955 questions total · 13pages · All types, answers revealed
Drag and drop the steps to recover a Cloud SQL instance from a backup into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Restoring to an existing instance may overwrite data; best practice is to restore to a new instance.
An organization wants to reduce costs for a batch data processing job that runs nightly and is resilient to interruptions. The job can be restarted from checkpoints. Which Compute Engine VM pricing model should be used?
Preemptible VMs cost about 60-91% less than standard VMs and are suitable for fault-tolerant batch jobs that can handle interruptions. The job can checkpoint and resume.
Why this answer
Preemptible VMs and Spot VMs are significantly cheaper than standard VMs and can be terminated by Google Cloud at any time. Since the job is batch and can resume from checkpoints, interruptions are acceptable. Sustained use discounts apply automatically to standard VMs, but preemptible/spot VMs offer the lowest cost for fault-tolerant workloads.
A company is deploying a multi-tier web application on Google Cloud. The application must comply with PCI DSS. Which combination of Google Cloud services should be used to restrict access to the database tier to only the application tier, while also encrypting data at rest and in transit?
Private IP isolates the database, SSL/TLS encrypts in transit, CMEK encrypts at rest with customer-managed keys.
Why this answer
It meets all PCI DSS requirements: Cloud SQL with private IP ensures the database tier is not exposed to the public internet, restricting access to only the application tier within the same VPC. SSL/TLS encrypts data in transit, and using Cloud KMS with a customer-managed encryption key (CMEK) provides control over encryption keys for data at rest, which is often required for compliance.
Exam trap
The trap here is that candidates often assume Google-managed encryption keys are sufficient for PCI DSS, but the standard often requires customer-managed keys (CMEK) to demonstrate control over key lifecycle, and they overlook that public IP (even with SSL) fails the network access restriction requirement.
How to eliminate wrong answers
Option A is wrong because Cloud Spanner with private IP and SSL/TLS does encrypt data in transit and restricts network access, but it uses Google-managed encryption keys by default, which may not satisfy PCI DSS requirements for customer control over encryption keys. Option B is wrong because Cloud SQL with public IP exposes the database to the internet, violating the requirement to restrict access to only the application tier, even with SSL/TLS. Option C is wrong because Cloud Datastore is a NoSQL document database that does not support secure WebSocket connections for encryption in transit (it uses gRPC/HTTP with TLS), and customer-managed encryption keys are not available for Cloud Datastore; it uses Google-managed keys only.
You are designing a Dataflow streaming pipeline for real-time event processing. The pipeline must be cost-effective while tolerating worker failures without data loss. Which configuration should you use?
Correct. A standard Dataflow job (non-FlexRS) with non-preemptible workers and Streaming Engine enabled offers the necessary failure tolerance and cost efficiency via autoscaling, avoiding the limitations of preemptible workers and batch-only scheduling.
Why this answer
A standard Dataflow streaming job (non-FlexRS) with non-preemptible workers and Streaming Engine enabled provides failure tolerance without data loss. Non-preemptible workers are not subject to termination, reducing failure frequency, and Streaming Engine's durable state checkpointing preserves progress across any worker failures. While preemptible workers are cheaper, they introduce higher failure risk; FlexRS is batch-only and cannot be used for streaming pipelines.
Therefore, option D is the correct choice for a cost-effective (via autoscaling) and reliable streaming pipeline.
Exam trap
Candidates often mistakenly believe FlexRS supports streaming pipelines because it offers cost savings with preemptible workers. However, FlexRS is strictly for batch jobs. For streaming, the correct cost-effective and fault-tolerant approach is to use Streaming Engine with non-preemptible workers in a standard Dataflow job.
How to eliminate wrong answers
Option A is wrong because batch Dataflow jobs do not support streaming mode, and preemptible workers in a batch job can cause data loss if not combined with appropriate checkpointing mechanisms, which are not designed for real-time event processing. Option B is wrong because using high-memory machine types does not prevent preemption; preemptible workers are still subject to termination, and this approach increases cost without addressing failure tolerance. Option D is wrong because non-preemptible workers are more expensive and do not inherently provide the cost-effectiveness required, while standard Dataflow jobs without Streaming Engine may lose data on worker failure in streaming mode due to lack of durable state persistence.
Company B uses Cloud Endpoints to expose their API. Recently, they started seeing 503 errors during periods of high traffic. They have enabled Cloud Endpoints with a moderate quota. The backend is running on Cloud Run. The Cloud Run service is configured with min instances = 0 and max instances = 100. The container concurrency is set to 80. The average request latency is 200ms. What is the most likely cause and what should they do?
Cold starts cause latency spikes leading to 503s; warm instances mitigate this.
Why this answer
The 503 errors during high traffic are most likely caused by Cloud Run's scaling latency. With min instances = 0, new requests must wait for a container to start (cold start), and during traffic spikes, the scaling algorithm may not provision instances quickly enough, leading to request timeouts and 503s. Setting a higher min instances value ensures a warm pool of containers is always ready to handle traffic bursts, reducing cold start delays.
Exam trap
The trap here is that candidates confuse 503 errors with quota exhaustion (option D) or misattribute the issue to concurrency limits (option A), when in fact the 503 is a classic symptom of Cloud Run's cold start and scaling delay with min instances = 0.
How to eliminate wrong answers
Option A is wrong because container concurrency (80) is already high; increasing it to 200 would not address the root cause of scaling delays and could overload containers, increasing latency. Option B is wrong because cold starts are caused by idle instances being shut down (min instances = 0), not by CPU limits; increasing CPU limits would not prevent cold starts. Option D is wrong because Cloud Endpoints quota is described as 'moderate' and the errors occur during high traffic on the backend, not at the API gateway; quota exhaustion would typically return 429 or 403 errors, not 503.
A company is migrating a legacy on-premises application to Google Cloud. The application has strict low-latency requirements between its components and requires stateful TCP sessions. Which TWO design decisions should the architect recommend?
Supports session affinity and preserves source IP for stateful protocols.
Why this answer
Regional managed instance groups (MIGs) with internal load balancing are correct because they keep all compute instances within a single region, minimizing network hops and latency between components. Internal load balancing provides a single IP address for stateful TCP sessions without introducing the latency of a global proxy, and it supports session affinity (e.g., client IP affinity) to maintain stateful connections.
Exam trap
The trap here is that candidates often confuse global load balancing (which is for external, stateless, HTTP-based traffic) with internal load balancing, and mistakenly think Cloud CDN or Cloud NAT can help with latency or stateful sessions, when they actually break TCP state or add unnecessary hops.
A company is migrating its on-premises workloads to Google Cloud. They have strict compliance requirements that all data at rest must be encrypted with customer-managed encryption keys (CMEK). Which Google Cloud service should they use to manage the lifecycle of these keys?
Cloud KMS is the correct service for managing CMEK.
Why this answer
Cloud KMS is the correct service because it provides centralized management of customer-managed encryption keys (CMEK) for Google Cloud services. It allows you to create, rotate, destroy, and set permissions on symmetric and asymmetric keys, and integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest with keys you control.
Exam trap
The trap here is that candidates often confuse Cloud HSM as a key management service, but Cloud HSM is a key storage backend for Cloud KMS, not a replacement for lifecycle management; you must use Cloud KMS to control key creation, rotation, and destruction even when using HSM-backed keys.
How to eliminate wrong answers
Option A is wrong because Secret Manager is designed to store and manage secrets such as API keys, passwords, and certificates, not to manage encryption keys for data-at-rest encryption under CMEK. Option B is wrong because Cloud External Key Manager (Cloud EKM) allows you to manage keys using an external key management system outside Google Cloud, but it does not provide native lifecycle management within Google Cloud; it relies on an external partner for key operations. Option D is wrong because Cloud HSM is a hardware security module service that provides FIPS 140-2 Level 3 validated key storage and cryptographic operations, but it is an additional protection layer for keys stored in Cloud KMS, not a standalone key lifecycle management service; you still use Cloud KMS to manage the key lifecycle.
A startup uses Cloud Functions for event-driven processing. They notice some functions are timing out. How to increase reliability without changing the business logic?
Cloud Functions supports automatic retry for event-driven triggers, which handles transient timeouts.
Why this answer
Enabling retry on failure for event-driven Cloud Functions allows the platform to automatically retry the invocation when a function times out or fails, without modifying the business logic. This leverages the built-in retry mechanism for background functions, which uses exponential backoff to handle transient failures and improve reliability.
Exam trap
Google Cloud often tests the misconception that increasing timeout or refactoring code is the only way to handle timeouts, but the trap here is that enabling retry on failure is a configuration-only change that improves reliability without altering business logic.
How to eliminate wrong answers
Option A is wrong because simply increasing the timeout to the maximum allowed (e.g., 540 seconds for HTTP functions) does not address the root cause of timeouts; it only postpones the failure and can lead to resource exhaustion. Option B is wrong because Cloud Tasks decouples and retries asynchronously, not synchronously; using it would require changing the architecture and business logic, which contradicts the requirement to not change business logic. Option D is wrong because refactoring the function to reduce complexity changes the business logic, which is explicitly disallowed by the question.
A company has a Cloud Spanner multi-region configuration serving a global user base. They observe increased latency during regional outages. They want to improve read availability and reduce read latency across regions. Which TWO actions should they take?
Additional read replicas improve read availability and reduce latency.
Why this answer
Cloud Spanner multi-region configurations (e.g., nam3) provide automatic failover and read replicas. Adding read replicas in multiple regions can reduce read latency. Using leader regions and follower reads can improve read performance.
Choosing a configuration with more read-only replicas (like nam3) increases availability. Reducing number of nodes would reduce capacity, not improve latency. Adjusting commit timestamp settings is for write performance, not read availability.
Refer to the exhibit. A Cloud Function processes files uploaded to Cloud Storage. It usually completes within 2 minutes, but recently it has been timing out after 540 seconds. What is the most likely cause?
Large files take longer to process, causing the function to hit the timeout.
Why this answer
Cloud Functions have a maximum execution timeout of 540 seconds (9 minutes). If a file larger than the function's memory and processing capacity is uploaded, the function may take longer than this hard limit to process it, resulting in a timeout. The exhibit indicates the function usually completes within 2 minutes, so a sudden spike to exactly 540 seconds strongly suggests the file size exceeded the function's ability to finish within the maximum allowed timeout.
Exam trap
Google Cloud often tests the misconception that a timeout is caused by a configuration error or infinite loop, rather than the function hitting the hard 540-second limit due to an oversized workload.
How to eliminate wrong answers
Option A is wrong because setting the function's maximum timeout to 540 seconds does not cause it to always take that long; the timeout is an upper bound, not a fixed execution time. Option C is wrong because low memory causing thrashing would typically result in out-of-memory errors or gradual slowdowns, not a consistent timeout exactly at 540 seconds. Option D is wrong because an infinite loop would cause the function to never complete, but Cloud Functions would still terminate at the 540-second timeout, not consistently hit that exact limit only when processing large files.
A company is migrating an on-premises PostgreSQL database (5 TB) to Cloud SQL. They need minimal downtime and automated schema conversion if needed. Which GCP service should they use?
DMS provides near-zero downtime migration for PostgreSQL to Cloud SQL. It supports schema conversion and ongoing replication.
Why this answer
Database Migration Service (DMS) supports continuous migration with minimal downtime from on-premises PostgreSQL to Cloud SQL. It handles schema and data migration. Migrate for Compute Engine is for VM migration, Transfer Appliance is for bulk data transfer, and Datastream is for streaming replication to BigQuery.
An engineer wants to migrate an on-premises MySQL database (5.6) to Cloud SQL for MySQL with minimal downtime. Which service should they use?
DMS provides one-click migration with continuous replication, minimizing downtime.
Why this answer
Database Migration Service (DMS) supports continuous replication from on-premises MySQL to Cloud SQL, enabling minimal downtime migration. Velostrata (Migrate for Compute Engine) is for VM migration. Storage Transfer Service is for file/object data.
BigQuery Data Transfer Service is for analytics data.
A company stores backup data in Cloud Storage. They observe high egress costs when clients download backups. Additionally, they must retain backups for 7 years for compliance. Which optimization should they implement first?
Requester pays shifts the egress cost to the client, solving the high egress issue.
Why this answer
High egress costs occur when clients download backups, and enabling requester pays shifts these costs to the clients. This directly addresses the cost issue without changing storage class or retention. Requester pays is the first optimization because it resolves the immediate cost problem while lifecycle rules or storage class changes address separate concerns like retention or storage cost.
Exam trap
Google Cloud often tests the misconception that changing storage class (e.g., to Archive) reduces egress costs, when in fact egress costs are independent of storage class and requester pays is the direct solution for shifting download costs.
How to eliminate wrong answers
Option A is wrong because lifecycle rules manage storage cost and retention, not egress costs; transitioning to Archive after 30 days reduces storage cost but does not shift or reduce the egress charges incurred during downloads. Option C is wrong because Cloud CDN caches content to reduce latency and origin load, but it does not eliminate egress costs from Cloud Storage; egress from Cloud CDN still incurs charges, and backups are typically not cacheable due to infrequent access. Option D is wrong because moving to Archive storage class reduces storage cost but does not affect egress costs; Archive has higher retrieval fees and minimum retention periods that could conflict with the 7-year compliance requirement.
A company is migrating a monolithic application to Google Kubernetes Engine (GKE). The application currently runs on a single Compute Engine instance and stores session state in local memory. The migration must support horizontal scaling and high availability. What should the company do to manage session state in the new architecture?
Redis provides a fast, scalable, shared session store that decouples session state from individual pods.
Why this answer
Migrating to a stateless architecture with Cloud Memorystore for Redis allows the application to scale horizontally without session state being tied to any single pod. By externalizing session state to a managed, highly available Redis service, any pod can handle any request, which is essential for high availability and autoscaling in GKE.
Exam trap
Google Cloud often tests the distinction between 'making the application stateless' versus 'using sticky sessions or StatefulSets'—the trap here is that candidates may think session affinity (Option C) is sufficient for high availability, but it actually creates a single point of failure at the pod level.
How to eliminate wrong answers
Option B is wrong because StatefulSets with headless services are designed for stateful workloads that require stable network identities and persistent storage, not for managing session state in a horizontally scalable stateless application. Option C is wrong because GKE Ingress with session affinity (sticky sessions) ties a client to a specific pod, which prevents true horizontal scaling and high availability—if that pod fails, the session is lost. Option D is wrong because Cloud SQL is a relational database not optimized for high-speed session state access; using it for session storage would introduce latency and unnecessary overhead compared to an in-memory data store like Redis.
You are designing a multi-region deployment for a critical application on GKE. The application must withstand a regional outage and automatically redirect traffic to the healthy region. Which THREE components must be configured? (Choose 3)
Provides multi-region strongly consistent database.
Why this answer
Multi-region GKE with global load balancing, multi-cluster ingress, and a multi-region database like Spanner are required.
A DevOps team uses Cloud Build to deploy Docker images to GKE. They want to ensure that only images that have passed a vulnerability scan and been signed by a trusted authority can be deployed. Which service should they integrate with Cloud Build and GKE?
Binary Authorization enforces image signing and attestation policies.
Why this answer
Binary Authorization enforces policies that require images to be signed by trusted authorities and verified before deployment on GKE.
A company uses Cloud KMS to encrypt sensitive data. They need to ensure that encryption key usage is audited and that keys are rotated automatically every 30 days. Which two actions should they take? (Choose two.)
Data Access audit logs record every encrypt/decrypt operation for compliance.
Why this answer
Enabling Data Access audit logs for the Cloud KMS API captures detailed information about every encryption key usage, including who accessed the key, when, and what operation was performed. This meets the auditing requirement by recording all key usage events in Cloud Audit Logs, which can be reviewed for compliance and security analysis.
Exam trap
The trap here is that candidates often confuse 'key rotation' with 'key usage monitoring' or assume that manual triggers or external managers can satisfy the automatic rotation requirement, when in fact Cloud KMS provides a native rotation period setting that must be used.
Refer to the exhibit. A Cloud Storage bucket has this IAM policy. What security recommendation should be made?
Signed URLs provide controlled, temporary access without making the bucket publicly accessible.
Why this answer
The IAM policy grants `roles/storage.objectViewer` to `allUsers`, which makes the bucket's objects publicly readable by anyone on the internet. This is a security risk because it allows anonymous access without authentication or logging. The recommended practice is to remove the `allUsers` member and instead use signed URLs (which embed a time-limited access token) to grant temporary, controlled access to specific objects.
Exam trap
Google Cloud often tests the misconception that `allAuthenticatedUsers` is a secure alternative to `allUsers`, but the trap is that it still allows any authenticated identity (including attackers) to access the data, whereas signed URLs provide granular, revocable, and auditable access.
How to eliminate wrong answers
Option B is wrong because changing `allUsers` to `allAuthenticatedUsers` still allows any authenticated Google account (including attackers with a free account) to read the objects, which does not provide fine-grained access control and still exposes the data broadly. Option C is wrong because enabling uniform bucket-level access only ensures that all access is governed by IAM policies rather than ACLs, but it does not address the underlying problem of granting public access via `allUsers`. Option D is wrong because simply removing the role binding without replacing it with a secure access method (like signed URLs) would break all access to the objects, which is not a security recommendation but a denial of service.
You are using Cloud SQL for PostgreSQL. You want to ensure that data can be recovered to any point within the last 7 days. What should you enable?
Point-in-time recovery uses binary logs to replay transactions, enabling recovery to any second within the retention period.
Why this answer
Enabling automated backups with binary logging (also known as write-ahead logging or WAL archiving) in Cloud SQL for PostgreSQL allows point-in-time recovery (PITR). This lets you restore your database to any specific timestamp within the retention window, which you can set to 7 days. Automated backups alone only provide daily snapshot restores, not the granularity needed for recovery to any point in time.
Exam trap
The trap here is that candidates confuse automated backups (daily snapshots) with point-in-time recovery, assuming that a 7-day backup retention alone provides the ability to restore to any moment, when in fact binary logging (WAL archiving) is required for that granularity.
How to eliminate wrong answers
Option A is wrong because exporting the database daily to Cloud Storage creates static snapshots at a single point in time each day; you cannot recover to arbitrary timestamps between exports, and the process is manual or scheduled, not a continuous recovery mechanism. Option B is wrong because a cross-region read replica provides read-only copies for disaster recovery or read scaling, but it does not enable point-in-time recovery or retain transaction logs for the primary instance. Option C is wrong because enabling automated backups with a 7-day retention period only stores daily full backups; without binary logging (WAL archiving), you can only restore to the exact backup timestamps, not to any arbitrary point within the 7 days.
Which TWO statements are true about Google Cloud VPC networks? (Select exactly 2.)
Subnets are regional and each subnet can have IP ranges across zones.
Why this answer
Google Cloud VPC subnets are regional resources that can span multiple zones within the same region. This allows resources in different zones to use the same subnet without requiring additional routing or VPN configuration, providing high availability and fault tolerance within a region.
Exam trap
The trap here is that candidates often confuse VPC scope with subnet scope, assuming VPCs are regional like in AWS, but Google Cloud VPCs are global, and they may also mistakenly believe VPC Peering supports transitive routing, which it explicitly does not.
The exhibit shows a managed instance group configuration. What is the primary purpose of the 'autoHealingPolicies' section?
Autohealing monitors instance health and replaces unhealthy ones.
Why this answer
The 'autoHealingPolicies' section in a managed instance group configuration is specifically designed to automatically replace instances that are deemed unhealthy based on a configured health check. When a health check probe (e.g., HTTP, TCP, or SSL) fails for a sustained period, the managed instance group terminates the unhealthy instance and creates a new one from the instance template, ensuring the desired number of healthy instances is maintained. This is distinct from autoscaling, which adjusts instance count based on load metrics.
Exam trap
Google Cloud often tests the distinction between 'autohealing' (health-based instance replacement) and 'autoscaling' (metric-based instance count adjustment), causing candidates to confuse the purpose of the 'autoHealingPolicies' section with scaling policies.
How to eliminate wrong answers
Option A is wrong because distributing incoming traffic evenly across instances is the function of a load balancer (e.g., HTTP(S) Load Balancer or Network Load Balancer) and its backend service, not the 'autoHealingPolicies' section of a managed instance group. Option B is wrong because automatically adding instances when CPU utilization exceeds 60% is a function of the 'autoscaling' policy (based on a CPU utilization metric), not the 'autoHealingPolicies' section, which only reacts to health check failures. Option D is wrong because automatically updating instances to a new instance template is achieved through a 'rolling update' or 'canary update' strategy (e.g., using the 'updatePolicy' section), not through 'autoHealingPolicies', which only replaces unhealthy instances with the current template.
An organization is using Shared VPC with multiple projects. They want to allow a service project to use a Cloud SQL instance created in the host project. Which step is required?
Private Services Access creates a VPC peering between the host project and the Cloud SQL service producer.
Why this answer
When using Shared VPC, a service project can use a Cloud SQL instance with a private IP from the host project's VPC. To enable this, the Cloud SQL instance must be created with a private IP and Private Services Access must be configured in the host project. This establishes a VPC peering connection between the host project's VPC and the Google-managed Cloud SQL service network, allowing the service project's resources to communicate with the instance via internal IP.
Exam trap
Google Cloud often tests the misconception that VPC peering between host and service projects is required, when in fact Shared VPC eliminates that need and the actual peering is with the Google-managed service network via Private Services Access.
How to eliminate wrong answers
Option B is wrong because granting the service project's Cloud SQL service account the Cloud SQL Client role on the host project is not required; the service account is used for instance-level operations, not for network connectivity between projects. Option C is wrong because VPC peering between the host and service project is not needed; Shared VPC already provides network connectivity, and the required peering is between the host project's VPC and the Cloud SQL service network via Private Services Access. Option D is wrong because enabling the Cloud SQL Admin API in the service project is necessary for managing Cloud SQL instances from that project, but it does not enable network access to an instance in the host project.
A company uses Cloud Storage to store critical documents. They need to protect against accidental deletion or overwrite of objects, and also retain deleted objects for at least 30 days. Which THREE features should they enable?
Versioning preserves previous versions when objects are overwritten or deleted.
Why this answer
Object versioning keeps multiple versions of objects, preventing overwrite loss. Object retention policies (retention policy) prevent deletion before a specified duration. Object holds can be applied to individual objects to prevent deletion.
Bucket lock is used to make a retention policy permanent, but it's not a separate feature for retention. Lifecycle management is for automating transitions or deletions, not for preventing deletion.
A company is migrating a legacy monolithic application to Google Cloud. They want to minimise changes while taking advantage of cloud benefits. Which TWO migration strategies are most appropriate? (Choose TWO.)
Minimal changes; move VMs to GCP.
Why this answer
Lift-and-shift (rehost) moves the application as-is with minimal changes. Replatform makes limited adjustments (e.g., using a managed database) without changing the core architecture. Both reduce risk and effort compared to re-architecting.
Refer to the exhibit. Which statement is true about this Deployment Manager template?
The ONE_TO_ONE_NAT access config assigns an ephemeral external IP.
Why this answer
Exam trap
A common pitfall is confusing disk `autoDelete` with network configuration. The public IP assignment is indicated by `type: ONE_TO_ONE_NAT` in the accessConfigs, not by `autoDelete`.
How to eliminate wrong answers
Option A is wrong because the template specifies `zone: us-central1-a`, not us-central1-b. Option B is wrong because the template defines `machineType: zones/us-central1-a/machineTypes/n1-standard-1`, which is a predefined standard machine type (1 vCPU, 3.75 GB memory), not a custom type. Option D is wrong because the `disks` block includes `autoDelete: true`, which means the boot disk will be automatically deleted when the VM is deleted, contrary to the statement.
A startup is deploying a microservices application on Google Kubernetes Engine (GKE) with a regional cluster. They have services that need to communicate with each other and also with external APIs. The cluster uses VPC-native routing. They have enabled Cloud NAT to allow outbound internet access for nodes without external IPs. However, the development team reports that some pods cannot reach the external APIs, while others can. All pods are in the same namespace and are not using any network policies. The pods that fail have the annotation 'cloud.google.com/gke-nat-ips' set to a list of static IP addresses. The pods that work do not have this annotation. What is the most likely cause of the failure?
The annotation is used for specific use cases, not with Cloud NAT.
Why this answer
The annotation 'cloud.google.com/gke-nat-ips' is used to assign specific static IP addresses for outbound traffic from pods, but it is only compatible with the GKE Native Networking (formerly VPC-native) and the Cloud NAT gateway when the pods use the default NAT configuration. When this annotation is set, Cloud NAT is bypassed for those pods, and the traffic is sent directly from the specified static IPs, which may not be properly routed or may be blocked by the external API's firewall rules. In contrast, pods without the annotation use Cloud NAT's dynamic IPs, which are correctly routed and allowed.
How to eliminate wrong answers
Option A is wrong because the question explicitly states that no network policies are in use, so there is no policy blocking outbound traffic. Option B is wrong because VPC-native routing is correctly configured for the cluster and works for pods without the annotation; the issue is specific to the annotation's interaction with Cloud NAT, not a misconfiguration of VPC-native routing itself. Option C is wrong because the annotation 'cloud.google.com/gke-nat-ips' is specifically designed to assign static IPs for outbound traffic from pods, not inbound traffic; inbound traffic uses load balancers or ingress resources.
A company wants to reduce Cloud Storage costs for archival data that is accessed less than once a year. They have data stored in Standard storage class. Which TWO actions should they take? (Choose TWO.)
If data is truly unneeded, deleting it eliminates storage costs entirely.
Why this answer
Using lifecycle policies to transition from Standard to Archive storage class reduces cost for rarely accessed data. Also, deleting unnecessary objects reduces storage. Coldline is for 90 days, Nearline for 30 days; Archive is for long-term archival.
Changing object names does not reduce cost.
A company runs a batch processing workload on Compute Engine instances that read from Cloud Storage and write results to BigQuery. The instances are launched via a managed instance group (MIG) and each job takes about 30 minutes. The company wants to reduce costs without sacrificing performance. What is the most cost-effective way to provision these instances?
Preemptible VMs provide significant cost savings for fault-tolerant batch jobs.
Why this answer
Preemptible VMs are up to 80% cheaper than regular VMs and are ideal for batch workloads that can tolerate interruptions. The job can be designed to checkpoint progress and restart on a new VM if preempted. Regular VMs are more expensive, sole-tenant nodes are for isolation requirements, and CUDs offer discounts for committed use but may not be as cost-effective for short-lived batch jobs.
A company uses Cloud Armor to protect an HTTPS Load Balancer. They want to allow traffic only from users who have passed a reCAPTCHA challenge. Cloud Armor supports which feature for this?
Cloud Armor supports reCAPTCHA token-based enforcement as a WAF feature.
Why this answer
Cloud Armor security policies can include rules that use reCAPTCHA tokens to block or allow traffic based on the challenge outcome.
A financial services company needs a globally distributed relational database that supports strong consistency across regions, with multi-region writes and sub-10ms latency for most queries. The database must also support SQL and ACID transactions. Which database should they choose?
Cloud Spanner is globally distributed, strongly consistent, SQL-compatible, and supports ACID transactions with multi-region writes.
Why this answer
Cloud Spanner is the only Google Cloud database that offers global distribution, strong consistency, multi-region writes, SQL support, and ACID transactions. Cloud SQL is single-region. Bigtable is NoSQL and does not support SQL or ACID.
Firestore is NoSQL with limited transactional support.
A company is designing a multi-region architecture for disaster recovery. Their primary region is us-central1 and they want a warm standby in another region. The application runs on Compute Engine with a stateful backend. Which approach minimizes RTO while keeping costs reasonable?
This provides warm standby with data replicated via snapshots.
Why this answer
Minimizes RTO by pre-provisioning Compute Engine instances in the secondary region via a managed instance group, using persistent disk snapshots for stateful data. This warm standby approach keeps instances ready to serve traffic with minimal startup delay, while Cloud Load Balancing failover automatically redirects traffic on primary region failure, balancing cost and recovery speed.
Exam trap
Google Cloud often tests the distinction between warm and cold standby by making candidates think that database replication alone (Option A) or serverless migration (Option C) meets the warm standby requirement, but they fail to address the stateful Compute Engine backend's need for pre-provisioned compute capacity and persistent disk state synchronization.
How to eliminate wrong answers
Option A is wrong because Cloud SQL cross-region replication provides database redundancy, but starting Compute Engine instances on failover introduces significant RTO due to instance boot time and application initialization, making it a cold standby rather than warm. Option C is wrong because Cloud Run is a serverless platform that does not support stateful backends with persistent disks or warm standby configurations, and it cannot directly replicate a stateful Compute Engine application without significant refactoring. Option D is wrong because a managed instance group without pre-provisioned instances means no instances are running in the secondary region, resulting in a cold standby with high RTO from instance creation and boot time, failing the warm standby requirement.
A security administrator wants to ensure that a Cloud Storage bucket named `gs://my-bucket` is only accessible by service accounts, not user accounts. Which action should they take?
Removing user members ensures only service accounts have access, and granting objectAdmin to a service account meets the requirement.
Why this answer
The requirement is to ensure that only service accounts, not user accounts, can access the bucket. By creating a new IAM policy that removes all user members and adds only a service account member with `roles/storage.objectAdmin`, the administrator directly enforces that no user account (Google Account or Google Workspace user) has any IAM role on the bucket. This is the simplest and most effective way to restrict access exclusively to service accounts.
Exam trap
A common misconception is that VPC Service Controls or IAM conditions can filter by member type (user vs. service account). However, IAM conditions cannot check the member type; the only way to enforce service-account-only access is to explicitly remove all user members from the IAM policy.
How to eliminate wrong answers
Option A is wrong because removing a user from a specific binding and adding a condition to deny user access does not prevent other user accounts from being granted access through other roles or bindings; IAM deny conditions are not supported for Cloud Storage in the same way as allow policies, and this approach is incomplete and not a standard practice. Option B is wrong because adding a bucket IAM condition that requires `resource.name.startsWith("projects/_/buckets/my-bucket/objects/")` is a condition that applies to object-level access, not to the bucket itself, and it does not restrict access to service accounts only; it merely narrows the scope of an existing binding. Option C is wrong because VPC Service Controls perimeters block access based on network context and identity, but they do not differentiate between user accounts and service accounts; they can block all access from outside a perimeter but cannot selectively allow only service accounts while blocking user accounts.
Refer to the exhibit. The output is from `gcloud compute instances describe instance-1 --format=json`. What can you conclude from this output?
The machine type determines the billing rate; n1-standard-2 is the type shown.
Why this answer
The output from `gcloud compute instances describe instance-1 --format=json` would include a `machineType` field that specifies the full URL of the machine type, such as `https://www.googleapis.com/compute/v1/projects/.../zones/.../machineTypes/n1-standard-2`. This confirms the instance is using the predefined n1-standard-2 machine type, which has 2 vCPUs and 7.5 GB of memory, and billing is based on that predefined type. The absence of a `custom` suffix or custom CPU/memory values in the machine type field indicates it is not a custom machine type.
Exam trap
Google Cloud often tests the distinction between predefined and custom machine types by hiding the machine type in the `machineType` URL, and candidates mistakenly think any non-standard name implies a custom type, but the key is checking for the `custom-` prefix or explicit CPU/memory fields.
How to eliminate wrong answers
Option B is wrong because a custom machine type would be indicated by a machine type URL ending with `custom-<vCPUs>-<memory>` (e.g., `custom-2-8192`) or by the presence of `custom` in the machine type name, which is not the case for `n1-standard-2`. Option C is wrong because committed use discounts are a billing-level commitment, not visible in the `gcloud compute instances describe` output; they would be shown in billing reports or the `gcloud compute commitments` command, not in instance metadata. Option D is wrong because a GPU attachment would be visible in the `accelerators` field of the instance description, which would list the GPU type and count; its absence means no GPU is attached.
A company is designing a hybrid network architecture connecting an on-premises data center to Google Cloud. They need high availability (99.99% SLA) and bandwidth up to 10 Gbps. They also need to use their existing MPLS circuits. Which THREE components should they include in the design? (Choose three.)
Using multiple VLAN attachments across different edge availability domains provides redundancy and high availability, meeting the 99.99% SLA.
Why this answer
VLAN attachments in Google Cloud are associated with edge availability domains (EADs), which represent physically independent failure domains within a zone. By attaching two VLAN attachments to two different EADs, the design ensures that a failure in one EAD does not affect the other, supporting the 99.99% SLA requirement. This is a key component of a highly available Dedicated Interconnect or Partner Interconnect setup.
Exam trap
The trap here is that candidates often confuse Cloud CDN or Cloud VPN as viable options for high-bandwidth, high-availability hybrid connectivity, but they fail to meet the 10 Gbps throughput and 99.99% SLA requirements, which only Dedicated Interconnect with redundant links and proper BGP configuration can satisfy.
A company uses Cloud Composer to manage Apache Airflow workflows. They want to optimize costs. Which practice is most effective?
Auto scaling dynamically adjusts the number of workers to match demand.
Why this answer
Cloud Composer supports autoscaling for its workers, which dynamically adjusts the number of worker pods based on the Airflow task queue depth. This directly optimizes costs by scaling down during low-load periods and scaling up only when needed, avoiding over-provisioning.
Exam trap
The trap here is that candidates often assume preemptible VMs are always the best cost-saving measure, but they fail to recognize that Airflow schedulers and other critical components require persistent, reliable compute resources, making autoscaling a safer and more effective optimization.
How to eliminate wrong answers
Option B is wrong because preemptible VMs cannot be used for Airflow schedulers; schedulers must be reliable and stateful, and preemptible VMs can be terminated at any time, causing workflow failures. Option C is wrong because Cloud Functions is not a replacement for Cloud Composer; Cloud Functions is designed for event-driven, short-lived tasks, not for orchestrating complex, long-running, or dependency-heavy workflows that Airflow handles. Option D is wrong because using small machine types for all components, especially the scheduler and database, can lead to performance bottlenecks, task queuing, and failures, ultimately increasing costs due to retries and delays.
A company runs batch analytics workloads each night on Compute Engine VMs. The workloads are fault-tolerant and can be interrupted. The finance team wants to reduce compute costs. Which Compute Engine pricing model should they use?
Preemptible VMs are ideal for fault-tolerant batch workloads because they cost much less and can be interrupted.
Why this answer
Preemptible VMs offer the deepest discount (up to 91% off regular pricing) and are perfect for batch, fault-tolerant workloads that can be interrupted. Committed use discounts are for long-term, steady-state usage; sustained use discounts are automatic but smaller; and sole-tenant nodes are for isolation, not cost savings.
Which TWO are best practices when designing a VPC network for a multi-tier application in Google Cloud?
Subnets allow segmentation and granular firewall rules.
Why this answer
Creating separate subnets for each application tier (e.g., web, application, database) allows you to apply granular firewall rules and routing policies per tier. This segmentation improves security by isolating traffic between tiers and aligns with Google Cloud's best practices for multi-tier architectures. It also simplifies network troubleshooting and scaling by keeping each tier's IP space distinct.
Exam trap
The trap here is that candidates assume a single subnet simplifies management (Option D) or that disabling flow logs is a harmless cost-saving measure (Option A), but the exam expects you to prioritize security and observability over minor cost savings or administrative convenience.
A financial services company requires that all data stored in Cloud Storage be encrypted with keys they manage, rotate, and audit. They also need to enforce encryption at the bucket level. Which configuration should they use?
CMEK provides key rotation and audit through Cloud KMS.
Why this answer
Customer-managed encryption keys (CMEK) with Cloud KMS allow the company to manage, rotate, and audit their own encryption keys while enforcing encryption at the bucket level. This meets the requirement of controlling key lifecycle and auditing, as Cloud KMS integrates with Cloud Audit Logs for key usage tracking.
Exam trap
The trap here is that candidates confuse CSEK with CMEK, thinking CSEK provides key management and auditing, when in fact CSEK requires the client to supply the key per request and lacks rotation and audit capabilities at the bucket level.
How to eliminate wrong answers
Option A is wrong because default Google-managed encryption uses Google-owned keys that the customer cannot manage, rotate, or audit, failing the key control requirement. Option C is wrong because customer-supplied encryption keys (CSEK) require the client to provide the key with each API call and do not support key rotation or auditing at the bucket level; they are also not persistent and cannot be enforced as a bucket-level policy. Option D is wrong because CMEK is already enabled at the bucket level by specifying a Cloud KMS key; the phrasing 'Enable CMEK at the bucket level with a Cloud KMS key' is redundant and misleading—CMEK is the mechanism, not a separate toggle, and the correct configuration is to set the bucket's default encryption to a CMEK key.
An organization wants to ensure that only container images signed by an authorized CI/CD pipeline can be deployed to their GKE clusters. Which GCP service should they use?
Why this answer
Binary Authorization is a GCP service that enforces attestation-based policies, ensuring only signed container images are deployed to GKE.
A company wants to set up monitoring and alerting for their application running on GKE. They need to receive alerts via email and also trigger an automated remediation workflow. Which TWO components should they use? (Choose two.)
Email notification channel sends alerts.
Why this answer
Alerting policies define conditions and notifications. Notification channels (email) send alerts. Pub/Sub can trigger Cloud Functions for remediation.
Logging is for logs, not alerting. Cloud Shell is a terminal.
An organization needs to connect their on-premises network to Google Cloud with a 99.99% SLA and up to 10 Gbps throughput. They have a supported partner for network connectivity. Which solution meets these requirements?
HA VPN provides a 99.99% SLA and supports up to 10 Gbps throughput when configured with two gateways and four tunnels.
Why this answer
HA VPN offers a 99.99% SLA and supports up to 10 Gbps throughput. It requires two VPN gateways and four tunnels for redundancy. Dedicated Interconnect offers 10-100 Gbps but a 99.99% SLA only with two connections.
Partner Interconnect provides up to 10 Gbps but the SLA depends on the partner. The question specifies up to 10 Gbps and a partner, but HA VPN is the only one with a built-in 99.99% SLA for a single connection. However, the 'supported partner' clue suggests Partner Interconnect, but its SLA is not 99.99% guaranteed by Google.
The correct answer is HA VPN because it explicitly offers 99.99% SLA and can handle up to 10 Gbps.
You are designing a disaster recovery plan for a critical application running on GKE. You need to back up the cluster's state and application data. Which TWO services should you use together? (Choose 2)
Velero is used for GKE backup and restore.
Why this answer
Velero is the standard tool for backing up GKE clusters and can store backups in Cloud Storage. Cloud Storage provides durable and versioned storage for backup artifacts. Filestore is for file storage, not cluster backups; Cloud SQL is for databases; Pub/Sub is for messaging.
A developer notices that web-server-1 is preemptible. They want to ensure their application remains available even if this instance is terminated. What should they do?
Managed instance groups automatically recreate instances, including preemptible ones, if they are terminated.
Why this answer
A managed instance group (MIG) with an autoscaler ensures that if the preemptible instance is terminated, the MIG automatically recreates it to maintain the desired number of instances. This provides resilience against preemption by restoring capacity without manual intervention. The load balancer can then distribute traffic across healthy instances in the group.
Exam trap
Google Cloud often tests the misconception that a load balancer alone provides high availability, but without a managed instance group to recreate terminated instances, the load balancer has no healthy backends to route traffic to.
How to eliminate wrong answers
Option A is wrong because modifying the preemptible flag to false would make the instance a standard (non-preemptible) instance, but this does not address availability during termination—it only prevents future preemption, and the instance could still fail for other reasons. Option C is wrong because a load balancer pointing to a single instance's external IP does not provide high availability; if the instance is terminated, the load balancer has no healthy backend and traffic is lost. Option D is wrong because a snapshot schedule only backs up persistent disks, it does not recreate the instance or maintain application availability after termination.
An engineer needs to grant a service account the ability to create and manage VMs in a specific project, but only those VMs with a certain label. Which IAM feature should they use?
IAM conditions allow you to apply attribute-based access control, e.g., only VMs with a specific label.
Why this answer
IAM conditions allow you to grant conditional access based on resource attributes such as labels, name, or creation time. Custom roles are a collection of permissions but do not enforce conditions. Service account impersonation is used to act as another service account.
Primitive roles are broad and do not support conditions.
A company wants to migrate a large on-premises relational database to Cloud SQL for PostgreSQL with minimal downtime. They need to ensure data consistency during the migration. Which THREE steps should they take?
A secure network connection is required for ongoing replication.
Why this answer
To migrate with minimal downtime, use Database Migration Service (DMS) for continuous replication, perform an initial dump/load to seed the target, and then cut over by stopping writes on the source and promoting the target. Using a read replica would not sync data. A VPN/Interconnect is required for secure connectivity.
A company runs a stateful workload on Compute Engine with regional persistent disks (PD). They need to implement a disaster recovery (DR) plan with a Recovery Point Objective (RPO) of less than 1 hour and Recovery Time Objective (RTO) of less than 4 hours. Which THREE steps should they include in their DR plan? (Choose three.)
Correct: meets RPO and protects against regional failure.
Why this answer
Taking snapshots every 30 minutes meets the RPO of less than 1 hour. By copying these snapshots to a Cloud Storage bucket in another region, you ensure data is available in a DR region for recovery, which is essential for cross-region disaster recovery.
Exam trap
The trap here is confusing zonal replication (regional PD) with cross-region disaster recovery; regional PDs only protect against zonal failures, not regional outages, so they cannot meet a cross-region DR requirement.
A startup wants to grant a new employee read-only access to view all Compute Engine instances in a project. What is the minimum IAM role they should assign?
Viewer role provides read-only access to compute resources.
Why this answer
The roles/compute.viewer role grants read-only access to Compute Engine resources, including the ability to list and view instances, without allowing modifications. This is the minimum IAM role that satisfies the requirement for read-only access to all Compute Engine instances in a project, as it provides the necessary permissions (e.g., compute.instances.list, compute.instances.get) without granting broader project-level or write permissions.
Exam trap
The trap here is that candidates may confuse roles/compute.viewer with roles/iam.securityReviewer, thinking the latter provides broader read access, but it lacks the specific Compute Engine permissions needed to view instances.
How to eliminate wrong answers
Option A is wrong because roles/owner grants full access to all resources in the project, including the ability to modify and delete instances, which far exceeds the required read-only access and violates the principle of least privilege. Option C is wrong because roles/iam.securityReviewer provides read access to IAM policies and security-related resources, but does not include the compute.instances.list or compute.instances.get permissions needed to view Compute Engine instances. Option D is wrong because roles/compute.admin grants full control over Compute Engine resources, including create, update, and delete operations, which is more permissive than the required read-only access.
An organization requires that only container images signed by a trusted authority can be deployed on Google Kubernetes Engine (GKE). Which Google Cloud service should they implement?
Binary Authorization ensures only signed images are deployed by integrating with attestors and admission controllers.
Why this answer
Binary Authorization enforces deploy-time policies based on attestations from trusted authorities. It ensures only signed images are deployed to GKE. Artifact Registry stores images, Secret Manager manages secrets, and Cloud Deploy handles deployments but does not enforce image signing.
An organization uses Cloud Functions (2nd gen) for event-driven processing. They notice that some functions fail with 'memory limit exceeded' errors during peak load. The function processes messages from Pub/Sub and writes to Firestore. What should they do to improve reliability without sacrificing throughput?
More memory allows the function to handle larger data per invocation without hitting the limit.
Why this answer
The 'memory limit exceeded' error indicates that the function's allocated memory is insufficient for the workload during peak load. Increasing the memory allocation (Option B) directly resolves this by providing more RAM for processing larger messages or concurrent operations, without altering the invocation pattern or throughput. Cloud Functions (2nd gen) allow memory to be set up to 32 GiB, and this change does not reduce the number of events processed per second.
Exam trap
Google Cloud often tests the misconception that scaling out (more instances) solves memory issues, but the trap here is that memory limits are per-instance, so only increasing the per-instance memory allocation directly resolves the error.
How to eliminate wrong answers
Option A is wrong because increasing the maximum number of concurrent instances does not address the per-instance memory limit; it may actually worsen the problem by allowing more instances to hit the same memory ceiling simultaneously. Option C is wrong because Pub/Sub batching reduces the number of function invocations but does not increase the memory available per invocation; it could also increase latency and does not fix the root cause of memory exhaustion. Option D is wrong because splitting the function into multiple smaller functions does not increase the memory per function instance; it adds complexity and may reduce throughput due to additional overhead, without guaranteeing that each smaller function avoids memory limits.
A healthcare organization is storing sensitive patient data in Cloud Storage. They need to ensure that all objects are encrypted with a key managed by their on-premises HSM. Which encryption approach should they use?
EKM allows you to use an external key management partner, including on-premises HSMs, to wrap the Google-managed encryption key.
Why this answer
Cloud External Key Manager (EKM) allows you to use an external key management system, such as an on-premises HSM, to manage encryption keys for Google Cloud services. This approach meets the requirement because the key never leaves the HSM, and Cloud Storage uses the key via the EKM integration, ensuring the organization retains full control over the key lifecycle.
Exam trap
In Google PCA, the trap here is that candidates confuse CMEK with EKM: CMEK keys are stored in Cloud KMS, not on an external HSM. EKM allows using an external key manager like an on-premises HSM.
How to eliminate wrong answers
Option A is wrong because Customer-Supplied Encryption Keys (CSEK) require you to supply the raw key material with each API call, and storing the key in Secret Manager does not keep it exclusively on the on-premises HSM; the key must be provided to Google Cloud, which violates the requirement of key management solely by the on-premises HSM. Option C is wrong because Customer-Managed Encryption Keys (CMEK) use Cloud KMS to generate and manage the key, and while you can import a key from an on-premises HSM, the key is then stored and managed within Cloud KMS, not exclusively on the on-premises HSM. Option D is wrong because client-side encryption before upload does not use Cloud Storage's native encryption integration; it requires the organization to manage encryption and decryption outside of Cloud Storage, which is not the same as ensuring Cloud Storage encrypts objects with a key managed by the on-premises HSM.
Refer to the exhibit. An architect created a VM instance using the above command. After the instance starts, the architect tries to access the nginx default page from the internet but gets a timeout. What is the most likely reason?
The 'no-address' flag omits the external IP, making the VM unreachable from the internet.
Why this answer
The most likely reason for the timeout is that the VM was created without an external (public) IP address. Without an external IP, the VM is not directly reachable from the internet, even if nginx is running and firewall rules allow HTTP traffic. The timeout occurs because the internet has no route to the VM's private IP address.
Exam trap
Google Cloud often tests the distinction between connectivity failures caused by missing firewall rules (which produce connection refused or dropped packets) versus missing external IP addresses (which produce timeouts because the host is unreachable).
How to eliminate wrong answers
Option A is wrong because Cloud NAT is used for outbound internet access from private VMs, not for inbound access from the internet; inbound traffic requires an external IP or a load balancer. Option B is wrong because even if a firewall rule allowing HTTP traffic exists, it cannot help if the VM has no external IP to receive the traffic from the internet. Option C is wrong because a failed nginx installation would result in a connection refused error, not a timeout; a timeout indicates the packet never reached the VM at all.
A media company stores video files in Cloud Storage for streaming. Infrequently accessed videos older than 90 days are currently in Standard storage. To reduce costs, they want to automatically move these files to a lower-cost storage class and delete them after 3 years. Which configuration should they use?
Lifecycle policies automate the transitions and deletion as per requirements.
Why this answer
Cloud Storage lifecycle policies can automatically transition objects between storage classes or delete them based on age. Setting conditions for transition to Nearline (or Coldline/Archive) after 90 days and deletion after 1095 days (3 years) is the correct approach.
A company uses Cloud Spanner for a global financial application. They experience increased latency and transaction aborts during peak hours. Which measure should they take first to improve reliability?
Short, single-partition transactions reduce the chance of conflicts and aborts.
Why this answer
Transaction aborts and latency in Cloud Spanner are most commonly caused by lock contention during peak hours. By optimizing transactions—such as reducing their scope, using read-only transactions where possible, and avoiding hot-spot writes—you directly address the root cause of contention without incurring additional cost or schema changes. This aligns with Google's best practices for Spanner reliability.
Exam trap
Google Cloud often tests the misconception that scaling nodes (Option A) is the universal fix for performance issues, but the trap here is that Spanner's horizontal scaling does not resolve lock contention—it only increases parallelism, which can worsen contention if transactions are not optimized.
How to eliminate wrong answers
Option A is wrong because increasing nodes primarily improves throughput and storage capacity, not latency or abort rates caused by lock contention; adding nodes can even increase distributed transaction overhead. Option B is wrong because reducing indexes on frequently updated columns may reduce write amplification but does not address the immediate issue of lock contention and aborts; indexes are not the primary cause of transaction conflicts. Option D is wrong because interleaved tables co-locate parent-child rows for faster joins and lower latency, but they do not reduce lock contention; in fact, they can increase contention if the parent row becomes a hot spot.
A developer wants to monitor a custom application metric from their application running on GKE. What should they use?
The custom metrics API allows ingesting and monitoring custom application metrics.
Why this answer
Cloud Monitoring custom metrics API (option D) is the correct choice because it allows a developer to push custom application-specific metrics (e.g., request latency, queue depth) from a GKE pod using the `custom.googleapis.com` metric domain. This integrates directly with Cloud Monitoring for alerting and dashboards, whereas Cloud Logging is for log data, not metrics.
Exam trap
The trap here is that candidates confuse Cloud Logging (for logs) with Cloud Monitoring (for metrics), or assume that Cloud Trace can handle custom metrics because it deals with application performance data.
How to eliminate wrong answers
Option A is wrong because Cloud Logging ingests log entries (text-based events), not numeric metric data points; it cannot be used to monitor custom application metrics like counters or gauges. Option B is wrong because Cloud Trace is a distributed tracing system for latency analysis of requests, not for publishing custom numeric metrics. Option C is wrong because Cloud Debugger is used for inspecting application state at specific code points without stopping the app, not for collecting or monitoring time-series metrics.
Your company plans to connect an on-premises data center to Google Cloud with a Dedicated Interconnect. You need to ensure high availability for the connection. What is the minimum configuration required to meet a 99.99% SLA for Dedicated Interconnect?
Two circuits with separate edge domains ensure 99.99% SLA.
Why this answer
Dedicated Interconnect requires two separate circuits (each 10 Gbps or 100 Gbps) to achieve a 99.99% SLA. A single circuit provides a 99.9% SLA, and Google Cloud recommends using two circuits in different edge availability domains. Cloud Router alone does not provide redundancy without multiple VLAN attachments and circuits.
Which TWO of the following are benefits of using a VPC Service Controls perimeter?
VPC Service Controls restrict data movement outside the perimeter.
Why this answer
VPC Service Controls perimeters prevent data exfiltration by creating a security boundary around Google Cloud managed services (e.g., BigQuery, Cloud Storage). Within the perimeter, data can only be copied to other resources inside the same perimeter, blocking unauthorized transfers to external projects or the internet. This is achieved through context-aware access policies that enforce data access based on the client's network identity and project membership, not by inspecting packet contents.
Exam trap
Google Cloud often tests the misconception that VPC Service Controls are a firewall or encryption mechanism, when in fact they are a context-aware access boundary that works alongside IAM and network controls.
Which TWO options are valid ways to connect an on-premises network to a VPC in Google Cloud? (Choose two.)
Cloud VPN provides IPsec tunnels to on-premises.
Why this answer
Cloud VPN is a valid way to connect an on-premises network to a VPC in Google Cloud. It uses IPsec (IKEv1 or IKEv2) to create an encrypted tunnel over the public internet between your on-premises VPN gateway and a Cloud VPN gateway in your VPC. This allows secure communication between your on-premises resources and your VPC subnets, making it a standard hybrid connectivity option.
A company wants to connect their on-premises data center to Google Cloud with a dedicated private connection that provides 99.99% availability and supports up to 100 Gbps bandwidth. They have a colocation facility near a Google Cloud region. Which connectivity option should they choose?
Dedicated Interconnect offers 10 or 100 Gbps circuits with a 99.99% SLA when configured with redundant links.
Why this answer
Dedicated Interconnect provides direct physical connections between on-premises and Google Cloud, offering 10 Gbps or 100 Gbps per circuit and supporting multiple VLANs. For high availability, two circuits are recommended. Partner Interconnect is limited to 10 Gbps and relies on a service provider.
HA VPN is over the public internet. Direct Peering does not provide SLA and is not recommended for production.
A company needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which two GCP services should they use? (Choose TWO).
Cloud Functions can integrate with Secret Manager to retrieve secrets.
Why this answer
Secret Manager stores secrets and supports rotation. Cloud Functions can access secrets via the Secret Manager API or by mounting them as volumes.
A team is using GKE with cluster autoscaling enabled. They notice that some nodes are underutilized but the cluster autoscaler does not remove them. What could be the reason?
If PDB prevents pod eviction, the node cannot be removed.
Why this answer
The cluster autoscaler does not remove a node if there are pods that cannot be rescheduled elsewhere. This can happen due to PodDisruptionBudgets, local storage, or node-specific constraints.
A company runs a global SaaS application on Google Cloud using Cloud Spanner. They need to ensure disaster recovery with a Recovery Time Objective (RTO) of less than 5 seconds and a Recovery Point Objective (RPO) of zero. Which configuration should they use?
Multi-region Spanner provides synchronous replication across regions, automatic failover with RPO=0 and RTO<5 seconds.
Why this answer
Cloud Spanner supports multi-region configurations with synchronous replication across regions, providing automatic failover with RPO of zero (no data loss) and RTO of less than 5 seconds. Backups can take hours to restore. Read replicas are for scaling reads, not for disaster recovery.
Point-in-time recovery is for restoring to a specific time, not for automatic failover.
An organization is planning to move 500 TB of archival data from on-premises to Cloud Storage. The data is not frequently accessed, and the network bandwidth is limited to 100 Mbps. What is the most efficient migration approach?
Transfer Appliance is a physical device shipped to the data center, loaded, and returned — ideal for large, low-bandwidth migrations.
Why this answer
Transfer Appliance is a physical device for shipping large amounts of data when bandwidth is low. At 100 Mbps, 500 TB would take over 500 days; Transfer Appliance bypasses network constraints.
A company is designing a microservices application on Google Cloud. They want to use an event-driven architecture where services communicate asynchronously. They need to reliably handle high-throughput events and ensure that each event is processed at least once. Which TWO services should they use together?
Pub/Sub provides at-least-once delivery and scalable event ingestion.
Why this answer
Pub/Sub is a scalable, asynchronous messaging service that delivers events at least once. Dataflow can be used to process streams of events from Pub/Sub with exactly-once semantics. Cloud Functions can be triggered by Pub/Sub but is not built for high-throughput stream processing.
Cloud Tasks is for task queues, not general pub/sub. Cloud Scheduler is for cron jobs.
A company migrated their on-premises database to Cloud SQL and now experiences high latency for read-heavy workloads. How can they optimize performance?
Read replicas serve read traffic, reducing load on primary and improving read latency.
Why this answer
Adding read replicas is the correct optimization because Cloud SQL read replicas offload read traffic from the primary instance, reducing latency for read-heavy workloads. Read replicas asynchronously replicate data from the primary using MySQL or PostgreSQL native replication, allowing queries to be distributed across multiple instances. This directly addresses the high latency by scaling read capacity horizontally without impacting write performance.
Exam trap
Google Cloud often tests the misconception that vertical scaling (higher machine type) is the universal fix for performance issues, but the trap here is that read-heavy workloads require horizontal scaling via read replicas to distribute the read load, not just a more powerful single instance.
How to eliminate wrong answers
Option A is wrong because switching to a higher machine type (vertical scaling) may improve performance but does not specifically address read-heavy workloads; it increases cost without distributing the read load, and latency improvements are limited by the single instance's resources. Option B is wrong because enabling automatic storage increase only prevents storage-full errors and does not affect query latency or read throughput; it is a capacity management feature, not a performance optimization. Option C is wrong because connection pooling reduces the overhead of establishing new database connections but does not reduce latency for read-heavy workloads; it improves connection management efficiency, not query execution speed or read distribution.
A global e-commerce platform uses Cloud Spanner in a multi-region configuration across us-central1 (leader) and europe-west1. The application writes all orders to a single table and reads from both regions. During a flash sale, write latency spikes, causing order failures. The team notices that the leader region's CPU utilization is at 95%, while the europe-west1 region is mostly idle. The application uses partitioned DML for batch updates. The development team proposes increasing node count. What should the architect do to reduce write latency while maintaining global read performance?
Correct. Changing to a dual-region with multiple writable leaders allows both regions to process writes, reducing the load on the original leader and decreasing write latency.
Why this answer
Configuring a dual-region with multiple writable leaders distributes write operations across both regions, reducing CPU utilization on the original leader region. This approach improves write latency during high-traffic events like a flash sale while maintaining global read performance from both regions. Scaling by adding nodes (as proposed) is also valid, but among the given choices, changing the placement configuration directly addresses the single-leader bottleneck.
Exam trap
A common misconception is that Cloud Spanner only supports a single leader for writes in any configuration. However, using a dual-region with multiple writable leaders allows both regions to handle writes, distributing the load and reducing latency.
How to eliminate wrong answers
Option A is wrong because manual sharding into multiple tables across instances is not a native Cloud Spanner pattern; it would break transactional consistency and increase operational complexity without addressing the root cause of insufficient node capacity. Option B is wrong because interleaved tables optimize read performance by colocating related rows, but they do not reduce write latency or CPU pressure caused by high write throughput. Option D is wrong because changing to a dual-region with multiple writable leaders would require a different configuration (e.g., dual-region with two writable regions) and does not solve the immediate CPU bottleneck in the current leader region; it also risks increased write conflicts and latency due to cross-region replication.
Refer to the exhibit. The process-image function fails intermittently with a memory limit exceeded error. Which action will MOST effectively resolve the issue?
More memory directly addresses the 'memory limit exceeded' error.
Why this answer
The error 'memory limit exceeded' indicates the function is running out of allocated memory. Increasing the function memory to 256MB directly addresses this by providing more memory for execution. In Google Cloud Functions, memory is also tied to CPU allocation, so increasing memory can improve performance and prevent out-of-memory errors.
Exam trap
A common misconception tested in Google Cloud exams is that timeout adjustments fix memory errors, but memory and timeout are independent resource limits; the trap is confusing a duration-based error with a resource-based error.
How to eliminate wrong answers
Option B is wrong because increasing the timeout (to 120 seconds) does not resolve a memory limit exceeded error; it only allows the function to run longer before being terminated. Option C is wrong because reducing maximum concurrent executions limits the number of parallel invocations but does not increase the memory available to a single function instance. Option D is wrong because changing the trigger to Cloud Pub/Sub does not reduce the memory footprint of the function; it only changes how the function is invoked, and Pub/Sub can still trigger the same memory-intensive workload.
Your company is using Cloud Storage to store sensitive customer data. The security team requires that all objects be encrypted with a customer-managed encryption key (CMEK) and that the key be automatically rotated every 90 days. You need to implement this without changing the application code. You have created a Cloud KMS key ring and a key with rotation period set to 90 days. What additional configuration is required?
Setting the default encryption key on the bucket ensures all new objects are automatically encrypted with the CMEK without code changes. Cloud KMS handles automatic rotation.
Why this answer
Setting the default encryption key of the Cloud Storage bucket to the Cloud KMS key ensures that all objects written to the bucket are automatically encrypted with that CMEK, without requiring any application code changes. The Cloud KMS key's rotation period of 90 days is already configured, so the key will be rotated automatically, meeting the security team's requirement.
Exam trap
The trap here is that candidates may think granting the Cloud KMS role to the Cloud Storage service account (Option C) is sufficient, but they overlook the critical step of actually setting the key as the default encryption key on the bucket to enforce automatic encryption.
How to eliminate wrong answers
Option A is wrong because bucket lifecycle rules manage object transitions between storage classes or deletion, not encryption key configuration or rotation. Option B is wrong because CSEK requires providing the key in each request, which would necessitate changing application code, and CSEK keys cannot be automatically rotated by Cloud KMS. Option C is wrong because granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account is necessary for the service account to use the key, but it is not the additional configuration required to enforce encryption on the bucket; the key must also be set as the default encryption key on the bucket.
Company A runs a containerized application on Google Kubernetes Engine (GKE) with 3 node pools: one for frontend, one for backend, and one for stateful databases. The backend services experience periodic latency spikes. After investigation, they found that the spikes correlate with the node pool autoscaler scaling down nodes. The backend services are deployed as Deployments with resource requests and limits set to 100m CPU and 200Mi memory each. The node pool uses n1-standard-2 machine types. The cluster autoscaler is enabled. What should they do to prevent the latency spikes?
Limits the number of pods that can be disrupted during voluntary disruptions.
Why this answer
The latency spikes occur because the cluster autoscaler is terminating nodes that host backend Pods, causing those Pods to be rescheduled and disrupting traffic. A PodDisruptionBudget (PDB) with a high minAvailable value ensures that a minimum number of backend Pods remain available during voluntary disruptions like node scale-down, preventing the sudden loss of capacity that leads to latency spikes. This directly addresses the root cause without disabling autoscaling or misconfiguring scheduling.
Exam trap
The trap here is that candidates often confuse resource requests/limits or node isolation with disruption protection, failing to recognize that PodDisruptionBudgets are the specific Kubernetes mechanism to control voluntary disruptions like autoscaler-driven node termination.
How to eliminate wrong answers
Option A is wrong because disabling the cluster autoscaler for the backend node pool would prevent automatic scaling entirely, leading to either over-provisioning (waste) or under-provisioning (capacity issues), and does not solve the disruption caused by scaling events. Option B is wrong because node taints and tolerations isolate Pods to specific nodes but do not prevent the autoscaler from terminating those nodes, so latency spikes would still occur during scale-down. Option C is wrong because increasing resource requests would only affect scheduling priority and node selection, not protect Pods from being evicted when the autoscaler decides to scale down a node.
A team is designing a multi-tier web application on Compute Engine. They need to ensure that only the web tier can access the application tier over a specific port. They plan to use VPC firewall rules. Which approach minimizes the attack surface?
Restricts access based on identity, minimizing attack surface.
Why this answer
It uses service account-based firewall rules, which allow you to specify the source as the service account attached to the web tier's instances rather than their IP addresses or subnets. This ensures that only instances with that specific service account (i.e., the web tier) can reach the application tier on the designated port, regardless of their IP or subnet. By scoping access to a specific identity, you minimize the attack surface because no other instances, even those in the same subnet, can reach the application tier unless they also use that service account.
Exam trap
Google Cloud often tests the misconception that subnet-based rules are the most secure approach, but the trap here is that service account-based rules provide finer-grained, identity-based access control that reduces the attack surface more effectively than subnet-based rules.
How to eliminate wrong answers
Option B is wrong because allowing ingress from any source to the application tier on the port exposes the application tier to the entire internet or VPC, which dramatically increases the attack surface and defeats the purpose of restricting access. Option C is wrong because allowing ingress from the web tier's subnet permits any instance in that subnet (including compromised or unauthorized instances) to reach the application tier, which is broader than necessary and does not leverage identity-based controls. Option D is wrong because an egress rule on the web tier does not control inbound traffic to the application tier; firewall rules are stateful in GCP, but the direction of the rule must match the traffic flow (ingress to the application tier), and egress rules alone cannot restrict who can reach the application tier.
A company uses Cloud Spanner for a global financial application. They need to ensure that a regional outage does not cause data loss. The application requires strong consistency and low latency reads and writes across multiple regions. Which configuration meets the reliability requirements?
Correct: provides synchronous replication and automatic failover.
Why this answer
A multi-region Spanner instance with a primary region and two witness regions uses Google's synchronous replication across three regions, ensuring strong consistency and no data loss during a regional outage. Witness regions participate in the Paxos quorum without serving read traffic, guaranteeing that writes are committed in at least two regions before acknowledgment, which meets the requirement for zero data loss and low latency reads and writes.
Exam trap
Google Cloud often tests the misconception that read replicas or backups can prevent data loss during a regional outage, but in Spanner, only synchronous replication via a multi-region instance with a quorum of regions (including witness regions) guarantees zero data loss and strong consistency across regions.
How to eliminate wrong answers
Option A is wrong because read replicas in Spanner are not a supported configuration; Spanner uses multi-region instances with regional replicas or witness regions, and read replicas would not participate in the write quorum, thus failing to prevent data loss during a regional outage. Option B is wrong because a single-region instance with backups to Cloud Storage cannot provide strong consistency and low latency across multiple regions, and backups are asynchronous, risking data loss of recent writes during an outage. Option D is wrong because point-in-time recovery (PITR) only protects against accidental data deletion or corruption within a single region, not against a regional outage, and it does not provide multi-region availability or low latency reads and writes across regions.
A company uses Cloud Logging to capture application logs. They need to alert when the number of errors exceeds 100 in a 5-minute window. Which type of alert should they create?
Log-based metrics count matching log entries; you can set an alert on the metric value.
Why this answer
Log-based metrics allow you to count log entries matching a filter. You can then create a metric and an alerting policy based on that metric. The other options are not suitable: SLO alerts monitor service level objectives, notification channels are destinations, and sinks export logs.
A company has a production GKE cluster running in Autopilot mode. They need to use a DaemonSet for a logging agent that must run on every node. However, they find that the DaemonSet pods are not being scheduled. What is the most likely cause?
Autopilot manages the node infrastructure; users cannot run DaemonSets because they require node-level scheduling permissions that Autopilot does not expose.
Why this answer
In GKE Autopilot, the control plane manages node resources and does not allow DaemonSets because Autopilot schedules pods without exposing nodes. DaemonSets require direct node access and are not supported in Autopilot. The cluster is 'node-less' from the user's perspective.
Workloads must be deployed as Deployments, StatefulSets, or Jobs. Node taints and resource quotas are not the issue because Autopilot handles them automatically.
Why did the VM resource fail while the disk succeeded?
A VM instance typically requires a boot disk; the disk resource exists but VM doesn't reference it as boot disk.
Why this answer
When you define a VM instance in Google Cloud, you must include a reference to a boot disk source. If the `source` field under `disks` is missing or empty, the API will reject the VM creation but may still succeed in creating the disk resource separately, since the disk creation does not depend on the VM. This explains why the disk succeeded while the VM failed.
Exam trap
Google Cloud often tests the subtle dependency that a boot disk must have an explicit `source` reference in the VM definition, and candidates mistakenly think the disk creation implies the VM will also succeed, or they confuse zone constraints with missing required fields.
How to eliminate wrong answers
Option A is wrong because the disk and VM do not need to be in the same zone for the VM to be created; the disk can be in a different zone and attached as a non-boot disk, but the boot disk must be in the same zone as the VM. However, the question states the disk succeeded, so zone consistency is not the issue. Option C is wrong because if the machine type were unavailable in us-central1-a, the API would return a specific 'machine type not found' error, but the question does not indicate that error; the failure is due to a missing boot disk source.
Option D is wrong because the network string 'global/networks/default' is correctly formatted; the option claims it is misspelled but then shows the same string, which is a typo in the option itself and not a real issue.
A company runs a batch processing job that runs daily and can handle interruptions. The job runs on a single Compute Engine instance. Which machine configuration is the most cost-effective?
Preemptible VMs are much cheaper and suitable for fault-tolerant batch jobs.
Why this answer
A preemptible VM costs significantly less than a standard VM (up to 80% discount) and is ideal for batch processing jobs that can handle interruptions. The job runs daily and can tolerate being stopped, so the lower cost of a preemptible instance provides the most cost-effective solution without sacrificing functionality.
Exam trap
Google Cloud often tests the misconception that sustained use discounts are the most cost-effective option, but the trap here is that preemptible VMs provide a much deeper discount for fault-tolerant workloads, and candidates may overlook the 'can handle interruptions' requirement in the question.
How to eliminate wrong answers
Option A is wrong because a n2-standard-4 VM with sustained use discount is more expensive than a preemptible VM; sustained use discounts apply automatically for running instances over a month, but they do not match the deep discount of preemptible instances, and the n2 series is a newer, higher-performance generation that is unnecessary for a batch job that can handle interruptions. Option B is wrong because a standard n1-standard-4 VM incurs full on-demand pricing, which is not cost-effective for a fault-tolerant batch job that can use cheaper preemptible instances. Option D is wrong because adding a GPU to an n1-standard-4 VM increases cost significantly and provides no benefit for a batch processing job that does not require GPU acceleration, making it the least cost-effective option.
Which TWO of the following are valid ways to deploy a Cloud Function? (Choose two.)
Correct. gcloud is a primary method.
Why this answer
`gcloud functions deploy` is the primary command-line interface (CLI) method to deploy a Cloud Function directly from a local source or a specified source location. Option E is correct because Cloud Build triggers can be configured to automatically deploy a Cloud Function whenever a change is pushed to a repository (e.g., Cloud Source Repositories, GitHub), enabling continuous deployment.
Exam trap
Google Cloud often tests the distinction between services that *trigger* or *store* code versus services that *deploy* code; the trap here is confusing Cloud Source Repositories (a source code host) or Cloud Scheduler (a job scheduler) with actual deployment methods, leading candidates to select them as valid deployment options.
Practice PCA by domain
Target a specific domain to shore up weak areas.