Knowledge + Practice

Google Professional Cloud Architect (PCA) — Questions 151–225

955 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 3 of 13

151

Multi-Selecthard

A company wants to migrate 200 TB of on-premises file shares to Cloud Storage. The network is slow (50 Mbps) and the project is time-sensitive. Which THREE services should they use? (Choose 3)

Select 3 answers

A.Transfer Appliance

B.gsutil

C.Database Migration Service

D.Migrate for Compute Engine

E.Storage Transfer Service

AnswersA, B, E

Physical device shipped to Google to upload data.

Why this answer

Transfer Appliance is for large data shipping. Storage Transfer Service can transfer from another cloud or on-prem (if intermediate). Migrate for Compute Engine is for VMs only.

Database Migration Service is for databases. gsutil is for direct upload but slow.

Full explanation →

152

MCQmedium

You are designing a disaster recovery plan for a Cloud SQL for MySQL instance. The instance is in us-east1. You need to be able to recover the database to a specific second in time within the past 7 days in the event of a regional outage. What should you do?

A.Enable automated backups and transaction log retention for 7 days. Restore the backup in a new instance in a different region.

B.Use Cloud SQL's built-in replication to create a cross-region replica, and enable failover. Failover automatically recovers to the latest transaction.

C.Enable point-in-time recovery and create a cross-region read replica. If needed, promote and recover the replica to the desired point in time.

D.Export the database daily using gcloud sql export and store in Cloud Storage with versioning.

AnswerC

PITR on the primary logs changes; the cross-region replica can be promoted and recovered to a specific second.

Why this answer

Cloud SQL point-in-time recovery (PITR) allows recovery to any second within the backup retention period. For regional disaster recovery, you need cross-region replicas. Enabling PITR on the primary and creating a cross-region replica (which also supports PITR) allows you to recover the replica to a specific point in time.

Automated backups alone cannot restore to a specific second.

Full explanation →

153

Multi-Selecthard

An engineering team is deploying a microservices application on Google Cloud. They want to use a service mesh for observability, traffic management, and security. They are considering Anthos Service Mesh (ASM). Which THREE components are part of ASM? (Choose THREE.)

Select 3 answers

A.Cloud Endpoints

B.Envoy sidecar proxies

C.Cloud Monitoring and Cloud Logging

D.Google Kubernetes Engine (GKE)

E.Istio control plane

AnswersB, C, E

Envoy proxies are injected as sidecars in pods.

Why this answer

ASM uses Istio as the control plane, Envoy as the sidecar proxy, and integrates with Google Cloud's operations suite (formerly Stackdriver) for telemetry. GKE is the platform, but not a component of ASM. Cloud Endpoints is a separate API management service.

Full explanation →

154

MCQmedium

A team deployed a new version of a service on Cloud Run. After deployment, users report 502 errors. The logs show "Error: Server Error" with no stack trace. What is the first step the team should take to diagnose the issue?

A.Enable Cloud Debugger to inspect the running instance.

B.Check the container image for missing dependencies or misconfiguration.

C.Increase Cloud Run max instances limit.

D.Rollback to the previous version immediately.

AnswerB

Logs indicate the container may be failing to start, so checking dependencies is the first diagnostic step.

Why this answer

The 502 error with 'Error: Server Error' and no stack trace typically indicates that the container failed to start or crashed immediately after startup, often due to missing dependencies or misconfiguration in the container image. Cloud Run requires the container to listen on the port specified by the PORT environment variable (default 8080) and respond to health checks; if the container exits or fails to bind, Cloud Run returns a 502. Checking the container image is the first diagnostic step because it addresses the most common root cause before investigating runtime or scaling issues.

Exam trap

Google Cloud often tests the distinction between startup failures (502) and runtime errors (500), leading candidates to mistakenly choose Cloud Debugger or scaling fixes instead of verifying the container image first.

How to eliminate wrong answers

Option A is wrong because Cloud Debugger is designed for inspecting live application state (e.g., variables, stack traces) in a running instance, but here the container is likely failing to start or crashing immediately, so there is no running instance to attach to. Option C is wrong because increasing the max instances limit addresses scaling or concurrency issues (e.g., 429 or 503 errors), not a 502 error caused by a container startup failure. Option D is wrong because rolling back immediately is a reactive recovery action, not a diagnostic step; the team should first understand the root cause to prevent recurrence, and the question explicitly asks for the first step to diagnose the issue.

Full explanation →

155

MCQhard

A company has a BigQuery dataset with a growing fact table (500 million rows, added daily). Queries that filter on a date column and group by a product ID are slow. The team wants to optimise query performance without increasing slot costs. Which two actions should they take? (Choose TWO.)

A.Cluster the table by the product ID column

B.Switch to BigQuery Editions with Autoscaling slots

C.Use SELECT * only when necessary

D.Create a materialised view that pre-aggregates the data

E.Partition the table by the date column

AnswerA, E

Clustering co-locates rows with similar product IDs, reducing the amount of data scanned for GROUP BY queries.

Why this answer

Partitioning by date and clustering by product ID can significantly improve query performance: partitioning prunes scans to relevant days, and clustering co-locates rows with similar product IDs. Materialised views pre-aggregate data but increase storage costs. SELECT * is inefficient and should be avoided.

Slots pricing does not help performance without changing configuration.

Full explanation →

156

MCQhard

A startup is building a real-time multiplayer game with global players. They need a database that provides strong consistency across regions and can handle millions of concurrent users. They anticipate rapid growth and want to avoid downtime for scaling. Which database service meets these requirements?

A.Cloud SQL with cross-region replication

B.Cloud Spanner

C.Cloud Bigtable

D.Cloud Firestore

AnswerB

Spanner provides global strong consistency, automatic scaling, and is designed for high-throughput OLTP workloads. It fits the requirements perfectly.

Why this answer

Cloud Spanner is a globally distributed, strongly consistent relational database with automatic horizontal scaling. It provides strong consistency across regions and can handle millions of transactions per second. Firestore is eventually consistent (or strong within a region) and not designed for relational data.

Bigtable does not support strong consistency across regions. Cloud SQL is regional with limited scalability.

Full explanation →

157

MCQeasy

An organization wants to enforce that all container images deployed to Google Kubernetes Engine (GKE) are signed and approved via an attestation authority. Which GCP service should they use?

A.Binary Authorization

B.Container Registry

C.Cloud Armor

D.Cloud Security Scanner

AnswerA

Binary Authorization provides attestation-based policy enforcement for container images on GKE.

Why this answer

Binary Authorization enforces deployment-time policies that require container images to be signed by trusted authorities. It integrates with GKE and Cloud Build to ensure only signed images are deployed.

Full explanation →

158

Multi-Selectmedium

A company is designing a disaster recovery plan for a critical application running on Compute Engine. The application requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. Which TWO strategies meet these requirements? (Choose 2)

Select 2 answers

A.Multi-region deployment with Cloud Load Balancing

B.Warm standby: run a scaled-down version of the environment in another region

C.Backup and restore: daily backups to Cloud Storage

D.Pilot light: replicate data to another region and have a minimal footprint ready

E.Cold standby: periodic snapshots to another region

AnswersB, D

Warm standby can achieve faster recovery than pilot light, still within 4 hours.

Why this answer

Pilot light involves replicating data and having a minimal environment ready to scale. Warm standby maintains a partially scaled environment. Both can achieve RPO of 15 minutes and RTO of 4 hours with proper setup.

Multi-region deployment and active-passive are not defined in terms of RPO/RTO.

Full explanation →

159

MCQhard

A developer is deploying a containerized application to Cloud Run. The deployment fails with the error above. What is the most likely cause?

A.The container is listening on port 3000 instead of 8080.

B.The container health check is misconfigured.

C.The container startup script fails.

D.The container does not have a web server.

AnswerA

Cloud Run requires the container to listen on the port defined by the PORT environment variable, which defaults to 8080.

Why this answer

Cloud Run requires containers to listen on the port defined by the `PORT` environment variable, which defaults to 8080. If the container is hardcoded to listen on port 3000, Cloud Run's health checks and routing will fail because the runtime cannot reach the application on the expected port, causing the deployment to fail.

Exam trap

Google Cloud often tests the misconception that any port mismatch will cause a health check failure, but the actual trap is that Cloud Run's deployment validation checks port binding before the container is considered healthy, so a wrong port causes an immediate deployment failure, not a post-deployment health check issue.

How to eliminate wrong answers

Option B is wrong because a misconfigured health check would cause the container to be marked unhealthy after startup, but the deployment itself would still succeed initially; the error in the question indicates a deployment failure, not a post-deployment health check failure. Option C is wrong because a startup script failure would typically result in a different error (e.g., container crash loop or exit code), not a port mismatch error. Option D is wrong because the container does have a web server (it listens on port 3000), but it is listening on the wrong port; Cloud Run does not require a specific web server, only that the container listens on the correct port.

Full explanation →

160

MCQmedium

A financial services company runs a mission-critical database on Compute Engine with local SSDs. They need to ensure data durability in case of an instance failure while maintaining low latency. What should they do?

A.Configure a regional persistent disk with synchronous replication and attach it to the instance

B.Use a managed instance group with autohealing and store data on a persistent disk

C.Set up a read replica in another zone using database-native replication

D.Take regular snapshots of the local SSDs to Cloud Storage

AnswerA

Regional persistent disks replicate data synchronously across zones, providing durability and low latency.

Why this answer

Regional persistent disks (PD) provide synchronous replication of data between two zones in the same region, ensuring data durability even if the entire zone fails. By attaching a regional PD to a Compute Engine instance, you maintain low latency (since the disk is network-attached but still within the same region) while achieving the required durability. Local SSDs, while offering very low latency, are ephemeral and lose data on instance failure, so they are not suitable for mission-critical durability requirements.

Exam trap

Google Cloud often tests the misconception that local SSDs are durable because they are fast, but the trap here is that local SSDs are ephemeral and data is lost on instance failure, so candidates may incorrectly choose snapshotting or database replication instead of the correct regional persistent disk solution.

How to eliminate wrong answers

Option B is wrong because a managed instance group with autohealing only recreates instances but does not preserve data on local SSDs, which are ephemeral; persistent disks would be needed for durability, but the option does not specify regional replication. Option C is wrong because setting up a read replica in another zone using database-native replication addresses read availability and disaster recovery, but it does not protect against the primary instance failure that loses local SSD data; it also adds latency for writes and does not provide synchronous durability for the primary database. Option D is wrong because regular snapshots of local SSDs to Cloud Storage provide point-in-time recovery but introduce significant latency for snapshot creation and do not guarantee zero data loss on instance failure; snapshots are asynchronous and not suitable for mission-critical, low-latency durability requirements.

Full explanation →

161

MCQmedium

A developer is using Cloud Build to automate deployments. The build fails with an error: 'Permission 'iam.serviceAccounts.actAs' denied.' What is the most likely cause?

A.The developer does not have iam.serviceAccounts.actAs permission on the project

B.The build configuration is missing a required step

C.The Cloud Build service account is not enabled

D.The Cloud Build service account does not have the Service Account User role on the service account used in the build steps

AnswerD

actAs permission is required for impersonation.

Why this answer

The error 'Permission iam.serviceAccounts.actAs denied' occurs when a Cloud Build build step tries to impersonate a service account (e.g., to deploy resources) but the Cloud Build service account lacks the Service Account User role on that target service account. Option D correctly identifies that the Cloud Build service account does not have the `roles/iam.serviceAccountUser` role on the service account used in the build steps, which is required to delegate access.

Exam trap

Google Cloud often tests the distinction between granting permissions to a user versus granting roles to a service account, and the trap here is that candidates mistakenly think the developer needs the `actAs` permission directly (Option A), when in fact it is the Cloud Build service account that requires the Service Account User role on the target service account.

How to eliminate wrong answers

Option A is wrong because the `iam.serviceAccounts.actAs` permission is not granted directly to the developer; it is granted to a service account (the Cloud Build service account) on another service account. The error is about the Cloud Build service account lacking this permission, not the developer. Option B is wrong because a missing build step would typically cause a syntax or execution error, not a specific IAM permission denial.

Option C is wrong because the Cloud Build service account is enabled by default when Cloud Build is used; the error is about missing IAM roles on that service account, not its existence.

Full explanation →

162

MCQeasy

A developer needs to cache session state for a web application to reduce latency. The cache must be highly available and support sub-millisecond access times. Which Google Cloud service should they use?

A.Firestore

B.Cloud Storage

C.Bigtable

D.Memorystore for Redis

AnswerD

Memorystore offers managed Redis with sub-millisecond latency and HA options.

Why this answer

Memorystore for Redis provides a managed in-memory cache with sub-millisecond latency and supports high availability with replication.

Full explanation →

163

MCQhard

An application running on Compute Engine is experiencing increased latency. You suspect a network bottleneck due to high egress traffic. Which gcloud command can you use to quickly check the network egress traffic for a specific VM instance?

A.gcloud logging read 'resource.type=gce_instance AND jsonPayload.egress_bytes'

B.gcloud compute instances list --format='value(networkInterfaces[0].networkIP)'

C.gcloud compute instances get-serial-port-output

D.gcloud monitoring metrics list

AnswerA

gcloud logging read with the specified filter queries Cloud Logging for egress bytes logs from Compute Engine instances, making it the correct choice.

Why this answer

The gcloud logging read command allows you to query Cloud Logging for specific log entries. For a Compute Engine instance, the resource type is gce_instance. You can filter for egress bytes by using the query 'resource.type=gce_instance AND jsonPayload.egress_bytes'. This will return log entries containing egress bytes information, assuming your VM is configured to send these logs (e.g., via the monitoring agent or VPC flow logs). This is the quickest way among the given options to check network egress traffic for a specific VM using a native gcloud command.

Option B is incorrect: gcloud compute instances list only displays the network IP of instances, not egress traffic metrics.

Option C is incorrect: gcloud compute instances get-serial-port-output shows the serial console output, which does not include network traffic data.

Option D is incorrect: gcloud monitoring metrics list just lists available metrics but does not retrieve the actual traffic data for a specific instance. To get the data you would need to use gcloud monitoring metric descriptors or gcloud monitoring dashboards, but the command as given does not return traffic.

Thus, A is the best choice.

Exam trap

Students may think that Cloud Monitoring is the only way to view metrics, but Cloud Logging can also be used to query specific data like egress bytes if logs are collected. They might also incorrectly choose D because monitoring sounds relevant, but the command 'gcloud monitoring metrics list' only lists metric descriptors, not actual data.

Full explanation →

164

Multi-Selectmedium

A security team needs to restrict access to a set of Cloud Storage buckets so that only Compute Engine instances with a specific service account can read objects. Which TWO steps should they take? (Choose two.)

Select 2 answers

A.Grant the service account the 'roles/storage.objectViewer' role on the bucket

B.Grant the user who owns the instances the 'roles/storage.admin' role

C.Configure VPC Service Controls to allow access only from the VPC where the instances reside

D.Create a bucket ACL that allows read access for the service account

E.Add a firewall rule allowing ingress from the service account to the bucket's IP range

AnswersA, C

This IAM role allows the service account to read objects.

Why this answer

To restrict access to Cloud Storage buckets so that only Compute Engine instances with a specific service account can read objects, the correct approach is to use IAM permissions (option A) to grant the service account the 'roles/storage.objectViewer' role, and VPC Service Controls (option C) to create a perimeter that limits access to the VPC where the instances reside. IAM defines who can access resources, while VPC Service Controls enforce network-based boundaries. Firewall rules (option E) are not applicable to Cloud Storage access, as Cloud Storage is a global service accessed via HTTPS, not via IP ranges.

Full explanation →

165

MCQhard

A company needs to transfer 200 TB of data from on-premises to Cloud Storage within one week. The on-premises network upload speed is 100 Mbps. Which method should they use?

A.Order a Transfer Appliance

B.Use Storage Transfer Service

C.Use gsutil rsync to transfer the data

D.Use Velostrata (Migrate for Compute Engine)

AnswerA

Transfer Appliance can handle up to hundreds of TB via physical shipping, meeting the one-week timeline.

Why this answer

200 TB at 100 Mbps = 200 * 1024 * 8 / (100/8) seconds ≈ 1,620,000 seconds ≈ 19 days, which exceeds one week. So network transfer is too slow. Transfer Appliance is a physical device for fast offline transfer.

Storage Transfer Service is for cloud-to-cloud. gsutil rsync is an online tool. Velostrata is for VM migration.

Full explanation →

166

Drag & Dropmedium

Drag and drop the steps to set up a VPC network peering between two projects in Google Cloud into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

VPC peering requires bidirectional connections; both sides must initiate peering. IP ranges must not overlap.

Full explanation →

167

Multi-Selecthard

An organization is implementing a data loss prevention (DLP) strategy for sensitive data stored in Cloud Storage. They want to automatically detect and redact credit card numbers in CSV files uploaded to a specific bucket. Which TWO Google Cloud services should they combine to achieve this?

Select 2 answers

A.Cloud Dataflow

B.Cloud Run

C.Cloud DLP

D.Cloud Functions

E.BigQuery

AnswersC, D

Cloud DLP provides inspection and redaction of sensitive data types like credit card numbers.

Why this answer

Cloud DLP (option C) is correct because it provides native content inspection and de-identification (redaction) of sensitive data like credit card numbers using built-in infoType detectors. Cloud Functions (option D) is correct because it can be triggered by Cloud Storage events (e.g., finalize/create) to invoke the DLP API on newly uploaded CSV files, enabling serverless, event-driven processing without managing infrastructure.

Exam trap

The trap here is that candidates may choose Cloud Dataflow (option A) thinking it is required for large-scale DLP processing, but the question specifies 'uploaded to a specific bucket' which implies per-file, event-driven processing where Cloud Functions is the simpler and correct serverless choice.

Full explanation →

168

MCQeasy

A startup is building a web application that experiences unpredictable traffic spikes. They want a scalable solution that minimizes costs. Which Google Cloud service should they use to run their containerized application?

A.App Engine Standard Environment

B.Cloud Run for Anthos

C.Compute Engine with managed instance groups

D.Google Kubernetes Engine (GKE) with autoscaling

AnswerD

GKE provides automatic scaling of nodes and pods, ideal for containerized apps with spikes.

Why this answer

Google Kubernetes Engine (GKE) with autoscaling is the correct choice because it combines cluster autoscaling (which adjusts the number of nodes based on pod resource requests) with Horizontal Pod Autoscaling (which scales the number of pod replicas based on CPU/memory utilization or custom metrics). This dual-layer scaling handles unpredictable traffic spikes efficiently while minimizing costs by only provisioning resources when needed, and it is purpose-built for containerized applications.

Exam trap

The trap here is that candidates often choose Compute Engine with managed instance groups (Option C) because they think it is the most cost-effective, but they overlook that GKE's autoscaling is more granular (pod-level vs. VM-level) and reduces operational overhead for containerized workloads, making it the better choice for minimizing costs and handling unpredictable spikes.

How to eliminate wrong answers

Option A is wrong because App Engine Standard Environment runs applications in a sandboxed runtime (e.g., Java 8, Python 2.7) and does not support arbitrary containerized workloads; it requires code to conform to specific runtime constraints and does not allow custom Docker images. Option B is wrong because Cloud Run for Anthos is designed for running stateless containers on GKE clusters, but it adds unnecessary complexity and cost (Anthos licensing) for a simple web app that does not require hybrid/multi-cloud capabilities; GKE alone with autoscaling is more cost-effective. Option C is wrong because Compute Engine with managed instance groups can autoscale VMs, but it requires manual management of container orchestration (e.g., installing Docker, configuring load balancers) and lacks the native pod-level scaling and self-healing capabilities that GKE provides for containerized applications, leading to higher operational overhead and potential cost inefficiency.

Full explanation →

169

MCQmedium

Refer to the exhibit. A developer wants to SSH into instance-1 from their local machine. Which command should they use?

A.gcloud compute ssh instance-2

B.gcloud compute ssh instance-1 --project default

C.gcloud compute ssh instance-1 --internal-ip

D.gcloud compute ssh instance-1 --zone us-central1-a

AnswerD

This command uses the external IP via SSH keys managed by gcloud.

Why this answer

The `gcloud compute ssh` command requires the `--zone` flag when the zone is not set in the gcloud configuration or when the instance is in a different zone than the default. In this scenario, instance-1 is in zone us-central1-a, so specifying `--zone us-central1-a` ensures the SSH connection targets the correct instance. Without this flag, the command may fail or connect to the wrong instance if the default zone is different.

Exam trap

The trap here is that candidates often overlook the zone requirement and assume the `--project` flag or omitting the zone will work, but the PCA exam tests the precise need for zone specification when the default zone is not set or differs from the instance's zone.

How to eliminate wrong answers

Option A is wrong because it specifies instance-2 instead of instance-1, which is the target instance the developer wants to SSH into. Option B is wrong because the `--project default` flag sets the project ID, but the issue here is the zone, not the project; the command would still fail if the zone is not correctly specified or defaults to a different zone. Option C is wrong because `--internal-ip` forces the SSH connection to use the internal IP address, which is not reachable from a local machine outside the VPC network; this flag is only useful when connecting from within the same network.

Full explanation →

170

Multi-Selecthard

A company is using Cloud Bigtable for time-series data from IoT devices. They are experiencing high latency for queries that scan a large range of rows. Which THREE actions can improve query performance? (Choose three.)

Select 3 answers

A.Reduce the size of row keys.

B.Increase the number of nodes in the Bigtable cluster.

C.Use Key Visualizer to analyze access patterns.

D.Switch from SSD storage to HDD storage.

E.Use application profiles to route to a single cluster if using replication.

AnswersA, B, E

Smaller row keys reduce I/O and improve scan performance.

Why this answer

Reducing the size of row keys (A) improves query performance because Bigtable stores rows sorted by key, and smaller keys reduce the amount of data that must be scanned and transferred during range scans. This directly lowers I/O and network overhead, which is critical for time-series data where row keys often include timestamps and device IDs.

Exam trap

Google Cloud often tests the misconception that Key Visualizer is a performance-tuning action rather than an analysis tool, and that HDD storage could improve latency for large scans, when in fact it degrades performance.

Full explanation →

171

Multi-Selectmedium

A company runs a multi-region application on GKE that requires low-latency access to a shared dataset that is read-heavy and updated frequently. They need a storage solution that supports strong consistency and can scale write throughput. Which TWO Google Cloud services meet these requirements? (Choose TWO.)

Select 2 answers

A.Memorystore

B.Cloud SQL

C.Cloud Firestore

D.Cloud Bigtable

E.Cloud Spanner

AnswersD, E

Strong consistency, high write throughput, low latency.

Why this answer

Cloud Bigtable provides strong consistency within a cluster and scales write throughput horizontally. Cloud Spanner offers strong global consistency and scales writes across regions. Both meet the requirements for low-latency, strong consistency, and write scalability.

Full explanation →

172

MCQhard

A company is migrating its on-premises MongoDB database to Google Cloud. They want a fully managed, highly available NoSQL database that is compatible with MongoDB drivers. Which Google Cloud service should they choose?

A.Cloud Firestore

B.MongoDB Atlas on Google Cloud Marketplace

C.Cloud Bigtable

D.Cloud SQL

AnswerB

MongoDB Atlas is a fully managed MongoDB-compatible service available via Google Cloud Marketplace.

Why this answer

MongoDB Atlas via Google Cloud Marketplace is a fully managed MongoDB service that runs on Google Cloud and is compatible with MongoDB drivers. Cloud Bigtable and Firestore are not MongoDB-compatible. Cloud SQL is relational.

Full explanation →

173

Multi-Selecteasy

Which TWO actions can reduce costs for a Cloud SQL for MySQL instance? (Choose two.)

Select 2 answers

A.Use database flags to limit connections.

B.Use committed use discounts.

C.Use preemptible instances.

D.Use a smaller machine type during off-peak hours.

E.Use high availability configuration.

AnswersB, D

Committed use discounts provide up to 57% discount for 1-year or 3-year commitment.

Why this answer

Committed use discounts (CUDs) provide significant cost savings (up to 57%) for Cloud SQL instances when you commit to a 1- or 3-year term. Resizing to a smaller machine type during off-peak hours directly reduces compute costs by lowering the vCPU and memory allocation when demand is low, and Cloud SQL supports live instance resizing with minimal downtime.

Exam trap

Google Cloud often tests the misconception that preemptible instances are available for managed services like Cloud SQL, when in fact they are exclusive to Compute Engine and GKE, and candidates may also confuse connection limits with cost reduction, thinking that limiting resources directly lowers the bill.

Full explanation →

174

MCQhard

A company is designing a disaster recovery plan for a Cloud SQL for PostgreSQL instance. They want to failover to a different region with minimal data loss and recovery time under 10 minutes. The database is 500 GB and experiences 2,000 write transactions per second. Which solution should they use?

A.Export the database daily using gsutil and import in the other region using pg_restore.

B.Create a cross-region read replica and promote it to primary during failover.

C.Configure a cross-region replica instance using Cloud SQL's cross-region replication feature.

D.Automated backups with point-in-time recovery to a new instance in the other region.

AnswerB, C

This is correct because Cloud SQL cross-region read replicas use asynchronous replication with minimal lag, and promotion can be completed in minutes, satisfying both RPO and RTO targets.

Why this answer

Both options B and C are valid solutions. Cloud SQL for PostgreSQL supports cross-region read replicas (also referred to as cross-region replicas) that are continuously updated via asynchronous replication. Promoting such a replica to a primary instance typically takes minutes, meeting the RTO under 10 minutes, while replication lag is usually a few seconds, meeting the requirement for minimal data loss.

Option B explicitly describes creating a cross-region read replica and promoting it, which is a standard DR practice. Option C describes the same feature using the managed cross-region replication feature. Therefore, both are correct.

Exam trap

A common mistake is to think that Cloud SQL for PostgreSQL read replicas cannot be cross-region. In fact, Cloud SQL for PostgreSQL supports cross-region read replicas, which can be promoted to primary during failover. However, the question requires a managed cross-region replication feature, which is explicitly available as 'cross-region replica' in Cloud SQL.

Option B describes a cross-region read replica, which is also possible, but the phrasing 'configure a cross-region replica instance using Cloud SQL's cross-region replication feature' in option C is more accurate to the specific managed feature. The key distinction is that Cloud SQL's cross-region replication is a specific feature designed for disaster recovery, while read replicas are primarily for read scaling and may have different promotion behavior.

How to eliminate wrong answers

Option A is wrong because daily exports using gsutil and pg_restore would result in up to 24 hours of data loss (poor RPO) and the recovery time would exceed 10 minutes due to the time needed to transfer and restore a 500 GB database. Option B is wrong because Cloud SQL for PostgreSQL does not support cross-region read replicas; read replicas are only available within the same region, so this option is not technically feasible. Option D is wrong because automated backups with point-in-time recovery require restoring from a backup stored in the same region or a different region, but the restore process can take significantly longer than 10 minutes for a 500 GB database, and the recovery point would be at best the last backup, not near-real-time.

Full explanation →

175

Multi-Selectmedium

Which TWO controls should a financial services company implement to comply with PCI DSS requirement related to protecting cardholder data stored in Cloud SQL? (Choose two.)

Select 2 answers

A.Use Cloud DLP to redact cardholder data in logs.

B.Enable Cloud Audit Logs to monitor access to the database.

C.Enable Cloud SQL encryption with Customer-Managed Encryption Keys (CMEK).

D.Configure VPC Service Controls to restrict egress from the Cloud SQL instance.

E.Implement column-level encryption for PAN fields before inserting into the database.

AnswersC, E

CMEK ensures data is encrypted at rest with a key managed by the organization.

Why this answer

PCI DSS requires encryption of cardholder data at rest, and Cloud SQL with Customer-Managed Encryption Keys (CMEK) allows the company to manage and control the encryption keys used to protect data stored in the database. This meets the requirement for strong cryptography and key management, ensuring that even if the underlying storage is compromised, the data remains unreadable.

Exam trap

Google often tests the distinction between encryption at rest (CMEK) and other security controls like logging (Cloud Audit Logs), network restrictions (VPC Service Controls), or data masking (Cloud DLP), leading candidates to confuse compliance requirements for data protection with monitoring or access control measures.

Full explanation →

176

MCQmedium

An organization has multiple Google Cloud projects that need to access a shared Cloud SQL database. The database should only be accessible from authorized projects. What is the most secure way to grant access?

A.Use Cloud SQL Proxy on each project's Compute Engine instances.

B.Configure the Cloud SQL instance with a private IP in a shared VPC and grant IAM roles to the authorized projects.

C.Expose the Cloud SQL instance on a public IP and authorize the IP ranges of the projects.

D.Set up a Cloud VPN between each project's VPC and the VPC hosting Cloud SQL.

AnswerB

Private IP and shared VPC provide a secure, internal network path with IAM controls.

Why this answer

Using a private IP in a shared VPC ensures that Cloud SQL is not exposed to the public internet, and IAM roles (e.g., roles/cloudsql.client) allow fine-grained access control at the project level. This approach leverages VPC peering or shared VPC to restrict network access exclusively to authorized projects, eliminating the need for public IPs or complex VPN configurations while maintaining high security.

Exam trap

The trap here is that candidates often confuse Cloud SQL Proxy (a secure tunnel tool) with a method for project-level authorization, when in fact it only provides encryption and IAM-based user authentication, not network-level restriction to specific projects.

How to eliminate wrong answers

Option A is wrong because Cloud SQL Proxy is a client-side tool that provides encrypted connections and IAM-based authentication, but it does not by itself restrict access to authorized projects; it still requires the Cloud SQL instance to have a public IP or be accessible via private networking, and it does not enforce project-level authorization. Option C is wrong because exposing Cloud SQL on a public IP and authorizing IP ranges is less secure; IP addresses can be spoofed or changed, and this approach relies on network-level controls rather than IAM-based project authorization, increasing the attack surface. Option D is wrong because setting up a Cloud VPN between each project's VPC and the VPC hosting Cloud SQL adds unnecessary complexity and cost; a shared VPC or VPC peering is more straightforward and provides the same private connectivity without the overhead of VPN tunnels.

Full explanation →

177

MCQmedium

An organization uses Active Directory (AD) on-premises. They want to synchronize user accounts and groups to Google Cloud Identity so that users can sign in with their existing AD credentials. Which service should they use?

A.Cloud Identity Platform

B.Google Cloud Directory Sync

C.Cloud Identity-Aware Proxy

D.Security Command Center

AnswerB

GCDS syncs users and groups from AD to Cloud Identity.

Why this answer

Google Cloud Directory Sync (GCDS) is the tool that synchronizes users and groups from an existing LDAP directory, such as Active Directory, to Cloud Identity. It does not handle SAML SSO directly.

Full explanation →

178

MCQmedium

A company wants to set up automated failover between two on-premises data centers and Google Cloud using Cloud VPN. They require a 99.99% SLA for the VPN connection. What configuration should they use?

Answer options not yet available.

Why this answer

HA VPN provides a 99.99% SLA when configured with two gateways (each in a different region) and two tunnels per gateway (four tunnels total), with dynamic routing (BGP). Using two VPN gateways in the same region does not provide region-level redundancy.

Full explanation →

179

Drag & Dropmedium

Drag and drop the steps to set up a Cloud VPN tunnel between Google Cloud and an on-premises network into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Cloud Router is used for dynamic routing. The tunnel requires the on-premises public IP and pre-shared key.

Full explanation →

180

MCQeasy

A company is running a web application on Compute Engine instances that average 20% CPU utilization. They want to reduce costs without impacting performance. What is the most effective action?

A.Rightsize instances to a smaller machine type based on usage metrics.

B.Change instance type to e2-standard-4.

C.Purchase 3-year committed use discounts.

D.Use preemptible instances for all traffic.

AnswerA

Rightsizing matches capacity to demand, reducing cost without performance impact.

Why this answer

The instances are averaging only 20% CPU utilization, indicating they are over-provisioned. Rightsizing to a smaller machine type directly reduces the compute cost per instance while maintaining adequate performance for the current workload, as the smaller instance can handle the existing load without degradation.

Exam trap

The trap here is that candidates often choose committed use discounts (Option C) as a quick cost-saving measure, failing to realize that rightsizing first yields greater savings without long-term commitment, and that preemptible instances (Option D) are not viable for production traffic due to their ephemeral nature.

How to eliminate wrong answers

Option B is wrong because it specifies a particular machine type (e2-standard-4) without considering the current usage metrics; this is a generic recommendation that may not be the optimal size and could still be over-provisioned or under-provisioned. Option C is wrong because purchasing 3-year committed use discounts locks in a long-term commitment for the current instance types, which may still be over-provisioned; rightsizing first then applying commitments is more cost-effective. Option D is wrong because preemptible instances can be terminated at any time by Google Cloud, making them unsuitable for handling all traffic in a production web application that requires reliability and availability.

Full explanation →

181

MCQmedium

A company hosts a web application on Compute Engine behind a global HTTP(S) load balancer. They notice that some users experience high latency from certain regions. They want to improve performance without adding complexity. What should they do?

A.Add more instances in the same region

B.Use Premium Tier networking

C.Enable Cloud Armor

D.Enable Cloud CDN

AnswerD

Cloud CDN caches content at edge locations, reducing latency.

Why this answer

Enabling Cloud CDN caches content at Google's globally distributed edge caches, reducing latency for users in regions far from the origin Compute Engine instances. This directly addresses the high-latency issue without adding complexity, as it requires no changes to the application architecture and is a simple configuration toggle on the load balancer backend bucket or backend service.

Exam trap

The trap here is that candidates may confuse network optimization (Premium Tier) with content caching (CDN), assuming that faster routing alone solves geographic latency, but only caching eliminates the need for long-distance round trips.

How to eliminate wrong answers

Option A is wrong because adding more instances in the same region does not reduce latency for users in distant regions; it only increases capacity within that region, leaving cross-continental network hops unchanged. Option B is wrong because Premium Tier networking improves routing performance by using Google's global fiber network, but it does not cache content; it still requires a full round trip to the origin for every request, so it does not eliminate latency from geographic distance. Option C is wrong because Cloud Armor provides security protections like DDoS mitigation and WAF rules; it does not cache or accelerate content delivery, so it has no effect on latency for static or cacheable responses.

Full explanation →

182

MCQhard

A company uses Cloud CDN to serve static content from a Cloud Storage bucket. They update the content every 2 hours, but users sometimes see stale content for up to 24 hours. They need users to see the latest content within 5 minutes of an update. Which action should they take?

A.Use cache invalidation after each update

B.Use custom cache keys

C.Set a short max-age TTL (e.g., 5 minutes) on the objects

D.Change cache mode to CACHE_ALL_STATIC

AnswerC

Setting a short TTL tells CDN to cache for only 5 minutes, after which it re-fetches from origin. This ensures fresh content within 5 minutes.

Why this answer

To ensure content is served fresh, they should set a short max-age (cache TTL) on the object metadata or via the bucket's default object holding. Invalidating the cache is a reactive measure, but setting a short TTL ensures that cache entries expire quickly. Cache modes affect query string handling, not TTL.

Cache keys affect how content is cached but not the freshness duration.

Full explanation →

183

MCQhard

A company is migrating a legacy e-commerce platform to GKE. The application consists of several stateless microservices and a stateful database. They want to minimize operational overhead for the database while ensuring high availability across zones. Which database option should they choose?

A.Cloud SQL for MySQL with regional high availability

B.Deploy MySQL on GKE StatefulSet with persistent volumes

C.Cloud Firestore

D.Cloud Spanner

AnswerA

Cloud SQL provides a managed, highly available MySQL instance across zones with automatic failover, minimizing operational overhead.

Why this answer

Cloud SQL for MySQL with regional high availability provides a managed MySQL instance with synchronous replication across zones, automatic failover, and minimal operational overhead. Self-managing MySQL on GKE adds complexity. Cloud Spanner is globally distributed and expensive for this workload.

Firestore is NoSQL, not suitable for a relational e-commerce database.

Full explanation →

184

MCQhard

A company is migrating a large on-premises SQL Server database to Cloud SQL for SQL Server. The database is 2 TB in size and must have minimal downtime. Which approach should they use?

A.Set up a Cloud SQL HA instance and replicate on-premises using Always On availability groups

B.Export the database to CSV files, then import using Cloud SQL import

C.Use Database Migration Service (DMS) for continuous one-way replication

D.Perform a full backup to Cloud Storage, then restore into Cloud SQL

AnswerC

DMS provides near-zero downtime migration for SQL Server.

Why this answer

Database Migration Service (DMS) supports continuous one-way replication from on-premises SQL Server to Cloud SQL for SQL Server using native SQL Server transaction log shipping or Always On availability group replication. This minimizes downtime by keeping the target synchronized during the migration cutover, which is critical for a 2 TB database where a full backup/restore would cause extended downtime.

Exam trap

The trap here is that candidates often assume a full backup/restore (Option D) is the simplest and fastest method, but for large databases with minimal downtime requirements, continuous replication via DMS is the only viable option, and Cloud SQL HA (Option A) is a high-availability feature for within Cloud SQL, not for hybrid replication from on-premises.

How to eliminate wrong answers

Option A is wrong because setting up a Cloud SQL HA instance with Always On availability groups for replication from on-premises is not a supported configuration; Cloud SQL for SQL Server does not support Always On availability groups as a replication target from external sources. Option B is wrong because exporting a 2 TB database to CSV files is impractical for minimal downtime due to the time required for export, transfer, and import, and it does not provide continuous replication to avoid downtime. Option D is wrong because performing a full backup to Cloud Storage and restoring into Cloud SQL requires taking the on-premises database offline for the duration of the backup and restore, which does not meet the minimal downtime requirement.

Full explanation →

185

MCQhard

A company is migrating a monolithic application to Google Cloud. The application consists of a stateful service that writes to local disk and a stateless web server. They want to minimize changes to the code. Which architecture should they use?

A.Run the entire application on Cloud Run and use Cloud Filestore for shared state

B.Use App Engine Flexible Environment for the web server and Cloud SQL for state

C.Refactor the application into microservices and deploy on GKE with StatefulSets

D.Lift and shift to Compute Engine instances with persistent disks for stateful service

AnswerD

Minimal code changes, uses persistent disks for state.

Why this answer

It represents a lift-and-shift migration that minimizes code changes by running the monolithic application on Compute Engine instances. The stateful service can use persistent disks for local disk writes, while the stateless web server runs on the same or separate instances, preserving the existing architecture without refactoring.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing cloud-native options (like Cloud Run or GKE) that require code changes, ignoring the explicit requirement to minimize changes and the suitability of a simple lift-and-shift with persistent disks.

How to eliminate wrong answers

Option A is wrong because Cloud Run is stateless and does not support local disk writes; Cloud Filestore is a network file system that would require code changes to replace local disk I/O. Option B is wrong because App Engine Flexible Environment does not support local disk writes for stateful services, and migrating to Cloud SQL would require significant code changes to replace local disk-based state. Option C is wrong because refactoring into microservices and using GKE with StatefulSets contradicts the requirement to minimize code changes, as it requires substantial application restructuring.

Full explanation →

186

MCQmedium

A financial services company must run a PostgreSQL database with strong consistency across three regions. They need to support high write throughput and require automatic failover with zero data loss. Which database service should they choose?

A.AlloyDB for PostgreSQL

B.Bigtable

C.Cloud SQL for PostgreSQL with cross-region replication

D.Cloud Spanner

AnswerD

Spanner offers global strong consistency, high write throughput, and automatic failover with zero data loss using multi-region configurations.

Why this answer

Cloud Spanner is the only Google Cloud managed database that provides globally distributed, strongly consistent transactions with automatic failover and zero data loss via multi-region configurations.

Full explanation →

187

MCQhard

Refer to the exhibit. An engineer notices that the instance 'instance-1' is running but does not serve web traffic on port 80. The instance was created with the provided metadata and scheduling configuration. What is the most likely reason the web server is not responding?

A.The startup script failed because apt-get requires root privileges but the script runs as a non-root user.

B.The instance is preemptible and was terminated before the startup script completed.

C.The firewall rules do not allow ingress traffic on port 80.

D.The enable-oslogin metadata key set to 'false' prevents SSH access, but not web traffic.

AnswerC

The exhibit does not show any firewall configuration; by default, GCP instances block inbound traffic except for specific protocols like SSH.

Why this answer

The exhibit shows that a firewall rule exists allowing ingress on port 80 only for instances with the network tag 'web-server'. The instance 'instance-1' does not have this tag, so the firewall rule does not apply to it. Therefore, traffic on port 80 is blocked by default, even if the web server is running.

Exam trap

In Google Cloud Platform, candidates often overlook the distinction between instance-level metadata (like startup scripts or OS login) and network-level configuration (firewall rules and tags), leading them to miss that a missing network tag can silently block traffic even when the application is running.

How to eliminate wrong answers

Option A is wrong because the startup script runs with root privileges by default when using the Google Cloud CLI or console, and the provided metadata does not indicate a non-root user context; apt-get would succeed. Option B is wrong because the instance is running and preemptible instances are terminated after 24 hours or due to capacity, not before a startup script completes; the question states the instance is running, so it was not terminated. Option D is wrong because the 'enable-oslogin' metadata key set to 'false' only disables OS Login for SSH authentication, which has no effect on web traffic or the ability to serve HTTP on port 80.

Full explanation →

188

MCQmedium

A developer runs the command above. The instance is created successfully, but cannot be reached via HTTP from the internet. What is the most likely cause?

A.There is no firewall rule allowing ingress traffic on ports 80 and 443.

B.The machine type n1-standard-2 is not suitable for HTTP.

C.The image family debian-10 does not support HTTP.

D.The boot disk type pd-standard is too slow.

AnswerA

Tags alone don't open ports; firewall rules needed.

Why this answer

The most likely cause is that there is no firewall rule allowing ingress traffic on ports 80 and 443. By default, Google Cloud Platform (GCP) firewall rules block all incoming traffic from the internet. Even though the instance is created successfully, HTTP/HTTPS traffic cannot reach it unless a firewall rule explicitly permits ingress on TCP ports 80 and 443, typically via a target tag like 'http-server' or 'https-server'.

Exam trap

Google Cloud often tests the misconception that creating a VM with a public IP automatically makes it reachable from the internet, when in reality GCP's default firewall rules block all ingress traffic until explicitly opened.

How to eliminate wrong answers

Option B is wrong because the machine type n1-standard-2 is a general-purpose machine that fully supports HTTP traffic; machine type does not affect protocol support. Option C is wrong because the image family debian-10 is a standard Linux distribution that supports HTTP out of the box; the OS image does not determine network reachability. Option D is wrong because the boot disk type pd-standard (standard persistent disk) provides sufficient I/O for basic HTTP serving; disk speed does not prevent the instance from being reached via HTTP from the internet.

Full explanation →

189

MCQmedium

A team is using Cloud Functions and wants to ensure retries on failure. What is the best practice?

A.Increase function timeout.

B.Use background functions with Pub/Sub.

C.Configure maximum retries and set dead-letter topic.

D.Use synchronous invocation.

AnswerC

Automatic retries with dead-letter for investigation.

Why this answer

Cloud Functions (2nd gen) and Cloud Run allow configuring maximum retry attempts and a dead-letter topic to handle messages that repeatedly fail processing. This ensures that transient failures are retried automatically, while persistent failures are captured in a dead-letter queue for later analysis, preventing message loss and enabling reliable event-driven processing.

Exam trap

Google Cloud often tests the misconception that simply using a background function or increasing timeout is sufficient for reliability, when in fact explicit retry configuration and dead-letter handling are required for robust error recovery.

How to eliminate wrong answers

Option A is wrong because increasing function timeout does not cause retries; it only extends the maximum execution duration, and if the function fails after the timeout, no retry is triggered unless explicitly configured. Option B is wrong because background functions with Pub/Sub are a type of function, not a retry mechanism; while Pub/Sub can be used with retry policies, the statement itself does not address configuring retries or dead-letter topics. Option D is wrong because synchronous invocation (e.g., via HTTP triggers) does not inherently provide retry logic; the caller must implement retries, and Cloud Functions does not automatically retry synchronous invocations on failure.

Full explanation →

190

MCQeasy

A DevOps team wants to monitor custom application metrics and set up an alert that triggers when the error rate exceeds 1% over a 5-minute window. Which Cloud Monitoring features should they use?

Answer options not yet available.

Why this answer

Cloud Monitoring SLOs allow you to define service level objectives based on metrics like error rate, and you can create alerting policies based on burn rate or direct condition. Log-based alerts are for log content, not metrics. Uptime checks are for HTTP endpoints.

Full explanation →

191

Multi-Selectmedium

A company has a legacy application that runs on a single Compute Engine VM and expects to use a fixed IP address. They want to migrate the VM to a different region with minimal downtime. Which TWO actions should they take?

Select 2 answers

A.Use gcloud compute instances move command

B.Delete the original VM before creating the new one

C.Convert the VM to a managed instance group

D.Reserve a static external IP address in the target region

E.Create a snapshot of the boot disk and create a new VM from the snapshot in the target region

AnswersD, E

Reserving a static IP ensures the VM has a fixed IP after migration.

Why this answer

Snapshot the VM disk and create a new VM from the snapshot in the target region. Reserve a static external IP address in the target region to keep the IP fixed. Snapshots are regional, so you can create an instance in another region.

Deleting the original VM first would cause downtime. Converting to managed instance group is not necessary for a single VM.

Full explanation →

192

MCQmedium

A company is designing a microservices architecture on Google Kubernetes Engine (GKE). They need to expose a set of internal microservices to other services within the same VPC, but not to the internet. Which GKE service type should they use?

A.ClusterIP

B.LoadBalancer

C.NodePort

D.ExternalName

AnswerA

ClusterIP exposes the service on an internal IP within the cluster, accessible only from within the cluster.

Why this answer

A ClusterIP service exposes the service on a cluster-internal IP, accessible only within the cluster. A NodePort service exposes on each node's IP but is not suitable for internal-only VPC access. A LoadBalancer service creates an external load balancer, which is internet-facing unless configured as internal.

An Internal Load Balancer (via ingress) can be used but is more complex; the simplest internal-only service type is ClusterIP with a proxy.

Full explanation →

193

MCQmedium

A company is migrating 50 on-premises VMs to Compute Engine. They need to minimise downtime and want an automated lift-and-shift migration that replicates disks incrementally. Which Google Cloud service should be used?

A.Database Migration Service

B.Migrate for Compute Engine

C.Storage Transfer Service

D.Transfer Appliance

AnswerB

This service provides agentless, incremental replication for VM migration to Compute Engine.

Why this answer

Migrate for Compute Engine (formerly Velostrata) performs agentless, incremental replication of VM disks to Compute Engine, enabling minimal downtime migrations.

Full explanation →

194

Drag & Dropmedium

Drag and drop the steps to deploy a containerized application to Google Kubernetes Engine (GKE) using a Deployment into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The image must be in a registry before the Deployment can reference it. The Service provides external access.

Full explanation →

195

MCQeasy

A company wants to give a new employee read-only access to all projects in their GCP organization. Which IAM role should they assign at the organization level to grant this access?

A.roles/owner

B.roles/editor

C.roles/viewer

D.roles/orgadmin

AnswerC

Viewer provides read-only access to all resources.

Why this answer

The Viewer primitive role (roles/viewer) grants read-only access to all resources in the organization. Owner and Editor roles are too broad. Organization Viewer is not a valid role.

Full explanation →

196

Multi-Selectmedium

A company wants to run containerized applications on Google Cloud with minimal operational overhead. They prefer to use a serverless container platform. Which TWO compute options should they consider? (Choose 2.)

Select 2 answers

A.Compute Engine

B.GKE Standard

C.Cloud Functions

D.GKE Autopilot

E.Cloud Run (fully managed)

AnswersD, E

GKE Autopilot provides a serverless Kubernetes experience with automated node management.

Why this answer

Cloud Run (fully managed) is a serverless container platform that abstracts infrastructure. GKE Autopilot is also serverless in the sense that Google manages nodes, but it still requires cluster configuration. However, GKE Autopilot is considered a 'serverless' Kubernetes offering.

Cloud Functions is for functions, not containers. GKE Standard requires node management. Compute Engine is not container-focused.

Full explanation →

197

Multi-Selecthard

A company runs a web application on Google Kubernetes Engine (GKE) with a Deployment of 5 replicas. They notice that one of the cluster nodes has failed, but the workload remains available. Which THREE GKE features are responsible for maintaining availability? (Choose THREE.)

Select 3 answers

A.Kubernetes scheduler

B.Cluster autoscaler

C.Readiness probe

D.ReplicaSet

E.Node auto-repair

AnswersA, D, E

Scheduler reschedules pods from the failed node to healthy nodes.

Why this answer

ReplicaSet ensures the desired number of pod replicas. Node auto-repair repairs unhealthy nodes. The Kubernetes scheduler reschedules pods from failed nodes to healthy ones.

Cluster autoscaler adds/removes nodes but does not directly handle a single node failure. A readiness probe detects if a pod is ready, but not the node failure directly.

Full explanation →

198

MCQeasy

A company wants to monitor their Cloud Run services for errors and latency. Which Google Cloud product should they use?

A.Cloud Trace

B.Cloud Monitoring

C.Cloud Logging

D.Error Reporting

AnswerB

Provides metrics, dashboards, and alerts.

Why this answer

Cloud Monitoring (formerly Stackdriver Monitoring) provides comprehensive observability for Cloud Run services, including built-in dashboards for request latency, error rates, and resource utilization. It collects metrics like request count, request latencies, and container instance counts, and allows you to set alerting policies based on these metrics. While Cloud Trace can help with latency analysis and Cloud Logging captures logs, Cloud Monitoring is the primary product for monitoring both errors and latency in a unified view.

Exam trap

The trap here is that candidates often confuse Cloud Trace (for latency) or Error Reporting (for errors) as standalone solutions, but the question asks for a single product that monitors both errors and latency, which is Cloud Monitoring's role as the central metrics and alerting platform.

How to eliminate wrong answers

Option A is wrong because Cloud Trace is a distributed tracing tool focused on analyzing latency across service requests, but it does not provide a unified dashboard for error rates or resource metrics for Cloud Run. Option C is wrong because Cloud Logging is for storing, searching, and analyzing log data, not for monitoring metrics like latency percentiles or error counts in real-time dashboards. Option D is wrong because Error Reporting aggregates and analyzes application errors from logs, but it does not monitor latency or provide a holistic view of service health.

Full explanation →

199

Multi-Selecthard

Your service has a 99.99% uptime SLO (monthly error budget ~ 4 minutes). Which TWO monitoring practices best support this SLO? (Choose 2)

Select 2 answers

A.Monitor CPU utilization and alert when average exceeds 80%.

B.Use a combination of availability (e.g., HTTP 200 rate) and latency (e.g., p99) as SLIs.

C.Use only synthetic monitoring from multiple locations.

D.Alert on every 5xx error immediately.

E.Track error budget consumption and alert when burn rate exceeds a threshold.

AnswersB, E

Good SLIs reflect user experience; availability and latency are common SLIs.

Why this answer

Options B and E are correct. A good SLI combines availability and latency into a single measure; the error budget approach is the standard way to manage SLOs. Option A is wrong: CPU alone is not a user-facing SLI.

Option C is wrong: synthetic monitoring is useful but not alone sufficient; a combination of real and synthetic is recommended. Option D is wrong: alerting on every 5xx error can lead to alert fatigue; better to alert based on error budget burn rate.

Full explanation →

200

MCQmedium

A company wants to enforce that all data stored in Cloud Storage buckets is encrypted with a key that they manage and rotate quarterly. They also want to ensure that the key is stored in a hardware security module (HSM). Which combination of services should they use?

A.Customer-Supplied Encryption Keys (CSEK) with Cloud Storage

B.Cloud KMS with a key backed by Cloud HSM, and set the bucket's default encryption to use that key (CMEK)

C.Cloud External Key Manager (Cloud EKM)

D.Cloud HSM with default Google-managed keys

AnswerB

Cloud KMS with HSM key provides customer-managed, HSM-backed encryption keys for Cloud Storage.

Why this answer

Cloud HSM provides HSM-backed keys, and Cloud KMS allows you to create and manage those keys. CMEK (Customer-Managed Encryption Keys) with Cloud KMS (backed by HSM) meets the requirements.

Full explanation →

201

MCQeasy

A company wants to migrate its on-premises monolithic application to Google Cloud with minimal changes. They plan to run it on a virtual machine with a predictable workload that runs 24/7 for a one-year commitment. Which compute option is MOST cost-effective?

A.Spot VMs

B.On-demand VMs

C.Committed use discounts

D.Preemptible VMs

AnswerC

Committed use discounts offer lower cost for a 1-year commitment on 24/7 workloads.

Why this answer

Committed use discounts provide significant cost savings for predictable, always-on workloads over a 1-year (or 3-year) term. While preemptible VMs are cheaper, they can be terminated at any time, making them unsuitable for a 24/7 workload. On-demand VMs are more expensive than committed use.

Spot VMs are similar to preemptible but still not guaranteed.

Full explanation →

202

MCQeasy

A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?

A.Condition: 'request.auth == "serviceAccount:sa@project.iam.gserviceaccount.com"'

B.Condition: 'origin.serviceAccount == "sa@project.iam.gserviceaccount.com"'

C.Condition: 'resource.serviceAccount == "sa@project.iam.gserviceaccount.com"'

D.Condition: 'iam.serviceAccount == "sa@project.iam.gserviceaccount.com"'

AnswerD

The condition 'iam.serviceAccount' matches the service account used by the caller.

Why this answer

The `iam.serviceAccount` condition attribute in IAM conditions allows you to restrict access based on the service account identity of the caller. When a Compute Engine instance uses a service account, the condition `iam.serviceAccount == "sa@project.iam.gserviceaccount.com"` ensures that only requests authenticated with that specific service account are allowed to access the Cloud Storage bucket. This is the standard IAM condition attribute for matching the service account of the requesting principal.

Exam trap

The trap here is confusing the caller's service account (`iam.serviceAccount`) with the resource's service account (`resource.serviceAccount`), leading candidates to pick Option C, which would incorrectly check the service account attached to the Cloud Storage bucket (which does not exist) instead of the requesting instance's identity.

How to eliminate wrong answers

Option A is wrong because `request.auth` is not a valid IAM condition attribute; the correct attribute for checking the authenticated identity is `iam.serviceAccount` or `principal` attributes. Option B is wrong because `origin.serviceAccount` is not a recognized IAM condition attribute; `origin` attributes are used for VPC Network or Cloud Armor conditions, not for IAM policies. Option C is wrong because `resource.serviceAccount` refers to the service account associated with the resource (e.g., a Compute Engine instance's attached service account), not the caller's service account; this would incorrectly check the target resource's identity instead of the requester's identity.

Full explanation →

203

MCQmedium

A company uses Cloud SQL for PostgreSQL and experiences connection spikes that cause connection limits to be exceeded. They need a solution to manage connection pooling. Which approach should they take?

A.Use ProxySQL to pool connections

B.Increase the number of vCPUs on the Cloud SQL instance

C.Use Cloud SQL Auth Proxy with connection pooling enabled

D.Configure PgBouncer on a separate Compute Engine instance to pool connections

AnswerD

PgBouncer is a PostgreSQL connection pooler that can be deployed alongside Cloud SQL.

Why this answer

Cloud SQL Auth Proxy handles authentication and encryption, but not pooling. PgBouncer is a lightweight connection pooler for PostgreSQL. Cloud SQL does not natively support ProxySQL for PostgreSQL.

Scaling up vCPUs increases connection limits but does not pool connections efficiently.

Full explanation →

204

MCQhard

A global e-commerce platform uses Cloud Spanner for product inventory and wants to reduce costs. They notice that read replicas are underutilized and that most queries are single-key reads. Which configuration change will reduce costs while maintaining availability?

A.Use Cloud SQL for reads and Spanner for writes only

B.Downgrade the instance to a smaller regional configuration with fewer nodes

C.Switch to a multi-region configuration with witness nodes

D.Reduce the number of read replicas in the instance configuration

AnswerB

Reducing nodes lowers cost; Spanner automatically redistributes data. This is a valid way to reduce costs.

Why this answer

For Spanner, read replicas are used for read-only workloads; if underutilized, reducing the number of read replicas can lower costs without affecting write availability. However, fine-grained instance configuration changes are not straightforward; the best option is to adjust the number of nodes or use a smaller instance class. But among options, choosing a smaller regional configuration (fewer nodes) is practical.

Full explanation →

205

Multi-Selecthard

A company wants to run a stateful workload on GKE that requires persistent storage with low latency and high IOPS. They need to use the fastest available storage and are willing to lose data if the pod is rescheduled. Which THREE options should they consider? (Choose 3.)

Select 3 answers

A.Memorystore for Redis

B.Local SSDs (ephemeral storage)

C.Persistent Disk (SSD)

D.Cloud Storage FUSE

E.Persistent Disk (balanced)

AnswersB, C, E

Local SSDs offer the highest performance but data is lost on reschedule.

Why this answer

Local SSDs provide the highest IOPS and lowest latency but are ephemeral. Persistent Disk SSD offers high IOPS and low latency while being persistent. Persistent Disk Balanced also provides good performance and durability, though not as high as SSD.

All three are among the fastest available storage options in GKE and should be considered for the workload, with the choice depending on the tolerance for data loss and performance needs.

Exam trap

The question says 'Choose 3' but candidates may incorrectly think only Local SSDs qualify because of the ephemeral requirement. However, the workload requires 'fastest available storage,' and Persistent Disk SSD and Balanced also offer high performance. While Local SSDs are fastest, the other two are also very fast and persistent, making them viable considerations.

Full explanation →

206

MCQhard

A GKE cluster has a Horizontal Pod Autoscaler (HPA) configured for CPU utilization. The pods are not scaling up even though CPU usage is high. What could be the reason?

A.The cluster autoscaler is disabled

B.The HPA is configured with the wrong metric name

C.The node pool is out of capacity

D.The pods do not have resource requests defined

AnswerD

HPA requires CPU resource requests on pods to calculate utilization.

Why this answer

The HPA may not have permissions to read metrics or the metrics server might be unavailable. Also, the target CPU utilization might be set incorrectly. Another common issue is that the HPA is using the wrong metric or the pod resource requests are not set.

Full explanation →

207

MCQmedium

An engineer needs to share a VPC network across multiple projects in an organization while maintaining centralized network administration. Which approach should they use?

A.Shared VPC

B.VPC peering between all projects

C.Private Google Access

D.Cloud VPN between projects

AnswerA

Shared VPC allows a host project to share networks with multiple service projects.

Why this answer

Shared VPC allows a host project to share its VPC network with service projects, enabling centralized network administration. VPC peering connects separate VPCs but does not allow centralized administration.

Full explanation →

208

MCQeasy

A startup is building a serverless application that processes events from Cloud Storage buckets. Each event triggers a Python function that resizes images. Which GCP compute service is MOST suitable for this event-driven workload?

A.Cloud Run

B.Compute Engine

C.App Engine

D.Cloud Functions

AnswerD

Cloud Functions natively supports Cloud Storage event triggers (e.g., on object finalize).

Why this answer

Cloud Functions is designed for event-driven, serverless compute. It can be triggered directly by Cloud Storage events (object finalize/create). Cloud Run requires HTTP invocation, App Engine is for web apps, and Compute Engine VMs require management.

Full explanation →

209

MCQhard

A security engineer is configuring VPC Service Controls to protect a project containing BigQuery datasets with PII. They want to prevent data exfiltration while allowing authorized users to query the data from outside the perimeter. Which configuration meets these requirements?

A.Create a perimeter that includes the project, and set the 'allowed external access' flag to true.

B.Create a perimeter and enable the 'exfiltration exception' for BigQuery.

C.Create a perimeter that includes only Compute Engine instances, and use a separate perimeter for BigQuery.

D.Create a perimeter that includes the project, and use an access level from Access Context Manager to grant access to authorized users.

AnswerD

Access levels allow fine-grained access from outside the perimeter.

Why this answer

VPC Service Controls use Access Context Manager (ACM) access levels to define granular, identity-based access conditions. By including the project in a perimeter and applying an access level that specifies authorized users (e.g., based on IP ranges, device state, or identity), you can allow those users to query BigQuery from outside the perimeter while blocking all other external traffic, preventing data exfiltration.

Exam trap

A common mistake in Google PCA exams is thinking VPC Service Controls have a simple 'allow external access' toggle or a dedicated 'exfiltration exception' flag, when in reality the only way to grant external access is through Access Context Manager access levels or ingress/egress rules.

How to eliminate wrong answers

Option A is wrong because VPC Service Controls do not have an 'allowed external access' flag; the correct mechanism is to use access levels from Access Context Manager to grant exceptions. Option B is wrong because there is no 'exfiltration exception' for BigQuery; VPC Service Controls block all data exfiltration by default, and exceptions are made via access levels or ingress/egress rules, not a dedicated flag. Option C is wrong because VPC Service Controls protect services like BigQuery by including the project containing the datasets, not by using separate perimeters for Compute Engine and BigQuery; Compute Engine instances are not the target resource here.

Full explanation →

210

Multi-Selecthard

Which THREE of the following are recommended practices when designing a highly available architecture on Google Cloud using multiple regions?

Select 3 answers

A.Deploy Compute Engine instances in a single regional managed instance group

B.Use a global external HTTP(S) load balancer with backend services in multiple regions

C.Use Cloud Spanner or cross-region replication for databases

D.Implement health checks and automated failover using Cloud DNS with weighted routing

E.Use a single Cloud VPN tunnel for connectivity between regions

AnswersB, C, D

Routes traffic to the nearest healthy backend, providing multi-region HA.

Why this answer

A global external HTTP(S) load balancer uses Google's global anycast IP and routes traffic to the closest healthy backend in any region, enabling cross-region failover and low latency. It automatically handles failover between regions when health checks detect backend failures. Option C is correct because Cloud Spanner provides built-in synchronous replication across regions for strong consistency and high availability, while cross-region replication for databases like Cloud SQL ensures data redundancy and automated failover.

Option D is correct because health checks detect instance or service failures, Cloud DNS with weighted routing allows traffic distribution across regions, and automated failover ensures that if one region becomes unhealthy, traffic is rerouted to healthy regions.

Exam trap

Google Cloud often tests the misconception that a single regional managed instance group or a single VPN tunnel is sufficient for multi-region high availability, but the exam expects you to recognize that redundancy across regions and elimination of single points of failure are mandatory.

Full explanation →

211

MCQhard

A Cloud Spanner instance is experiencing high latency for point reads. The instance has 5 nodes and the read throughput is moderate. The table has a primary key with monotonically increasing values. What is the most likely cause and optimization?

A.Use interleaved tables to reduce the number of index lookups.

B.The instance is underprovisioned; add more nodes.

C.The primary key design causes hotspotting; use a hash prefix or add a leading random value.

D.The instance has too many nodes causing transaction conflicts; reduce nodes.

AnswerC

This distributes writes across splits.

Why this answer

The monotonically increasing primary key causes all writes to be directed to the last tablet (splitting point), creating a hotspot on one node. This hotspot leads to high latency for point reads because that node becomes a bottleneck. Adding a hash prefix or a leading random value distributes writes and reads evenly across all nodes, resolving the hotspotting issue.

Exam trap

Google Cloud often tests the misconception that adding more nodes solves all performance issues, but here the problem is a design flaw (hotspotting) that requires a key distribution strategy, not more capacity.

How to eliminate wrong answers

Option A is wrong because interleaved tables reduce join latency by colocating parent-child rows, but they do not address the root cause of hotspotting from a monotonically increasing primary key. Option B is wrong because the instance has moderate throughput and 5 nodes, so underprovisioning is not indicated; adding more nodes would not fix the hotspotting and could increase costs unnecessarily. Option D is wrong because having too many nodes does not cause transaction conflicts; Cloud Spanner uses a distributed transaction protocol (Paxos-based) that scales with nodes, and reducing nodes would not resolve the hotspotting issue.

Full explanation →

212

Multi-Selecthard

A company wants to use Binary Authorization to enforce that only images signed by their internal CI/CD pipeline can be deployed to their GKE clusters. They have set up Cloud Build to sign images. Which THREE steps are required to configure this? (Choose 3)

Select 3 answers

A.Create an attestation for each container image using Cloud Build

B.Create a Binary Authorization policy that requires attestations for the GKE cluster

C.Create an attestor in Binary Authorization

D.Store the signing keys in Cloud HSM

E.Grant the GKE service account the roles/container.deployer role

AnswersA, B, C

Attestations are the signed metadata proving the image was verified.

Why this answer

To use Binary Authorization, you need to create an attestor that represents the signing authority, create an attestation (signed metadata) for each image, and create a policy that requires attestations. The policy can be cluster-specific. Granting the attestor the Cloud KMS signer role is needed to sign, but the question asks for steps to configure; storing keys in Cloud KMS is a prerequisite but not listed as a step here.

Full explanation →

213

MCQmedium

A company uses Cloud Storage to store sensitive customer data. They must ensure that data at rest is encrypted with a customer-managed key that is automatically rotated every 90 days. Which Cloud Storage configuration should they use?

A.Use customer-supplied encryption keys (CSEK) and rotate them manually

B.Enable default encryption with a customer-managed key (CMEK) from Cloud KMS with automatic rotation set to 90 days

C.Use Cloud HSM to create a key and set the bucket to use that key without rotation policy

D.Use Google-managed encryption keys (SSE-GM)

AnswerB

CMEK with KMS rotation meets the requirement: customer-managed, automatic rotation.

Why this answer

Cloud Storage supports CMEK (Customer-Managed Encryption Keys) via Cloud KMS. By using a Cloud KMS key with automatic rotation period of 90 days, objects written to the bucket are encrypted with that key. The bucket's default encryption is set to that key.

Customer-supplied encryption keys (CSEK) require manual key management and no automatic rotation. SSE with Google-managed keys does not meet the customer-managed requirement. Using a Cloud HSM key also supports CMEK but for automatic rotation, KMS key rotation is sufficient.

Full explanation →

214

MCQhard

A team uses BigQuery for analytics. They notice that queries against a table with billions of rows are slow and expensive. The table is partitioned by ingestion time and has no clustering. Queries frequently filter on a 'customer_id' column. Which optimization would MOST reduce query cost and latency?

A.Use a materialized view pre-aggregated by customer_id

B.Switch to on-demand pricing

C.Add a clustered index on customer_id

D.Cluster the table on customer_id

AnswerD

Clustering on customer_id will group rows with the same customer_id together, reducing data scanned when filtering on that column.

Why this answer

Clustering on 'customer_id' will physically co-locate rows with the same customer_id within each partition. This allows BigQuery to prune blocks, reducing the amount of data scanned for queries that filter on customer_id. Partitioning alone is not enough; clustering on the filter column is key.

Full explanation →

215

MCQhard

Refer to the exhibit. A subnet was created with the `--enable-private-ip-google-access` flag. What does this flag enable for instances in this subnet?

A.Instances can use direct peering to connect to on-premises networks.

B.Instances automatically receive internal DNS names for Google services.

C.Instances can access Google APIs and services without requiring an external IP address.

D.Instances can route traffic to the internet through a Cloud NAT gateway.

AnswerC

This is the purpose of Private Google Access: it enables private IP VMs to reach Google services via the Google network.

Why this answer

The `--enable-private-ip-google-access` flag allows VM instances in a subnet to reach Google APIs and services (such as Cloud Storage, BigQuery, and Cloud Pub/Sub) using only their internal (private) IP addresses, without needing an external IP address. This works by routing traffic through Google's internal network to the Google Front End (GFE), bypassing the public internet.

Exam trap

Google Cloud often tests the distinction between private Google access (which only covers Google APIs and services) and Cloud NAT (which provides outbound internet access for private instances), leading candidates to confuse the two or assume private Google access enables general internet connectivity.

How to eliminate wrong answers

Option A is wrong because direct peering to on-premises networks is enabled by setting up a dedicated interconnect or partner interconnect, not by the `--enable-private-ip-google-access` flag. Option B is wrong because internal DNS names for Google services are automatically provided by the Cloud DNS service for resources within the VPC, not by this subnet-level flag. Option D is wrong because routing traffic to the internet through a Cloud NAT gateway is a separate configuration that requires a Cloud NAT resource and a router, and it is not enabled by this flag; the flag specifically enables access to Google APIs and services, not general internet access.

Full explanation →

216

MCQmedium

An organization wants to ensure that all VMs in a project have the 'restricted-vm' tag to apply a firewall rule that allows only SSH from a bastion host. The VMs are created by multiple teams. Which approach ensures the tag is automatically applied to all new VMs?

A.Create a Cloud Function that listens to Compute Engine audit logs and adds the tag to new instances

B.Use a custom image that includes the tag in the instance metadata

C.Use an organization policy to require the tag

D.Configure OS Config with a software recipe to add the tag

AnswerA

This approach can tag instances automatically upon creation by monitoring the compute.instances.insert operation.

Why this answer

OS Config can enforce OS policies, but tagging is done via instance templates or organization policies. Using a custom image with the tag is not automatic. A pre-create Cloud Function can detect VM creation and add the tag.

Org policies cannot enforce tags directly.

Full explanation →

217

MCQmedium

A company wants to save costs on batch-processing workloads that can be interrupted and resumed. The workloads run on Compute Engine VMs and tolerate occasional failures. Which VM pricing model is MOST cost-effective?

A.Spot VMs

B.Preemptible VMs (with no discount)

C.Standard (on-demand) VMs

D.Committed use discounts (1-year)

AnswerA

Spot VMs are significantly cheaper and suitable for fault-tolerant batch workloads that can handle preemption.

Why this answer

Spot VMs (formerly preemptible) offer up to 60-91% discount but can be terminated at any time. They are ideal for fault-tolerant batch jobs. Committed use discounts provide lower prices for 1- or 3-year commitments.

Standard VMs are on-demand. The question specifies cost savings and tolerance to interruption.

Full explanation →

218

MCQeasy

An organization wants to enforce that all container images deployed to their Google Kubernetes Engine (GKE) clusters are signed and have passed a vulnerability scan. Which GCP service should they use to enforce this policy?

A.Cloud Build

B.Artifact Registry

C.IAM

D.Binary Authorization

AnswerD

Binary Authorization is the correct service for enforcing attestation-based policies on container images deployed to GKE.

Why this answer

Binary Authorization enforces policies that require container images to be signed by trusted authorities and optionally pass vulnerability scans before deployment. Cloud Build can be used to sign images, but the enforcement is done by Binary Authorization. Artifact Registry stores images, and IAM controls access but does not enforce signing policies.

Full explanation →

219

MCQmedium

A company uses the above IAM policy on a Cloud Storage bucket. They find that Bob can view objects in the bucket. Which statement explains this?

A.There is a higher-level policy that grants Bob viewer access.

B.The etag is mismatched causing policy override.

C.The bucket has uniform bucket-level access disabled.

D.Bob is a member of the group viewers@example.com.

E.The objectCreator role implicitly includes read access.

AnswerD

Group membership grants viewer access to Bob.

Why this answer

The IAM policy shown includes a binding that grants the `roles/storage.objectViewer` role to the group `viewers@example.com`. If Bob is a member of that group, he inherits the permissions to view objects in the bucket. The policy explicitly lists this group as a principal, so Bob's ability to view objects is directly explained by his group membership.

Exam trap

Google Cloud often tests the distinction between IAM roles and ACLs, and the trap here is that candidates may overlook the group membership in the policy and instead incorrectly attribute Bob's access to a higher-level policy or a misunderstanding of role permissions.

How to eliminate wrong answers

Option A is wrong because the question asks which statement explains Bob's access given the provided IAM policy; a higher-level policy is not shown and would be an assumption, not a direct explanation from the given policy. Option B is wrong because the `etag` is used for optimistic concurrency control to prevent concurrent modification conflicts, not to cause policy overrides or grant access. Option C is wrong because uniform bucket-level access controls whether IAM policies alone govern access (disabling it would allow ACLs, but the policy shown still grants Bob access via IAM, so this does not explain his access).

Option E is wrong because the `roles/storage.objectCreator` role only allows creating objects, not reading them; read access requires the `roles/storage.objectViewer` role or equivalent.

Full explanation →

220

MCQmedium

A company is using Cloud SQL for MySQL and wants to implement automated backups that are retained for 30 days. They also need point-in-time recovery. Which configuration should they use?

A.Enable database replication

B.Use Cloud Storage versioning

C.Enable automated backups with binary logging

D.Enable automated backups and set backup retention to 30

AnswerC

Binary logging enables point-in-time recovery.

Why this answer

Cloud SQL for MySQL requires automated backups to be enabled along with binary logging to support point-in-time recovery (PITR). Binary logs record all changes to the database, allowing you to restore to any specific timestamp within the backup retention period. Setting the retention to 30 days ensures backups are kept for the required duration, and binary logging enables the granular recovery needed for PITR.

Exam trap

The trap here is that candidates often assume enabling automated backups alone (Option D) is sufficient for point-in-time recovery, but they overlook the critical requirement of binary logging, which is the mechanism that enables granular time-based restores.

How to eliminate wrong answers

Option A is wrong because database replication (e.g., read replicas) provides high availability and read scaling, not automated backups or point-in-time recovery. Option B is wrong because Cloud Storage versioning applies to objects in buckets, not to Cloud SQL databases; it cannot restore database transactions or provide PITR. Option D is wrong because enabling automated backups with a 30-day retention alone only stores full backups; without binary logging, you cannot perform point-in-time recovery to a specific moment within that window.

Full explanation →

221

MCQmedium

A company runs batch processing jobs nightly that can tolerate interruptions. They want to minimize compute costs for these jobs. Which Compute Engine machine type and provisioning model is most cost-effective?

A.E2 custom VMs with sole-tenant nodes

B.N2 standard VMs with committed use discounts

C.Preemptible VMs with custom machine types

D.GPU-accelerated VMs

AnswerC

Preemptible VMs are up to 60-91% cheaper than regular VMs and suitable for batch jobs.

Why this answer

Preemptible/Spot VMs offer significant discounts (up to 91%) and are ideal for fault-tolerant, interruptible workloads like batch processing.

Full explanation →

222

MCQeasy

A developer wants to allow a Compute Engine VM to authenticate to Google Cloud APIs without embedding service account keys in the VM image. What is the recommended approach?

A.Use Cloud KMS to encrypt a service account key and store it in a bucket

B.Use a service account impersonation flow

C.Attach a service account to the VM instance

D.Create a service account key and store it in the VM's startup script

AnswerC

The VM can then use the default service account credentials via the metadata server.

Why this answer

Attaching a service account to the Compute Engine VM allows it to automatically obtain credentials via the metadata server, avoiding key management.

Full explanation →

223

MCQeasy

A company wants to reduce costs for a batch analytics job that runs nightly for 4 hours on Compute Engine VMs. The job is fault-tolerant and can handle instance restarts. Which Compute Engine VM pricing model is MOST cost-effective?

A.3-year committed use discount (CUD)

B.1-year committed use discount (CUD)

C.Sustained use discounts

D.Preemptible VMs

AnswerD

Preemptible VMs offer the maximum discount (approx. 60-80%) and are designed for fault-tolerant, batch workloads that can be interrupted and restarted.

Why this answer

Preemptible VMs offer the lowest cost (up to 80% discount) and are ideal for fault-tolerant, short-lived batch workloads that can handle interruptions. Sustained use discounts apply automatically but require running a VM for at least 25% of a month. Committed use discounts require a 1- or 3-year commitment and are not as flexible for a short nightly job.

Full explanation →

224

MCQeasy

A DevOps team wants to automate the deployment of infrastructure on Google Cloud using a declarative configuration language. They need to support Python and Jinja templates for reusable modules. Which service should they use?

A.Config Connector

B.Terraform on Google Cloud

C.Cloud Deployment Manager

D.Cloud Build

AnswerC

Cloud Deployment Manager supports YAML, Python, and Jinja templates, fulfilling the requirement for declarative configuration with reusable modules.

Why this answer

Cloud Deployment Manager supports YAML, Python, and Jinja templates, making it the correct choice for declarative infrastructure as code. Terraform is also declarative but uses HCL, not Python/Jinja. Cloud Build is for CI/CD pipelines, not infrastructure provisioning.

Config Connector is for Kubernetes-style resource management, not Python/Jinja templates.

Full explanation →

225

MCQhard

A company runs a batch processing workload on Compute Engine that processes financial transactions. The workload runs daily and must complete within a 4-hour window. The application reads input data from Cloud Storage, processes it, and writes output to another Cloud Storage bucket. The current implementation uses a single VM with a 500 GB persistent disk. Recently, the data volume has increased, and the job is now taking over 6 hours, exceeding the SLA. The team is tasked with redesigning the solution to be faster and more reliable. They want to minimize costs and operational overhead. The data is critical and must not be lost. Which approach should they take?

A.Use a managed instance group with a startup script that processes data, and use Cloud Pub/Sub to coordinate.

B.Increase the VM to a high-CPU machine type with a regional persistent disk for HA.

C.Deploy the processing logic in Cloud Functions and trigger from Cloud Storage events.

D.Use Cloud Dataflow with autoscaling to process the data in parallel.

AnswerD

Dataflow is a managed service that can scale horizontally, complete the job within the window, and provides fault tolerance.

Why this answer

Cloud Dataflow with autoscaling is the correct choice because it provides a fully managed, serverless service for parallel data processing that can automatically scale resources based on the volume of data. This directly addresses the need to complete the batch workload within the 4-hour SLA, as Dataflow can distribute the processing across many workers, significantly reducing execution time. It also ensures reliability and data durability through checkpointing and exactly-once processing semantics, meeting the critical data loss prevention requirement.

Exam trap

Google Cloud often tests the misconception that serverless functions like Cloud Functions can handle long-running batch jobs, but the key trap is ignoring the 9-minute timeout and lack of state management, leading candidates to choose Option C over the correct Dataflow solution.

How to eliminate wrong answers

Option A is wrong because using a managed instance group with a startup script and Cloud Pub/Sub adds unnecessary operational overhead and complexity for a batch workload; it does not natively provide parallel processing or autoscaling for data pipelines, and the coordination via Pub/Sub is not designed for batch processing of this nature. Option B is wrong because simply increasing the VM to a high-CPU machine type with a regional persistent disk does not address the parallelism needed to reduce processing time from 6+ hours to under 4 hours; it is a vertical scaling approach that has limits and does not improve reliability through distribution, and regional persistent disks provide high availability but not faster processing. Option C is wrong because Cloud Functions are designed for event-driven, short-lived executions with a maximum timeout of 9 minutes (540 seconds) and are not suitable for long-running batch processing jobs that can take hours; they also lack the ability to handle large-scale data shuffling and stateful processing required for financial transactions.

Full explanation →

Page 3 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCA by domain

Target a specific domain to shore up weak areas.

Managing Implementation and Ensuring Solution and Operations Reliability Managing and Provisioning a Solution Infrastructure Designing for Security and Compliance Analysing and Optimising Technical and Business Processes Design and plan a cloud solution architecture Manage and provision cloud infrastructure Design for security and compliance Analyze and optimize technical and business processes Manage implementation of cloud architecture Ensure solution and operations reliability

See all domains with question counts →