Google Professional Cloud Architect (PCA) — Questions 301–375

The application is stateless and overprovisioned, so the most effective first step is to right-size instances and use autoscaling to match capacity to demand. This reduces cost while maintaining performance and availability. Committed use discounts and long-term commitments only make sense after you have optimized the instance shape and quantity.

For multi-cloud security policy management, a third-party CSPM tool is designed to work across different cloud providers, offering centralized policy definition, monitoring, and enforcement. Google Cloud native tools like Organization Policy Service and VPC Service Controls are limited to Google Cloud, and Terraform is for provisioning, not continuous enforcement.

Restoring to an existing instance may overwrite data; best practice is to restore to a new instance.

Preemptible VMs and Spot VMs are significantly cheaper than standard VMs and can be terminated by Google Cloud at any time. Since the job is batch and can resume from checkpoints, interruptions are acceptable. Sustained use discounts apply automatically to standard VMs, but preemptible/spot VMs offer the lowest cost for fault-tolerant workloads.

Cloud Run revisions are immutable and traffic can be split by percentage across them. Deploying with no traffic, then assigning a small percentage, implements a canary, and setting the previous revision to 100 percent rolls back instantly. This built-in capability avoids external load balancers or delivery pipelines for a straightforward canary and rollback.

It meets all PCI DSS requirements: Cloud SQL with private IP ensures the database tier is not exposed to the public internet, restricting access to only the application tier within the same VPC. SSL/TLS encrypts data in transit, and using Cloud KMS with a customer-managed encryption key (CMEK) provides control over encryption keys for data at rest, which is often required for compliance.

Regional managed instance groups (MIGs) with internal load balancing are correct because they keep all compute instances within a single region, minimizing network hops and latency between components. Internal load balancing provides a single IP address for stateful TCP sessions without introducing the latency of a global proxy, and it supports session affinity (e.g., client IP affinity) to maintain stateful connections.

Cloud Run is the managed serverless container platform that scales to zero, bills per request and resource consumption, and removes cluster and node operations. Deploying the container image as a Cloud Run service gives the startup an HTTPS endpoint with automatic scaling and no idle cost, matching the stateless API, minimal operations, and pay-per-use requirements.

Cloud KMS is the correct service because it provides centralized management of customer-managed encryption keys (CMEK) for Google Cloud services. It allows you to create, rotate, destroy, and set permissions on symmetric and asymmetric keys, and integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest with keys you control.

Zero recovery point objective demands synchronous cross-region replication, which only a multi-region Cloud Spanner instance provides. Sub-minute recovery demands application compute already running in a second region with automated traffic failover. Combining a multi-region Spanner instance with regional GKE clusters in two regions behind a global external Application Load Balancer satisfies both constraints simultaneously.

Database Migration Service (DMS) is the correct choice because it is a fully managed GCP service designed to migrate databases to Cloud SQL with minimal downtime, supporting continuous replication and automated schema conversion via the Database Migration Service conversion workspace. It handles homogeneous migrations like PostgreSQL to Cloud SQL for PostgreSQL and can perform schema conversion when needed. Datastream is a change data capture service, not a full migration tool, and the other options are for different migration scenarios.

Database Migration Service (DMS) is purpose-built for migrating relational databases like MySQL 5.6 to Cloud SQL with minimal downtime. It performs an initial full load followed by continuous change data capture (CDC) replication from the source, allowing cutover with seconds of downtime. DMS natively supports MySQL, PostgreSQL, and SQL Server sources into Cloud SQL and AlloyDB.

High egress costs occur when clients download backups, and enabling requester pays shifts these costs to the clients. This directly addresses the cost issue without changing storage class or retention. Requester pays is the first optimization because it resolves the immediate cost problem while lifecycle rules or storage class changes address separate concerns like retention or storage cost.

Migrating to a stateless architecture with Cloud Memorystore for Redis allows the application to scale horizontally without session state being tied to any single pod. By externalizing session state to a managed, highly available Redis service, any pod can handle any request, which is essential for high availability and autoscaling in GKE.

Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed to GKE. It integrates with Cloud Build to sign images after vulnerability scanning and with GKE to enforce policies that only allow signed images. This directly meets the requirement of ensuring only scanned and signed images are deployed.

Enabling Data Access audit logs for the Cloud KMS API captures detailed information about every encryption key usage, including who accessed the key, when, and what operation was performed. This meets the auditing requirement by recording all key usage events in Cloud Audit Logs, which can be reviewed for compliance and security analysis.

The IAM policy grants `roles/storage.objectViewer` to `allUsers`, which makes the bucket's objects publicly readable by anyone on the internet. This is a security risk because it allows anonymous access without authentication or logging. The recommended practice is to remove the `allUsers` member and instead use signed URLs (which embed a time-limited access token) to grant temporary, controlled access to specific objects.

Google Cloud VPC subnets are regional resources that can span multiple zones within the same region. This allows resources in different zones to use the same subnet without requiring additional routing or VPN configuration, providing high availability and fault tolerance within a region.

The 'autoHealingPolicies' section in a managed instance group configuration is specifically designed to automatically replace instances that are deemed unhealthy based on a configured health check. When a health check probe (e.g., HTTP, TCP, or SSL) fails for a sustained period, the managed instance group terminates the unhealthy instance and creates a new one from the instance template, ensuring the desired number of healthy instances is maintained. This is distinct from autoscaling, which adjusts instance count based on load metrics.

Surviving a zonal outage with minimal data loss and no custom failover logic requires managed, zone-redundant building blocks at every tier. A regional managed instance group combined with a global external Application Load Balancer keeps serving traffic when a zone disappears, and a regional Cloud SQL instance promotes its standby automatically. Together these services remove the need for the small operations team to write or run replication and failover scripts.

Cloud External Key Manager allows Cloud KMS to wrap data encryption keys with key material held in an external key management system outside Google Cloud. Because access to the wrapped keys requires the external system, the company controls generation and rotation and can deny access by making the external key unavailable, meeting the regulatory requirements for both Cloud Storage and BigQuery.

Cloud Monitoring supports defining SLOs and creating burn rate alerts. Burn rate alerts fire when the rate of error budget consumption is too high, helping teams respond before the budget is exhausted. This is the native, recommended way to alert on SLO violations.

Cloud Armor supports reCAPTCHA integration through WAF rules that use the 'token.recaptcha_session.score' or 'token.recaptcha_action.score' attributes to allow, deny, or redirect traffic based on the reCAPTCHA assessment score. This is configured as a security policy rule with a reCAPTCHA challenge action, enabling the load balancer to enforce human verification before granting access.

The three requirements are EU data residency, self-controlled key hardware, and instant revocation. Only an external key manager integration satisfies all three because the keys physically live in the firm's data center and Google must reach out to them for every unwrap operation. Location constraints in organization policy handle the residency requirement, and severing the external key path provides the immediate revocation the security team wants.

The output from `gcloud compute instances describe instance-1 --format=json` would include a `machineType` field that specifies the full URL of the machine type, such as `https://www.googleapis.com/compute/v1/projects/.../zones/.../machineTypes/n1-standard-2`. This confirms the instance is using the predefined n1-standard-2 machine type, which has 2 vCPUs and 7.5 GB of memory, and billing is based on that predefined type. The absence of a `custom` suffix or custom CPU/memory values in the machine type field indicates it is not a custom machine type.

Customer-managed encryption keys (CMEK) in Cloud KMS allow the healthcare company to manage its own encryption keys, set a 90-day rotation schedule, and control access via IAM. This satisfies the requirements for encryption at rest, automatic key rotation, and full control over key lifecycle. Other options either do not provide self-management or lack automatic rotation.

Cloud Composer supports autoscaling for its workers, which dynamically adjusts the number of worker pods based on the Airflow task queue depth. This directly optimizes costs by scaling down during low-load periods and scaling up only when needed, avoiding over-provisioning.

Preemptible VMs are short-lived, heavily discounted Compute Engine instances (up to ~80% off) that can be terminated by Google at any time with a 30-second notice. They are ideal for fault-tolerant, interruptible batch workloads like nightly analytics jobs, which is exactly the scenario described.

Creating separate subnets for each application tier (e.g., web, application, database) allows you to apply granular firewall rules and routing policies per tier. This segmentation improves security by isolating traffic between tiers and aligns with Google Cloud's best practices for multi-tier architectures. It also simplifies network troubleshooting and scaling by keeping each tier's IP space distinct.

Binary Authorization is the GCP service that enforces deploy-time attestation, ensuring that only container images signed by trusted authorities (such as an authorized CI/CD pipeline) can be deployed to GKE clusters. It uses attestors and attestations created via Container Analysis, and policies can be set to allow only images with valid attestations. This directly satisfies the requirement to restrict deployments to pipeline-signed images.

Cloud Run is a fully managed serverless platform that runs containers and automatically scales, including to zero. It requires no infrastructure management, making it ideal for a startup wanting to deploy a containerized web application. Compute Engine and GKE require more management, and App Engine flexible environment is not fully serverless.

The compliance demands map to preventive controls: least privilege to limit permissions, a reviewed CI/CD pipeline with a dedicated service account in a separate project to enforce change review and attribution, and a resource-level deny policy plus separation of duties to stop any one engineer from deleting the production database. Detective measures like audit logging and alerting are useful but insufficient on their own. The combination of IAM restrictions, automation, and deny policies satisfies all three requirements.

Global external HTTP(S) Load Balancing is the only option that provides a single global anycast IP, edge termination, and automatic multi-region failover for HTTP(S) workloads. Regional proxies lack global anycast, Cloud DNS geo-routing introduces DNS caching delays and multiple IPs, and internal load balancing is not internet-facing. The chosen design satisfies global low latency and region-failure survivability.

Spreading the service across zones with a regional managed instance group, pairing it with a Cloud SQL regional instance that has a standby in another zone, and using Memorystore Standard Tier with automatic failover together address zone failure at every tier. Each component exposes stable endpoints, so the application keeps its existing connection strings.

Data residency is about where bytes are physically stored and replicated, so the architecture must pin personal data to regionally scoped datasets and buckets in the required country and use VPC Service Controls to stop egress. Encryption keys and network topology do not constrain physical location. Only anonymized aggregates may cross into the central analytics project.

A managed instance group (MIG) with an autoscaler ensures that if the preemptible instance is terminated, the MIG automatically recreates it to maintain the desired number of instances. This provides resilience against preemption by restoring capacity without manual intervention. The load balancer can then distribute traffic across healthy instances in the group.

Customer-managed encryption keys (CMEK) in Cloud KMS give the company full control over key creation, rotation, and usage. Cloud KMS integrates with Cloud Audit Logs to record all key operations, providing the required audit trail. Google-managed keys offer no customer control, CSEK lack integrated auditing, and Cloud HSM is a backing option for CMEK rather than a standalone solution.

Taking snapshots every 30 minutes meets the RPO of less than 1 hour. By copying these snapshots to a Cloud Storage bucket in another region, you ensure data is available in a DR region for recovery, which is essential for cross-region disaster recovery.

The roles/compute.viewer role grants read-only access to Compute Engine resources, including the ability to list and view instances, without allowing modifications. This is the minimum IAM role that satisfies the requirement for read-only access to all Compute Engine instances in a project, as it provides the necessary permissions (e.g., compute.instances.list, compute.instances.get) without granting broader project-level or write permissions.

Binary Authorization is a Google Cloud service that enforces deploy-time policies on GKE, allowing only container images signed by trusted authorities to be deployed. It integrates with Container Analysis and attestations to verify signatures before admission.

The 'memory limit exceeded' error indicates that the function's allocated memory is insufficient for the workload during peak load. Increasing the memory allocation (Option B) directly resolves this by providing more RAM for processing larger messages or concurrent operations, without altering the invocation pattern or throughput. Cloud Functions (2nd gen) allow memory to be set up to 32 GiB, and this change does not reduce the number of events processed per second.

Cloud External Key Manager (EKM) allows you to use an external key management system, such as an on-premises HSM, to manage encryption keys for Google Cloud services. This approach meets the requirement because the key never leaves the HSM, and Cloud Storage uses the key via the EKM integration, ensuring the organization retains full control over the key lifecycle.

Kubernetes NetworkPolicies are the native, low-overhead way to enforce pod-level network segmentation in GKE. They allow you to define which pods can communicate based on labels and namespaces, and they are enforced by the CNI plugin. This meets the requirement for fine-grained control with minimal operational effort compared to a service mesh or node-level firewall rules.

Cloud Storage lifecycle rules are the native, automated way to transition objects between storage classes and delete them based on age. A rule with condition 'age > 90 days' setting storage class to Nearline (or Coldline) reduces cost for infrequent access, and a second rule with 'age > 1095 days' (3 years) deletes the objects. This is declarative, server-side, and requires no custom code.

Transaction aborts and latency in Cloud Spanner are most commonly caused by lock contention during peak hours. By optimizing transactions—such as reducing their scope, using read-only transactions where possible, and avoiding hot-spot writes—you directly address the root cause of contention without incurring additional cost or schema changes. This aligns with Google's best practices for Spanner reliability.

Cloud Monitoring custom metrics API (option D) is the correct choice because it allows a developer to push custom application-specific metrics (e.g., request latency, queue depth) from a GKE pod using the `custom.googleapis.com` metric domain. This integrates directly with Cloud Monitoring for alerting and dashboards, whereas Cloud Logging is for log data, not metrics.

To achieve the 99.99% availability SLA for Dedicated Interconnect, Google requires at least two Dedicated Interconnect connections in two different edge availability domains (metro availability zones), each terminating on a separate Cloud Router. This topology ensures that a single circuit or router failure does not take down connectivity. The 99.99% SLA is explicitly tied to this redundant, diverse-path configuration.

Anthos Service Mesh offers advanced traffic management, including canary deployments with precise traffic splitting and automated rollback triggered by monitoring metrics. This aligns with the need to release to a subset, monitor, and revert automatically. The other options lack either the fine-grained traffic control or the automation required.

Private Service Access (PSA) is the GCP feature that allows private connectivity from a VPC network to Google-managed services like Cloud SQL. It uses VPC peering with the Google-managed service's VPC to enable private IP communication. Private Service Connect, on the other hand, is used for publishing services to consumers, not for consuming services like Cloud SQL.

Cloud VPN is a valid way to connect an on-premises network to a VPC in Google Cloud. It uses IPsec (IKEv1 or IKEv2) to create an encrypted tunnel over the public internet between your on-premises VPN gateway and a Cloud VPN gateway in your VPC. This allows secure communication between your on-premises resources and your VPC subnets, making it a standard hybrid connectivity option.

Dedicated Interconnect provides a direct physical connection between the customer's colocation facility and Google's network, supporting up to 100 Gbps per link (with 10 Gbps or 100 Gbps circuits) and offering a 99.99% SLA when configured with redundant connections. Because the company already has a colocation facility near a Google region, Dedicated Interconnect is the correct fit for the stated bandwidth and availability requirements.

Cloud Spanner multi-region configurations synchronously replicate data across regions using Paxos, giving an RPO of zero (no committed data is ever lost) and an RTO of seconds because a regional failure triggers automatic leader re-election without manual intervention. This is the only option that satisfies both the zero-RPO and sub-5-second RTO requirements simultaneously.

Transfer Appliance is a physical device for shipping large amounts of data when bandwidth is low. At 100 Mbps, 500 TB would take over 500 days; Transfer Appliance bypasses network constraints.

Adding read replicas is the correct optimization because Cloud SQL read replicas offload read traffic from the primary instance, reducing latency for read-heavy workloads. Read replicas asynchronously replicate data from the primary using MySQL or PostgreSQL native replication, allowing queries to be distributed across multiple instances. This directly addresses the high latency by scaling read capacity horizontally without impacting write performance.

Setting the default encryption key of the Cloud Storage bucket to the Cloud KMS key ensures that all objects written to the bucket are automatically encrypted with that CMEK, without requiring any application code changes. The Cloud KMS key's rotation period of 90 days is already configured, so the key will be rotated automatically, meeting the security team's requirement.

Binary Authorization is the GKE-native admission control that enforces policies at deploy time using attestations. A policy can require that images be attested by a trusted scanner and originate from an approved registry, and violations are denied and logged. Vulnerability scanning alone detects but does not block, network policies do not govern kubelet image pulls, and sandboxing hardens runtime without validating provenance.

To alert on the count of error log entries exceeding 100 in a 5-minute window, the engineer must first create a log-based metric that counts matching log entries, then attach an alerting policy with a threshold condition on that metric. Cloud Logging alone cannot alert on log content; it must be converted into a metric that Cloud Monitoring can evaluate. This is the standard pattern for log-driven alerting in Google Cloud.

The access pattern is predictable: hot for 30 days, then cold for years. Object Lifecycle Management transitions objects between storage classes in place, so applications keep reading the same object names while the per-gigabyte cost drops as access frequency falls. Approaches that move objects to another bucket or change the default class either break read paths or fail to reclassify existing data.

A preemptible VM costs significantly less than a standard VM (up to 80% discount) and is ideal for batch processing jobs that can handle interruptions. The job runs daily and can tolerate being stopped, so the lower cost of a preemptible instance provides the most cost-effective solution without sacrificing functionality.

Folders under the organization node enable policy inheritance and delegated administration, letting central teams set guardrails while business units own their projects. Separate Cloud Billing accounts per business unit isolate costs and budgets. Labels, over-broad organization roles, and networking alone do not deliver the required policy control and billing separation.

Workload Identity allows binding a Kubernetes service account to a GCP service account. Then, IAM can be granted to that GCP service account for the Cloud Storage bucket.

Cloud External Key Manager is the only option that keeps key material outside Google Cloud in a partner HSM while still integrating with Google Cloud services for encryption at rest. It supports customer-controlled rotation and, critically, allows the customer to revoke Google's access by disabling the external key. CMEK and GMEK keep key custody inside Google, which does not meet the external control and revocation mandate.