Google Professional Cloud Architect (PCA) — Questions 226–300

Cloud SQL for MySQL supports read replicas that receive asynchronous replication from the primary. Pointing read-only traffic at the replica IP offloads the primary and scales reads horizontally. The application tolerates slight staleness, which matches asynchronous replication, and no schema or code changes are needed beyond routing read connections.

VPC Service Controls builds a service perimeter around BigQuery, restricting access to approved VPC networks and blocking data exfiltration even by authorised identities. This directly enforces the network-origin constraint on the prod-data project's datasets, which IAM alone cannot achieve.

Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on GKE. By configuring a policy that requires an attestation from the security team's attestor, only images that have been scanned and approved can be admitted. This enforcement happens at the cluster level without changing the CI/CD pipeline.

Correct. Cloud Storage is the native Terraform backend for GCP.

The first step in troubleshooting is to gather data. Cloud Logging captures load balancer logs that include the status code, backend instance, and error details. By filtering for 502 errors, the team can identify patterns such as a specific instance or a particular request path. Examining health check logs can reveal if health checks are flapping or if instances are being marked unhealthy intermittently. This data-driven approach identifies the root cause before making changes.

StatefulSets are designed for stateful applications, providing stable network identities and persistent storage. The volumeClaimTemplates automatically create a PersistentVolumeClaim for each replica, which dynamically provisions a PersistentVolume (e.g., a Compute Engine persistent disk) and attaches it to the pod. This meets the requirement for stable identity and persistent storage that survives pod restarts.

Cloud DLP inspects Cloud Storage objects using infoType detectors that recognise credit card numbers and other sensitive patterns, then redacts or masks the matches. It satisfies the detection-and-redaction requirement directly, unlike encryption or access-control services that never examine file contents.

Cloud HSM is a cloud-hosted HSM that is FIPS 140-2 Level 3 validated. When used with Cloud KMS, you can create and manage keys in an HSM, control rotation, and use them for encryption at rest. This meets all requirements: customer-controlled keys, on-demand rotation, and HSM storage with FIPS 140-2 Level 3. It integrates with many Google Cloud services for CMEK.

Health checks and autohealing ensure that unhealthy instances are automatically recreated. This maintains the desired capacity and availability of the application. When combined with multi-zone deployment, autohealing helps recover from instance failures quickly, contributing to meeting high availability SLAs.

IAM policies can be attached at the organisation node, and these inherit downward to all folders, projects and resources beneath it. This satisfies centralised control across the entire resource hierarchy rather than a single project scope.

Vertical Pod Autoscaler continuously analyses historical CPU and memory consumption from the metrics pipeline, then recalculates and applies pod resource requests and limits automatically. This directly satisfies the stem's requirement to right-size requests and limits from observed usage, rather than scaling replica counts horizontally or reacting only to live thresholds.

Archive storage suits data accessed roughly once a quarter and retained for a decade, since its low storage price offsets higher retrieval costs and minimum storage duration. It satisfies the stem's cost-minimisation constraint for cold, compliance-bound video files, unlike Nearline or Coldline, which cost more per gigabyte stored.

CMEK allows you to use your own keys in Cloud KMS to encrypt BigQuery data. Enabling Cloud KMS audit logs records all key usage, including encryption and decryption operations. Disabling the key immediately revokes access to the data. This meets all requirements: customer-controlled keys, key usage logging, and revocation capability.

Private Google Access lets VMs without external IP addresses reach Google APIs and services, including Cloud Storage, using the internal IP address and Google's internal routing. Enabling it on the subnet is sufficient for the transcoding VMs to read source objects without public internet exposure. This directly satisfies the policy against external IPs while keeping API traffic on Google's network.

CMEK with Cloud HSM lets the customer retain control of the key while Cloud HSM stores it in a hardware security module validated to FIPS 140-2 Level 3. This satisfies the explicit HSM and certification constraint that software-backed or Google-managed keys cannot meet.

Configuring a Cloud SQL instance as regional creates a standby replica in a different zone. If the primary zone fails, Cloud SQL automatically fails over to the standby, allowing writes to continue with minimal downtime. This matches the requirement for automatic failover and continued write availability during a zonal failure.

Cloud SQL for MySQL is a managed service supporting cross-zone high availability with automatic failover, and its Database Migration Service enables minimal-downtime replication from on-premises MySQL. This directly satisfies the automated failover and low-downtime migration constraints.

An organisation policy with a list constraint enforces exactly this prohibition: the constraint `storage.uniformBucketLevelAccess` accepts allowed values, and denying `false` blocks bucket creation where uniform bucket-level access is disabled. This satisfies the stem's requirement to prevent, rather than merely detect, non-compliant buckets across the organisation.

Cloud Trace collects and correlates latency data across microservice calls, producing distributed traces that pinpoint slow spans in request paths. This directly satisfies the need to analyse latency in microservices applications, unlike logging or monitoring services that lack span-level tracing.

VPC Service Controls create a service perimeter around the project, blocking access from outside approved networks regardless of IAM permissions. This satisfies the IP-based restriction requirement by enforcing perimeter ingress rules, though note that Cloud Storage access via the Google Cloud console or APIs is contained within the perimeter boundary.

Object versioning retains every overwrite and delete, which silently multiplies storage charges. A lifecycle rule that deletes noncurrent versions after 90 days bounds that accumulation while preserving a recovery window, directly reducing the bucket's storage cost.

The Google Cloud service account is the identity the pod impersonates to call Google Cloud APIs. It must exist and be granted the required IAM roles, forming the target of the Workload Identity mapping that removes the need for downloaded keys.

gsutil relies on credentials from gcloud authentication. Since the user is not authenticated, no access token exists, so the request fails with AccessDenied. Running gcloud auth login establishes the Google account credentials gsutil then uses, resolving the authentication failure before any permission check occurs.

Regional GKE clusters behind a multicluster ingress and global external HTTP(S) load balancer give anycast-style entry, directing users to the nearest healthy region and rerouting automatically when a region fails, meeting both the proximity and failover constraints.

Cloud Armor rate limiting enforces per-IP throttling at the Google Cloud edge, satisfying the requirement to restrict traffic from specific addresses. Combined with its preconfigured WAF rules for SQL injection and XSS, it addresses the attack-mitigation constraint directly, protecting the HTTPS load-balanced backend without application changes.

Cloud Interconnect provides dedicated private connectivity at 10 Gbps or 100 Gbps per attachment, bypassing the public internet. This satisfies the high-bandwidth, low-latency requirement for migrating hundreds of VMs, unlike VPN tunnels which traverse shared internet paths.

A public managed zone serves authoritative answers for example.com to internet resolvers, while a private managed zone scoped to the VPC resolves internal hostnames for resources inside that network. Two zones satisfy both the public authoritative and internal resolution requirements.

IAP TCP forwarding tunnels SSH over HTTPS through Google's edge, so VMs need no external IP. Combined with OS Login, IAM policies control SSH access per user or group, credentials are ephemeral, and every session is logged to Cloud Audit Logs, satisfying the auditable single control plane requirement.

Secret Manager stores API keys and database passwords as versioned secrets, and its rotation schedules trigger Pub/Sub notifications every 30 days so rotation can be automated. This directly satisfies the stem's requirement for secure storage plus automatic 30-day rotation, unlike Cloud KMS, which manages encryption keys rather than application credentials.

Folders allow policies and IAM to be inherited and scoped per business unit and environment, satisfying the security team's need for guardrails. Placing application projects inside environment folders keeps production and non-production separated. A dedicated shared networking project, owned centrally, is the standard pattern for shared VPC host projects and keeps network administration distinct from application ownership, supporting separate billing.

Cloud Audit Logs records IAM policy and role binding changes as immutable, timestamped Admin Activity entries retained for the project or organisation. This provides the historical change record the audit requires, unlike current-state views such as IAM policy queries.

CMEK with Cloud KMS lets the organisation generate, rotate and manage its own key material inside Google Cloud, satisfying the 90-day rotation requirement without on-premises key storage. BigQuery decrypts data using these keys, so control stays with the customer while keys never leave Cloud KMS.

Workload Identity federates a Kubernetes service account with a Google Cloud service account via the cluster's workload identity pool, issuing short-lived tokens. The pod therefore accesses Cloud Storage without any long-lived service account key stored in the cluster.

Log-based metrics derive values from log entries, and the load balancer logs include status details for each request. By counting 5xx responses and dividing by total requests, you can compute an error rate. Alerting policies can use such metrics with threshold conditions, and maintenance windows suppress alerts during planned downtime. This directly addresses the requirement to monitor application-level errors rather than infrastructure health, and respects maintenance periods.

AlloyDB provides a fully managed, PostgreSQL-compatible engine with a columnar acceleration layer, delivering the high OLTP throughput the stem demands. Its compatibility allows the Oracle application to migrate with minimal code changes, satisfying both the performance and low-modification constraints simultaneously.

Cloud Deploy orchestrates the progressive rollout across the MIG, defining a canary phase that shifts a percentage of traffic, then runs automated verification against your defined metrics before promoting or rolling back. This satisfies the requirement to advance only when performance stays healthy.

Committed use discounts lock in predictable pricing for the steady baseline compute, while preemptible VMs supply cheap burst capacity. Since the jobs are fault-tolerant and resumable, preemption causes no data loss, meeting the lowest-cost requirement.

Side inputs broadcast a small lookup dataset to each worker, letting the pipeline enrich events locally instead of performing a cross join. A cross join forces every element to pair with every other, exploding shuffle volume; replacing it with side inputs removes that multiplication, cutting processing cost.

Dedicated Interconnect provides a private physical link between on-premises and Google Cloud, delivering high bandwidth, low latency and an SLA of up to 99.99%. This satisfies the dedicated, SLA-backed requirement, unlike Partner Interconnect or VPN options.

Cloud NAT provides outbound internet access for instances lacking external IP addresses, while Private Google Access lets those instances reach Google APIs and Cloud Storage internally. Together they satisfy both requirements without exposing instances to inbound internet traffic.

Serverless VPC access routes Cloud Run egress through the connector's own subnet and IP range, not the service's. If the connector sits in the wrong subnet or firewall rules omit its range, Compute Engine silently drops packets, surfacing as 502 responses.

Cloud Monitoring allows you to define SLOs based on latency distributions, set a performance goal (e.g., 99% of requests under 200 ms), and create alerting policies based on error budget burn rates. This directly meets the requirement to measure the proportion and alert on rapid consumption.

In Shared VPC, subnet creation rights reside with the host project, not the service project. The service project admin needs the compute.subnetworks.create permission granted on the host project, which explains the permission denied error when attempting to create the subnet.

Partitioning splits the table by date or timestamp, so a query with a date filter prunes irrelevant partitions and scans only the matching ones. This reduces bytes processed, lowering cost and improving performance versus full table scans.

The global external HTTP(S) Load Balancer provides global anycast IP, low-latency routing, and URL path-based routing via URL maps. It supports Google-managed SSL certificates for TLS termination and integrates with Cloud Armor for DDoS protection and WAF rules. This meets all requirements: global load balancing, path-based routing, SSL offload, and DDoS mitigation.

Cloud Spanner multi-region configuration synchronously replicates data across regions with strong consistency, so the database survives a full regional outage. This satisfies the stem's requirement that the application remain available despite an entire Google Cloud region failing.

Firewall rules on VPC networks can use service accounts as both source and target, which authorizes traffic based on the identity attached to the instance rather than its IP. Unique service accounts per tier plus service-account-based rules enforce least privilege and satisfy the identity-based evaluation requirement without depending on address ranges.

OS Config's patch management applies OS updates to Compute Engine instances on a schedule you define, satisfying the weekly compliance requirement without manual intervention. It targets the guest OS directly, unlike image-level tooling, and reports patch compliance per instance, which is exactly what the stem demands.

A regional MIG spreads instances across multiple zones in a region, so if one zone fails, instances in other zones continue to serve traffic. Autoscaling ensures capacity is maintained. A global external HTTP(S) load balancer provides a single anycast IP and routes users to the closest healthy backend, minimizing latency across the US. This combination meets high availability and low latency requirements.

A global external Application Load Balancer provides a single anycast hostname and can route to serverless network endpoint groups in multiple regions, so failover happens without DNS changes. A Cloud SQL cross-region replica keeps a warm copy of the data that can be promoted if the primary region fails, satisfying the readability requirement during a regional outage.

Identity-Aware Proxy enforces authentication and authorisation at the load balancer layer, verifying user identity before granting access to the backend application. It integrates with external identity providers, satisfying the requirement to restrict access to authenticated corporate Active Directory users.

Dedicated Interconnect provides a private physical circuit between the on-premises network and Google's VPC, delivering consistent high bandwidth beyond 10 Gbps with low latency. Partner Interconnect and VPN options cannot guarantee the sustained throughput the stem requires.

BigQuery is a fully managed, petabyte-scale analytics data warehouse that supports ANSI SQL and integrates with many BI tools. It is designed for high-performance analytics and can scale seamlessly. It is serverless and allows you to run fast SQL queries on large datasets. This makes it the ideal choice for migrating an on-premises data warehouse and supporting BI workloads.

Preemptible VMs cost substantially less than standard instances but can be reclaimed at any time, with a 24-hour maximum runtime. The batch jobs tolerate interruptions, so this constraint is satisfied. Combining them with a managed instance group and restart logic keeps the nightly workload completing despite preemption.

Autoscaling adjusts the number of VM instances in the group based on load, so you pay only for what you need. Setting a lower minimum reduces cost during low-traffic periods, while the autoscaler adds instances when CPU or other metrics rise, preserving performance during peaks. This directly addresses the low average utilization without manual intervention.

CPU utilization lags behind actual request load, especially for I/O-bound APIs that block on downstream calls while CPU stays moderate. Scaling on a request-rate metric lets the HPA add replicas as soon as traffic climbs, matching the sales-event pattern. This reduces latency risk and avoids over-provisioning between events, directly addressing the bottleneck.

Cloud Audit Logs records Admin Activity and Data Access entries, including firewall rule insertions, updates and deletions in a GCP project. It is the native service that captures these configuration changes for audit, satisfying the requirement to track all firewall rule modifications.

Cloud Pub/Sub carries the audit log events onward, letting a subscriber receive IAM policy change notifications in real time. Combined with Cloud Logging log sinks and a notification channel, it delivers the alerting pipeline the security team requires for new bindings.

Preemptible VMs cost substantially less than standard instances but can be reclaimed at any time, so checkpointing preserves progress across interruptions. This suits the four-hour CPU-intensive batch job, cutting cost while the MIG restarts reclaimed instances to maintain throughput.

HA VPN provides two tunnels across two interfaces, delivering a 99.99% availability SLA when configured with two external IP addresses. It encrypts traffic over the public internet, matching both the SLA and encryption constraints in the stem.

Secret Manager stores API keys and passwords encrypted at rest, granting the Cloud Function access through IAM roles rather than embedding credentials in code or environment variables. This satisfies the stem's requirement to secure secrets, since versioned, audited retrieval replaces hard-coded values that leak through source control or function configuration.

Correct: regional cluster survives zone failure.

Cloud Storage performs CMEK envelope encryption through its per-project service agent, not the Compute Engine service account. The service agent `service-<project-number>@gs-project-accounts.iam.gserviceaccount.com` in `data-proj` requires the Cloud KMS CryptoKey Encrypter/Decrypter role on the key in `kms-proj`; without it, reads fail with Access Denied.

A global external Application Load Balancer provides a single anycast IP and routes each user to the closest healthy backend based on latency and health. By deploying the stateless API in multiple regions behind this load balancer, users in each geography are served from a nearby region, reducing latency without code changes. This is the standard global serving pattern in Google Cloud.

CMEK with Cloud HSM provides customer-controlled, HSM-backed keys with automatic rotation.

The global external Application Load Balancer is a managed Layer 7 proxy that terminates TLS at Google's edge, supports custom hostnames through Google-managed certificates, and uses a URL map to route by path prefix to different backends. It scales globally without reverse-proxy VMs, which matches every stated requirement.

Cloud Run's request-driven autoscaling can reduce the service to zero instances during idle periods, which removes idle infrastructure cost entirely. That directly satisfies the requirement to scale to zero when no traffic exists, and the consumption-based billing model means the team pays only for the CPU and memory used while requests are being processed, which is exactly the economic behavior the scenario demands.

Traffic splitting routes a configurable percentage of requests to the new version while the old version keeps serving the remainder. If the new version fails, traffic shifts back without downtime, satisfying the reliability requirement during deployments.

Hierarchical firewall policies are defined at the organisation node, which is the root of the resource hierarchy. Attaching policy there lets rules cascade to every folder and project beneath it, satisfying the requirement for centralised firewall management across all projects.

Cloud Run is fully managed and scales to zero, removing cluster and node operational overhead entirely. It autoscales on HTTP request concurrency, directly satisfying the startup's requirement to scale with request load without managing infrastructure.

Cloud EKM lets Cloud KMS call an external key manager you control, so key material resides outside Google and never enters Google's infrastructure. Revoking the external key immediately renders wrapped data keys unusable, satisfying both the external custody and rapid revocation requirements for Cloud Storage and BigQuery.

A managed instance group spanning multiple zones maintains capacity when one zone fails, satisfying the automatic zone-failure recovery requirement. The group's regional distribution and autohealing replace unhealthy instances in surviving zones, unlike a single-zone group or manual restart, which cannot survive zone loss.