Google Professional Cloud Architect (PCA) — Questions 451–525

Cloud Armor security policies are the correct choice because they allow you to define IP-based allow/deny rules at the edge of Google's network, directly integrated with the global HTTP(S) load balancer. This provides granular access control based on source IP ranges before traffic reaches your backend instances, which is exactly what the requirement specifies.

Cloud Build triggers support branch filtering via the 'Branch' field (regex) in the trigger configuration, so a trigger can be scoped to only fire on pushes to a specific branch such as 'refs/heads/main' or 'release/*'. This ensures that only builds originating from the trusted branch proceed to the deploy step, satisfying the requirement with a native Cloud Build feature.

The principle of least privilege dictates that the service account should be granted only the minimal permissions required to read objects, which is roles/storage.objectViewer. By removing all other bindings, the bucket becomes accessible exclusively to that service account, ensuring that no other identities (users, groups, or other service accounts) can read the sensitive data. This approach directly enforces the requirement using IAM roles on the bucket resource.

Firestore is a NoSQL document database that supports flexible schema and automatic scaling, making it ideal for non-relational data. It offers real-time synchronization, offline support, and serverless scaling, which aligns with the requirement for storing and retrieving data without manual sharding or capacity planning.

It pragmatically balances modernization benefits with operational overhead by migrating only stateless components to Cloud Run (a fully managed serverless platform that reduces operational complexity) while keeping stateful components on GKE with managed services like Cloud Spanner. This approach improves deployment frequency and resource utilization without requiring a full rewrite, and it leverages Cloud Run's automatic scaling and zero infrastructure management to minimize operational burden.

The landing zone needs organization-level enforcement that propagates automatically. A resource location organization policy at the root keeps data in approved European regions, and a Shared VPC host project with hierarchical firewall policies and a central inspection project centralizes and logs egress. Together these meet the security requirements while minimizing per-project work.

Cloud DLP (Data Loss Prevention) is the correct service because it is specifically designed to scan, classify, and de-identify sensitive data such as PII. It can inspect data in Cloud Storage and apply de-identification transformations like masking, tokenization, or redaction before loading into BigQuery. This is a core use case for Cloud DLP.

The most likely cause is that no firewall rule allows ingress traffic to the instance. By default, GCP instances are created with a VPC network that has implied deny-all ingress rules, and unless a specific firewall rule (e.g., allowing tcp:22 for SSH or tcp:80 for HTTP) is applied to the instance's network tags or service account, all inbound traffic from the internet is blocked. The Terraform configuration shown in the exhibit likely omitted a `google_compute_firewall` resource or did not assign the necessary network tags to the instance.

Cloud Bigtable is Google's petabyte-scale, low-latency NoSQL wide-column store, purpose-built for time-series and IoT workloads with single-digit millisecond latency at millions of reads/writes per second. Its row-key design supports efficient range scans by timestamp, and it scales horizontally by adding nodes, making it the best fit for high-throughput sensor data with simple key-value access.

Two independent constraints must be satisfied: Google APIs stay reachable while workloads have no public addresses, and on-premises traffic stays off the internet. Private Google Access on the subnet handles the first by routing API traffic internally, and a Cloud VPN or Interconnect link with Cloud Router BGP handles the second by providing private connectivity to the fraud-detection system. Cloud NAT, external IPs, and proxy VMs all push traffic onto the public internet.

Cloud Functions is the correct choice because it is a fully managed, event-driven serverless compute service that natively triggers on Cloud Storage bucket events (e.g., object finalize/create). It automatically scales from zero to thousands of concurrent invocations within seconds, meeting the burst requirement, and has a maximum timeout of 9 minutes (well above the 'few seconds' requirement).

Binary Authorization is a Google Cloud service that enforces deploy-time policies by requiring attestations. By integrating with Container Analysis, you can automatically attest only images that pass vulnerability scanning, and the policy blocks images without attestations. This automates enforcement and reduces manual review, satisfying both security and operational efficiency.

Dedicated Cloud Interconnect provides direct physical connections between on-premises and Google's network with speeds up to 100 Gbps per link. It offers high availability and low latency. HA VPN is over the public internet, Partner Interconnect depends on a partner, and Classic VPN is older.

Establishing a secure network connection and using Database Migration Service for continuous replication are critical for a low-downtime migration. The network connection enables data transfer, and Database Migration Service keeps the target in sync until cutover. These steps ensure minimal downtime and data consistency, unlike manual export/import or unrelated scaling measures.

Cloud Armor is the correct choice because it provides IP-based access control at the edge of Google's network, integrated directly with the Global HTTPS Load Balancer. It allows you to create security policies with IP allow/deny rules that are evaluated before traffic reaches your Compute Engine instances, making it the appropriate service for client IP restriction at the load balancer level.

Cloud CDN is the correct service because it caches HTTP(S) load balancer content at Google's globally distributed edge points of presence, reducing latency for static assets without any application code changes. It integrates directly with the Global HTTPS Load Balancer, so enabling it requires only a checkbox or gcloud command on the backend service. This satisfies the requirement to cache content closer to users while keeping the existing architecture intact.

Using a mixed instance group with both preemptible and regular VMs allows the batch processing job to continue on regular VMs when preemptible VMs are terminated during peak hours. This balances cost and reliability: preemptible VMs handle most of the workload at low cost, while regular VMs act as a fallback to ensure job completion without the full expense of switching entirely to regular VMs.

Cross-project IAM access in Google Cloud is granted by adding the service account's email as a principal (member) on the target project and binding it to the required roles. IAM is global and project-scoped, so the pipeline's service account in Project A can be granted roles/editor or specific deploy roles in Project B without any network-level configuration. This is the canonical, least-privilege approach for CI/CD cross-project deployments.

VPC Service Controls is the correct choice because it creates a security perimeter around Google Cloud resources, such as BigQuery or Cloud Storage, and prevents data exfiltration by blocking access from outside the perimeter or to external IP addresses. It enforces context-aware access policies that can deny egress traffic to non-permitted destinations, directly addressing the requirement to restrict copying data to external IPs.

Customer-Supplied Encryption Keys (CSEK) allow you to provide your own AES-256 key with each Cloud Storage request; Google Cloud uses the key to encrypt/decrypt data but does not store the key. This matches the requirement of a self-generated, self-managed key not stored in Google Cloud. CMEK, by contrast, stores the key in Cloud KMS.

Encrypting data in transit using TLS is a mandatory security control for HIPAA compliance because it protects electronic protected health information (ePHI) from interception during transmission over networks. TLS 1.2 or higher ensures that data moving between clients, services, and Google Cloud endpoints is encrypted, meeting the HIPAA Security Rule requirement for integrity and confidentiality of ePHI in transit.

Object Lifecycle Management in Cloud Storage is designed exactly for this use case: automatically transitioning objects to lower-cost storage classes based on age or other conditions. Configuring a lifecycle rule to transition objects older than 90 days to the Archive class (A) reduces cost while preserving durability and access when needed. Lifecycle policies run asynchronously and are the standard, supported mechanism for automated class transitions.

roles/logging.privateLogViewer grants read access to private logs, which includes Data Access audit logs, and is the least-privilege role designed for viewing sensitive audit data. Data Access logs are classified as private logs in Cloud Logging, so the security team needs a role that explicitly includes logging.privateLogs.view permission. This satisfies the FedRAMP requirement that only authorized personnel can view data access audit logs.

Rehosting (lift-and-shift) the monolithic application to Compute Engine with Cloud SQL for MySQL minimizes code changes while improving scalability and reliability. Cloud SQL provides managed MySQL with automated backups, replication, and failover, addressing the need for reliability without requiring application refactoring.

BigQuery column-level security with Data Catalog policy tags enforces per-column access in the query engine. Sensitive columns are tagged, and only principals granted the Fine-Grained Reader role on that tag can read raw values. Analysts without the role receive masked or denied results, and engineers with the role see clear text, with no application changes needed.

The Organization Policy constraint `constraints/compute.restrictDiskEncryptionKeyTypes` allows administrators to enforce that all Compute Engine VMs must use specific disk encryption key types (e.g., CMEK or CSEK). This policy is evaluated at resource creation time and blocks any VM that does not comply with the allowed key types, providing a preventive control rather than a reactive one.

A regional Cloud SQL instance with automatic failover uses a primary and a standby zone within the same region, with synchronous replication between them. If the primary zone fails, Cloud SQL automatically promotes the standby to primary, ensuring high availability without data loss. This configuration meets the requirement for automatic failover during a zonal failure.

VPC Service Controls lets you define a service perimeter around GCP resources (such as Cloud Storage, BigQuery, and APIs) and restrict access so that requests must originate from within an authorized network — including a specific Cloud VPN tunnel or VPC network. By configuring an access level based on the VPN tunnel's source IP range or network, you can enforce that API calls to protected services from outside the corporate network are denied unless they traverse the specified VPN.

Database Migration Service (DMS) supports continuous replication from on-premises PostgreSQL to Cloud SQL using native PostgreSQL logical replication (pglogical or native publication/slot). This allows near-zero downtime by keeping the target in sync until promotion, which is ideal for a 1 TB database over a 500 Mbps link where a full dump/restore would take hours.

VPC Service Controls provide a centralized, organization-level security perimeter that prevents access to Cloud Storage from outside authorized networks, even if IAM policies are misconfigured. By defining access levels based on corporate IP ranges, the organization can ensure that only requests from the corporate network are allowed. This is the most effective and least administrative approach compared to per-binding IAM Conditions or bucket-level constraints.

The requirement is one logical anycast endpoint that terminates arbitrary TCP and picks the nearest healthy region. A global external proxy Network Load Balancer does exactly that, with SSL or TCP proxy target proxies and health-checked regional backends. Application Load Balancers are HTTP(S)-only, DNS geolocation needs per-region records, and Interconnect plus an internal passthrough load balancer cannot accept public device traffic.

To scale based on custom metrics in GKE, the metrics must be exported to Cloud Monitoring, and then the Horizontal Pod Autoscaler can be configured to use those metrics. This approach leverages managed GKE features, minimizing operational overhead. Cluster Autoscaler and VPA address different scaling dimensions and are not required for custom metric scaling.

Immutability for a fixed period is delivered by a bucket retention policy, and locking the bucket makes that policy irreversible so no principal can shorten it or delete protected objects early. Seven years expressed as a retention duration plus restricted write access satisfies the legal hold while still permitting new masters to be uploaded to the bucket.

A Cloud Storage trigger is specifically designed to invoke a Cloud Function in response to object events in a Cloud Storage bucket, such as object creation (google.storage.object.finalize). This is the direct and native trigger type for 'new object created in a bucket' scenarios. It eliminates the need for additional event routing or polling.

A single global anycast IP, edge TLS termination, and URL path routing to backends in three regions all point to the global external Application Load Balancer. Its layer 7 proxy architecture inspects HTTP requests and uses URL maps to direct traffic, while the Google front end absorbs TLS and distributes requests across regional managed instance groups without requiring a separate IP per region.

Cloud Run scales to zero and then out automatically, which matches unpredictable promotional spikes while keeping idle cost near zero. Cloud Spanner provides a managed relational store that scales reads and writes horizontally with automatic replication, so the team never manages replicas or failover. Together they cover the compute and data tiers without the operational overhead of self-managed alternatives.

The correct command to list Compute Engine instances is 'gcloud compute instances list'. The other options are incorrect: 'gcloud compute machine-types list' lists machine types, 'gcloud compute instance-groups list' lists instance groups, and 'gcloud compute instances describe' describes a specific instance.

Cloud Build is the correct service because it provides build triggers that can be configured to automatically build container images from source repositories like GitHub. When a push to the main branch occurs, Cloud Build can execute a build using a Dockerfile or buildpack, and then push the resulting image to Artifact Registry. This directly addresses the requirement to automate image building and storage.

Database Migration Service (DMS) supports online migration from Oracle to Cloud SQL for PostgreSQL with minimal downtime by using continuous replication. Cloud SQL Auth Proxy is a tool for secure client connections to Cloud SQL instances; it is not required for the migration process itself. Cloud Dataflow is for data processing, Cloud Scheduler for job scheduling, and Migrate for Compute Engine for VM migration.

The latency spikes correlate with CPU throttling, and increasing the CPU request to 2 CPUs ensures that each backend pod receives a guaranteed CPU share, reducing throttling under load. Since the backend is CPU-bound and node utilization is 70%, the current 1 CPU request may be insufficient, causing the Kubernetes CPU manager to throttle the pods when the node's CPU is contended. This directly addresses the root cause without adding unnecessary replicas or memory.

Preemptible VMs are the most cost-effective for interruptible batch ML training jobs because they offer up to 80% discount compared to standard VMs. They can be terminated at any time by Compute Engine, but since the jobs can be interrupted, this is acceptable. Other pricing models like sustained use discounts apply automatically to standard VMs but offer smaller discounts, and committed use discounts require a 1- or 3-year commitment, which may not be suitable for temporary or variable workloads.

Global external Application Load Balancers route HTTP traffic to the nearest healthy backend across regions and support serverless NEGs for Cloud Run, while multi-region Cloud Spanner provides strongly consistent, automatically replicated data with regional failover. Together they meet the global latency, regional resilience, and low-overhead goals. Regional load balancers, proxy network load balancers, and DNS-based routing each fall short on at least one requirement.

Cloud Spanner with a multi-region configuration is the correct choice because it provides strong global consistency, low-latency reads and writes across regions, and automatic horizontal scaling to handle a 10x growth in workload. Its multi-region replication ensures synchronous replication for disaster recovery while maintaining ACID transactions, which is critical for a database requiring consistent low-latency access.

OS Config (now part of VM Manager) provides patch management for Compute Engine instances, including Windows Server, with the ability to schedule patch jobs, define patch windows, and report compliance through the OS Config API and Cloud Console. It is the native Google Cloud service designed for OS patch deployment and compliance reporting across fleets of VMs.

The two goals are preventing analysts from reading identifiers and logging all access to raw records. De-identifying or tokenizing identifiers before the analytics layer sees them meets the first goal, and enabling Data Access audit logs on the services holding raw records meets the second. Broad viewer grants, generic storage protections, and encryption alone do not de-identify data or provide the necessary read-level audit trail.

A Cloud Storage retention policy enforces a minimum age before objects can be deleted or overwritten, and locking the bucket makes that policy permanent and irreversible. Locking removes the ability of any principal, including project owners, to delete the policy or shorten the retention period, which is exactly the immutability regulators require for the seven-year window.

Repeatable deployments across environments require a declarative, versioned definition of infrastructure. Terraform with per-environment variable files lets one set of modules produce consistent resources in development, staging, and production, while version control records changes and enables review and rollback. This prevents configuration drift far more effectively than manual changes or post-hoc detection.

Active Assist is a suite of tools that provides automated recommendations for cost, security, and performance. It analyzes resource usage and suggests optimizations such as right-sizing or deleting idle resources. This directly supports the goal of implementing a process for cost optimization recommendations.

Cloud IAM Conditions allow you to define and enforce attribute-based, context-aware access control policies on Google Cloud resources. By specifying conditions such as time, resource type, or IP address in IAM policies, you can grant temporary or scoped permissions, ensuring users have only the access necessary for their specific task. This directly supports least-privilege by reducing standing privileges and preventing over-permissioning.

Folders sit between the organization and projects and let administrators apply IAM and organization policies that projects inherit, giving each environment a consistent administrative boundary. Each project supplies its own quotas, APIs, and resource namespace, so experiments stay isolated. Because everything remains inside one organization and billing account, environments can be spun up or torn down quickly without touching billing or identity setup.

PgBouncer is a lightweight connection pooler that sits between the application and Cloud SQL, maintaining a pool of persistent connections and multiplexing many client connections onto a smaller number of database connections. This reduces connection overhead and prevents exhausting the max_connections limit without requiring application code changes. Cloud SQL Auth Proxy is for secure authentication, not pooling, and increasing max_connections only postpones the problem.

Cloud Pub/Sub provides scalable, asynchronous ingestion for unpredictable IoT data spikes, Cloud Dataflow enables stream processing for near real-time aggregations with sub-second latency, and Cloud Bigtable offers low-latency, high-throughput storage ideal for serving aggregated results directly to a dashboard. This combination meets the requirements of unpredictable volume, real-time processing, and low-latency queries.

Terraform is the industry-standard declarative infrastructure as code tool that supports version control and provides a plan phase to preview changes. The Google Cloud provider enables management of all relevant resources, ensuring repeatability and safety.

Ultra-low latency between tightly coupled components depends on physical proximity and adequate network throughput. Compact placement policies schedule instances close together on the same rack, reducing switch hops and jitter, while the higher total egress bandwidth tier removes the default throughput cap that would otherwise throttle a heavy small-message workload. Keeping all components in a single zone avoids inter-zone round trips entirely, which is essential for the stated sub-millisecond requirement.

A regional Cloud SQL instance with high availability provisions a standby in a different zone within the same region and performs automatic failover via a regional persistent disk, with synchronous replication ensuring zero data loss (RPO ≈ 0). This is the only option that combines automatic failover with no data loss for a single-region production database.

Cloud Storage with a multi-region bucket provides durable, highly available storage, and Cloud CDN caches content globally to reduce latency. This is the simplest and most cost-effective solution for static web content. The other options involve unnecessary compute resources or management overhead.

Velero is the standard open-source tool for backing up and restoring Kubernetes cluster resources and persistent volumes. It can snapshot Compute Engine persistent disks and also back up Kubernetes objects like deployments and services, which matches the requirement to protect both application data and resource configurations.

The pipeline needs durable stream ingestion, managed stream processing with enrichment, and a warehouse for analyst SQL. Pub/Sub absorbs bursts and decouples producers, Dataflow handles autoscaling stream transforms and joins, and BigQuery stores and queries the results. Alternatives either require cluster management, cannot run analytics at scale, or use services not intended for continuous streaming.

The requirement is a preventive, hierarchy-wide guardrail against overly broad IAM grants. Custom organization policy constraints on the IAM allow policy resource can inspect both the binding's scope and the principal, so a rule that denies organization- and folder-level grants except for a designated break-glass group enforces least privilege automatically for existing and new projects. Domain-based and condition-based approaches either do not address scope breadth or rely on per-binding correctness, so they would not have prevented the audit finding.

Cloud Spanner multi-region configurations use a leader replica in one region and read-only replicas in others. Writes must go through the leader (Paxos quorum), so if the region hosting the leader fails, writes are unavailable until a new leader is elected — typically within seconds to minutes depending on the config. Reads, however, can be served from any healthy replica (strong or stale reads), so read availability is preserved as long as at least one replica region survives.

The Ops Agent provides automatic host metrics and log collection for Compute Engine, and log-based metrics let those logs be charted and alerted in Cloud Monitoring. Together they deliver the telemetry to detect performance regressions and correlate them with deployments without touching application code. Tracing, profiling, and audit logs either require code changes or capture different data than runtime performance.

Cloud Spanner is a globally distributed, strongly consistent relational database that supports SQL and can scale to millions of writes per second. Cloud SQL is regional, Bigtable is NoSQL and not relational, BigQuery is an analytics warehouse.