Courseiva

Google Professional Cloud Architect (PCA) — Questions 301–375

955 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 13

Page 6
301
MCQeasy

A user runs the gsutil command shown in the exhibit and gets an AccessDenied error. The user is not authenticated with gcloud. What should the user do first?

A.Create a service account and download a JSON key.
B.Grant public write access to the bucket.
C.Use gcloud config set project my-project to set the project.
D.Run gcloud auth login to authenticate with their Google account.
AnswerD

This will authenticate the user and allow gsutil to use their credentials.

Why this answer

The error occurs because the user is not authenticated with gcloud. The gsutil command requires valid authentication credentials to access Google Cloud Storage resources. Running `gcloud auth login` initiates the OAuth 2.0 flow, which authenticates the user with their Google account and generates the access token that gsutil uses for API calls.

This is the prerequisite step before any gsutil operation can succeed.

Exam trap

Google Cloud often tests the distinction between authentication (who you are) and authorization (what you can do); the trap here is that candidates may confuse the AccessDenied error with a bucket permission issue and jump to granting public access or setting a project, when the root cause is simply missing authentication credentials.

How to eliminate wrong answers

Option A is wrong because creating a service account and downloading a JSON key is an alternative authentication method, but it is not the first step; the user must first authenticate with gcloud (either via user account or service account) before gsutil can use those credentials. Option B is wrong because granting public write access to the bucket would bypass authentication entirely, which is a severe security misconfiguration and not a solution for an unauthenticated user; the error is about missing credentials, not bucket permissions. Option C is wrong because `gcloud config set project my-project` only sets the default project for gcloud commands but does not authenticate the user; without authentication, gsutil still cannot access any bucket regardless of the project setting.

Full explanation →
302
MCQhard

A financial services company is designing a multi-region application on Google Kubernetes Engine (GKE) for high availability. They need to serve user requests from the closest region and automatically failover if a region becomes unavailable. Which architecture should they use?

A.Use a global external HTTP(S) load balancer with a single backend service pointing to one regional cluster.
B.Use Cloud CDN in front of a single regional GKE cluster to cache content.
C.Use a single regional GKE cluster with auto-scaling across zones.
D.Deploy GKE clusters in multiple regions and use a multicluster ingress with an external HTTP(S) load balancer set up with the global external backend.
AnswerD

This architecture uses the Global External HTTP(S) Load Balancer with multicluster ingress to direct traffic to the nearest healthy cluster, providing geographic load balancing and failover.

Why this answer

Deploying GKE clusters in multiple regions and using a multicluster ingress with a global external HTTP(S) load balancer enables traffic routing to the closest healthy backend cluster based on latency or geography, and automatically fails over to another region if one becomes unavailable. The global external backend configuration allows the load balancer to distribute traffic across multiple regional GKE clusters, providing both proximity-based routing and high availability.

Exam trap

The trap here is that candidates often confuse zonal high availability (auto-scaling across zones within one region) with regional high availability (multi-region failover), and overlook that a global load balancer with multiple regional backends is required for true multi-region traffic steering and failover.

How to eliminate wrong answers

Option A is wrong because a single backend service pointing to one regional cluster cannot provide multi-region failover or route users to the closest region; it only supports a single region. Option B is wrong because Cloud CDN caches content but does not provide active failover or multi-region traffic steering; it only reduces latency for cached content from a single origin. Option C is wrong because a single regional GKE cluster with auto-scaling across zones provides zonal high availability within one region but cannot serve requests from the closest region or failover to another region if the entire region becomes unavailable.

Full explanation →
303
Multi-Selectmedium

An organization wants to protect an HTTPS load-balanced web application from common web attacks, such as SQL injection and cross-site scripting (XSS), as well as rate-limit traffic from specific IPs. Which three capabilities should they use together? (Choose three.)

Select 3 answers
A.Cloud Armor rate limiting
B.Cloud CDN
C.Cloud Armor WAF rules
D.Cloud Load Balancing logging
E.Cloud Armor IP blacklist/whitelist
AnswersA, C, E

Rate limiting can throttle traffic from specific IPs.

Why this answer

Cloud Armor provides WAF rules (preconfigured rules for SQLi, XSS, etc.), rate limiting, and IP blacklisting/whitelisting. All three are part of Cloud Armor security policies.

Full explanation →
304
MCQhard

An engineer is configuring Cloud Armor security policies for an HTTPS Load Balancer. They want to block requests from a specific IP range but allow all other traffic. What is the correct way to configure this?

A.Create a rule with priority 1000 to allow all traffic, and a rule with priority 100 to deny the IP range
B.Create a single rule with the IP range and action 'deny'
C.Create a rule with priority 100 to deny the IP range, and a rule with priority 1000 to allow all traffic
D.Create a rule with priority 1000 to deny the IP range, and no allow rule
AnswerC

The deny rule with lower priority number is evaluated first, blocking the IP range, then the allow rule permits everything else.

Why this answer

Cloud Armor security policies use rules with a 'deny' action for blocking and 'allow' for permitting. Rules are evaluated in order of priority, with lower numbers having higher priority.

Full explanation →
305
Multi-Selecthard

An organization wants to implement a zero-trust architecture for a web application running on Compute Engine. They require: - All traffic must be authenticated and authorized at the application layer. - Access decisions must consider the user's identity, device security posture, and IP address. - Session hijacking must be mitigated. Which THREE services or features should they use? (Choose three.)

Select 3 answers
A.IAP's signed headers (X-Goog-Authenticated-User-Email)
B.Cloud Armor with adaptive protection
C.Identity-Aware Proxy (IAP)
D.Cloud Armor with security policies that include access from certain IP ranges
E.VPC Service Controls
AnswersA, C, D

Signed headers ensure that requests come from IAP, preventing session hijacking.

Why this answer

IAP provides identity-aware access, Cloud Armor can enforce context-based access, and IAP signed headers prevent session hijacking.

Full explanation →
306
MCQhard

An organization uses Cloud Spanner with a multi-region configuration to achieve 99.999% availability for their global user base. They notice an increase in write latency during peak hours. Which action would MOST effectively reduce write latency?

A.Use a stronger read consistency level
B.Change from a multi-region to a single-region configuration
C.Enable follower reads
D.Add more nodes to the Spanner instance
AnswerD

Adding nodes increases throughput and reduces write latency by providing more resources.

Why this answer

In Cloud Spanner, write latency can be reduced by adding more nodes (increasing throughput) or optimizing schema. Adding nodes provides more compute and I/O capacity, reducing queuing and latency.

Full explanation →
307
MCQmedium

Your company has a production environment on Google Cloud that includes Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Security policies require that all data at rest is encrypted with CMEK, and audit logs must be retained for 7 years. The current configuration uses Google-managed encryption keys. You have been asked to transition to CMEK for all resources. After enabling CMEK for new resources, you discover that the existing resources are not re-encrypted. To comply with the policy, you need to re-encrypt the existing data. What should you do?

A.Enable CMEK on the existing resources by modifying the resource's encryption settings. This will automatically re-encrypt the data.
B.Delete the existing resources and recreate them with CMEK enabled. Then restore data from backups.
C.Enable Data Loss Prevention (DLP) API to scan and re-encrypt data automatically.
D.For Compute Engine: create new disks with CMEK, attach them, and copy data. For Cloud Storage: rewrite objects with CMEK. For BigQuery: copy datasets to new datasets with CMEK.
AnswerD

This correctly re-encrypts existing data for each service.

Why this answer

CMEK is applied at the resource creation level for Compute Engine disks, Cloud Storage buckets, and BigQuery datasets. Existing resources encrypted with Google-managed keys cannot be re-encrypted in place; you must create new resources with CMEK enabled and migrate the data. For Compute Engine, this means creating new disks with CMEK, attaching them, and copying data.

For Cloud Storage, you rewrite objects to a new bucket or use the rewrite API with CMEK. For BigQuery, you copy datasets to new datasets that have CMEK configured.

Exam trap

Google Cloud often tests the misconception that you can simply toggle encryption settings on existing resources to apply CMEK, when in reality CMEK must be configured at creation time and data must be migrated to new resources.

How to eliminate wrong answers

Option A is wrong because modifying encryption settings on existing resources does not trigger automatic re-encryption; CMEK must be specified at creation time for disks, buckets, and datasets, and there is no in-place re-encryption mechanism. Option B is wrong because deleting and recreating resources from backups would require the backups themselves to be encrypted with CMEK, and this approach is unnecessarily destructive and risks data loss; a more controlled migration is preferred. Option C is wrong because the DLP API is designed for content inspection and de-identification, not for re-encrypting data at rest with CMEK; it cannot change the underlying encryption key of a Cloud Storage object or BigQuery table.

Full explanation →
308
MCQhard

A large enterprise is migrating their on-premises data center to Google Cloud. They have hundreds of VMs and need to minimize network latency between on-prem and cloud during migration. They have high bandwidth requirements. Which connectivity solution should they use?

A.Cloud Interconnect
B.Cloud VPN
C.Cloud NAT
D.Peering with Google
AnswerA

Dedicated connection with high bandwidth and low latency.

Why this answer

Cloud Interconnect provides a dedicated, high-bandwidth, low-latency connection between on-premises data centers and Google Cloud, bypassing the public internet. This is ideal for large-scale migrations with hundreds of VMs where minimizing latency and ensuring consistent throughput is critical.

Exam trap

The trap here is that candidates often confuse Cloud VPN with Cloud Interconnect, assuming VPN is sufficient for high-bandwidth, low-latency needs, but VPN's reliance on the public internet introduces jitter and bandwidth constraints that make it unsuitable for large-scale migrations.

How to eliminate wrong answers

Option B (Cloud VPN) is wrong because it uses IPSec tunnels over the public internet, which introduces variable latency, lower throughput limits, and no SLA for bandwidth, making it unsuitable for high-bandwidth, latency-sensitive migrations. Option C (Cloud NAT) is wrong because it is used to enable outbound internet access for private VMs without public IPs, not for establishing a private, low-latency connection between on-prem and cloud. Option D (Peering with Google) is wrong because it provides connectivity to Google services (e.g., YouTube, Gmail) via public peering points, not a dedicated private connection to a specific VPC network, and lacks SLA-backed bandwidth and latency guarantees required for enterprise migration.

Full explanation →
309
MCQeasy

An organization wants to manage DNS records for a domain they own (e.g., example.com) and use Google Cloud for authoritative DNS. They also need to resolve internal hostnames for resources within their VPC. Which Cloud DNS configuration should they use?

A.Create a single public managed zone and use DNS peering for internal resolution
B.Create a single private managed zone for both external and internal DNS resolution
C.Use Google Groups DNS to manage both public and private records
D.Create a public managed zone for example.com and a private managed zone for internal VPC resources
AnswerD

Public zone handles external DNS queries; private zone attached to the VPC handles internal resolution.

Why this answer

Cloud DNS public zones manage public DNS records for internet-facing domains. Cloud DNS private zones are used for internal DNS resolution within VPCs. The correct approach is to create a public zone for example.com and a private zone for internal hostnames attached to the VPC.

Full explanation →
310
MCQmedium

A company uses Cloud SQL for PostgreSQL for their transactional database. They need a disaster recovery solution that provides cross-region failover with a recovery point objective (RPO) of less than 1 minute. Which solution meets these requirements?

A.Create a cross-region read replica and promote it during failover
B.Use Cloud Spanner for global strong consistency
C.Use a Cloud SQL for PostgreSQL instance with multiple zones
D.Take daily automated backups and restore in another region
AnswerA

Cross-region read replicas replicate data asynchronously with low RPO.

Why this answer

A cross-region read replica in Cloud SQL for PostgreSQL can be promoted to a standalone instance during a disaster, enabling failover to another region. The replica uses PostgreSQL's native streaming replication, which typically provides an RPO of less than 1 minute because changes are replicated asynchronously but with very low latency. This meets the stated RPO requirement without needing to redesign the application for global consistency.

Exam trap

Google Cloud often tests the distinction between high availability (within a region) and disaster recovery (cross-region), and the trap here is that candidates confuse multi-zone (regional) instances with cross-region failover, or assume that automated backups can meet a sub-minute RPO.

How to eliminate wrong answers

Option B is wrong because Cloud Spanner provides global strong consistency and automatic failover, but it is a different database service, not a solution for an existing Cloud SQL for PostgreSQL instance; migrating to Spanner would require significant application changes and is not a direct DR solution for Cloud SQL. Option C is wrong because a multi-zone (regional) Cloud SQL instance provides high availability within a single region, not cross-region failover, so it cannot protect against a regional outage. Option D is wrong because daily automated backups have an RPO of up to 24 hours (or the backup interval), which far exceeds the requirement of less than 1 minute; restoring from a backup also takes significant time, failing the recovery time objective.

Full explanation →
311
MCQmedium

An organization needs to store API keys and database passwords securely in Google Cloud. They want to automatically rotate secrets every 30 days. Which service should they use?

A.Cloud Storage with bucket-level encryption
B.Cloud Key Management Service (Cloud KMS)
C.Secret Manager
D.Cloud Runtime Configurator
AnswerC

Secret Manager is designed for storing API keys, passwords, and other secrets, and supports rotation.

Why this answer

Secret Manager supports automatic rotation with a rotation period and can trigger a Cloud Function to generate a new secret version.

Full explanation →
312
Multi-Selecthard

An organization runs a critical application on Compute Engine with a 99.99% SLO. They have set an error budget of 0.01% over a 30-day window. Recently, an unexpected traffic spike caused a 0.005% error rate for a few hours. Which THREE actions align with SRE best practices? (Choose 3)

Select 3 answers
A.Immediately rollback any recent changes to prevent further errors.
B.Disable monitoring alerts for the error rate to avoid false alarms.
C.Conduct a blameless postmortem to understand the root cause and prevent recurrence.
D.Accept the incident as within the error budget and focus on other improvements.
E.Increase capacity proactively for anticipated future spikes.
AnswersC, D, E

Blameless postmortems are key to learning and improving reliability.

Why this answer

SRE best practices include using error budgets to drive decisions, conducting blameless postmortems, and adjusting capacity based on usage. Relying on past data and ignoring the spike is not proactive.

Full explanation →
313
MCQhard

A security team wants to audit all IAM role assignments in an organization. They need a historical record of changes. Which tool should they use?

A.Cloud Asset Inventory
B.Access Transparency
C.Cloud Audit Logs
D.Security Command Center
AnswerC

Cloud Audit Logs capture historical IAM policy changes for an organization.

Why this answer

Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify IAM policies, including role assignments. These logs are immutable and retained for the default retention period (400 days for Admin Activity logs), providing a historical record of changes. Cloud Asset Inventory (A) shows the current state but not historical changes, Access Transparency (B) logs Google staff access to your data, and Security Command Center (D) provides security findings and posture, not a change history.

Exam trap

Google Cloud often tests the distinction between tools that show current state (Cloud Asset Inventory) versus tools that record historical changes (Cloud Audit Logs), leading candidates to pick Cloud Asset Inventory because it 'audits' resources, but it does not provide a change history.

How to eliminate wrong answers

Option A is wrong because Cloud Asset Inventory provides a snapshot of current IAM role assignments and other resources, but it does not maintain a historical record of changes; it lacks the audit trail capability. Option B is wrong because Access Transparency logs actions performed by Google personnel when accessing your data, not IAM role assignment changes made by your own users or services. Option D is wrong because Security Command Center is a security and risk management platform that aggregates findings and vulnerabilities, but it does not natively record a chronological history of IAM policy modifications.

Full explanation →
314
MCQhard

An organization needs to encrypt data at rest in BigQuery using keys that are rotated every 90 days. They want to manage the keys themselves but cannot store keys on-premises. Which encryption approach should they use?

A.Default Google-managed encryption
B.Customer-Managed Encryption Keys (CMEK) with Cloud KMS
C.Cloud HSM
D.Customer-Supplied Encryption Keys (CSEK)
AnswerB

CMEK allows customers to control key rotation and manage keys in Cloud KMS.

Why this answer

CMEK with Cloud KMS allows customers to manage their own keys (including rotation) while keys are stored in Google's Cloud KMS.

Full explanation →
315
MCQmedium

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using a specific service account without storing long-lived credentials. Which method should be used?

A.Assign the service account directly to the GKE node pool
B.Create a JSON key for a service account and mount it as a secret in the pod
C.Use Workload Identity to bind the Kubernetes service account to a Google Cloud service account
D.Use Application Default Credentials on the pod
AnswerC

Workload Identity provides secure, automated authentication without static keys.

Why this answer

Workload Identity allows a Kubernetes service account to act as a Google Cloud service account by binding them. This eliminates the need for static keys and uses short-lived tokens.

Full explanation →
316
Multi-Selecthard

A company needs to design a disaster recovery strategy for a critical application running on Cloud SQL for PostgreSQL. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 30 minutes. Which THREE actions should they take to meet these objectives? (Choose THREE.)

Select 3 answers
A.Take regular on-demand exports to Cloud Storage
B.Configure cross-region replication for the Cloud SQL instance
C.Create a failover replica in the same region
D.Use a regional Cloud SQL instance with high availability
E.Enable automated backups with binary logging
AnswersB, D, E

Cross-region replica provides fast failover with low RPO.

Why this answer

Cross-region replication with failover replicas can achieve RPO of a few seconds and RTO of minutes. Point-in-time recovery and automated backups provide additional recovery options but may not meet RPO as low as 5 minutes alone.

Full explanation →
317
MCQmedium

A company is migrating an on-premises Oracle database to Google Cloud. They want to minimize application changes and need a fully managed, PostgreSQL-compatible database with high performance for OLTP workloads. Which service is MOST suitable?

A.Bigtable
B.AlloyDB
C.Cloud SQL for PostgreSQL
D.Cloud Spanner
AnswerB

AlloyDB is PostgreSQL-compatible, fully managed, and offers 4x faster transaction processing than standard PostgreSQL, making it ideal for Oracle migrations.

Why this answer

AlloyDB is a fully managed, PostgreSQL-compatible database optimized for high-performance OLTP workloads, designed for migration from Oracle with minimal changes. Cloud SQL for PostgreSQL is also managed but does not offer the same performance optimizations as AlloyDB. Cloud Spanner is global and SQL-compatible but may require application changes.

Bigtable is NoSQL.

Full explanation →
318
MCQhard

Your company runs a production application on Compute Engine instances behind a managed instance group (MIG). You need to perform a rolling update with canary testing, gradually shifting traffic to the new version only if performance metrics are healthy. Which approach should you use?

A.Use Cloud Deploy with a deployment strategy that includes a canary phase and automated verification
B.Create a new MIG with the new template and use a Cloud Load Balancer's traffic splitting
C.Manually update each instance by SSH'ing and running a script
D.Use gcloud compute instance-groups managed rolling-action start-update with a maxSurge of 0
AnswerA

Cloud Deploy supports canary deployments with verification steps.

Why this answer

Cloud Deploy can be used to orchestrate canary deployments on Compute Engine. However, a more direct approach is to use a MIG with a canary configuration: you can update the MIG's instance template and use a new MIG for the canary version, then adjust the load balancer's backend weights to shift traffic gradually. Cloud Deploy supports this with deployment strategies.

Full explanation →
319
MCQmedium

A company wants to run batch processing workloads that can be interrupted and resumed, at the lowest possible cost. The jobs are fault-tolerant and can handle preemption. They also need predictable pricing for a baseline amount of compute. Which combination of compute options should they use?

A.Use spot VMs for all workloads and rely on automatic restart
B.Use standard VMs with sustained use discounts
C.Use only preemptible VMs for all workloads
D.Use committed use discounts for baseline capacity and preemptible VMs for additional burst capacity
AnswerD

Committed use discounts give predictable pricing for baseline; preemptible VMs are cheap for additional capacity.

Why this answer

Preemptible VMs (or Spot VMs) are significantly cheaper but can be terminated at any time. Committed use discounts provide a discount for a 1- or 3-year commitment. Using committed use discounts for a baseline ensures predictable pricing, and using preemptible VMs for additional capacity reduces cost further.

Sustained use discounts apply automatically but are not as cost-effective as committed discounts for predictable baseline. Standard VMs are more expensive.

Full explanation →
320
Multi-Selecteasy

A company is building a serverless event-driven application that processes messages from Pub/Sub and stores results in Firestore. Which THREE Google Cloud services should they use together to implement this architecture? (Choose THREE.)

Select 3 answers
A.Firestore
B.Cloud Functions
C.Compute Engine
D.Cloud Run
E.Cloud Pub/Sub
AnswersA, B, E

Firestore stores the processed data.

Why this answer

Cloud Functions is a serverless compute option that can be triggered by Pub/Sub messages. Pub/Sub provides asynchronous messaging. Firestore is a NoSQL database for storing results.

Cloud Run is also serverless but not event-driven by Pub/Sub out-of-the-box (requires additional setup). Compute Engine and Cloud SQL are not serverless.

Full explanation →
321
MCQhard

An organization's security policy requires that all Compute Engine VMs have Shielded VM features enabled. How can this be enforced at the organization level?

A.Create an Organization Policy with the constraint compute.requireShieldedVm.
B.Enable Cloud Audit Logs and review VM creations.
C.Use VPC Service Controls to restrict VM creation.
D.Assign a custom IAM role that only allows creation of Shielded VMs.
E.Use Deployment Manager templates that include Shielded VM.
AnswerA

Correct. This enforces Shielded VM on all new VMs.

Why this answer

The Organization Policy constraint `compute.requireShieldedVm` is a Google Cloud-native mechanism that enforces Shielded VM features at the organization, folder, or project level. When this constraint is applied, any Compute Engine VM creation request that does not include Shielded VM settings (such as Secure Boot, vTPM, and Integrity Monitoring) is denied by the Organization Policy service, ensuring compliance without relying on user behavior or manual review.

Exam trap

Google Cloud often tests the distinction between enforcement mechanisms (like Organization Policies) and detection or automation tools (like Audit Logs or Deployment Manager), leading candidates to choose options that only provide visibility or templates rather than actual policy enforcement.

How to eliminate wrong answers

Option B is wrong because Cloud Audit Logs only provide visibility into VM creation events; they do not prevent non-compliant VMs from being created, so they cannot enforce the policy. Option C is wrong because VPC Service Controls are designed to protect data exfiltration and control access to Google Cloud APIs, not to enforce VM-level security features like Shielded VM. Option D is wrong because custom IAM roles cannot restrict specific VM configuration parameters (e.g., Shielded VM settings); IAM controls who can create VMs, not how they are configured.

Option E is wrong because Deployment Manager templates can include Shielded VM settings, but they are not enforceable at the organization level—users can still create VMs outside of Deployment Manager without those settings.

Full explanation →
322
Multi-Selecteasy

A company runs a containerized application on Cloud Run. Which TWO actions will most improve the reliability of the service?

Select 2 answers
A.Enable CPU always allocated
B.Disable concurrency
C.Deploy the service in multiple regions
D.Set min instances to at least 1
E.Use Cloud CDN
AnswersC, D

Multi-region deployment provides high availability and failover if one region becomes unavailable.

Why this answer

Deploying the service in multiple regions (Option C) improves reliability by distributing traffic across geographically separate Cloud Run instances, so if one region fails, traffic can be routed to healthy regions via a global load balancer. Setting min instances to at least 1 (Option D) prevents cold starts and ensures that at least one container instance is always running, reducing latency spikes and avoiding request failures during scale-from-zero events.

Exam trap

A common mistake is confusing operational tuning settings (like disabling concurrency or enabling CPU always allocated) with mechanisms that improve reliability; these settings address performance or cost, not availability.

Full explanation →
323
Multi-Selecthard

Which THREE steps can reduce processing costs in a Dataflow streaming pipeline? (Choose three.)

Select 3 answers
A.Use side inputs instead of a cross join.
B.Use a batch pipeline for non-critical data.
C.Minimize the use of GroupByKey in streaming mode.
D.Use a custom runner.
E.Increase the number of workers.
AnswersA, B, C

Side inputs are more efficient than cross joins, reducing processing cost.

Why this answer

Side inputs allow you to broadcast a static or slowly-changing dataset to all workers, avoiding the expensive shuffle and per-element processing required by a cross join. In Dataflow, cross joins in streaming mode require stateful processing and can lead to high data amplification, whereas side inputs are distributed efficiently via the streaming engine. This reduces both CPU and memory costs by eliminating redundant data movement.

Exam trap

Google Cloud often tests the misconception that scaling out (increasing workers) always reduces costs, when in fact it increases costs unless the pipeline is bottlenecked; the trap is to confuse throughput optimization with cost reduction.

Full explanation →
324
MCQeasy

An engineer needs to provision a GKE cluster with a node pool that uses preemptible VMs to reduce costs. Which gcloud command should they use?

A.gcloud container clusters update --preemptible
B.gcloud container clusters create --preemptible-nodes
C.gcloud compute instances create --preemptible
D.gcloud container node-pools create --preemptible
AnswerD

This correctly creates a node pool with preemptible VMs.

Why this answer

The --preemptible flag when creating a node pool makes all nodes in that pool preemptible. The other options either don't exist or are incorrect.

Full explanation →
325
MCQhard

A company has Compute Engine instances that need to access the internet for updates but should not be reachable from the internet. They also need to access Google APIs and services like Cloud Storage. Which configuration meets these requirements?

A.Use Cloud NAT for outbound internet and enable Private Google Access on the subnet.
B.Assign external IPs to all instances and configure firewall rules to block inbound traffic.
C.Configure a VPN tunnel to an on-premises proxy server for internet access.
D.Use Cloud NAT for outbound internet and use external IPs for Google API access.
AnswerA

Cloud NAT allows outbound internet without external IPs; Private Google Access allows access to Google APIs via internal IPs.

Why this answer

Cloud NAT provides outbound internet connectivity for instances without external IPs, while Private Google Access allows those same instances to reach Google APIs and services (like Cloud Storage) using internal IPs via the subnet's default route. This combination ensures instances can initiate outbound connections to the internet and Google services but remain unreachable from the internet, meeting both security and functional requirements.

Exam trap

The trap here is that candidates often think Cloud NAT alone is sufficient for Google API access, but they miss that Private Google Access must be explicitly enabled on the subnet for instances without external IPs to reach Google APIs and services.

How to eliminate wrong answers

Option B is wrong because assigning external IPs makes instances directly reachable from the internet, even with firewall rules blocking inbound traffic; the external IP itself exposes the instance to potential attacks (e.g., DDoS) and violates the requirement that instances should not be reachable from the internet. Option C is wrong because a VPN tunnel to an on-premises proxy server adds unnecessary complexity, latency, and dependency on on-premises infrastructure; it does not directly address the need for Google API access, which is better served by Private Google Access. Option D is wrong because using external IPs for Google API access defeats the purpose of Cloud NAT; instances with external IPs are still reachable from the internet (even if only for API calls), and the requirement explicitly states instances should not be reachable from the internet.

Full explanation →
326
Multi-Selectmedium

A company wants to use a multi-cloud strategy to avoid vendor lock-in and run workloads on both Google Cloud and AWS. They need to manage Kubernetes clusters across both environments consistently. Which TWO Google Cloud services can help achieve this?

Select 2 answers
A.Config Sync
B.Cloud Run
C.BigQuery Omni
D.GKE on AWS
E.Anthos (GKE Enterprise)
AnswersA, E

Config Sync is part of Anthos that syncs configuration across clusters, including multi-cloud.

Why this answer

Anthos (now GKE Enterprise) provides a consistent Kubernetes platform across on-premises and multiple clouds, including AWS. Config Sync is a component of Anthos that enables configuration management across clusters. BigQuery Omni allows querying data across clouds but is for analytics.

Cloud Run is serverless and not for multi-cloud Kubernetes management. GKE on AWS is deprecated; Anthos is the recommended approach.

Full explanation →
327
MCQmedium

A Cloud Run service frequently fails with 502 errors when making requests to a backend service running on Compute Engine. The two services are in the same VPC network. The Cloud Run service is configured with a VPC connector. What is the most likely cause?

A.The Cloud Run service needs to be peered with the VPC using VPC Network Peering.
B.The VPC connector is set to a low number of instances, causing traffic throttling.
C.The VPC connector is not attached to the correct subnet, or the firewall rules are blocking traffic from the connector's IP range.
D.The Cloud Run service's service account lacks the roles/compute.instanceAdmin role.
AnswerC

The VPC connector's subnet must have routes to the backend, and firewall rules must allow ingress from the connector's IP range.

Why this answer

Cloud Run uses a VPC connector to send requests to resources in a VPC. If the connector is attached to the wrong subnet, its egress traffic may not reach the Compute Engine instance, or firewall rules may block traffic from the connector's IP range (e.g., 10.8.0.0/28). This results in 502 errors from the backend, as the Cloud Run service cannot establish a TCP connection to the Compute Engine instance.

Exam trap

The trap here is that candidates confuse VPC Network Peering (used for inter-VPC connectivity) with the VPC connector (used for serverless-to-VPC access), and they overlook the firewall rules that must explicitly allow traffic from the connector's IP range.

How to eliminate wrong answers

Option A is wrong because VPC Network Peering is used to connect two separate VPC networks, not to connect a serverless service to its own VPC; Cloud Run uses a VPC connector, not peering. Option B is wrong because a low number of VPC connector instances causes throttling or increased latency, not 502 errors; 502 errors indicate a failure to reach or get a valid response from the backend, not a capacity issue. Option D is wrong because the roles/compute.instanceAdmin role grants permissions to manage Compute Engine instances, but Cloud Run does not need that role to make HTTP requests to a backend; it only needs network connectivity via the VPC connector.

Full explanation →
328
MCQeasy

A company wants to deploy a standard VM image with pre-installed software across multiple projects. Which Google Cloud solution should they use to automate this process?

A.Cloud Build
B.Compute Engine
C.Cloud Deployment Manager
D.Cloud Shell
E.Artifact Registry
AnswerC

Correct. Deployment Manager automates resource deployment via templates.

Why this answer

Cloud Deployment Manager (option C) is the correct choice because it allows you to define a declarative template (in YAML, Jinja, or Python) that specifies the VM instance configuration, including the boot disk image with pre-installed software, and then deploy that template consistently across multiple projects. This automates the entire provisioning process, ensuring each VM is identical and reducing manual effort.

Exam trap

The trap here is that candidates often confuse Cloud Build (a CI/CD tool) with infrastructure deployment, or think Compute Engine itself can automate multi-project deployments, but neither provides the declarative, repeatable provisioning that Deployment Manager offers.

How to eliminate wrong answers

Option A (Cloud Build) is wrong because it is a CI/CD service for building, testing, and deploying software artifacts, not for provisioning infrastructure like VMs across projects. Option B (Compute Engine) is wrong because it is the IaaS service that provides the VM instances themselves, not an automation tool for deploying them. Option D (Cloud Shell) is wrong because it is a browser-based command-line environment for managing Google Cloud resources, not a deployment automation service.

Option E (Artifact Registry) is wrong because it is a service for storing and managing container images and packages, not for deploying VM instances.

Full explanation →
329
MCQhard

A company uses Shared VPC. A project admin in a service project tries to create a subnet in the shared VPC network but receives a permission denied error. What is the most likely cause?

A.Only the Shared VPC host project admin can create subnets.
B.The service project admin lacks the compute.subnetworks.create permission on the host project.
C.The Shared VPC is not enabled for the service project.
D.Subnets must be created in the service project, not the host project.
AnswerB

Permission must be granted on the host project for subnet creation.

Why this answer

In a Shared VPC architecture, subnet creation is a privileged operation that can only be performed by a user with the compute.subnetworks.create permission on the host project. The service project admin, by default, does not have this permission in the host project, which is why the permission denied error occurs. Granting this permission to the service project admin at the host project level would resolve the issue.

Exam trap

Google Cloud often tests the misconception that service project admins have full control over the shared network, when in reality they only have usage permissions unless explicitly granted administrative permissions on the host project.

How to eliminate wrong answers

Option A is wrong because it is not strictly 'only the host project admin' who can create subnets; any user with the compute.subnetworks.create permission on the host project can do so, including a service project admin if that permission is explicitly granted. Option C is wrong because the Shared VPC being enabled for the service project is a prerequisite for using the shared network, but the error here is about permissions, not about the feature being disabled. Option D is wrong because subnets in a Shared VPC must be created in the host project, not the service project; the service project consumes subnets from the host project.

Full explanation →
330
Multi-Selecthard

A company is designing a highly available architecture for a web application using Google Cloud. They need to ensure that the application remains available even if an entire Google Cloud region experiences an outage. Which THREE components should they include in their architecture? (Choose THREE.)

Select 3 answers
A.Cloud Spanner multi-region configuration
B.Cloud SQL with a cross-region read replica
C.Global external HTTP(S) load balancer
D.Cloud CDN
E.Regional managed instance groups in multiple regions
AnswersA, C, E

Cloud Spanner multi-region automatically replicates data across regions and provides strong consistency and automatic failover.

Why this answer

For multi-region high availability, use a global load balancer, deploy instances in multiple regions (e.g., via regional MIGs), and use a multi-region database like Cloud Spanner or cross-region replication.

Full explanation →
331
MCQmedium

A security engineer needs to allow a Compute Engine instance with the service account 'sa-prod@project.iam.gserviceaccount.com' to connect to a Cloud SQL instance over a private IP. The VPC has no firewall rules allowing this traffic. What is the MOST secure way to grant access?

A.Add a firewall rule with source service account 'sa-prod@project.iam.gserviceaccount.com' and target service account 'cloud-sql-sa@project.iam.gserviceaccount.com'
B.Grant the IAM role 'cloudsql.client' to the service account 'sa-prod@project.iam.gserviceaccount.com'
C.Add a firewall rule with source tag 'prod' and target tag 'cloud-sql'
D.Create a VPC peering connection between the Compute Engine VPC and the Cloud SQL VPC
AnswerA

Using service accounts in firewall rules is the secure method, as it ties the rule directly to the identity of the instances.

Why this answer

Firewall rules can target service accounts directly, allowing fine-grained access without relying on network tags. This avoids managing tags and reduces attack surface.

Full explanation →
332
MCQmedium

An organization needs to grant a third-party auditor read-only access to view all resources in a project, including sensitive data like IAM policies and logs. Which role should be assigned?

A.Security Reviewer
B.Logs Viewer
C.Viewer
D.Monitoring Viewer
AnswerC

Why this answer

The Viewer primitive role provides read-only access to all resources in a project, including IAM policies and logs.

Full explanation →
333
Matchingmedium

Match each GCP monitoring/logging tool to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Metrics, dashboards, alerts

Centralized log storage and analysis

Distributed tracing for latency analysis

Inspect code behavior in production

CPU and memory profiling

Why these pairings

Correct matches: Cloud Monitoring monitors performance, Cloud Logging manages logs, Error Reporting tracks errors. Confusion often arises between logging and monitoring roles.

Full explanation →
334
MCQmedium

A company runs a critical application on Compute Engine instances. They want to automatically patch the operating system on a weekly schedule to meet compliance requirements. Which Google Cloud service should they use?

A.Cloud Monitoring
B.Cloud Security Command Center
C.Cloud Build
D.OS Config
AnswerD

Correct. OS Config includes patch management for Compute Engine instances.

Why this answer

OS Config, part of VM Manager, provides patch management capabilities including scheduled patching and compliance reporting.

Full explanation →
335
Multi-Selecthard

A company needs to ensure that data stored in Cloud Storage is encrypted with customer-managed keys that are rotated every 90 days. Which two steps must be taken to achieve this? (Choose TWO).

Select 2 answers
A.Set a rotation period of 90 days on the Cloud KMS key
B.Enable CSEK on the bucket
C.Grant the Cloud Storage service account access to the Cloud KMS key
D.Create a key ring and a key in Cloud KMS
E.Set the default encryption key on the Cloud Storage bucket to the Cloud KMS key
AnswersD, E

A CMEK key is created in Cloud KMS.

Why this answer

A CMEK key must be created in Cloud KMS, and the Cloud Storage bucket must be configured to use that CMEK key.

Full explanation →
336
MCQeasy

A company runs a batch process every night that loads data into BigQuery. They want to ensure that if the job fails, it is retried automatically up to 3 times. Which configuration should they use?

A.Cloud Run jobs with --max-retries=3.
B.Cloud Scheduler with retry policy.
C.BigQuery load job with maximum retries setting.
D.Cloud Functions with error handling.
E.Cloud Composer (Airflow) tasks with retries.
AnswerE

Cloud Composer (Airflow) provides built-in task retry mechanism.

Why this answer

Cloud Composer (Airflow) natively supports task-level retries via the `retries` parameter in task definitions, allowing you to specify up to 3 automatic retries on failure. This is the appropriate choice for orchestrating a batch process that loads data into BigQuery, as Airflow provides robust retry logic, dependency management, and monitoring for complex workflows.

Exam trap

Google Cloud often tests the distinction between a simple retry mechanism (like Cloud Scheduler or Cloud Functions) and a full workflow orchestration tool (Cloud Composer) that can manage retries within a multi-step batch process, leading candidates to pick a simpler option that lacks the necessary pipeline control.

How to eliminate wrong answers

Option A is wrong because Cloud Run jobs are designed for stateless containerized workloads, not for orchestrating batch data loads into BigQuery; their `--max-retries` applies to the job execution itself, not to the data loading step within a pipeline. Option B is wrong because Cloud Scheduler retry policies handle HTTP request failures, not the success or failure of the underlying BigQuery load job; it would retry the scheduler trigger, not the data load. Option C is wrong because BigQuery load jobs do not have a 'maximum retries setting' — they either succeed or fail, and retries must be managed externally by the caller.

Option D is wrong because Cloud Functions error handling (e.g., retry on failure) is for function execution, not for orchestrating a batch load job; it lacks the workflow-level retry control and dependency management needed for a nightly batch process.

Full explanation →
337
Multi-Selectmedium

A company wants to deploy a web application behind an HTTPS Load Balancer and only allow authenticated users from their corporate Active Directory. Which two services should they use together? (Choose two.)

Select 2 answers
A.Identity-Aware Proxy (IAP)
B.VPC Service Controls
C.Cloud NAT
D.Cloud Identity
E.Cloud Armor
AnswersA, D

Why this answer

Identity-Aware Proxy (IAP) provides authentication and authorization for applications. Cloud Identity (or Cloud Directory Sync) integrates with Active Directory to provide user identities.

Full explanation →
338
MCQhard

A security architect is designing a zero-trust network for applications running on Compute Engine. They want to enforce that all traffic between VMs must be encrypted and authenticated, regardless of the VPC network. Which approach meets this requirement?

A.Configure each VM to use IPsec tunnels to every other VM.
B.Deploy Anthos Service Mesh with mTLS enabled.
C.Use Cloud VPN to encrypt all inter-VM traffic.
D.Enable VPC Flow Logs and use firewall rules to allow only encrypted traffic.
AnswerB

Service mesh with mTLS provides both encryption and authentication between services.

Why this answer

Anthos Service Mesh with mTLS (mutual TLS) encrypts and authenticates all traffic between workloads at the application layer, regardless of the underlying VPC network. This meets the zero-trust requirement because mTLS ensures both encryption and mutual authentication for every request, without needing to manage per-VM tunnels or rely on network-layer constructs.

Exam trap

The trap here is that candidates often confuse network-layer encryption (like IPsec or Cloud VPN) with application-layer mTLS, assuming any encryption meets zero-trust requirements, but zero-trust demands per-request authentication and identity-based policy, which only a service mesh like Anthos with mTLS provides.

How to eliminate wrong answers

Option A is wrong because configuring IPsec tunnels between every pair of VMs creates a full-mesh topology that is operationally unscalable and complex to manage, and it does not provide application-layer authentication or granular policy enforcement. Option C is wrong because Cloud VPN is designed to encrypt traffic between on-premises networks and Google Cloud VPCs, not between VMs within the same or different VPCs; it cannot enforce per-request authentication. Option D is wrong because VPC Flow Logs only capture metadata about network flows and do not encrypt traffic, and firewall rules cannot inspect or enforce encryption at the application layer.

Full explanation →
339
MCQmedium

A company is migrating its on-premises data center to Google Cloud. They need a dedicated, low-latency, high-bandwidth connection between their on-premises network and VPC. They anticipate consistent traffic above 10 Gbps. Which connectivity option should they choose?

A.Partner Interconnect
B.Dedicated Interconnect
C.HA VPN
D.Classic VPN
AnswerB

Dedicated Interconnect provides direct, high-bandwidth (up to 100 Gbps) connection with low latency.

Why this answer

Dedicated Interconnect provides a direct physical connection with bandwidth up to 100 Gbps per circuit, ideal for high-throughput, low-latency requirements. Partner Interconnect relies on a service provider and typically offers lower bandwidth. HA VPN is over the public internet and may not meet high bandwidth or low latency.

Classic VPN is a single tunnel without high availability.

Full explanation →
340
MCQhard

A large enterprise is migrating its on-premises data warehouse to BigQuery. The current warehouse is 100 TB and uses complex ETL jobs that run on SQL Server Integration Services (SSIS). The team wants to minimize migration effort and maintain the same SQL logic for transformations. They plan to use BigQuery's standard SQL. They also need to schedule transformations and load data from multiple on-premises sources. Which approach should they take?

A.Connect SSIS to BigQuery using ODBC and run SSIS packages in a VM on Compute Engine.
B.Rewrite SSIS packages as Dataflow pipelines using Apache Beam.
C.Use Data Fusion to replicate SSIS packages.
D.Use Cloud Composer (Airflow) to orchestrate SQL statements in BigQuery, and use Data Transfer Service for scheduled loads.
AnswerD

This approach allows reusing SQL logic and provides native scheduling with minimal code changes.

Why this answer

Cloud Composer (Airflow) can orchestrate BigQuery SQL statements, and Data Transfer Service handles scheduled loads from on-premises sources, minimizing code changes. Option A is incorrect because running SSIS on Compute Engine still requires managing virtual machines and does not leverage BigQuery's full capabilities. Option B is incorrect because rewriting SSIS packages as Dataflow pipelines using Apache Beam would require significant recoding.

Option C is incorrect because Data Fusion is a data integration service for replicating and transforming data, but it does not directly replicate SSIS package logic.

Full explanation →
341
MCQmedium

A data analytics company runs nightly batch jobs using Compute Engine instances. The jobs can tolerate interruptions, and the company wants to minimize costs. What should they do?

A.Use preemptible VMs for the batch jobs.
B.Use C2 high-CPU machine types for faster processing.
C.Use standard (on-demand) VMs and commit to a 1-year resource-based commitment.
D.Deploy VMs on Sole-tenant nodes for cost isolation.
AnswerA

Preemptible VMs cost much less than standard VMs and can be interrupted, acceptable for batch jobs that are checkpointed.

Why this answer

Preemptible VMs (now called Spot VMs) are Compute Engine instances that last up to 24 hours and can be terminated at any time by Google Cloud. Because the batch jobs are interruptible, using preemptible VMs reduces compute costs by up to 60-91% compared to standard on-demand VMs, directly meeting the goal of minimizing costs.

Exam trap

The trap here is that candidates may confuse preemptible VMs with standard VMs and assume they are unreliable for any workload, but the question explicitly states the jobs can tolerate interruptions, making preemptible VMs the correct cost-saving choice.

How to eliminate wrong answers

Option B is wrong because C2 high-CPU machine types are optimized for compute-intensive workloads, not for cost minimization; they are more expensive per hour than standard machine types and do not address the interruptible nature of the jobs. Option C is wrong because committing to a 1-year resource-based commitment locks the company into a fixed cost for on-demand VMs, which is more expensive than preemptible VMs and unnecessary for interruptible batch jobs that do not require guaranteed availability. Option D is wrong because Sole-tenant nodes provide hardware isolation for compliance or licensing needs, not cost reduction; they actually increase costs due to premium pricing for dedicated hardware.

Full explanation →
342
MCQeasy

An engineer needs to view the last 100 lines of a log file from a Compute Engine instance without leaving the Google Cloud Console. Which tool should they use?

A.Cloud Logging in the Console
B.Cloud Console's VM instances page
C.Cloud Shell
D.Cloud SDK installed locally
AnswerC

Cloud Shell provides a command line in the browser. The engineer can SSH to the instance and use 'tail' to view the log file.

Why this answer

Cloud Shell is an in-browser shell that comes pre-installed with gcloud and other tools. The engineer can SSH into the instance from Cloud Shell and use commands like 'tail' to view log lines.

Full explanation →
343
MCQhard

An organization needs to audit all changes to network firewall rules in a GCP project. Which service should be used to capture these changes?

A.Cloud Logging
B.Cloud Monitoring
C.Cloud Audit Logs
D.VPC Flow Logs
AnswerC

Audit logs capture all admin activity, including firewall rule changes.

Why this answer

Cloud Audit Logs (specifically Admin Activity audit logs) record all API calls that modify the configuration or metadata of resources, including changes to firewall rules. When a firewall rule is created, updated, or deleted, an audit log entry is automatically generated with details such as the user, timestamp, and the change made. This makes Cloud Audit Logs the correct service for auditing changes to network firewall rules in a GCP project.

Exam trap

The trap here is that candidates confuse Cloud Logging (which is a general log storage and analysis platform) with Cloud Audit Logs (which is a specific type of log that records administrative actions), leading them to pick A instead of C.

How to eliminate wrong answers

Option A is wrong because Cloud Logging is a service for ingesting, storing, and analyzing log data from various sources, but it does not natively capture configuration changes to firewall rules; it would require custom log sinks or agents to collect such data. Option B is wrong because Cloud Monitoring focuses on metrics, uptime checks, and alerting based on performance and health indicators, not on recording API-driven configuration changes. Option D is wrong because VPC Flow Logs capture network traffic metadata (e.g., source/destination IPs, ports, protocols) for flow-level analysis, not the administrative changes to firewall rule definitions.

Full explanation →
344
Multi-Selecthard

A security team wants to monitor and audit all changes to IAM policies in a Google Cloud organization. They need to set up real-time alerts when a new binding is added. Which THREE services should they combine to achieve this?

Select 3 answers
A.Cloud Scheduler
B.Cloud Pub/Sub
C.Cloud Functions
D.Cloud Audit Logs
E.Cloud Storage
AnswersB, C, D

Pub/Sub delivers log entries in real-time for processing.

Why this answer

Cloud Audit Logs record IAM changes. Cloud Pub/Sub can receive logs in near real-time. Cloud Functions can process Pub/Sub messages and trigger alerts (e.g., via email).

Cloud Storage is for storage, not real-time alerting. Cloud Scheduler is for cron jobs. Cloud Armor is for security policies at the network edge.

Full explanation →
345
MCQeasy

A company runs a batch processing workload on Compute Engine instances in a managed instance group (MIG). The job is CPU-intensive and takes approximately 4 hours to complete. The company wants to reduce costs without sacrificing performance. Which action should they take?

A.Purchase committed use discounts for the instance type.
B.Change the machine series to a smaller machine type.
C.Use preemptible VMs for the MIG and implement a checkpointing mechanism to handle interruptions.
D.Provision additional reserved VMs to ensure capacity.
AnswerC

Preemptible VMs are up to 80% cheaper and, with checkpointing, can handle preemptions gracefully.

Why this answer

Preemptible VMs are significantly cheaper than standard VMs but can be terminated at any time. For a batch processing workload that is CPU-intensive and runs for 4 hours, using preemptible VMs in a MIG with a checkpointing mechanism allows the job to resume from the last saved state after an interruption, thus reducing costs without sacrificing performance.

Exam trap

Google Cloud often tests the misconception that committed use discounts are the best cost-saving option for any workload, but they are only cost-effective for predictable, always-on instances, not for batch jobs that can leverage preemptible VMs.

How to eliminate wrong answers

Option A is wrong because committed use discounts require a 1- or 3-year commitment and do not reduce costs for short-lived or interruptible workloads; they are best for steady-state, always-on instances. Option B is wrong because changing to a smaller machine type would reduce performance, potentially increasing job duration and negating cost savings. Option D is wrong because provisioning additional reserved VMs increases costs without addressing the need to reduce them, and reserved VMs are not cost-effective for batch jobs that can tolerate interruptions.

Full explanation →
346
MCQeasy

A company wants to connect their on-premises network to Google Cloud with a 99.99% SLA using encrypted tunnels over the public internet. Which connectivity solution should they choose?

A.HA VPN
B.Standard VPN with single tunnel
C.Partner Interconnect
D.Dedicated Interconnect
AnswerA

HA VPN offers 99.99% SLA with two VPN gateways and four tunnels over the public internet, providing encrypted connectivity.

Why this answer

HA VPN provides a 99.99% SLA when configured with two VPN gateways and four tunnels over the public internet. Dedicated Interconnect is a private connection with higher bandwidth but not over the public internet. Partner Interconnect uses a partner's network, not the public internet.

Standard VPN does not offer a 99.99% SLA.

Full explanation →
347
MCQeasy

A developer needs to secure secrets (API keys, passwords) used in a Cloud Function. What is the recommended approach?

A.Store secrets in environment variables
B.Store in Cloud Storage and download at runtime
C.Use Secret Manager
D.Hard-code in the function code
AnswerC

Secret Manager provides secure storage and access control.

Why this answer

Secret Manager is the recommended approach for securing sensitive data like API keys and passwords in Cloud Functions because it provides encrypted storage, fine-grained access control via IAM, and automatic rotation. Unlike environment variables, which are visible in the Cloud Console and logs, Secret Manager ensures secrets are never exposed in plaintext and are injected securely at runtime.

Exam trap

Google Cloud often tests the misconception that environment variables are a secure way to store secrets because they are 'hidden' from code, but in reality they are plaintext and accessible via the Cloud Console and logs.

How to eliminate wrong answers

Option A is wrong because environment variables are not encrypted by default and can be viewed in the Cloud Console, logs, or by anyone with access to the function's configuration, making them insecure for secrets. Option B is wrong because storing secrets in Cloud Storage requires managing bucket permissions and encryption keys manually, and downloading at runtime introduces latency and potential exposure if the bucket is misconfigured. Option D is wrong because hard-coding secrets in function code exposes them in source control, build artifacts, and logs, violating security best practices and making rotation nearly impossible.

Full explanation →
348
MCQeasy

You are the lead cloud architect for a startup that runs a web application on Google Kubernetes Engine (GKE) with a standard (zonal) cluster. The application is deployed with 3 replicas of a stateless frontend service. During a recent incident, a zone outage caused all GKE nodes to become unavailable, leading to application downtime of 45 minutes. You need to redesign the cluster to tolerate a single zone failure with no more than 5 minutes of downtime. Your budget allows for at most a 20% increase in compute costs. Which approach should you take?

A.Increase the number of replicas from 3 to 9 and keep the zonal cluster
B.Change the frontend deployment to use regional persistent disks
C.Deploy second GKE cluster in another region and use global load balancer for failover
D.Migrate the cluster to a regional GKE cluster with nodes in 3 zones and distribute replicas across zones
AnswerD

Correct: regional cluster survives zone failure.

Why this answer

D is correct because a regional GKE cluster distributes nodes across three zones, ensuring that if one zone fails, the remaining two zones continue serving traffic. By spreading the 3 replicas across zones (e.g., one per zone), the application tolerates a single zone outage with near-zero downtime, and the 20% cost increase covers the additional node pool overhead without exceeding the budget.

Exam trap

The trap here is that candidates confuse increasing replica count with achieving zone redundancy, failing to realize that replicas must be distributed across failure domains (zones) to survive a zone outage, and that regional persistent disks are irrelevant for stateless workloads.

How to eliminate wrong answers

Option A is wrong because increasing replicas to 9 in a zonal cluster does not provide zone redundancy; all nodes remain in a single zone, so a zone outage still takes down all replicas. Option B is wrong because regional persistent disks are used for stateful workloads (e.g., databases) and do not help with zone-level node failure for a stateless frontend; the frontend does not require persistent disks. Option C is wrong because deploying a second cluster in another region introduces cross-region latency and failover complexity, and the 5-minute downtime target cannot be met with DNS propagation or global load balancer failover; it also likely exceeds the 20% cost increase due to full cluster duplication.

Full explanation →
349
MCQeasy

A financial services company is migrating a sensitive customer data application to Google Cloud. The application runs on Compute Engine VMs in a VPC. The security team requires that all data at rest in Cloud Storage and BigQuery must be encrypted with customer-managed encryption keys (CMEK). Additionally, the keys must be stored in a different project than the data, and access to the keys must be audited. The operations team has set up a CMEK key in Cloud KMS in a separate project, assigned the Cloud KMS CryptoKey Encrypter/Decrypter role to the data project's Compute Engine service account, and enabled Cloud Storage and BigQuery to use CMEK. However, when the application tries to read from Cloud Storage, it fails with 'Access Denied.' The Cloud KMS key is in project 'kms-proj' and the data is in project 'data-proj'. What is the most likely cause?

A.The Compute Engine service account used by the VM does not have the Cloud KMS Decrypter role.
B.The VPC firewall rules are blocking egress to Cloud KMS.
C.The Cloud KMS key has been disabled due to an Organization Policy.
D.The Cloud Storage service agent in 'data-proj' does not have the Cloud KMS CryptoKey Encrypter/Decrypter role.
AnswerD

Cloud Storage requires its service agent to have KMS permissions to encrypt/decrypt using CMEK. The team only granted permission to the Compute Engine service account.

Why this answer

Cloud Storage uses a Google-managed service agent (not the Compute Engine service account) to interact with CMEK keys. When Cloud Storage is configured to use CMEK, its service agent in the data project must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role on the key in the KMS project. Without this permission, Cloud Storage cannot decrypt the key to access the data, resulting in an 'Access Denied' error even though the VM's service account has the correct role.

Exam trap

A common trap on Google Cloud exams is the distinction between the service account used by the compute resource (e.g., Compute Engine VM) and the service agent used by the Google Cloud service (e.g., Cloud Storage), leading candidates to incorrectly assume the VM's service account handles all encryption operations.

How to eliminate wrong answers

Option A is wrong because the Compute Engine service account does not directly decrypt Cloud Storage data; Cloud Storage uses its own service agent for CMEK operations, and the VM's service account only needs the role for operations like signing URLs or accessing KMS directly, not for reading CMEK-encrypted objects. Option B is wrong because VPC firewall rules blocking egress to Cloud KMS would cause a timeout or connection error, not an 'Access Denied' response from Cloud Storage; the error is a permission issue, not a network connectivity issue. Option C is wrong because a disabled key would produce a different error (e.g., 'Key disabled' or 'CryptoKey not found'), and the question states the key was set up and assigned roles, with no indication of an Organization Policy disabling it.

Full explanation →
350
MCQmedium

A company needs to choose between Cloud Spanner and Firestore for a global inventory application that requires strong consistency and horizontal scaling. The application has a fixed schema with complex joins. Which database is most appropriate?

A.Cloud Spanner
B.Firestore
C.Cloud SQL
D.Cloud Bigtable
AnswerA

Spanner provides strong consistency, relational schema, joins, and horizontal scaling across regions.

Why this answer

Cloud Spanner is a globally distributed relational database with strong consistency and supports complex joins. Firestore is a NoSQL document database with eventual consistency (strong consistency only within a single document).

Full explanation →
351
MCQeasy

A company runs a web application on Compute Engine instances. The application stores session state in files on local SSD. The company wants to reduce costs without sacrificing performance for a predictable traffic pattern. What should they do?

A.Use preemptible VMs in a managed instance group with autoscaling, and store session state in Redis (Memorystore).
B.Change the machine type to N2 standard and use committed use discounts.
C.Keep local SSDs but use sole-tenant nodes to reduce contention.
D.Migrate the session state to Cloud Firestore and use preemptible VMs.
AnswerA

Using preemptible VMs in a MIG with autoscaling reduces costs, and storing session state in Memorystore (Redis) ensures persistence and high availability.

Why this answer

Preemptible VMs reduce compute costs by up to 80%, and using a managed instance group with autoscaling handles the predictable traffic pattern efficiently. Storing session state in Redis (Memorystore) instead of local SSD ensures session data persists across VM preemptions and is shared among instances, which is critical for stateful applications. This combination maintains performance while eliminating the cost of always-on VMs.

Exam trap

Google Cloud often tests the misconception that local SSD is acceptable for session state if VMs are persistent, but the trap here is that any VM termination (preemption, maintenance, or autoscaling down) destroys local SSD data, so a shared external session store like Redis is mandatory when using preemptible or autoscaled instances.

How to eliminate wrong answers

Option B is wrong because changing to N2 standard machines and using committed use discounts reduces costs only if the workload runs continuously for 1 or 3 years, but it does not address the session state persistence issue—local SSD data is lost on VM termination, and the traffic pattern is predictable, not constant. Option C is wrong because sole-tenant nodes increase costs (dedicated hardware) and do not solve the session state problem; local SSD data is still ephemeral and lost on instance stop/termination. Option D is wrong because Cloud Firestore is a NoSQL document database not optimized for low-latency session state access (it is designed for mobile/web apps with eventual consistency), and preemptible VMs without a shared session store like Redis will lose session data on preemption.

Full explanation →
352
Multi-Selecteasy

Which TWO methods can be used to provide secure access to a private Google Kubernetes Engine (GKE) cluster from the internet? (Choose two.)

Select 2 answers
A.Expose the cluster via an internal load balancer.
B.Configure a Cloud NAT to allow inbound connections from the internet.
C.Use Cloud VPN to connect from an on-premises network that has internet access.
D.Assign a public IP address to the cluster master endpoint.
E.Use Identity-Aware Proxy (IAP) with TCP forwarding to access the cluster master.
AnswersC, E

On-prem can route via VPN to private cluster.

Why this answer

Cloud VPN establishes an encrypted tunnel (using IPsec) from an on-premises network to a VPC in Google Cloud, allowing secure access to a private GKE cluster master endpoint without exposing it to the public internet. Option E is correct because Identity-Aware Proxy (IAP) with TCP forwarding enables authenticated and authorized access to the private cluster master endpoint via a bastion-like tunnel, without requiring a public IP on the master or a VPN.

Exam trap

The trap here is that candidates often confuse Cloud NAT (outbound-only) with a solution for inbound internet access, or mistakenly think an internal load balancer can provide internet-facing access to a private cluster.

Full explanation →
353
MCQmedium

Given the IAM policy: ```json { "bindings": [ { "role": "roles/storage.objectViewer", "members": ["user:alice@example.com"], "condition": { "expression": "resource.name.startsWith('projects/_/buckets/bucket-x/objects/')", "title": "Restrict to bucket-x" } } ] } ``` What does the condition in this IAM policy do?

A.It denies Alice access to all buckets.
B.It allows Alice to view objects only in bucket-x.
C.It allows Alice to view objects in any bucket.
D.It allows Alice to list all buckets in the project.
E.It allows Alice to view and delete objects in bucket-x.
AnswerB

Correct. The condition restricts the read permission to only objects in bucket-x.

Why this answer

The condition in the IAM policy restricts the `storage.objects.get` action to the `projects/_/buckets/bucket-x/objects/*` resource, which means Alice can only view (read) objects within that specific bucket. The `storage.objects.list` action is also allowed on `bucket-x`, enabling her to list its contents. No other actions or buckets are permitted, making option B correct.

Exam trap

Google Cloud often tests the distinction between bucket-level actions (like `storage.buckets.list`) and object-level actions (like `storage.objects.get`), and the trap here is that candidates assume 'view objects' includes listing all buckets or deleting objects, when the policy only grants specific read permissions on a single bucket.

How to eliminate wrong answers

Option A is wrong because the policy explicitly allows access to bucket-x, not denies all buckets. Option C is wrong because the resource ARN is limited to bucket-x, not any bucket. Option D is wrong because the `s3:ListAllMyBuckets` action is not included in the policy, so Alice cannot list all buckets in the project.

Option E is wrong because the policy only grants `s3:GetObject` (view) and `s3:ListBucket` (list), not `s3:DeleteObject` (delete).

Full explanation →
354
Multi-Selecteasy

A startup wants to store application secrets (e.g., API keys, database passwords) securely on Google Cloud. They need to support automatic rotation of secrets and fine-grained access control. Which TWO services should they use? (Choose 2.)

Select 2 answers
A.Cloud Storage with object versioning
B.Cloud Functions
C.Secret Manager
D.Cloud Identity and Access Management (IAM)
E.Cloud Key Management Service (Cloud KMS)
AnswersC, E

Secret Manager is the dedicated service for storing and managing secrets with rotation and versioning.

Why this answer

Secret Manager is the primary service for storing secrets, with support for versioning, automatic rotation, and IAM. Cloud KMS can be used to encrypt secrets stored in Secret Manager, providing an additional layer of security. Cloud Key Management Service (KMS) is used for managing encryption keys, but Secret Manager already encrypts secrets at rest using Google-managed keys by default; using CMEK via Cloud KMS adds customer-managed key control.

Cloud Storage is not designed for secrets. IAM alone does not provide secret storage. Cloud Functions can access secrets but is not a storage service.

Full explanation →
355
MCQmedium

A company wants to migrate its on-premises Oracle database to GCP with minimal changes. They require a fully managed, PostgreSQL-compatible database that offers high performance for analytics and AI workloads. Which service should they choose?

A.Cloud Spanner
B.AlloyDB
C.BigQuery
D.Cloud SQL for PostgreSQL
AnswerB

AlloyDB is PostgreSQL-compatible and optimized for analytics and AI workloads with up to 4x faster query performance than standard PostgreSQL.

Why this answer

AlloyDB is a fully managed PostgreSQL-compatible database optimized for high performance analytics and AI, with support for vector embeddings and other AI features.

Full explanation →
356
MCQhard

A financial services company must comply with PCI DSS. They use Cloud SQL for MySQL for transaction processing. They need to ensure that all data at rest is encrypted with keys generated and stored in a Hardware Security Module (HSM) and that key rotation occurs every 90 days. Which configuration should they use?

A.Use Cloud External Key Manager (EKM) to integrate with on-premises HSM
B.Use Cloud SQL with customer-supplied encryption keys (CSEK) and automate rotation with Cloud Scheduler
C.Use Cloud SQL with CMEK backed by Cloud HSM, and set automatic rotation period of 90 days
D.Use Cloud SQL's default encryption with organization policy requiring rotation
AnswerC

CMEK with Cloud HSM provides customer-controlled, HSM-backed keys with automatic rotation.

Why this answer

Cloud SQL with CMEK backed by Cloud HSM meets the requirement for keys generated and stored in an HSM, and Cloud HSM supports automatic key rotation with a configurable period, including 90 days. CMEK allows you to manage and rotate the key used to encrypt data at rest, while Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key storage. The automatic rotation period can be set to 90 days via the key rotation policy in Cloud KMS, satisfying the compliance mandate.

Exam trap

The trap here is that candidates confuse CSEK with CMEK, assuming CSEK provides HSM-backed keys, but CSEK keys are stored in Cloud KMS software, not in an HSM, and cannot be automatically rotated for Cloud SQL.

How to eliminate wrong answers

Option A is wrong because Cloud EKM integrates with an external key management system outside Google Cloud, but the requirement specifies keys generated and stored in an HSM, and EKM does not use Cloud HSM; it relies on an external partner HSM, which may not meet the 'stored in an HSM' requirement if the on-premises HSM is not Cloud HSM. Option B is wrong because Cloud SQL with CSEK uses customer-supplied encryption keys that are stored in Cloud KMS, not in an HSM, and CSEK does not support automatic rotation via Cloud Scheduler; you would need to manually re-encrypt the data, which is impractical and not supported for Cloud SQL. Option D is wrong because Cloud SQL's default encryption uses Google-managed keys, which are not generated or stored in a customer-controlled HSM, and organization policies cannot enforce key rotation on default encryption keys.

Full explanation →
357
MCQhard

Your team uses Cloud Deploy to manage canary deployments on GKE. You want to automatically roll back a release if the error rate increases by more than 5% within 10 minutes after the canary receives 10% of traffic. Which approach meets this requirement?

A.Configure a Cloud Build trigger to run a script that checks logs and rolls back if error rate exceeds threshold.
B.Use the Cloud Deploy rollout strategy with a canary phase and set the 'failurePolicy' to 'ROLLBACK' with a metric threshold.
C.Set up a Cloud Monitoring alert with a notification to the SRE team and have them manually roll back.
D.Use GKE blue-green deployment with a manual verification step before switching traffic.
AnswerB

Cloud Deploy supports automatic rollback based on metric thresholds during canary phases.

Why this answer

Cloud Deploy supports canary deployments with automatic rollback based on Cloud Monitoring metrics. You can define a rollout strategy with a canary phase and attach an alert policy that triggers a rollback. Cloud Deploy integrates with Cloud Monitoring to watch metrics.

Manual verification or Cloud Build does not provide automatic rollback based on metrics.

Full explanation →
358
Multi-Selectmedium

A company wants to use Cloud DLP to scan a Cloud Storage bucket for personally identifiable information (PII) and de-identify the data before storing it in another bucket. Which TWO actions should they take? (Choose 2)

Select 2 answers
A.Use DLP de-identification templates to transform data and write to a target bucket
B.Export the inspection results to BigQuery for analysis
C.Set up a Cloud Dataflow pipeline to stream data
D.Grant the Cloud DLP service account the roles/storage.objectViewer role on the source bucket
E.Create a DLP inspection job to scan the source bucket
AnswersA, E

De-identification transforms the data, and the output can be written to another bucket.

Why this answer

Cloud DLP can inspect the data and de-identify it using techniques like masking. The output is typically stored in a different bucket. Exporting to BigQuery is optional and not required for de-identification.

IAM roles for DLP are needed to create jobs.

Full explanation →
359
MCQmedium

A company runs a batch processing job every night that takes 4 hours on a single n2-standard-8 VM. They are willing to accept up to 2 minutes of additional completion time in exchange for significant cost savings. The job is fault-tolerant and can be restarted if interrupted. Which compute option should they use?

A.Reserve an n2-standard-8 with a 1-year committed use discount
B.Use a spot VM (preemptible) with a custom machine type n2-standard-8
C.Deploy on Cloud Run with 8 vCPUs
D.Use a sole-tenant node with the n2-standard-8 machine type
AnswerB

Spot VMs offer the same discount as preemptible and are ideal for fault-tolerant batch jobs like this one.

Why this answer

Preemptible VMs offer up to 80% discount but can be terminated at any time. Since the job is fault-tolerant and can handle interruptions, this is the best cost-saving option with minimal impact on completion time.

Full explanation →
360
MCQhard

A financial institution stores sensitive customer data in Cloud Storage. They need to audit all data access and prevent unauthorized data exfiltration. They also require context-aware access controls based on user location and device. Which Google Cloud service should they configure?

A.Cloud Data Loss Prevention (DLP) for inspecting data
B.Cloud Audit Logs and Cloud Monitoring for alerts
C.VPC Service Controls with the perimeter set to the data layer
D.Access Transparency logs for audit
AnswerC

VPC Service Controls prevent data from leaving the perimeter and support context-aware access.

Why this answer

VPC Service Controls (option C) is correct because it creates a security perimeter around Google Cloud APIs, including Cloud Storage, to prevent unauthorized data exfiltration (e.g., copying data to an external project) while allowing context-aware access controls based on user location and device via Access Context Manager. This directly addresses the requirement for both audit (via Cloud Audit Logs integrated with the perimeter) and exfiltration prevention, which other services like DLP or Access Transparency alone cannot enforce.

Exam trap

Google Cloud often tests the distinction between detective controls (audit logs, DLP) and preventive controls (VPC Service Controls), leading candidates to choose audit-focused options like B or D when the question explicitly requires preventing data exfiltration.

How to eliminate wrong answers

Option A is wrong because Cloud Data Loss Prevention (DLP) is an inspection and classification service for sensitive data, not an access control or exfiltration prevention mechanism; it cannot block data access or enforce context-aware policies. Option B is wrong because Cloud Audit Logs and Cloud Monitoring provide logging and alerting for visibility but do not prevent unauthorized data exfiltration or enforce context-aware access controls; they are reactive, not proactive. Option D is wrong because Access Transparency logs provide audit records of Google staff access to customer data, not customer-side access controls or exfiltration prevention; they do not block data movement or enforce location/device-based policies.

Full explanation →
361
Multi-Selecthard

A company runs a web application on App Engine Standard environment. The application experiences downtime during deployments due to traffic shifting. Which two strategies should they implement to improve reliability? (Choose two.)

Select 2 answers
A.Use Cloud Endpoints to manage API traffic and route deployments.
B.Increase the number of idle instances to handle traffic during deployment.
C.Use traffic splitting to gradually migrate traffic to the new version.
D.Deploy to a separate version and then shift traffic using the App Engine console or gcloud.
E.Set manual scaling to avoid autoscaling delays.
AnswersC, D

Gradual migration reduces impact of any issues.

Why this answer

App Engine's traffic splitting feature allows you to gradually shift traffic from the old version to the new version, minimizing the impact of deployment-related errors or performance issues. This incremental migration reduces the risk of a full outage during deployment and enables quick rollback if problems arise.

Exam trap

Google Cloud often tests the distinction between deployment strategies (traffic splitting/version shifting) and scaling or API management features, leading candidates to confuse operational scaling fixes with deployment reliability improvements.

Full explanation →
362
Multi-Selecthard

A company wants to centrally manage firewall rules for all projects in an organization using hierarchical firewall policies. Which three resources can be used in conjunction with hierarchical firewall policies? (Choose three.)

Select 3 answers
A.Compute Engine instance
B.Organization node
C.Project
D.VPC network
E.Folder
AnswersB, C, E

Why this answer

Hierarchical firewall policies can be applied to the organization, folders, and projects. They cannot be applied to VPC networks or individual resources directly.

Full explanation →
363
Multi-Selecteasy

Which TWO features help reduce costs for batch processing workloads on Compute Engine?

Select 2 answers
A.Preemptible VMs
B.Sustained use discounts
C.GPU accelerators
D.Sole-tenant nodes
E.Committed use discounts
AnswersA, B

Preemptible VMs are up to 80% cheaper and suitable for batch jobs.

Why this answer

Preemptible VMs are short-lived, low-cost instances that can be terminated at any time by Compute Engine, making them ideal for batch processing workloads that are fault-tolerant and can handle interruptions. They offer up to 80% cost savings compared to standard VMs, directly reducing costs for batch jobs that can checkpoint and resume.

Exam trap

The trap here is that candidates often confuse committed use discounts with sustained use discounts, but committed use discounts require a contractual commitment and are not suitable for batch workloads that may not run continuously, while sustained use discounts are automatic and better suited for long-running batch jobs.

Full explanation →
364
MCQeasy

A startup is migrating a monolithic application to Google Cloud. They want to minimize operational overhead and auto-scale based on HTTP request load. Which compute solution should they choose?

A.Compute Engine managed instance groups with autoscaling
B.Google Kubernetes Engine (GKE)
C.Cloud Functions
D.Cloud Run
AnswerD

Fully managed, auto-scales based on HTTP requests, minimal overhead.

Why this answer

Cloud Run is the best choice because it is a fully managed serverless platform that automatically scales from zero based on HTTP request load, minimizing operational overhead. It abstracts away infrastructure management, supports containerized applications, and charges only for resources used during request processing, aligning perfectly with the requirement to auto-scale based on HTTP traffic.

Exam trap

The trap here is that candidates often choose GKE or Compute Engine for 'auto-scaling' without recognizing that serverless options like Cloud Run offer the same capability with significantly less operational overhead for HTTP-based workloads.

How to eliminate wrong answers

Option A is wrong because Compute Engine managed instance groups with autoscaling require managing virtual machines, patching OS, and configuring scaling policies, which increases operational overhead compared to serverless options. Option B is wrong because Google Kubernetes Engine (GKE) introduces cluster management, node patching, and container orchestration complexity, which is not minimal operational overhead for a simple HTTP workload. Option C is wrong because Cloud Functions is designed for event-driven, short-lived functions, not for running a monolithic application that typically requires a persistent runtime environment and longer request handling.

Full explanation →
365
MCQeasy

A company has two VPC networks in the same project: vpc-a (us-central1) and vpc-b (us-east1). They want to allow communication between instances in these VPCs using internal IPs. Which action should they take?

A.Move both VPCs to the same region.
B.Set up VPC Network Peering between vpc-a and vpc-b.
C.Create a VPN tunnel between the VPCs.
D.Ensure firewall rules allow ingress from the other VPC's subnet ranges.
AnswerB

VPC peering enables internal IP communication across VPCs without any gateway.

Why this answer

VPC Network Peering allows direct internal IP communication between two VPC networks, regardless of region, as long as they are in the same project or across projects. This is the simplest and most efficient method for enabling private RFC 1918 connectivity without requiring VPN tunnels or moving resources. Peering uses Google's internal infrastructure, so traffic stays within the Google network and does not traverse the public internet.

Exam trap

Google Cloud often tests the misconception that VPCs must be in the same region to use internal IPs, or that a VPN tunnel is required for cross-region connectivity, when in fact VPC Network Peering works across regions within the same project or across projects.

How to eliminate wrong answers

Option A is wrong because VPCs can be in different regions and still communicate via internal IPs using VPC Network Peering; moving both to the same region is unnecessary and would disrupt existing resources. Option C is wrong because a VPN tunnel is an over-engineered solution for VPCs within the same project—VPC Network Peering is simpler, has lower latency, and does not require a Cloud VPN gateway or tunnel configuration. Option D is wrong because while firewall rules are necessary to allow traffic, they are not sufficient on their own; the VPCs must first be connected via VPC Network Peering (or another connectivity method) for the firewall rules to have any effect.

Full explanation →
366
Matchingmedium

Match each GCP compute service to its characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Virtual machines with full control

Managed Kubernetes clusters

Serverless containers

Platform as a Service (PaaS)

Event-driven serverless functions

Why these pairings

Compute Engine provides IaaS virtual machines; GKE offers managed Kubernetes; Cloud Run enables serverless containers; App Engine is a PaaS for web apps. Common confusions include mixing serverless and Kubernetes features.

Full explanation →
367
MCQmedium

A company wants to run a stateful application on Google Kubernetes Engine that requires persistent storage with high read/write performance from multiple pods simultaneously. Which storage option should they use?

A.Cloud Storage FUSE
B.Local SSDs on each node
C.Persistent Disk with ReadWriteMany access mode
D.Filestore
AnswerD

Filestore provides a shared NFS file system that can be mounted by multiple pods with high performance.

Why this answer

Filestore provides a fully managed NFS file share that can be mounted by multiple pods simultaneously with high performance. Persistent Disk with ReadWriteMany access mode is not supported by GKE; it supports ReadOnlyMany. Cloud Storage is object storage not suitable for POSIX-like file systems.

Local SSDs are ephemeral and cannot be shared across pods.

Full explanation →
368
Matchingmedium

Match each GCP migration term to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Move workloads without modification

Tool to migrate VMs to GCP

Physical device for large data transfer

Online data transfer from other clouds or on-prem

Migrate databases to Cloud SQL with minimal downtime

Why these pairings

Correct matches: Migrate for Compute Engine migrates VMs; Cloud Storage Transfer Service handles online data transfers; Transfer Appliance is a physical device for large datasets; Database Migration Service migrates databases to Cloud SQL. Common confusions include swapping the roles of these services.

Full explanation →
369
MCQmedium

A company is deploying a new application on Compute Engine. They need to ensure that the application can automatically recover from a zone failure. What is the best approach?

A.Create a managed instance group with instances in multiple zones.
B.Use a global load balancer in front of a single instance.
C.Create a single VM in a single zone and rely on live migration.
D.Use Cloud Storage to store application state and restore from a snapshot.
AnswerA

MIG auto-heals and distributes across zones.

Why this answer

A managed instance group (MIG) with instances in multiple zones provides automatic recovery from a zone failure by distributing instances across zones and using auto-healing to recreate failed instances. If one zone becomes unavailable, the load balancer routes traffic to healthy instances in other zones, ensuring high availability without manual intervention.

Exam trap

Google Cloud often tests the distinction between live migration (which handles host maintenance but not zone failures) and multi-zone MIGs (which handle zone failures), leading candidates to mistakenly choose live migration as a recovery mechanism.

How to eliminate wrong answers

Option B is wrong because a global load balancer in front of a single instance does not provide zone-level redundancy; if the zone fails, the single instance becomes unavailable, and the load balancer has no healthy backend to route traffic to. Option C is wrong because live migration only protects against host maintenance events, not zone failures; if the entire zone fails, the VM is lost and cannot be recovered automatically. Option D is wrong because storing application state in Cloud Storage and restoring from a snapshot is a disaster recovery approach, not an automatic recovery mechanism; it requires manual steps to recreate the VM and does not provide seamless failover.

Full explanation →
370
Multi-Selectmedium

Which TWO statements are true about Google Cloud HTTPS Load Balancers?

Select 2 answers
A.They support only external backends, such as internet-facing instances.
B.They support only IPv4 traffic.
C.They can forward traffic to backends in multiple regions, including instances in different VPC networks.
D.They can be used to load balance internal HTTP(S) traffic within a VPC.
E.They are global resources and use a single anycast IP address.
AnswersC, E

Global HTTPS Load Balancers support multi-region backends, including across VPCs via Network Endpoint Groups.

Why this answer

Google Cloud HTTPS Load Balancers are global external load balancers that can distribute traffic to backends across multiple regions, and they support cross-VPC connectivity via Shared VPC or VPC Network Peering, allowing instances in different VPC networks to serve as backends.

Exam trap

The trap here is that candidates often confuse the global HTTPS Load Balancer (for external traffic) with the Internal HTTP(S) Load Balancer (for internal traffic), leading them to incorrectly select option D as true.

Full explanation →
371
MCQeasy

An organization is using Cloud Build to build container images and push them to Artifact Registry. Which step in the cloudbuild.yaml file is necessary to tag and push the image?

A.A step that runs 'docker push' with the Artifact Registry URL
B.A step that runs 'gcloud container images push'
C.A step that runs 'gsutil cp' to upload the image
D.A step that runs 'kubectl apply'
AnswerA

This step pushes the image to Artifact Registry.

Why this answer

The 'docker push' step with the destination in Artifact Registry is required to push the built image to a registry.

Full explanation →
372
MCQhard

A company runs a real-time data analytics platform on Google Cloud that ingests streaming data from IoT devices. The architecture uses Cloud Pub/Sub to receive messages, Dataflow for processing, and BigQuery for storage. Recently, the team noticed that the processing latency has increased significantly during peak hours. Upon investigation, they found that the Dataflow pipeline is experiencing high system lag and some workers are being killed due to out-of-memory errors. The pipeline uses a fixed window of 10 seconds and writes to BigQuery using streaming inserts. The company wants to reduce latency without sacrificing data accuracy. Which course of action should they take?

A.Change the windowing to a global window and use batch inserts to BigQuery
B.Increase the number of Dataflow workers and machine type to handle the load
C.Implement a dead-letter queue for unprocessed messages and use a slower processing rate
D.Enable Dataflow streaming engine and use exactly-once processing mode
AnswerD

Streaming engine reduces memory usage; exactly-once ensures accuracy.

Why this answer

Dataflow Streaming Engine offloads the shuffle operation to a backend service, reducing memory pressure and allowing workers to handle more data. Increasing workers (A) may help but root cause is memory. Changing windowing (B) sacrifices timeliness.

Dead-letter queue (C) does not address latency.

Full explanation →
373
MCQmedium

A company is performing a TCO analysis to compare on-premises costs with Google Cloud. Which cost should they include as a hidden operational cost on-premises?

A.Compute Engine instance costs
B.Power, cooling, and physical security
C.Egress charges
D.Software license costs
AnswerB

These are often overlooked operational costs for on-premises.

Why this answer

On-premises hidden costs include facility costs (power, cooling, space), hardware maintenance, personnel for patching and upgrades. Egress costs are cloud costs, not on-prem. Compute Engine instance cost is a direct cloud cost.

Software licenses depend on licensing model.

Full explanation →
374
Multi-Selecthard

Which THREE are best practices for designing a highly available application on Compute Engine?

Select 3 answers
A.Use local SSDs for stateful data
B.Use a single large machine type
C.Use managed instance groups with autoscaling
D.Use an external load balancer with health checks
E.Distribute instances across multiple zones
AnswersC, D, E

Managed instance groups automatically handle scaling and healing.

Why this answer

Managed instance groups (MIGs) with autoscaling are a best practice for high availability because they automatically maintain a target number of healthy instances across zones, replacing failed instances and scaling based on load. This ensures the application can withstand instance failures and traffic spikes without manual intervention, directly supporting high availability.

Exam trap

Google Cloud often tests the misconception that local SSDs are suitable for stateful data in HA designs, but the trap is that local SSDs are ephemeral and data is lost on instance failure, so they should only be used for cache or temporary data, not for persistent state.

Full explanation →
375
MCQeasy

A media streaming company is deploying a new video transcoding pipeline on Google Cloud. The pipeline receives raw video files uploaded to Cloud Storage, triggers a Cloud Function that submits transcoding jobs to a Compute Engine worker pool, and stores the transcoded output in another Cloud Storage bucket. The workers are managed by a managed instance group (MIG) running a custom container image. Currently, when there is a spike in uploads, the MIG takes 5-7 minutes to scale up new workers, causing processing delays. The architect needs to reduce the time to add new workers to under 2 minutes. The workers are stateless and the container image is about 2 GB. What should the architect do?

A.Use Cloud Run instead of Compute Engine to run the transcoding workers
B.Increase the minimum number of instances in the MIG to 10
C.Replace the Compute Engine workers with Cloud Functions to handle the transcoding
D.Create a custom Compute Engine image that includes the container runtime and pre-pulled container
AnswerD

A custom image with the container already pulled reduces boot time as the image does not need to be downloaded.

Why this answer

Creating a custom Compute Engine image that includes the container runtime and pre-pulls the 2 GB container image eliminates the need to download the image during scale-up. This reduces the instance startup time from 5-7 minutes to under 2 minutes, as the container is already cached locally on the image, bypassing the network pull delay.

Exam trap

The trap here is that candidates may assume increasing the minimum instance count (Option B) solves the scaling delay, but it only pre-provisions a fixed number of instances and does not address the startup latency for additional instances beyond that baseline.

How to eliminate wrong answers

Option A is wrong because Cloud Run has a maximum request timeout of 60 minutes and is designed for stateless HTTP-triggered workloads, not for long-running, resource-intensive video transcoding jobs that require GPU or high CPU. Option B is wrong because increasing the minimum number of instances to 10 does not reduce the time to add new workers; it only ensures a baseline of running instances, but scaling up beyond that still incurs the same 5-7 minute delay due to container image pull. Option C is wrong because Cloud Functions have a maximum execution timeout of 9 minutes and limited memory/CPU, making them unsuitable for transcoding large video files, which often require sustained compute and storage access.

Full explanation →
Page 4

Page 5 of 13

Page 6

All pages

12345678910111213

Practice PCA by domain

Target a specific domain to shore up weak areas.

Managing Implementation and Ensuring Solution and Operations ReliabilityManaging and Provisioning a Solution InfrastructureDesigning for Security and ComplianceAnalysing and Optimising Technical and Business ProcessesDesign and plan a cloud solution architectureManage and provision cloud infrastructureDesign for security and complianceAnalyze and optimize technical and business processesManage implementation of cloud architectureEnsure solution and operations reliability
See all domains with question counts →