a project-level role that includes storage.buckets.list, it would have the unintended ability to list all buckets in the project, even if bucket-level IAM was configured to restrict access to specific buckets.

Exam trap

In Google PCA exams, the distinction between project-level and resource-level IAM roles is critical. The trap here is that candidates assume bucket-level IAM is the only way to grant bucket access, forgetting that project-level roles can also include bucket-related permissions like storage.buckets.list.

How to eliminate wrong answers

Option A is wrong because an incorrect etag would cause a concurrent modification error during an IAM policy update, but it would not grant additional permissions like storage.buckets.list; the policy would simply fail to apply. Option C is wrong because a missing condition in a policy update would not cause the service account to gain unintended permissions; conditions restrict access, so their absence might allow broader access than intended, but the question states the service account already has the ability to list buckets, implying the permission was granted via a role, not due to a missing condition. Option D is wrong because bucket-level IAM roles are more granular and would not grant the project-level storage.buckets.list permission; bucket-level roles only apply to the specific bucket they are assigned to, not to listing all buckets in the project.

83
MCQeasy

A company is migrating a monolithic e-commerce application to Google Cloud. The application has been refactored into microservices. Most services are stateless and can run on Cloud Run. However, the checkout service requires maintaining session state across multiple requests, and the session data must be available globally for low latency. The application will be deployed in multiple regions to serve a global user base. Which approach should the company take?

A.Run the checkout service on Compute Engine with regional managed instance groups and Cloud Filestore
B.Use Cloud Run with session affinity and in-memory caching within each instance
C.Deploy the checkout service on Cloud Run in multiple regions, and use Memorystore (Redis) with replication as the session store
D.Deploy the checkout service on Google Kubernetes Engine using StatefulSets and regional persistent disks
AnswerC

Cloud Run can scale globally, and Memorystore provides a fast, shared session store.

Why this answer

Memorystore (Redis) with replication provides a globally accessible, low-latency session store that can be used by Cloud Run instances in multiple regions. Redis replication ensures data durability and high availability, while Cloud Run's stateless nature is complemented by externalizing session state to a managed caching layer. This architecture meets the requirement for global session data availability without coupling state to individual compute instances.

Exam trap

The trap here is that candidates may assume session affinity (sticky sessions) is sufficient for stateful services on Cloud Run, but they overlook that Cloud Run instances are stateless and ephemeral, making external session storage like Redis mandatory for global, durable session management.

How to eliminate wrong answers

Option A is wrong because Compute Engine with regional managed instance groups and Cloud Filestore introduces unnecessary infrastructure complexity and latency; Cloud Filestore is a file storage service not designed for low-latency session state across global regions, and it lacks the in-memory performance needed for session data. Option B is wrong because Cloud Run with session affinity and in-memory caching within each instance cannot guarantee global session availability; session affinity only pins a client to a specific instance, but Cloud Run instances are ephemeral and can be terminated, losing in-memory session data, and cross-region access is not supported. Option D is wrong because Google Kubernetes Engine with StatefulSets and regional persistent disks ties session state to specific pods and disks, which cannot be shared globally across regions; persistent disks are zonal resources and do not provide low-latency access from multiple regions, defeating the global requirement.

84
MCQeasy

What will happen to this instance during a Google-initiated maintenance event?

A.The instance will be migrated and then restarted.
B.The instance will be terminated and then restarted after maintenance.
C.The instance will be preempted and deleted.
D.The instance will stop and remain stopped.
E.The instance will be live-migrated to another host.
AnswerB

Correct. TERMINATE with automaticRestart=true causes termination followed by restart.

Why this answer

During a Google-initiated maintenance event, a standard (non-live-migratable) Compute Engine instance is terminated and then restarted on another host after the maintenance is complete. This behavior is controlled by the instance's 'onHostMaintenance' setting; when set to 'TERMINATE' (the default for instances with GPUs or certain configurations), the instance is stopped, the host undergoes maintenance, and then the instance is restarted. Option B correctly describes this termination-and-restart sequence.

Exam trap

Google Cloud often tests the misconception that all instances are live-migrated by default, but the trap here is that instances with GPUs, local SSDs, or certain machine types are terminated instead, and candidates must recognize the 'TERMINATE' behavior as the correct answer.

How to eliminate wrong answers

Option A is wrong because 'migrated and then restarted' describes a live migration process, which is not used for instances that are terminated during maintenance; live migration keeps the instance running without restart. Option C is wrong because 'preempted and deleted' applies to preemptible VMs, which are terminated after 24 hours or when capacity is needed, not during standard maintenance events. Option D is wrong because the instance does not remain stopped; it is restarted after maintenance completes.

Option E is wrong because live migration is only used when 'onHostMaintenance' is set to 'MIGRATE', which is not the case for instances that undergo termination; the question implies a scenario where termination occurs.

85
Multi-Selectmedium

A company wants to implement blameless postmortems as part of their SRE practices. Which THREE principles should they follow?

Select 3 answers
A.Only involve senior management in the review
B.Create actionable recommendations to prevent recurrence
C.Focus on identifying the root cause without blaming individuals
D.Assign responsibility to the team that caused the incident
E.Share findings with all relevant stakeholders
AnswersB, C, E

Postmortems should lead to improvements.

Why this answer

Blameless postmortems focus on learning from incidents without assigning blame. They should focus on system improvements, include everyone involved, and document findings. Assigning blame, only involving management, and ignoring fixes are contrary to blameless culture.

86
MCQmedium

You are running a Cloud Run service that experiences occasional cold starts causing latency spikes. You want to minimize cold starts cost-effectively. What should you do?

A.Increase the max-instances setting to allow more concurrent requests.
B.Set concurrency to 1 to ensure each instance handles one request at a time.
C.Set min-instances to 1 to keep at least one instance always warm.
D.Use a larger machine type (e.g., 2 vCPU) to reduce startup time.
AnswerC

This directly addresses cold starts by keeping an instance running.

Why this answer

Setting min-instances to 1 ensures that at least one instance of your Cloud Run service is always kept warm, meaning it is initialized and ready to handle requests immediately. This eliminates cold starts for the first request after a period of inactivity, reducing latency spikes without requiring over-provisioning of resources. It is cost-effective because you only pay for the idle instance when it is not serving traffic, and you avoid the higher costs of larger machine types or excessive concurrent instances.

Exam trap

Google Cloud often tests the misconception that increasing resources (like vCPU or max-instances) solves cold starts, but the real solution is to keep an instance warm via min-instances, which directly addresses the root cause of initialization delay.

How to eliminate wrong answers

Option A is wrong because increasing max-instances allows more concurrent requests but does not prevent cold starts; it only caps the maximum number of instances, and cold starts still occur when new instances are needed. Option B is wrong because setting concurrency to 1 forces each instance to handle only one request at a time, which can increase the number of instances and cold starts, not minimize them, and it wastes resources. Option D is wrong because using a larger machine type (e.g., 2 vCPU) reduces startup time slightly but does not eliminate cold starts entirely, and it increases cost significantly without guaranteeing a warm instance is always available.

87
MCQmedium

A company wants to migrate an on-premises Oracle database to Google Cloud. They need high availability and want to minimize application changes. Which service should they use?

A.Cloud SQL for MySQL
B.Bare Metal Solution
C.Cloud Spanner
D.Compute Engine with Oracle license
AnswerB

Bare Metal Solution offers dedicated Oracle-optimized hardware with minimal application changes.

Why this answer

Bare Metal Solution is correct because it provides dedicated physical servers for Oracle workloads, enabling high availability through Oracle RAC or Data Guard while preserving the existing Oracle database architecture. This minimizes application changes since the database remains Oracle-native, unlike managed services that require migration to a different database engine.

Exam trap

The trap here is that candidates often choose Compute Engine with Oracle license (Option D) thinking it is the most flexible, but they overlook the high-availability requirement and the operational overhead of manually configuring Oracle RAC or Data Guard, which Bare Metal Solution simplifies with a managed infrastructure.

How to eliminate wrong answers

Option A is wrong because Cloud SQL for MySQL is a managed MySQL service, not compatible with Oracle databases, requiring a full database migration and application code changes. Option C is wrong because Cloud Spanner is a globally distributed, horizontally scalable relational database that uses a proprietary SQL dialect, not Oracle-compatible, necessitating significant application rewrites. Option D is wrong because Compute Engine with Oracle license requires manual configuration for high availability (e.g., setting up Oracle RAC or Data Guard) and does not provide the same level of managed infrastructure as Bare Metal Solution, increasing operational complexity.

88
Multi-Selectmedium

A company has deployed a critical application on Google Kubernetes Engine (GKE) with a Regional cluster (us-central1). The application uses a Cloud SQL for PostgreSQL database with a cross-region replica for disaster recovery. The SRE team needs to ensure that the application can survive a regional outage with minimal data loss. Which TWO actions should the team take to improve the reliability of the solution?

Select 2 answers
A.Configure the application to automatically promote the Cloud SQL cross-region replica to a primary instance when the primary region is unavailable.
B.Configure Cloud SQL cross-region replication to be synchronous to ensure zero data loss during failover.
C.Configure an external HTTP(S) load balancer with a backend service pointing to both the primary and secondary GKE clusters, and use a DNS failover policy to route traffic to the secondary region if the primary region becomes unhealthy.
D.Deploy a secondary GKE cluster in the same region as the primary to provide a hot standby that can take over immediately.
E.Use a TCP/UDP load balancer to route traffic to both regions based on latency.
AnswersA, C

Correct. Promoting a Cloud SQL cross-region replica to a primary instance is the standard DR procedure. Automation via Cloud Functions or Cloud Run reduces RTO. However, cross-region replication is asynchronous, so some data loss is possible.

Why this answer

To survive a regional outage with minimal data loss, two key actions are needed: (1) Automate promotion of the Cloud SQL cross-region replica to primary when the primary region fails (Option A) – this is the standard Cloud SQL DR procedure; automation via Cloud Functions/Cloud Run reduces RTO. Note that cross-region replication is asynchronous, so some data loss (replication lag) is possible. (2) Deploy a multi-region GKE cluster pair (primary and secondary) and use an external HTTP(S) load balancer with a backend service pointing to both clusters, combined with a DNS failover policy (Option C) – this allows the load balancer to detect primary region health and route traffic to the secondary region if needed. Options B is wrong because cross-region replication cannot be synchronous.

Option D is wrong because a secondary cluster in the same region does not help during a regional outage. Option E is wrong because a TCP/UDP load balancer with latency-based routing does not provide failover based on region health.

Exam trap

The trap here is that candidates often assume synchronous replication is possible across regions for zero data loss, but in practice, cross-region replication is always asynchronous due to the speed of light and network latency constraints.

89
MCQeasy

A company commits to using Compute Engine for 3 years and wants the maximum discount. Which purchasing option should they use?

A.3-year committed use discount.
B.Pay-as-you-go pricing.
C.Sustained use discounts.
D.1-year committed use discount.
AnswerA

Highest discount for long-term commitment.

Why this answer

A 3-year committed use discount (CUD) offers the highest discount rate (up to 57% for most machine types) compared to 1-year CUDs (up to 37%) or pay-as-you-go pricing. By committing to a consistent resource usage for the full 3-year term, the company maximizes the discount on Compute Engine costs.

Exam trap

Google Cloud often tests the misconception that sustained use discounts provide the best long-term savings, but they are automatic and capped at 30%, whereas committed use discounts require a contractual commitment but offer significantly higher discounts for longer terms.

How to eliminate wrong answers

Option B is wrong because pay-as-you-go pricing provides no discount and is the most expensive option for long-term usage. Option C is wrong because sustained use discounts are automatic per-month discounts for running instances over 25% of a month, but they max out at 30% and do not require a commitment; they cannot match the deeper discount of a 3-year CUD. Option D is wrong because a 1-year committed use discount offers a lower discount rate (up to 37%) than a 3-year CUD (up to 57%), so it does not provide the maximum discount.

90
Multi-Selecthard

Your organization runs a microservices application on GKE Autopilot. You want to implement a gradual rollout of a new version with the ability to compare performance metrics between the old and new versions. Which TWO approaches should you combine?

Select 2 answers
A.Configure A/B testing with Traffic Director by routing based on request headers.
B.Implement a canary deployment using Traffic Director.
C.Use Cloud Deploy's rollout strategy with a canary phase.
D.Use Cloud Load Balancing to gradually shift traffic from old to new version.
E.Use GKE blue-green deployment and manually compare metrics.
AnswersA, B

Traffic Director can route traffic based on headers, enabling A/B testing.

Why this answer

A canary deployment gradually shifts traffic to the new version. Traffic Director provides service mesh capabilities including traffic splitting and metrics. Istio can also be used.

A/B testing requires routing rules based on headers or other criteria; Traffic Director can do this. Cloud Deploy supports canary but does not handle A/B testing natively. The combination of canary deployment (via Traffic Director) and A/B testing (with Traffic Director's routing rules) allows gradual rollout and comparison.

91
MCQeasy

Refer to the exhibit. A team wants to grant the ability to run queries (but not modify) on BigQuery datasets to a new set of users who have email addresses in the 'example.com' domain. What is the simplest way to achieve this?

A.No action needed; new users with 'example.com' accounts already have the dataViewer role through the existing domain membership
B.Create a new binding with role 'roles/bigquery.dataViewer' and include the new users as members
C.Remove the domain binding and only grant access to individual users
D.Add the new users to the existing 'domain:example.com' member list
AnswerA

The domain binding automatically grants access to all users in that domain.

Why this answer

The exhibit shows an existing IAM policy binding that grants the 'roles/bigquery.dataViewer' role to 'domain:example.com'. IAM domain-based bindings automatically apply to all authenticated users with email addresses in that domain. When new users with 'example.com' accounts are added, they inherit this role without any additional configuration, as IAM evaluates domain membership at access time.

Exam trap

A common misconception is that new users in a domain need to be manually added to the IAM policy. In Google Cloud, domain-based IAM bindings automatically grant access to all current and future members of the domain, making additional bindings or user additions unnecessary.

How to eliminate wrong answers

Option B is wrong because it suggests creating a new binding for individual users, which is unnecessary and less efficient when a domain-level binding already covers all users in the 'example.com' domain. Option C is wrong because removing the domain binding and granting access only to individual users would break access for existing users and increase administrative overhead, violating the principle of least privilege and simplicity. Option D is wrong because 'domain:example.com' is not a member list that can be added to; it is an IAM principal identifier that automatically includes all users in the domain, so there is no separate 'member list' to update.

92
MCQmedium

A company wants to implement canary deployments on GKE to gradually roll out a new version of a microservice. They need to route a small percentage of traffic to the new version initially. Which tool can they use to achieve traffic splitting?

A.Cloud Load Balancing
B.Cloud Shell
C.Cloud Deployment Manager
D.Cloud Deploy with a Service Mesh like Istio
AnswerD

Cloud Deploy supports canary deployments and traffic splitting via Service Mesh or other configurations.

Why this answer

Cloud Deploy supports canary deployments with traffic splitting using Service Mesh (Istio) or other ingresses. Istio itself can also be used directly. Cloud Load Balancing can do traffic splitting but not as part of a deployment pipeline.

Cloud Shell is just a terminal. Cloud Deployment Manager is for infrastructure deployment.

93
MCQmedium

A company has two VPC networks in the same project: 'vpc-prod' and 'vpc-dev'. They want to allow communication between instances in both VPCs. What is the simplest method?

A.Create a VPC Network Peering connection between them
B.Set up a Cloud VPN tunnel between the two VPCs
C.Configure a custom route in each VPC pointing to the other's subnet
D.Add firewall rules allowing traffic between the VPCs
AnswerA

VPC Network Peering enables direct, private connectivity.

Why this answer

VPC Network Peering is the simplest method because it directly connects two VPCs using Google's internal infrastructure, allowing private RFC 1918 IP communication across the networks without requiring external gateways, VPN tunnels, or additional bandwidth costs. It requires no routes to be manually configured—Google automatically adds the necessary routes for each peered VPC's subnets—and only a single firewall rule to permit traffic between the instances.

Exam trap

Google Cloud often tests the misconception that firewall rules alone can enable inter-VPC communication, but candidates must remember that firewall rules are only effective after a connectivity mechanism (like peering or VPN) is in place.

How to eliminate wrong answers

Option B is wrong because a Cloud VPN tunnel introduces unnecessary complexity and latency by routing traffic over the public internet or through Cloud VPN gateways, whereas VPC peering uses Google's internal backbone with lower latency and no per-tunnel charges. Option C is wrong because custom routes alone cannot enable inter-VPC communication; routes only direct traffic to a next hop, but without a peering connection or VPN tunnel, there is no path for the packets to travel between the VPCs. Option D is wrong because firewall rules only control allowed traffic within a VPC or between VPCs that already have a connectivity mechanism (like peering or VPN); they do not establish the underlying network link required for packets to leave one VPC and enter another.

94
MCQmedium

A company runs a web application on Compute Engine behind a HTTP(S) Load Balancer. They want to reduce latency for users worldwide. Which Google Cloud service should they use?

A.Cloud CDN
B.Cloud Armor
C.Cloud NAT
D.Cloud VPN
AnswerA

Cloud CDN caches content at edge locations to reduce latency.

Why this answer

Cloud CDN caches content at Google's edge locations, reducing latency for global users. Cloud Armor is for security, Cloud NAT for outbound connectivity, and Cloud VPN for site-to-site VPN.

95
Multi-Selecteasy

Which TWO statements about Google Cloud VPC networks are true? (Choose two.)

Select 2 answers
A.Subnets are regional resources.
B.VPC networks are global resources.
C.VPC networks are project-level resources.
D.Firewall rules are regional.
E.Subnets are zonal resources.
AnswersA, B

Subnets are regional and can span zones.

Why this answer

Subnets in Google Cloud VPC are regional resources. When you create a subnet, you specify a region and a CIDR block, and the subnet spans all zones within that region. This allows resources in different zones of the same region to use the same subnet without additional configuration.

Exam trap

The trap here is that candidates often confuse subnets as zonal resources (like in AWS or on-premises networking) and firewall rules as regional, but Google Cloud VPC treats subnets as regional and firewall rules as global, which is a key differentiator tested on the PCA exam.

96
MCQmedium

A company runs a microservices application on Google Kubernetes Engine (GKE). Each service is deployed as a Deployment with resource requests and limits. After deploying a new version of a service, the pods start crashing with OOMKilled. The team increased the memory limits in the Deployment manifest, but the pods still crash after a few minutes. The cluster has cluster autoscaling enabled. The node pool has sufficient capacity. What is the most likely cause of the issue?

A.The Horizontal Pod Autoscaler is configured with a wrong target metric
B.The cluster autoscaler is not scaling up quickly enough
C.The application has a memory leak
D.The pods are hitting the node's ephemeral storage limit
AnswerC

Memory leak causes continuously increasing memory usage, leading to OOMKilled even with higher limits.

Why this answer

The pods are crashing with OOMKilled even after increasing memory limits, and the node pool has sufficient capacity. This indicates the application itself has a memory leak, where memory usage grows unbounded over time until it exceeds the new limit, causing the OOMKiller to terminate the pod. Increasing limits only delays the crash if the leak persists.

Exam trap

The trap here is that candidates confuse resource limits with scaling mechanisms, assuming that increasing limits or enabling autoscaling fixes memory exhaustion, rather than recognizing the application-level memory leak as the root cause.

How to eliminate wrong answers

Option A is wrong because the Horizontal Pod Autoscaler (HPA) scales the number of pods based on CPU/memory utilization, but it does not prevent individual pods from being OOMKilled; the issue is per-pod memory exhaustion, not scaling. Option B is wrong because cluster autoscaler scales node count when pods are unschedulable due to resource shortage, but the node pool has sufficient capacity, so the autoscaler is not the bottleneck. Option D is wrong because ephemeral storage limits affect disk space, not memory; OOMKilled is a memory-related termination, not a storage issue.

97
MCQmedium

A company is using Cloud Load Balancing to distribute traffic to a managed instance group (MIG) of web servers. The web servers are currently running in us-central1. To improve availability, the company plans to add a second MIG in us-west1. What must be done to ensure traffic is automatically routed to the closest healthy backend?

A.Use a Network Load Balancer in us-central1 and configure a redirect to the new MIG.
B.Use a global external HTTP(S) load balancer and add both MIGs as backends.
C.Use an internal TCP/UDP load balancer in each region and configure DNS-based routing.
D.Use an external TCP/UDP Network Load Balancer with the new MIG as an additional backend.
AnswerB

Global HTTP(S) load balancer provides cross-region load balancing with intelligent routing.

Why this answer

A global external HTTP(S) load balancer can route traffic to backends in multiple regions and automatically directs requests to the closest healthy backend based on the client's geographic location and backend health. Adding both MIGs as backends to this single anycast IP ensures traffic is distributed to the nearest region without additional DNS-based routing or redirects.

Exam trap

The trap here is that candidates confuse regional load balancers (Network Load Balancer, TCP/UDP Proxy) with global load balancers, assuming any external load balancer can span regions, but only the global external HTTP(S) load balancer (and the global external SSL proxy) support multi-region backends with automatic proximity-based routing.

How to eliminate wrong answers

Option A is wrong because a Network Load Balancer is regional and cannot route traffic across regions; a redirect would introduce a single point of failure and latency, not automatic closest-backend routing. Option C is wrong because internal TCP/UDP load balancers are regional and cannot be used for external traffic; DNS-based routing would require manual configuration and does not provide automatic proximity-based routing with health-aware failover. Option D is wrong because an external TCP/UDP Network Load Balancer is regional (not global) and cannot distribute traffic to backends in multiple regions; it only supports backends within a single region.

98
Multi-Selectmedium

Which TWO of the following are valid methods to enforce data residency at rest in Google Cloud?

Select 2 answers
A.Use a VPC Service Controls perimeter with restricted API access.
B.Use Cloud VPN to encrypt data in transit.
C.Set bucket locations at creation time and use Object Lifecycle Management to prevent cross-region replication.
D.Configure Organization Policies to restrict resource locations via `gcp.resource-locations` constraint.
E.Enable Data Loss Prevention (DLP) API to mask sensitive data.
AnswersC, D

Setting bucket location and disabling replication ensures data remains in the chosen region.

Why this answer

Setting bucket locations at creation time and using Object Lifecycle Management to prevent cross-region replication ensures that data is stored only in the specified region and cannot be moved or replicated to another region. This directly enforces data residency at rest by controlling where the data physically resides within Google Cloud Storage.

Exam trap

In Google Cloud exams, a common pitfall is confusing data residency enforcement (geographic location control) with data protection methods (encryption, masking, access controls). Candidates often select options that secure data but do not enforce the storage location.

99
MCQhard

A global e-commerce platform is experiencing intermittent latency spikes during flash sales. The application is deployed on Google Kubernetes Engine (GKE) with a regional cluster. The architecture includes a frontend service, a product catalog service using Cloud Spanner, and an order processing service using Cloud Pub/Sub. During high load, the catalog service shows increased query latency, and some requests time out. What should the architect prioritize to address the issue?

A.Use Cloud CDN to cache product catalog responses.
B.Increase the number of nodes in the GKE node pool.
C.Enable Cloud Spanner interleaved tables and add secondary indexes for common query filters.
D.Migrate the catalog service from Cloud Spanner to Cloud Bigtable for better read performance.
AnswerC

Secondary indexes and interleaved tables optimize query access patterns, reducing latency.

Why this answer

The issue is specifically with Cloud Spanner query latency under high load. Enabling interleaved tables and adding secondary indexes optimizes data locality and query performance, reducing the need for expensive cross-table joins and full table scans. This directly addresses the root cause of increased latency and timeouts in the catalog service.

Exam trap

The trap here is that candidates often confuse horizontal scaling (adding nodes) with database optimization, overlooking that Cloud Spanner performance issues require schema-level tuning rather than infrastructure scaling.

How to eliminate wrong answers

Option A is wrong because Cloud CDN caches static content at edge locations, but the product catalog service uses Cloud Spanner for dynamic, frequently updated data; caching would serve stale data and not resolve database query latency. Option B is wrong because increasing GKE nodes adds compute capacity but does not fix the underlying database query performance issue; the bottleneck is in Cloud Spanner, not in pod scheduling or node resources. Option D is wrong because Cloud Bigtable is optimized for high-throughput, low-latency key-value lookups, not for complex queries with secondary filters or joins; migrating would require significant architectural changes and may not support the catalog service's query patterns.

100
MCQhard

A company is migrating a legacy application to Google Cloud. The application has a stateful TCP-based protocol that requires client IP persistence. They plan to use a load balancer. Which load balancer type should they choose?

A.External HTTP(S) Load Balancer
B.Internal TCP/UDP Load Balancer
C.External TCP Proxy Load Balancer
D.External Network Load Balancer (passthrough)
AnswerD

This is a passthrough load balancer that preserves the client IP for TCP/UDP traffic.

Why this answer

The External Network Load Balancer (passthrough) is the correct choice because it preserves the original client IP address via direct server return (DSR) and does not terminate the TCP connection. This is essential for stateful TCP-based protocols that require client IP persistence, as the backend instances see the actual client IP and can maintain session state.

Exam trap

The trap here is that candidates confuse 'TCP proxy' with 'TCP passthrough,' assuming any TCP-capable load balancer preserves client IP, but only the passthrough (Network Load Balancer) avoids terminating the TCP connection and maintains the original source IP.

How to eliminate wrong answers

Option A is wrong because the External HTTP(S) Load Balancer is a Layer 7 proxy that terminates TCP connections and replaces the client IP with its own, breaking client IP persistence for stateful TCP protocols. Option B is wrong because the Internal TCP/UDP Load Balancer is designed for internal traffic within a VPC and cannot be used for external client-facing applications. Option C is wrong because the External TCP Proxy Load Balancer terminates TCP connections at the proxy, which changes the source IP and disrupts client IP persistence required by the stateful protocol.

101
MCQhard

Refer to the exhibit. A user creates a snapshot of a persistent disk. Later, they want to create a new VM from this snapshot in the same project but in a different region (europe-west1). Which step is missing or incorrect?

A.The snapshot cannot be used to create a VM in a different region; the user must first create a disk in the same region and then replicate it.
B.The snapshot must be created with '--storage-location=europe-west1' to be usable in that region.
C.The user must wait for the snapshot operation to complete before using it to create a VM.
D.The user must specify the '--region' flag when creating the snapshot to make it available in europe-west1.
AnswerC

Correct: The '--async' flag returns immediately without waiting for the operation to complete. The snapshot must be in a 'READY' state before it can be used.

Why this answer

A snapshot operation is asynchronous; the snapshot must reach the 'READY' state before it can be used to create a VM. Attempting to create a VM from a snapshot that is still being created will fail, as the snapshot data is not yet fully available.

Exam trap

Google Cloud often tests the asynchronous nature of snapshot creation, trapping candidates who assume the snapshot is immediately available after the create command returns.

How to eliminate wrong answers

Option A is wrong because snapshots in Google Cloud are global resources; they can be used to create disks in any region, regardless of where the original disk resided. Option B is wrong because the '--storage-location' flag only controls where the snapshot is stored (e.g., for compliance), not its regional availability; snapshots are inherently global. Option D is wrong because snapshots are global resources and do not have a '--region' flag; they are not tied to a specific region.

102
MCQmedium

A company has multiple GCP projects under a folder. They want to define a custom IAM role that can be reused across all projects. Where should the custom role be defined?

A.At the folder level
B.At the project level
C.At the organization level
D.At the resource level
AnswerA

Folder-level roles apply to all projects in that folder.

Why this answer

Custom roles can be defined at the organization level, folder level, or project level. To reuse across all projects, the role should be defined at the organization level or at the folder level if the folder contains all projects.

103
MCQhard

During a load test, an application running on GKE experiences high latency and errors. You suspect the issue is due to insufficient cluster resources. Which gcloud command should you use to quickly check the current resource utilization of all nodes in the cluster?

A.gcloud container clusters describe
B.gcloud container clusters list
C.gcloud container clusters get-credentials
D.gcloud compute instances list
AnswerD

This command lists all compute instances, including GKE cluster nodes, and shows their status. While it does not display real-time CPU/memory usage, it quickly provides a list of nodes and their current state, which can help identify if nodes are down or overutilized based on status. However, for exact resource utilization, you would use kubectl top nodes.

Why this answer

None of the listed gcloud commands shows current resource utilization of GKE nodes. gcloud container clusters describe shows configuration, gcloud container clusters list lists clusters, gcloud container clusters get-credentials retrieves credentials, and gcloud compute instances list only lists instances and their status. The correct command for current CPU/memory utilization is kubectl top nodes.

Exam trap

Do not assume that gcloud container clusters describe or gcloud compute instances list shows resource utilization. They do not provide current CPU/memory metrics; use kubectl top nodes for that.

104
MCQeasy

A developer needs to programmatically create and manage Compute Engine instances. Which Google Cloud service should they use to authenticate and authorize service accounts?

A.Cloud Audit Logs
B.Cloud Key Management Service (KMS)
C.Cloud Scheduler
D.Cloud IAM
AnswerD

IAM manages service accounts and permissions.

Why this answer

Cloud IAM is the correct service because it provides the identity and access management framework for authenticating and authorizing service accounts. When a developer creates Compute Engine instances, they must attach a service account and grant IAM roles (e.g., roles/compute.instanceAdmin) to define what actions that service account can perform. Cloud IAM handles the authentication via OAuth 2.0 tokens and authorization via role-based access control (RBAC), making it the foundational service for managing service account permissions.

Exam trap

Google Cloud often tests the misconception that Cloud Audit Logs or Cloud KMS can handle authentication/authorization, but candidates must remember that only Cloud IAM manages identities and permissions, while the other options serve logging or encryption purposes.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs is a logging service that records API calls and administrative actions, not a service for authenticating or authorizing service accounts. Option B is wrong because Cloud Key Management Service (KMS) manages cryptographic keys for encryption, not identity or permission management for service accounts. Option C is wrong because Cloud Scheduler is a cron-job service for triggering tasks on a schedule, and it has no role in authentication or authorization of service accounts.

105
MCQeasy

An organization wants to enforce that all container images deployed to Google Kubernetes Engine (GKE) clusters are signed by an authorized authority and only those images are allowed to run. Which GCP service should they use?

A.Cloud Key Management Service (Cloud KMS)
B.Binary Authorization
C.Cloud Build
D.Artifact Registry
AnswerB

Binary Authorization is the correct service for requiring signed container images.

Why this answer

Binary Authorization enforces deployment-time policies that require container images to be signed by trusted authorities before they can be deployed to GKE.

106
Multi-Selectmedium

A company wants to reduce costs for their BigQuery workloads. Which TWO actions will help achieve this?

Select 2 answers
A.Use clustered and partitioned tables to limit data scanned
B.Use flat-rate pricing with BigQuery slot reservations
C.Enable compression on exported data
D.Delete unnecessary datasets
E.Use materialized views to pre-compute results
AnswersA, B

Clustering and partitioning reduce the data processed, lowering costs.

Why this answer

Using flat-rate pricing with slot reservations provides predictable costs, and using clustered and partitioned tables reduces the amount of data scanned per query, lowering on-demand costs. Materialized views can reduce costs but are not always needed. Deleting datasets and compression are not relevant.

107
MCQeasy

A company is planning to deploy a global web application on Google Cloud. They expect low latency for users worldwide and need to serve static content (images, CSS) as well as dynamic API responses. Which architecture should they use?

A.Use Cloud CDN in front of an external HTTPS Load Balancer with backend services in multiple regions.
B.Use Cloud NAT to allow egress traffic from instances and distribute static content via a shared VPC.
C.Use Cloud DNS with geo-routing to direct users to the closest regional Cloud Run service.
D.Use VPC Network Peering to connect multiple regional VPCs and serve content from a central location.
AnswerA

Cloud CDN caches static content at edge, and Load Balancer routes dynamic requests to nearest backend.

Why this answer

Cloud CDN in front of an external HTTPS Load Balancer with backend services in multiple regions is correct because it provides global anycast IP termination, low-latency content delivery via Google's edge cache for static content, and dynamic API requests are forwarded to the nearest healthy backend in the closest region. This architecture meets both the low-latency requirement for users worldwide and the need to serve both static and dynamic content efficiently.

Exam trap

Google Cloud often tests the misconception that DNS geo-routing alone (Option C) can provide low-latency global content delivery, but it lacks caching and introduces DNS resolution delays, making it unsuitable for static content without a CDN.

How to eliminate wrong answers

Option B is wrong because Cloud NAT is used for outbound internet access from private instances, not for distributing static content or reducing latency for global users; it does not provide any caching or global load balancing. Option C is wrong because Cloud DNS with geo-routing directs traffic based on DNS resolution, but it cannot cache static content and introduces DNS propagation delays; Cloud Run services alone do not include a CDN for static assets. Option D is wrong because VPC Network Peering connects VPCs for private networking but does not provide global load balancing, caching, or low-latency content delivery; serving from a central location would increase latency for distant users.

108
MCQeasy

A company wants to set a monthly spending limit for their Compute Engine usage and receive alerts when spending exceeds a threshold. Which tool should they use?

A.Cloud Monitoring
B.Cloud Budget alerts
C.Cloud Logging
D.Cloud Armor
AnswerB

Budget alerts send notifications when spending reaches a defined threshold.

Why this answer

Budget alerts in Cloud Billing allow you to set a spending budget and receive notifications when actual spending exceeds thresholds. They can be scoped to projects or services.

109
MCQeasy

A company is migrating 50 TB of on-premises file server data to Cloud Storage. The network bandwidth is limited to 100 Mbps. What is the most cost-effective and time-efficient migration method?

A.Use gsutil cp to copy files directly
B.Use gsutil rsync to synchronize
C.Use Transfer Appliance
D.Use Storage Transfer Service
AnswerC

Transfer Appliance is the fast, cost-effective option for large on-prem data migrations over slow networks.

Why this answer

Transfer Appliance is Google's physical device for transferring large amounts of data when network is slow or expensive. It avoids lengthy uploads over limited bandwidth. Storage Transfer Service is for cloud-to-cloud, not on-prem. gsutil cp and rsync over 100 Mbps would take weeks.

110
MCQmedium

A developer needs to securely store a database password that will be used by a Compute Engine instance. The password must be rotated automatically every 30 days. Which service should they use?

A.Cloud KMS
B.Cloud Storage with encryption
C.Environment variables
D.Secret Manager
AnswerD

Secret Manager stores secrets and supports automatic rotation every 30 days.

Why this answer

Secret Manager is designed for storing secrets like API keys and passwords, and it supports automatic rotation schedules. Cloud KMS is for encryption keys, not generic secrets. Cloud Storage can store encrypted data but does not natively support rotation.

Environment variables are insecure and not managed.

111
Multi-Selecthard

A company is designing a disaster recovery plan for a critical application running on Compute Engine. The application uses a PostgreSQL database and stores files on persistent disks. The recovery time objective (RTO) is 4 hours, and the recovery point objective (RPO) is 1 hour. Which two actions should the company take?

Select 2 answers
A.Create an instance template for the application and store it in Cloud Storage.
B.Take hourly persistent disk snapshots and store them in the same region.
C.Configure PostgreSQL replication to a standby instance in another region.
D.Use Cloud Storage to store database backups and transfer them to a different region daily.
E.Use snapshot replication to copy persistent disk snapshots to another region.
AnswersC, E

Database replication ensures minimal data loss and fast failover, meeting RPO and RTO.

Why this answer

PostgreSQL replication to a standby instance in another region meets both the RPO of 1 hour (near-real-time replication keeps data loss minimal) and the RTO of 4 hours (a standby can be promoted quickly). This is a standard disaster recovery pattern for cross-region resilience, ensuring that database changes are continuously replicated with minimal lag.

Exam trap

Google Cloud often tests the distinction between snapshot replication (which provides crash-consistent, point-in-time copies) and database-native replication (which provides transaction-consistent, near-real-time copies), leading candidates to choose snapshot replication for RPOs under 1 hour when database replication is actually required.

112
Multi-Selecthard

A company wants to implement a CI/CD pipeline for a Java application that will be deployed to Cloud Run. They use Cloud Build and Artifact Registry. The pipeline must compile the Java code, run unit tests, build a container image, and deploy to Cloud Run. Which THREE steps are required in the cloudbuild.yaml? (Choose 3)

Select 3 answers
A.Step with image 'gcloud' and entrypoint: 'gcloud', args: ['container', 'clusters', 'get-credentials']
B.Step with image 'docker' and args: ['build', '-t', '...']
C.Step with image 'maven' and args: ['mvn', 'compile', 'test']
D.Step with image 'node' and entrypoint: 'npm', args: ['test']
E.Step with image 'gcloud' and entrypoint: 'gcloud', args: ['run', 'deploy', ...]
AnswersB, C, E

This builds the container image.

Why this answer

To compile Java, use a Maven or Gradle step. Build the image using docker build. Deploy to Cloud Run using gcloud run deploy.

113
MCQmedium

A company stores sensitive customer data in Cloud Storage buckets. They want to ensure that access to these buckets is only allowed from within their VPC network. Which configuration should they use?

A.Bucket IAM policies with condition on service account
B.Cloud Armor WAF rules
C.Private Google Access for on-premises
D.VPC Service Controls with a service perimeter
AnswerD

Restricts access to authorized VPCs and prevents data exfiltration.

Why this answer

D is correct because VPC Service Controls (VPC-SC) allow you to define a service perimeter that restricts access to Google Cloud Storage (and other managed services) to only requests originating from a specified VPC network. This ensures that data exfiltration and unauthorized access from outside the VPC are blocked, even if the bucket is publicly accessible or IAM allows broader access.

Exam trap

The trap here is that candidates often confuse VPC Service Controls with Private Google Access or IAM conditions, not realizing that VPC-SC is the only option that enforces network-level boundaries for Google-managed services like Cloud Storage.

How to eliminate wrong answers

Option A is wrong because Bucket IAM policies with a condition on a service account can restrict which service account can access the bucket, but they do not limit access to only requests from within a VPC network; the request could still come from outside the VPC if the service account is used elsewhere. Option B is wrong because Cloud Armor WAF rules are designed to protect HTTP(S) load-balanced applications from web attacks, not to enforce network-level access controls for Cloud Storage buckets accessed via gRPC or REST APIs. Option C is wrong because Private Google Access for on-premises allows on-premises hosts (using private IPs) to reach Google APIs and services, but it does not restrict access to only within a VPC; it actually enables access from outside the VPC, which is the opposite of the requirement.

114
MCQmedium

A company is deploying a multi-region web application that must provide sub-second read latency globally for a small dataset (under 100 MB) that is updated infrequently. They want a fully managed service that caches data close to users. Which service should they use?

A.Memorystore for Redis with replication across regions
B.Cloud Spanner multi-region
C.Cloud Firestore in multi-region mode
D.Cloud CDN
AnswerD

CDN caches content at edge locations; ideal for static or infrequently updated data with sub-second global latency.

Why this answer

Cloud CDN with HTTP(S) Load Balancing caches static content at edge locations globally, providing low-latency access. For small, infrequently updated data, CDN is cost-effective and simple.

115
MCQhard

An organization has multiple projects in Google Cloud and wants to centralize logging and monitoring for all projects. They need to aggregate logs from all projects into a single project for analysis. Which approach should they use?

A.Export logs from each project to a Cloud Storage bucket and then import them into BigQuery.
B.Enable Cloud Audit Logs for all projects and view them from the central project.
C.Install the Stackdriver agent on all VMs and point them to the central project.
D.Create a logs sink in each project that exports logs to a BigQuery dataset in the central project.
AnswerD

Logs sinks can route any log entries to BigQuery.

Why this answer

Google Cloud's logs sink feature allows you to route logs from multiple source projects to a centralized BigQuery dataset in a single destination project. This approach aggregates logs efficiently without requiring agents or manual import steps, and it supports real-time log export for analysis.

Exam trap

The trap here is that candidates confuse the Stackdriver agent (which collects logs from VMs) with the logs sink feature (which routes logs from projects), leading them to choose Option C instead of the correct centralized export method.

How to eliminate wrong answers

Option A is wrong because exporting logs to Cloud Storage and then importing them into BigQuery adds unnecessary latency and complexity; logs sinks can export directly to BigQuery. Option B is wrong because Cloud Audit Logs are enabled per project and cannot be centrally viewed without aggregation; they must be exported via sinks to a central project. Option C is wrong because the Stackdriver agent (now legacy) is used for collecting VM metrics and logs, but it cannot aggregate logs from multiple projects into a single central project; logs sinks are the correct mechanism for cross-project log aggregation.

116
MCQhard

A healthcare organization uses Cloud Storage to store protected health information (PHI). They have a compliance requirement to ensure that all objects in the bucket are encrypted with a customer-managed key (CMK) that is rotated every 90 days. They also need to log all access to the bucket and detect anomalous access patterns. Which combination of Google Cloud services should they use?

A.Cloud Storage with default encryption, Cloud Audit Logs, and Security Command Center
B.Cloud Storage with CMEK via Cloud HSM, Cloud Audit Logs, and Cloud DLP
C.Cloud Storage with CSEK, Cloud Audit Logs, and Security Command Center
D.Cloud Storage with CMEK via Cloud KMS, Cloud Audit Logs, and Chronicle
AnswerD

CMEK uses Cloud KMS for key management, Cloud Audit Logs for logging, and Chronicle for anomaly detection.

Why this answer

Cloud Storage with CMEK via Cloud KMS allows the organization to use a customer-managed key that can be rotated every 90 days, meeting the compliance requirement. Cloud Audit Logs capture all access to the bucket, and Chronicle provides advanced security analytics to detect anomalous access patterns, fulfilling the logging and detection needs.

Exam trap

The trap here is confusing the key management options (CMEK vs. CSEK vs. default encryption) and the security analytics tools (Security Command Center vs. Chronicle), where candidates often pick Security Command Center for anomaly detection when Chronicle is specifically designed for log-based threat detection.

How to eliminate wrong answers

Option A is wrong because default encryption uses Google-managed keys, not a customer-managed key (CMK), and Security Command Center provides vulnerability scanning but not the specific anomalous access pattern detection required. Option B is wrong because Cloud HSM is a hardware security module service for key management, but the question specifies CMEK via Cloud KMS, and Cloud DLP is for data loss prevention, not for logging or detecting anomalous access patterns. Option C is wrong because CSEK (customer-supplied encryption keys) requires the customer to manage the key material directly, which does not support automatic rotation every 90 days as needed, and Security Command Center is not designed for real-time anomalous access pattern detection like Chronicle.

117
MCQmedium

A company monitors their application with Cloud Monitoring. They set up an alerting policy to notify the on-call team when the 99th percentile latency exceeds 500 ms for 5 minutes. However, they receive false positive alerts due to short bursts. How should they refine the policy?

A.Set up alerting on each data point individually.
B.Decrease the threshold to 400 ms.
C.Change the metric to average latency instead of 99th percentile.
D.Increase the evaluation window to 10 minutes.
AnswerD

Longer window filters out transient spikes, alerting only on sustained high latency.

Why this answer

Increasing the evaluation window to 10 minutes smooths out short bursts of high latency, ensuring the alert triggers only when the 99th percentile latency exceeds 500 ms for a sustained period. Cloud Monitoring evaluates metrics over the specified window, so a longer window reduces false positives from transient spikes while still detecting genuine degradation.

Exam trap

Google Cloud often tests the misconception that lowering thresholds or changing percentiles reduces false positives, when in reality the evaluation window duration is the key lever for filtering out short-lived bursts without sacrificing sensitivity to sustained issues.

How to eliminate wrong answers

Option A is wrong because setting up alerting on each data point individually would make the policy hypersensitive to every single spike, increasing false positives rather than reducing them. Option B is wrong because decreasing the threshold to 400 ms would cause the alert to fire even more frequently, including during normal operation, exacerbating the false positive problem. Option C is wrong because changing the metric to average latency masks tail latency issues; the 99th percentile is specifically used to catch outliers, and averaging would hide the very bursts they want to monitor, potentially missing real problems.

118
Multi-Selectmedium

A company wants to implement a disaster recovery strategy for their critical workloads on GCP. They require an RPO of 15 minutes and an RTO of 1 hour. Which THREE components should they include in their architecture? (Choose 3)

Select 3 answers
A.Persistent disk snapshots copied to a secondary region every 15 minutes
B.Multi-region Cloud Storage bucket with object versioning
C.Managed Instance Groups in the secondary region with a global load balancer
D.Cloud CDN to cache content and reduce latency
E.Cloud SQL with cross-region replication enabled
AnswersB, C, E

Multi-region bucket provides automatic geo-redundancy for backups and static data.

Why this answer

Multi-region Cloud Storage for backups or data replication, Cloud SQL cross-region replication for databases, and MIGs in a secondary region with a global load balancer for compute failover meet the RPO/RTO. Persistent disk snapshots copied across regions are too slow for 15-minute RPO. Cloud Spanner multi-region is possible but not listed; the combination of these three services provides the required RPO/RTO.

119
Matchingmedium

Match each GCP database service to its type.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Managed relational database (MySQL, PostgreSQL, SQL Server)

NoSQL document database

NoSQL wide-column database

Horizontally scalable relational database

Managed Redis or Memcached

Why these pairings

Correct matches: Cloud SQL (Relational), Firestore (NoSQL document), Bigtable (NoSQL wide-column). Common confusions include mistaking Cloud Spanner or Memorystore for other types, or confusing Datastore with cache services.

120
MCQeasy

A startup wants to deploy a web application on Google Cloud with a MySQL database. They anticipate low traffic initially but want the ability to scale seamlessly. They also want to minimize operational overhead. Which combination of services should they choose?

A.Compute Engine with a self-managed MySQL instance.
B.Cloud Run with Cloud Spanner.
C.App Engine Standard Environment with Cloud SQL.
D.Google Kubernetes Engine (GKE) with Cloud SQL.
AnswerC

App Engine Standard auto-scales and is serverless; Cloud SQL is managed.

Why this answer

App Engine Standard Environment provides a fully managed, autoscaling platform for web applications, while Cloud SQL offers a managed MySQL database with automatic replication and backups. This combination minimizes operational overhead because Google handles infrastructure provisioning, patching, and scaling, and Cloud SQL integrates natively with App Engine via the Cloud SQL proxy or Unix socket, requiring no manual configuration for connectivity.

Exam trap

Google Cloud often tests the misconception that Kubernetes (GKE) is always the best choice for scalability, but the trap here is that for a low-traffic application with minimal operational overhead requirements, a fully managed platform like App Engine Standard Environment is more appropriate than the complex orchestration overhead of GKE.

How to eliminate wrong answers

Option A is wrong because Compute Engine with a self-managed MySQL instance requires the startup to manually handle OS patching, database backups, replication, and scaling, which increases operational overhead and contradicts the goal of minimizing it. Option B is wrong because Cloud Spanner is a globally distributed, strongly consistent relational database designed for high-throughput, horizontal scaling, which is overkill and more expensive for a low-traffic web application that only needs a MySQL-compatible database. Option D is wrong because Google Kubernetes Engine (GKE) introduces significant operational complexity for managing container orchestration, node pools, and networking, which is unnecessary for a low-traffic application that could be served by a simpler, fully managed platform like App Engine.

121
MCQeasy

A startup wants to deploy a containerized application with minimal operational overhead. They expect variable traffic. Which compute option should they choose?

A.App Engine Flexible Environment
B.Cloud Run
C.Compute Engine single VM
D.Google Kubernetes Engine (GKE)
AnswerB

Fully managed serverless container platform that auto-scales.

Why this answer

Cloud Run is the correct choice because it is a fully managed serverless compute platform that automatically scales from zero based on traffic, charges only for resources used during request processing, and eliminates all infrastructure management. This aligns perfectly with the startup's requirement for minimal operational overhead and handling variable traffic patterns without provisioning or scaling concerns.

Exam trap

The trap here is that candidates often confuse Cloud Run with App Engine Flexible Environment, assuming both are fully managed, but App Engine Flexible Environment does not scale to zero and requires VM-level management, making Cloud Run the only option that truly minimizes operational overhead for variable traffic.

How to eliminate wrong answers

Option A is wrong because App Engine Flexible Environment requires you to manage the underlying VM instances and does not scale to zero, incurring costs even when idle, which contradicts the goal of minimal operational overhead and cost efficiency for variable traffic. Option C is wrong because a single Compute Engine VM provides no autoscaling, requires manual capacity planning and maintenance, and cannot handle variable traffic without manual intervention or over-provisioning, leading to either downtime or wasted resources. Option D is wrong because Google Kubernetes Engine (GKE) introduces significant operational overhead for cluster management, node scaling, and Kubernetes configuration, which is excessive for a simple containerized application with variable traffic and contradicts the 'minimal operational overhead' requirement.

122
Multi-Selectmedium

A company wants to back up their GKE cluster's etcd data and persistent volumes for disaster recovery. They are evaluating Velero. Which two components does Velero require to perform backups? (Choose two.)

Select 1 answer
A.A separate database such as Cloud SQL
B.A Velero plugin for each persistent volume
C.A dedicated backup server with stateful storage
D.A Cloud Storage bucket for backup storage
E.Access to the cluster's kubeconfig file
AnswersD

A Cloud Storage bucket is required as the durable storage destination for backup artifacts, including resource definitions and volume snapshots.

Why this answer

Velero requires two core components: a storage destination (like a Cloud Storage bucket) to store backup artifacts, and a service account with appropriate IAM permissions to authenticate with the Google Cloud APIs and access cluster resources. A kubeconfig file is used for client-side kubectl operations, not as a component for Velero backups. Velero uses its own service account to communicate with the Kubernetes API server and trigger volume snapshots.

Therefore, only option D is correct; option E is incorrect because Velero does not require a kubeconfig file.

123
MCQeasy

To achieve a 99.999% availability SLA for a globally distributed application using Cloud Spanner, which configuration is required?

A.Multi-region instance configuration
B.Fine-grained access control
C.Single-region instance configuration
D.Customer-managed encryption keys (CMEK)
AnswerA

Multi-region provides 99.999% SLA.

Why this answer

Cloud Spanner multi-region configuration provides 99.999% SLA. Single-region offers 99.99%. Fine-grained access control and customer-managed encryption keys (CMEK) do not affect availability SLA.

124
MCQmedium

A company runs batch analytics workloads on Compute Engine that can tolerate interruptions. They want to reduce compute costs by up to 60-90%. Which compute option is the most cost-effective?

A.On-demand VMs
B.Committed use discounts (1-year)
C.Preemptible VMs
D.Sustained use discounts
AnswerC

Preemptible VMs provide up to 90% discount and are suitable for batch workloads that can be interrupted.

Why this answer

Preemptible VMs offer significant discounts (60-90%) for interruptible workloads. Spot VMs are the newer equivalent with same discounts but no max runtime limit.

125
Multi-Selectmedium

An organization needs to implement a change management process for a mission-critical application on GKE. They want to validate performance before full rollout and be able to roll back quickly. Which THREE practices should they adopt? (Choose THREE.)

Select 3 answers
A.Deploy changes directly to production
B.Implement canary deployments with traffic splitting
C.Use feature flags to enable/disable features dynamically
D.Manually monitor and roll back if issues appear
E.Define automated rollback policies in Cloud Deploy
AnswersB, C, E

Canary deployments allow gradual traffic shifting and validation.

Why this answer

Phased rollouts (canary) and gradual traffic shifting allow validation and rollback. Feature flags enable toggling features without redeployment. Automated rollback policies ensure quick recovery.

Direct rollout to production is risky. Manual rollback is slow.

126
MCQeasy

Which Google Cloud service provides a fully managed, auto-scaling environment for running stateless HTTP(S) web applications using a variety of supported programming languages?

A.Cloud Functions
B.Google Kubernetes Engine
C.Compute Engine
D.App Engine Standard
AnswerD

App Engine Standard provides a fully managed, auto-scaling environment for web apps with supported runtimes.

Why this answer

App Engine Standard is the correct choice because it is a fully managed, auto-scaling platform specifically designed for stateless HTTP(S) web applications. It supports multiple programming languages (e.g., Python, Java, Go, PHP, Node.js) and automatically handles scaling, load balancing, and patching, allowing developers to focus on code without managing infrastructure.

Exam trap

The trap here is that candidates often confuse App Engine Standard with App Engine Flexible, which offers more customization but is not fully managed in the same way, or they mistakenly think Cloud Functions can serve persistent web applications, but Cloud Functions is limited to stateless, event-driven functions with a maximum timeout of 9 minutes and no support for persistent HTTP sessions.

How to eliminate wrong answers

Option A is wrong because Cloud Functions is a serverless compute service for event-driven, short-lived functions, not designed for persistent web applications requiring HTTP(S) request handling with full web frameworks. Option B is wrong because Google Kubernetes Engine (GKE) provides a managed Kubernetes cluster but requires manual configuration of auto-scaling, node pools, and cluster management, not a fully managed environment where the platform handles scaling automatically without user intervention. Option C is wrong because Compute Engine offers virtual machines with full control over the OS and scaling, but it is not fully managed—users must configure auto-scaling groups, health checks, and load balancers themselves, and it does not provide a built-in runtime for web applications.

127
MCQhard

Refer to the exhibit. A developer is trying to connect to the Kubernetes API server from their workstation using the master IP (34.67.89.12) but receives a timeout. The developer can reach other external IPs. What is the most likely reason for the timeout?

A.The cluster is in a different region than the developer's VPC.
B.The developer's workstation does not have the required firewall rule to allow traffic to the master IP.
C.The private cluster is configured with a private endpoint and public endpoint disabled, so the master IP is not accessible from outside the VPC.
D.The Kubernetes Engine API is not enabled in the developer's project.
AnswerC

The cluster configuration shows enablePrivateEndpoint: true and publicEndpoint: false, meaning the API server endpoint is private and not reachable from the internet.

Why this answer

A private GKE cluster with a private endpoint and public endpoint disabled means the Kubernetes API server is only reachable from within the cluster's VPC network. The developer's workstation is outside the VPC, so attempts to reach the master IP (34.67.89.12) will time out, even though other external IPs are reachable. This is a common configuration for security-sensitive workloads that require the API server to be isolated from the public internet.

Exam trap

Google PCA often tests the distinction between a private GKE cluster with public endpoint disabled versus a cluster that is simply in a different region or has firewall issues, leading candidates to overlook the fact that a timeout from outside the VPC indicates the endpoint is not publicly accessible.

How to eliminate wrong answers

Option A is wrong because the cluster being in a different region than the developer's VPC does not inherently cause a timeout; cross-region connectivity is possible via public internet or VPN, and the developer can reach other external IPs, so region mismatch is not the issue. Option B is wrong because the developer's workstation firewall rules are irrelevant if the cluster's API server endpoint is not exposed to the public internet; the timeout occurs at the network level before any firewall on the workstation is evaluated. Option D is wrong because if the Kubernetes Engine API were not enabled, the developer would likely receive an API error (e.g., 403 or 404) rather than a timeout; a timeout indicates a network connectivity issue, not a disabled API.

128
MCQmedium

A company is planning a phased migration of their on-premises database to Cloud SQL. They want to minimize downtime and ensure data consistency. Which approach should they use?

A.Use Database Migration Service (DMS)
B.Lift and shift the database server to Compute Engine
C.Export the database to a SQL dump file and import into Cloud SQL
D.Use VM migration to move the database server
AnswerA

DMS provides continuous replication, minimizing downtime.

Why this answer

Database Migration Service (DMS) supports continuous replication with minimal downtime. Export and import involves downtime. Lift-and-shift is not a GCP service.

VM migration is for servers, not databases.

129
Multi-Selecthard

An e-commerce platform runs on GKE with Autopilot. The team wants to perform a canary deployment where 10% of traffic goes to a new version. They need to monitor the canary's error rate and latency, and automatically roll back if thresholds are exceeded. Which TWO services or features should they use together?

Select 2 answers
A.GKE Autopilot node pools
B.Cloud Scheduler
C.Cloud Monitoring
D.Cloud Deploy
E.Traffic Director
AnswersC, D

Cloud Monitoring can set up alerts on error rate and latency to trigger automatic rollback.

Why this answer

Cloud Deploy can orchestrate canary deployments with traffic splitting. Cloud Monitoring provides alerting that can trigger rollbacks. GKE Autopilot does not support node management.

Traffic Director is for service mesh traffic management but not directly for canary deployments with automatic rollback. Cloud Scheduler is for cron jobs, not deployment.

130
MCQeasy

A company deploys a stateful workload using StatefulSets on GKE. They want to ensure that if a pod is evicted, its persistent volume claim (PVC) is reattached to the replacement pod in the same zone. Which configuration achieves this?

A.Use a StatefulSet with a volumeClaimTemplate referencing a persistent disk in the same zone.
B.Use a Deployment with a PVC that has allowedTopologies restricting to the desired zone.
C.Use a Deployment with a persistent volume that is manually attached after pod creation.
D.Use a StatefulSet with a persistent disk that has access mode ReadOnlyMany.
AnswerA

StatefulSet ensures stable pod identity and PVC reattachment; zone affinity ensures the disk is in the same zone.

Why this answer

StatefulSets are designed for stateful workloads and guarantee stable network identities and persistent storage. When a pod is evicted, the StatefulSet controller ensures the replacement pod uses the same PVC, which is bound to a GCE Persistent Disk in the same zone as the original pod, provided the volumeClaimTemplate specifies a disk in that zone. This maintains data locality and avoids cross-zone reattachment.

Exam trap

Google Cloud often tests the misconception that Deployments can handle stateful workloads with persistent storage, but they lack the ordinal identity and PVC reattachment guarantees that StatefulSets provide for zone-pinned recovery.

How to eliminate wrong answers

Option B is wrong because Deployments do not guarantee stable pod identities or PVC reattachment to the same zone; allowedTopologies can restrict where a PVC is created but do not ensure the replacement pod reuses the same PVC after eviction. Option C is wrong because manually attaching a persistent volume after pod creation is not automated and defeats the purpose of a self-healing, declarative Kubernetes setup. Option D is wrong because ReadOnlyMany access mode allows multiple pods to read the same volume but does not ensure zone-pinned reattachment or single-pod write access, and StatefulSets typically use ReadWriteOnce for stateful workloads.

131
MCQmedium

A DevOps team is building a CI/CD pipeline for a microservices application deployed on Google Kubernetes Engine. They want to ensure that each microservice can be deployed independently without affecting other services. Which strategy should they use?

A.Implement canary deployments with a service mesh such as Istio and use separate Cloud Build triggers per microservice.
B.Use blue/green deployments with a global load balancer to switch traffic.
C.Use Cloud Deploy with rollout strategies and keep all microservices in the same GKE namespace.
D.Create a single monolithic pipeline that deploys all microservices simultaneously.
AnswerA

Canary releases with service mesh enable fine-grained traffic management per microservice.

Why this answer

It combines canary deployments with a service mesh (Istio) to gradually shift traffic to a new version of a single microservice, ensuring independent deployment without impacting other services. Separate Cloud Build triggers per microservice allow each service to be built and deployed independently, aligning with the microservices architecture's requirement for decoupled release cycles.

Exam trap

Google Cloud often tests the distinction between deployment strategies that affect the entire application (blue/green, global load balancer) versus those that allow per-service granularity (canary with service mesh), and candidates may mistakenly choose blue/green because it is a well-known pattern, ignoring the requirement for independent microservice deployments.

How to eliminate wrong answers

Option B is wrong because blue/green deployments with a global load balancer are typically used for switching traffic between entire application versions, not for independently deploying individual microservices; this approach would require coordinating all services together, violating the independence requirement. Option C is wrong because keeping all microservices in the same GKE namespace does not prevent cross-service impact during deployment; Cloud Deploy's rollout strategies apply to the entire set of services in that namespace, not per microservice. Option D is wrong because a single monolithic pipeline that deploys all microservices simultaneously directly contradicts the goal of independent deployment; any failure or change in one service would block or affect all others.

132
MCQmedium

A company has a global user base and wants to serve static content (images, videos, CSS) with low latency from edge locations. They also want to protect their origin server from traffic spikes. Which combination of services should they use?

A.Cloud Armor with Cloud CDN
B.Cloud CDN with an internal TCP/UDP load balancer
C.Cloud CDN with an external HTTP(S) Load Balancer
D.Cloud Functions to serve static content
AnswerC

This combination caches content at edge locations and distributes traffic globally, protecting the origin.

Why this answer

Cloud CDN caches content at Google's edge locations, providing low-latency delivery and offloading traffic from the origin. HTTP(S) Load Balancer is required to enable Cloud CDN and provides global load balancing and DDoS protection. Cloud Armor adds WAF capabilities but is not required for basic CDN.

133
Multi-Selectmedium

A company is migrating a legacy Java application to GCP. The application currently runs on a single on-premises server with a MySQL database. They want to minimize changes to the application code but take advantage of GCP managed services. Which TWO approaches should they consider? (Choose 2)

Select 2 answers
A.Use Firebase Realtime Database to replace MySQL.
B.Use Cloud Functions to replace the application logic.
C.Lift and shift the application to Compute Engine and use Cloud SQL for MySQL.
D.Migrate the database to Cloud SQL for MySQL with minimal changes.
E.Re-architect the application as a set of microservices on GKE.
AnswersC, D

Lift-and-shift moves the server to Compute Engine; using Cloud SQL for MySQL as the database is re-platforming with minimal code change.

Why this answer

Lift-and-shift (migrating the application to Compute Engine as-is) and re-platform (using Cloud SQL for MySQL) are the best approaches to minimize code changes. Re-architecting as microservices would require significant code changes. Cloud Functions and Firebase are not suitable for a legacy Java application.

134
MCQeasy

A company is using Cloud NAT to allow private instances to access the internet. They notice that outbound connections are failing intermittently. What is the most likely cause?

A.The private instances are using the wrong DNS server.
B.The VPC firewall rules are blocking egress traffic.
C.Cloud NAT does not support TCP connections.
D.The number of concurrent connections exceeds the Cloud NAT source port capacity for the assigned NAT IPs.
AnswerD

Cloud NAT has limited ports per public IP; exhaustion causes intermittent drops.

Why this answer

Cloud NAT uses source network address translation (SNAT) to map private instance IPs to a single public IP address. Each NAT IP has a limited pool of source ports (typically 64,512 per IP for TCP/UDP). When concurrent connections exceed this capacity, new outbound connections are dropped, causing intermittent failures.

This is the most likely cause given the symptom of intermittent failures.

Exam trap

The trap here is that candidates confuse intermittent failures with firewall misconfigurations or DNS issues, but the key clue is 'intermittent'—which points to a resource exhaustion problem like port capacity, not a static policy or configuration error.

How to eliminate wrong answers

Option A is wrong because DNS server misconfiguration would cause name resolution failures, not intermittent connection drops after resolution; Cloud NAT operates at the network layer and is independent of DNS. Option B is wrong because VPC firewall rules blocking egress traffic would cause consistent, not intermittent, failures; the question states failures are intermittent, which points to resource exhaustion rather than a static rule. Option C is wrong because Cloud NAT explicitly supports TCP, UDP, and ICMP connections; it performs SNAT for all these protocols.

135
Multi-Selectmedium

Which TWO statements about Google Cloud VPC firewall rules are correct? (Choose two.)

Select 2 answers
A.Firewall rules are stateless and require explicit rules for return traffic.
B.Firewall rules allow you to specify both source and destination IP ranges.
C.Default VPC has firewall rules that block all ingress traffic.
D.Firewall rules cannot be applied to instances by service account.
E.Hierarchical firewall policies can be applied to the organization, folder, or project level.
AnswersB, E

Rules can have source and destination filters.

Why this answer

Google Cloud VPC firewall rules are stateful and allow you to specify both source and destination IP ranges in a single rule. This enables granular control over traffic direction, such as allowing ingress from a specific source CIDR to a specific destination CIDR within the VPC.

Exam trap

Google Cloud often tests the misconception that firewall rules are stateless or that the default VPC blocks all ingress, when in fact Google Cloud VPC rules are stateful and the default VPC allows specific ingress traffic (ICMP, RDP, SSH) from any source.

136
MCQhard

A company runs a batch processing workload on Compute Engine instances. The workload is triggered every hour and runs for about 10 minutes. They want to reduce costs. They currently use preemptible VMs, but they notice that sometimes the workload fails because VMs are preempted before completion. They need a cost-effective solution that ensures the workload completes reliably. What should they do?

A.Increase the machine size of the preemptible VMs to finish faster.
B.Provision a commitment-based discount for standard VMs.
C.Use standard (non-preemptible) VMs to avoid preemption.
D.Create a custom machine type with minimal resources and use a managed instance group with preemptible VMs, combined with a startup script that retries on failure.
AnswerD

Custom machine types match the exact resource needs, avoiding waste. Preemptible VMs are cheap, and the managed instance group will recreate VMs if preempted. A startup script that retries ensures reliability.

Why this answer

It combines the cost savings of preemptible VMs with reliability through a managed instance group (MIG) and a retry startup script. The MIG automatically recreates VMs if preempted, and the startup script ensures the batch workload restarts from where it left off or retries the entire job, guaranteeing completion at minimal cost.

Exam trap

The trap here is that candidates assume standard VMs are the only reliable option, overlooking that managed instance groups with preemptible VMs and retry logic provide both reliability and cost savings.

How to eliminate wrong answers

Option A is wrong because increasing machine size does not prevent preemption; preemptible VMs can be terminated at any time regardless of size, and larger machines may actually increase cost without solving the reliability issue. Option B is wrong because commitment-based discounts (e.g., 1-year or 3-year commitments) require a sustained usage baseline, but this workload runs only 10 minutes per hour, making commitments cost-ineffective and inflexible. Option C is wrong because while standard VMs avoid preemption, they are significantly more expensive than preemptible VMs, and the goal is a cost-effective solution, not just reliability.

137
MCQhard

You are designing a high-availability architecture for a global e-commerce platform that uses Cloud SQL for MySQL as the primary database. The application writes to a single Cloud SQL instance in us-central1 and reads from read replicas in us-central1 and us-west1. During a recent regional outage in us-central1, the primary instance became unavailable, and the application experienced full downtime for 3 hours because the failover to a read replica was not automatic. The application can tolerate up to 10 minutes of data loss but needs to recover within 30 minutes. You need to automate failover to a geographically distant region with minimal manual intervention. The application's connection string must not change. Which solution meets these requirements?

A.Set up a Cloud SQL for MySQL high-availability configuration across zones within us-central1
B.Create a cross-region read replica in us-west1, use a Cloud Load Balancing with a static IP that maps to the primary or promoted replica, and automate monitoring and failover via Cloud Functions
C.Configure an external read replica in us-west1 and manually promote it using gcloud commands during an incident
D.Enable automatic failover by creating a Cloud SQL for MySQL regional failover replica in us-central1
AnswerB

Correct: cross-region replica with load balancer and automation meets RTO and RPO.

Why this answer

It uses a cross-region read replica in us-west1 combined with a static IP via Cloud Load Balancing, which allows the connection string to remain unchanged after failover. Cloud Functions automate the monitoring and promotion of the replica, meeting the 30-minute recovery and 10-minute data loss tolerance. This design ensures failover to a geographically distant region with minimal manual intervention, unlike single-zone or same-region HA configurations.

Exam trap

The trap here is that candidates often confuse zonal high-availability (HA) with cross-region disaster recovery, assuming that a regional failover replica (Option D) provides geographic redundancy, when in fact it only spans zones within the same region.

How to eliminate wrong answers

Option A is wrong because a high-availability configuration across zones within us-central1 does not provide failover to a geographically distant region; it only protects against zonal failures, not a full regional outage. Option C is wrong because manually promoting an external read replica using gcloud commands during an incident does not meet the requirement for automated failover with minimal manual intervention, and it would likely exceed the 30-minute recovery time. Option D is wrong because a regional failover replica in us-central1 is still within the same region and cannot recover from a regional outage; it only provides zonal HA within that region.

138
MCQhard

A company uses Cloud Storage for analytics data with lifecycle policies to move objects from Standard to Coldline after 30 days and delete after 365 days. They notice that objects are being deleted after 30 days instead of 365. What is the most likely cause?

A.An IAM policy is inadvertently allowing users to delete objects.
B.The Coldline storage class has a minimum storage duration of 30 days, causing immediate deletion.
C.The bucket is using a uniform bucket-level access policy.
D.The lifecycle rule is set to delete objects after 30 days instead of transitioning to Coldline.
AnswerD

If a delete rule with age 30 days is present, objects will be deleted at 30 days, before the 365-day rule applies.

Why this answer

Lifecycle rules apply in order; if a rule is set to delete after 30 days, it will delete regardless of earlier transitions. The most likely issue is that the rules are configured incorrectly: there may be a delete rule with age 30 days overriding the transition rule. The correct order should be: transition to Coldline at 30 days, then delete at 365 days.

139
MCQeasy

An organization needs to ensure that only Compute Engine instances with a specific label can access a Cloud Storage bucket. Which policy type should be used?

A.Organization policy
B.Firewall rule
C.IAM policy
D.Signed URL
AnswerC

IAM conditions can enforce label-based access to Cloud Storage.

Why this answer

IAM policies are the correct mechanism to control access to Cloud Storage buckets based on identity and conditions. By attaching an IAM policy to the bucket with a condition that checks for a specific label on the requesting Compute Engine instance (e.g., using `resource.labels.tag`), you can restrict access to only those instances that have that label. This is the native Google Cloud way to implement attribute-based access control (ABAC) for storage resources.

Exam trap

The trap here is that candidates often confuse IAM conditions with Organization policies or firewall rules, thinking that network-level controls can enforce label-based access to Cloud Storage, when in fact only IAM with conditions can evaluate resource metadata like labels at the API level.

How to eliminate wrong answers

Option A is wrong because Organization policies are used to enforce constraints on all resources within an organization (e.g., disabling service creation), not to grant or deny access to individual resources like a Cloud Storage bucket based on instance labels. Option B is wrong because Firewall rules control network traffic at the VPC level (IP addresses, ports, protocols) and cannot evaluate instance labels or grant access to Cloud Storage, which is a global service accessed via HTTPS. Option D is wrong because Signed URLs provide time-limited access to specific objects in a bucket without requiring authentication, but they cannot restrict access based on the requesting instance's labels; they are designed for sharing objects externally, not for internal access control.

140
MCQhard

Your company runs a containerized microservices application on Google Kubernetes Engine (GKE) with a regional cluster. The application consists of a frontend service, a backend API service, and a background worker service that processes messages from Cloud Pub/Sub. The worker service uses a Deployment with 3 replicas. Recently, the team noticed that the worker service is frequently failing with 'ContainerCreating' errors. The error message in the pod events is: 'Failed to pull image "gcr.io/my-project/my-worker:latest": rpc error: code = DeadlineExceeded desc = context deadline exceeded'. The image is stored in Container Registry in the same project. The cluster nodes are n1-standard-2 VMs with 10 GB of disk space. The team has confirmed that the image exists and that the nodes have internet access. What is the most likely cause of the issue?

A.The worker pods require node affinity to a specific node pool that is not configured.
B.The nodes have insufficient disk space to pull the new image, causing the pull to time out.
C.The nodes do not have the necessary permissions to access Container Registry.
D.The cluster is a regional cluster, but the worker pods are all scheduled in the same zone, causing resource contention.
AnswerB

With 10 GB disk and multiple images, disk may fill up, leading to failed pulls.

Why this answer

The error 'context deadline exceeded' when pulling an image indicates that the kubelet timed out while trying to download the container image. With only 10 GB of disk space on n1-standard-2 nodes, the node's disk may be nearly full, causing the image pull to stall or fail due to insufficient space to unpack the layers. This is the most likely cause because the image exists and internet access is confirmed, ruling out authentication or connectivity issues.

Exam trap

Google Cloud often tests the distinction between image pull errors that are due to permissions (e.g., 'unauthorized') versus resource exhaustion (e.g., disk full), and candidates mistakenly assume internet connectivity or permissions are the issue when the error message explicitly mentions a deadline exceeded.

How to eliminate wrong answers

Option A is wrong because node affinity is used to constrain pod scheduling to specific nodes, but the error is about pulling an image, not scheduling; the pods are already being created but fail during container setup. Option C is wrong because if nodes lacked permissions to access Container Registry, the error would be 'unauthorized' or 'access denied', not a deadline exceeded timeout; the team confirmed the image exists and nodes have internet access. Option D is wrong because a regional cluster distributes pods across zones by default, and even if all pods were in one zone, resource contention would manifest as 'Unschedulable' or 'CPU/memory pressure', not a pull timeout.

141
MCQeasy

A company uses Cloud Storage for backup data. They want to protect against accidental deletion. Which option is best?

A.Enable object versioning.
B.Use a lifecycle policy.
C.Set a retention policy.
D.Use object holds.
AnswerA

Preserves noncurrent versions for recovery.

Why this answer

Object versioning in Cloud Storage preserves every version of an object, including overwrites and deletions. When versioning is enabled, a delete operation creates a delete marker instead of permanently removing the object, allowing easy recovery. This directly protects against accidental deletion by retaining all previous object versions.

Exam trap

Google Cloud often tests the distinction between versioning (which allows recovery from accidental deletion) and retention policies (which prevent deletion but do not provide recovery after the fact), leading candidates to confuse compliance protection with accidental deletion protection.

How to eliminate wrong answers

Option B is wrong because lifecycle policies automate transitions or deletions based on age or conditions, but they do not prevent accidental deletion; they can actually cause deletion if misconfigured. Option C is wrong because retention policies (e.g., Bucket Lock) prevent object modification or deletion for a fixed period, but they are designed for compliance and data retention, not for recovering from accidental deletion after the fact. Option D is a duplicate of the correct answer and is not a separate option; the question lists two identical 'Enable object versioning' entries, but only one is correct.

142
MCQmedium

A team is deploying a microservice on Cloud Run that needs to access a Cloud SQL database securely. They want to avoid using public IPs and ensure traffic stays within Google's network. Which configuration should they use?

A.Configure Cloud SQL with a public IP and use Cloud SQL Proxy in the Cloud Run service
B.Enable Private Google Access on the VPC subnet
C.Use Serverless VPC Access and assign a private IP to the Cloud SQL instance
D.Create a VPC network peering between the Cloud Run tenant project and the Cloud SQL project
AnswerC

Serverless VPC Access connects Cloud Run to your VPC, and Cloud SQL private IP ensures traffic stays within Google's network.

Why this answer

Serverless VPC Access allows Cloud Run to connect to a VPC network via a VPC connector. Combined with Private Services Access, Cloud SQL can be configured with a private IP (within the VPC) and accessed without traversing the public internet. Cloud SQL Proxy is a sidecar pattern that can use public IP with SSL, but it does not keep traffic entirely within Google's network if the Cloud SQL instance uses a public IP.

Private Google Access is for on-premises or VM access to Google APIs, not for Cloud Run to Cloud SQL.

143
MCQeasy

A company runs a global e-commerce site on GKE. They want to ensure disaster recovery with multi-region deployment. What is the best practice for configuring GKE clusters?

A.Deploy separate regional clusters in two or more regions.
B.Use a single zonal cluster with node auto-repair.
C.Deploy a single cluster with multi-master setup.
D.Use a single regional cluster with multiple zones.
AnswerA

Multi-region clusters provide geographic redundancy.

Why this answer

For disaster recovery with a multi-region deployment, the best practice is to deploy separate regional clusters in two or more regions. This ensures that if an entire region fails, traffic can be redirected to the other region's cluster, providing true geographic redundancy. A single cluster, whether zonal or regional, cannot survive a regional outage because it is bound to a single control plane location.

Exam trap

Google Cloud often tests the misconception that a regional cluster with multiple zones is sufficient for disaster recovery, but the trap here is that a regional cluster is still confined to a single region and cannot survive a full regional outage.

How to eliminate wrong answers

Option B is wrong because a single zonal cluster with node auto-repair only protects against node-level failures within that single zone, not against a full zone or regional outage, and thus does not meet multi-region disaster recovery requirements. Option C is wrong because GKE does not support a multi-master setup; each cluster has a single control plane, and multi-master is not a valid configuration for GKE. Option D is wrong because a single regional cluster with multiple zones provides high availability within a single region but cannot survive a regional failure, as the control plane is still regional and would be unavailable if the entire region goes down.

144
MCQhard

An organization has set the IAM policy constraint 'constraints/iam.allowedPolicyMemberDomains' with the values shown. Which of the following users can be granted an IAM role on a project in this organization? (Choose all that apply.)

A.service-account@project-id.iam.gserviceaccount.com
B.external@otherdomain.com
C.admin@another-customer-domain.com
D.user@example.com
AnswerA, D

Service accounts within the organization are allowed.

Why this answer

The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts IAM role grants to members from specified domains. The correct answer includes both A and D. Option A: service-account@project-id.iam.gserviceaccount.com is allowed because service accounts ending in 'gserviceaccount.com' are Google-managed and implicitly exempt from the constraint.

Option D: user@example.com is allowed because 'example.com' is one of the domains specified in the constraint (as implied by the correct marking). The constraint explicitly lists allowed domains, and 'example.com' is included. Options B and C are from domains not in the allowed list, so they cannot be granted roles.

Exam trap

Google Cloud often tests the misconception that all service accounts are exempt from domain restrictions, but only Google-managed service accounts (those ending in 'gserviceaccount.com') are exempt; customer-managed service accounts from other domains are still subject to the constraint.

How to eliminate wrong answers

Option B is wrong because 'external@otherdomain.com' is from a domain not listed in the constraint, and the constraint explicitly denies granting roles to users from unlisted domains. Option C is wrong because 'admin@another-customer-domain.com' is from a domain that is not allowed by the constraint, and the constraint applies to all IAM members except Google-managed service accounts.

145
MCQmedium

An organization wants to connect its on-premises data center to Google Cloud with a consistent 10 Gbps bandwidth and a 99.99% availability SLA. They already have a Dedicated Interconnect connection, but need to ensure high availability. What should they do?

Answer options not yet available.

Why this answer

For high availability with Dedicated Interconnect, you must have at least two connections (each 10 Gbps or 100 Gbps) that terminate on different routers in different edge availability domains. This meets the 99.99% SLA. A single connection does not provide HA.

146
Multi-Selecteasy

A company is designing a data pipeline to ingest streaming data from IoT devices and store it in BigQuery for analysis. They need to minimize latency and operational overhead. Which two Google Cloud services should they use? (Choose two.)

Select 2 answers
A.Cloud Dataflow
B.Cloud Pub/Sub
C.Cloud Dataproc
D.Cloud Storage
E.Cloud Functions
AnswersA, B

Cloud Dataflow can process streaming data from Pub/Sub and write to BigQuery in real time.

Why this answer

Cloud Pub/Sub is the recommended service for ingesting streaming data, and Cloud Dataflow can process the data and write it directly to BigQuery with low latency. Cloud Storage is for batch uploads, Cloud Functions is event-driven but not ideal for high-throughput streaming, and Cloud Dataproc is for batch processing.

147
MCQeasy

Your company runs a stateless web application on Compute Engine. You want to ensure that if a zone fails, the application continues to serve traffic with minimal manual intervention. What should you do?

A.Schedule regular snapshots of each instance's persistent disk to a regional bucket.
B.Create a regional managed instance group with an autoscaling policy and use a global Cloud Load Balancer.
C.Use a global Cloud Load Balancer and enable Cloud CDN.
D.Create an instance template and manually deploy instances in another zone.
AnswerB

A regional MIG with autoscaling across zones and a global load balancer ensures traffic is rerouted away from failed zones and instances are automatically replaced.

Why this answer

A regional managed instance group (MIG) distributes instances across multiple zones within a region, ensuring that if one zone fails, the remaining zones continue serving traffic. Combined with a global Cloud Load Balancer, traffic is automatically routed to healthy instances in any zone, providing high availability with minimal manual intervention. Autoscaling further ensures that new instances are created to handle load, even if a zone becomes unavailable.

Exam trap

Google Cloud often tests the distinction between data backup (snapshots) and compute redundancy (MIGs), leading candidates to choose backup solutions when the question asks for continuous traffic serving during a zone failure.

How to eliminate wrong answers

Option A is wrong because scheduling snapshots to a regional bucket provides data backup and disaster recovery for persistent disks, but does not automatically redirect traffic or maintain application availability during a zone failure; it requires manual restoration and reconfiguration. Option C is wrong because enabling Cloud CDN caches static content at edge locations, which improves performance and reduces load on origin servers, but does not provide zone-level redundancy or automatic failover for the compute instances themselves. Option D is wrong because manually deploying instances in another zone is a manual, slow process that does not provide automated failover or load balancing; it also lacks autoscaling and health checking, leading to potential downtime and increased operational overhead.

148
MCQeasy

A developer needs to deploy a Python script that processes images uploaded to a Cloud Storage bucket. The script should run only when new objects are created, and should scale automatically with no idle costs. Which GCP service is most appropriate?

A.Cloud Functions
B.App Engine Standard Environment
C.Compute Engine with a startup script
D.Cloud Run
AnswerA

Cloud Functions natively supports Cloud Storage event triggers, is serverless, and scales to zero.

Why this answer

Cloud Functions is an event-driven serverless compute service that can be triggered by Cloud Storage events (e.g., object finalize). It scales automatically, runs only when triggered, and has no idle cost. Cloud Run also works for containers, but the script is lightweight and can be written as a function.

App Engine requires manual scaling setup. Compute Engine would have idle cost.

149
MCQhard

A financial services company requires that all audit logs be retained for 7 years in a cost-effective, immutable storage. They also need to run ad-hoc SQL queries on the logs. Which configuration should they use?

A.Create a log sink to BigQuery with a 7-year partition expiration and use BigQuery's SQL capabilities
B.Use Cloud Logging's default retention and set up a log-based metric to trigger a Cloud Function that copies logs to BigQuery
C.Export logs to Cloud Storage with a retention policy set to 7 years and use Cloud Storage SQL interface
D.Create two log sinks: one to BigQuery for querying, and one to Cloud Storage with object retention policy for immutable storage
AnswerD

Log sinks to BigQuery allow SQL queries; Cloud Storage with retention policy provides immutable, cost-effective long-term storage.

Why this answer

Logging can export logs to BigQuery for SQL querying, and BigQuery offers time-based partitioning and long-term retention. However, for immutable storage, Cloud Storage with retention policy is recommended. The best approach is to use a log sink to BigQuery for analysis, and another sink to Cloud Storage with a retention policy for long-term immutable storage.

Option D combines both sinks correctly.

150
MCQhard

An organization policy at the organization level restricts project creation to only Project Creator role holders. The exhibit shows the IAM policy for the organization. A member of the group pm-team@example.com attempts to create a project but receives a permission denied error. What is the most likely cause?

A.The user's email domain is not allowed by the organization policy.
B.An organization policy with a constraint to block project creation for non-allowlisted users is enforced.
C.The group pm-team@example.com does not exist.
D.The IAM policy is missing the resourcemanager.projectCreator role.
AnswerB

Organization policy can deny project creation even if IAM allows it.

Why this answer

The organization policy explicitly restricts project creation to only users who hold the Project Creator role. The user is a member of pm-team@example.com but does not have the Project Creator role, so the policy denies the request. This is a common IAM constraint at the organization level that overrides any lower-level permissions.

Exam trap

Google Cloud often tests the distinction between IAM roles and organization policies, where candidates mistakenly think that having a role at any level is sufficient, ignoring that organization-level constraints can block actions even with the correct role at a lower level.

How to eliminate wrong answers

Option A is wrong because the organization policy does not mention any email domain restriction; the error is due to role absence, not domain. Option C is wrong because if the group did not exist, the user would not be a member and the error would be different (e.g., 'group not found'), not a permission denied on project creation. Option D is wrong because the IAM policy shown includes the resourcemanager.projectCreator role for the group, but the organization policy overrides it by restricting creation to only Project Creator role holders, meaning the user lacks the specific role binding required by the policy.

Page 1

Page 2 of 13

Page 3