Knowledge + Practice

Google Professional Cloud Architect (PCA) — Questions 451–525

955 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 7 of 13

451

MCQmedium

A company needs to ensure that only applications running in a specific GKE namespace can access a Cloud Storage bucket. Which approach should they use?

A.Use Workload Identity to bind the Kubernetes service account to a GCP service account with appropriate IAM roles

B.Use VPC Service Controls to restrict the bucket to only the GKE cluster's VPC

C.Use firewall rules to allow traffic only from the GKE cluster's pod CIDR

D.Use Cloud Armor to restrict access based on source IP

AnswerA

Workload Identity allows mapping a KSA to a GSA, enabling fine-grained access control based on namespace.

Why this answer

Workload Identity allows binding a Kubernetes service account to a GCP service account. Then, IAM can be granted to that GCP service account for the Cloud Storage bucket.

Full explanation →

452

MCQeasy

A company has a Cloud Run service that processes images uploaded by users. The service reads the images from a Cloud Storage bucket and writes processed images to another bucket. The team recently updated the service to use a custom service account named 'image-processor-sa' with minimal permissions. After the update, the service fails with permission errors when trying to read from the source bucket. The team verified that the service account has the Storage Object Viewer role on the source bucket and Storage Object Creator role on the destination bucket. What should the architect do to resolve the issue?

A.Ensure the Cloud Run service uses the correct service account by redeploying with the --service-account flag set to 'image-processor-sa@project-id.iam.gserviceaccount.com'.

B.Grant the service account the Cloud Run Invoker role on the Cloud Run service.

C.Assign the Storage Admin role to the service account.

D.Enable the Cloud Storage API for the project.

AnswerA

Correct: This ensures the Cloud Run service uses the custom service account with appropriate permissions.

Why this answer

The error occurs because the Cloud Run service is not using the custom service account 'image-processor-sa' despite it being created and granted permissions. By default, Cloud Run uses the Compute Engine default service account unless explicitly overridden. Redeploying with the --service-account flag attaches the correct identity to the Cloud Run revision, allowing it to authenticate with Cloud Storage using the minimal permissions already assigned.

Exam trap

Google Cloud often tests the distinction between granting permissions to a service account versus actually attaching that service account to a resource; candidates mistakenly assume that creating and granting roles to a service account automatically makes it the active identity of the Cloud Run service.

How to eliminate wrong answers

Option B is wrong because the Cloud Run Invoker role grants permission to invoke the service (i.e., call its HTTP endpoint), not to read from Cloud Storage; it does not resolve the missing identity binding. Option C is wrong because assigning Storage Admin is an overly permissive solution that violates the principle of least privilege; the service account already has the necessary Object Viewer and Object Creator roles, so the issue is not about missing permissions but about the service not using the correct account. Option D is wrong because the Cloud Storage API is enabled by default when Cloud Storage is used; the error is not due to a disabled API but due to the service running under the wrong identity.

Full explanation →

453

MCQeasy

A data scientist needs read-only access to a Cloud Storage bucket containing training data. What is the least privileged IAM role to grant at the bucket level?

A.roles/storage.objectAdmin

B.roles/storage.objectCreator

C.roles/storage.admin

D.roles/storage.objectViewer

AnswerD

ObjectViewer grants read-only access to objects.

Why this answer

Roles/storage.objectViewer grants read-only access to objects in a Cloud Storage bucket without allowing any write or administrative actions. This is the least privileged role that satisfies the requirement for read-only access to training data at the bucket level, as it only permits storage.objects.get and storage.objects.list permissions.

Exam trap

The trap here is that candidates often confuse roles/storage.objectViewer with roles/storage.objectAdmin or roles/storage.admin, mistakenly thinking broader roles are needed for read access, or they incorrectly assume roles/storage.objectCreator provides read capabilities.

How to eliminate wrong answers

Option A is wrong because roles/storage.objectAdmin grants full control over objects, including create, delete, and update permissions, which exceeds the read-only requirement. Option B is wrong because roles/storage.objectCreator only allows creating new objects but does not grant read access to existing objects, so it cannot fulfill the read-only need. Option C is wrong because roles/storage.admin provides full administrative control over the bucket, including modifying bucket metadata and IAM policies, which is far more permissive than read-only access.

Full explanation →

454

MCQhard

A company is migrating a monolithic application to microservices on Google Cloud. They need to manage service-to-service authentication and authorization. Which service should they use?

A.Cloud NAT

B.Cloud Identity-Aware Proxy

C.Cloud Endpoints

D.Service Mesh (Anthos)

AnswerD

Anthos Service Mesh provides mTLS, authorization policies, and observability for microservices.

Why this answer

Service Mesh (Anthos) provides a dedicated infrastructure layer for managing service-to-service communication, including mutual TLS (mTLS) authentication, fine-grained authorization policies, and observability. It uses sidecar proxies (Envoy) to intercept traffic and enforce security policies without modifying application code, making it ideal for microservices authentication and authorization.

Exam trap

The trap here is that candidates often confuse Cloud Endpoints (API management for external clients) with the internal service-to-service security needs of microservices, or assume Cloud IAP can be extended to internal traffic, but IAP only works for user-facing HTTP(S) requests and cannot enforce policies between backend services.

How to eliminate wrong answers

Option A is wrong because Cloud NAT is a network address translation service for outbound internet access from private instances, not for service-to-service authentication or authorization. Option B is wrong because Cloud Identity-Aware Proxy (IAP) is designed for user-to-application authentication and access control at the edge, not for internal service-to-service communication within a VPC. Option C is wrong because Cloud Endpoints is an API management service that handles API keys, authentication, and quotas for external-facing APIs, but it does not provide the sidecar-based, fine-grained service-to-service authentication and authorization needed for microservices.

Full explanation →

455

MCQmedium

A team is implementing a canary deployment for a microservice on GKE using traffic splitting. They want to gradually shift 1% of traffic to a new version, monitor for errors, and then increase the percentage. Which tool or configuration should they use?

A.Configure a GKE Ingress with weighted backend services

B.Deploy the new version to a separate namespace and use DNS weighting

C.Use Cloud Deploy with a canary deployment strategy and Istio traffic splitting

D.Use Kubernetes Deployment with rolling update strategy

AnswerC

Cloud Deploy natively supports canary deployments with traffic splitting via Istio or other service mesh.

Why this answer

Cloud Deploy supports canary deployments with traffic splitting via Istio or other service meshes. It allows gradual rollout and automated promotion based on criteria.

Full explanation →

456

MCQmedium

A DevOps team wants to manage Google Cloud resources declaratively using Infrastructure as Code. They need to version control their configuration and automate deployments. Which two tools are natively supported by Google Cloud for this purpose?

A.Cloud Shell and gcloud CLI

B.AWS CloudFormation and Terraform

C.Ansible and Puppet

D.Cloud Deployment Manager and Terraform

AnswerD

Both are natively supported IaC tools on Google Cloud.

Why this answer

Cloud Deployment Manager uses YAML, Python, or Jinja templates, and Terraform is a popular IaC tool with a native Google Cloud provider. Both allow declarative management and version control.

Full explanation →

457

MCQhard

A company uses Cloud SQL for MySQL and wants to achieve a Recovery Time Objective (RTO) of less than 5 minutes and a Recovery Point Objective (RPO) of less than 1 minute for a regional disaster. Which configuration should they use?

A.Use Cloud Spanner with multi-region configuration

B.Use Cloud SQL with point-in-time recovery and automated backups

C.Use Cloud SQL with cross-region replica and failover

D.Enable high availability (regional) with a standby zone

AnswerA

Cloud Spanner provides synchronous replication across regions, achieving RPO of 0 and RTO minutes.

Why this answer

Cloud Spanner with a multi-region configuration is the only option that can meet an RTO of less than 5 minutes and an RPO of less than 1 minute for a regional disaster. Cloud Spanner provides synchronous replication across multiple regions, ensuring that data is consistent with no data loss (RPO near zero) and automatic failover within seconds, achieving the required RTO. Cloud SQL, even with cross-region replicas or high availability, relies on asynchronous replication (for cross-region) or semi-synchronous replication (for regional HA), which cannot guarantee sub-minute RPO or sub-5-minute RTO during a full regional outage.

Exam trap

The trap here is that candidates confuse Cloud SQL's regional HA (which only covers zonal failures) with cross-region disaster recovery, and underestimate the replication lag and manual failover time of Cloud SQL cross-region replicas, assuming they can meet aggressive RTO/RPO targets like those required for a regional disaster.

How to eliminate wrong answers

Option B is wrong because point-in-time recovery and automated backups are designed for data recovery from accidental deletion or corruption, not for regional disaster failover; restoring from backups would take minutes to hours, far exceeding the 5-minute RTO. Option C is wrong because Cloud SQL cross-region replicas use asynchronous replication, which can result in minutes of data loss (RPO > 1 minute) and manual promotion steps that typically take longer than 5 minutes, failing both RTO and RPO. Option D is wrong because high availability with a standby zone only protects against zonal failures within the same region, not a regional disaster; a regional outage would affect both zones, making this configuration ineffective.

Full explanation →

458

Multi-Selectmedium

A company is migrating a monolithic application to a microservices architecture on GCP. They want to use an event-driven approach to decouple services and ensure reliable message delivery. Which TWO services should they use for inter-service communication? (Choose TWO.)

Select 2 answers

A.Cloud Scheduler

B.Cloud Functions

C.Cloud Tasks

D.Eventarc

E.Cloud Pub/Sub

AnswersD, E

Eventarc simplifies event ingestion and routing to services like Cloud Run.

Why this answer

Pub/Sub is a fully managed messaging service for asynchronous event-driven communication between services. Eventarc allows routing events from various sources to services like Cloud Run, enabling event-driven architecture.

Full explanation →

459

MCQmedium

Your company runs a customer-facing API on Cloud Run with a concurrency setting of 80. The API calls a backend Cloud Function that performs a heavy computation (2–5 seconds). During peak hours, the API experiences increased latency and some requests time out after 60 seconds. Monitoring shows that the Cloud Run max instances is set to 100, and the Cloud Function max instances is set to 10. The timeout for Cloud Run is set to 300 seconds. The Cloud Function's timeout is set to 540 seconds. You need to reduce end-to-end latency and prevent timeouts while minimizing cost. Which action is most effective?

A.Increase Cloud Run max instances from 100 to 500

B.Increase Cloud Run request timeout from 300 to 600 seconds

C.Increase Cloud Function max instances from 10 to 100

D.Reduce Cloud Run concurrency from 80 to 10

AnswerC

Correct: removes backend capacity bottleneck.

Why this answer

The bottleneck is the Cloud Function's low max instances (10), causing queuing. Increasing Cloud Function max instances allows more concurrent requests to be processed, reducing latency and timeouts. Option A is wrong because concurrency on Cloud Run is separate from backend; reducing concurrency would require more Cloud Run containers and increase cost.

Option B is wrong because increasing Cloud Run max instances alone doesn't help if Cloud Function capacity is the limit. Option D is wrong because increasing Cloud Run timeout doesn't reduce latency; it just keeps the connection alive longer.

Full explanation →

460

MCQhard

A financial services company must store customer data in a GCP region that is certified for FedRAMP High. They also need to ensure that only authorized personnel can access the data, and that access logs are kept for 10 years. Which combination of services meets these requirements?

A.Cloud HSM and Cloud Audit Logs

B.VPC Service Controls with Cloud DLP

C.Cloud KMS with CMEK and Cloud Audit Logs

D.Assured Workloads with Cloud Audit Logs and IAM

AnswerD

Assured Workloads provides the required compliance boundaries, Cloud Audit Logs retain logs for 10 years, and IAM controls access.

Why this answer

Assured Workloads provides a FedRAMP High environment with specific regions. Cloud Audit Logs can be configured for extended retention. IAM controls access.

CMEK is not required for compliance in this case. DLP is for data classification, not access control.

Full explanation →

461

Multi-Selectmedium

A company is migrating a legacy monolithic application to Google Cloud. They want to adopt microservices and improve deployment frequency. Which THREE practices should they adopt? (Choose 3.)

Select 3 answers

A.Use Infrastructure as Code (IaC) with Terraform.

B.Build a single deployment pipeline for all services.

C.Implement blue/green deployments.

D.Use canary releases with traffic splitting.

E.Apply immutable infrastructure principles.

AnswersA, D, E

IaC enables rapid provisioning of environments, increasing deployment frequency.

Why this answer

Infrastructure as Code (IaC) with Terraform enables declarative, version-controlled provisioning of cloud resources. This supports the microservices migration by allowing teams to spin up consistent, repeatable environments for each service, which is essential for increasing deployment frequency without manual configuration errors.

Exam trap

The trap here is that candidates often confuse 'blue/green deployments' with 'canary releases' and assume both are equally valid, but the question specifically asks for three practices that improve deployment frequency, and canary releases with traffic splitting directly enable faster, safer rollouts, whereas blue/green is a broader strategy that may not inherently increase frequency.

Full explanation →

462

MCQmedium

A company is deploying a new application on Compute Engine and wants to automate the installation of a custom agent on every newly created VM in a specific project. Which Google Cloud service should they use?

A.VM Manager (OS Config) with a guest policy to install the agent.

B.Instance templates with startup scripts.

C.Deployment Manager with a template that includes the agent installation.

D.Cloud Build triggered on new VM creation events.

AnswerA

Os Config can enforce agent installation on all VMs in a project.

Why this answer

VM Manager (OS Config) with a guest policy is the correct choice because it provides a native, agent-based configuration management service that can enforce the installation of a custom agent on all existing and newly created VMs in a project without requiring changes to instance templates or startup scripts. Guest policies are evaluated and applied at VM boot time and periodically thereafter, ensuring consistent agent deployment across the fleet.

Exam trap

The trap here is that candidates often confuse configuration management (OS Config guest policies) with provisioning-time automation (startup scripts in instance templates), assuming that startup scripts are sufficient for fleet-wide enforcement when they only apply at creation time and are not re-evaluated.

How to eliminate wrong answers

Option B is wrong because instance templates with startup scripts only apply to VMs created from that specific template; they do not automatically cover VMs created from other templates, images, or via other methods, and they do not enforce the agent on existing VMs. Option C is wrong because Deployment Manager is an infrastructure-as-code tool for deploying resources, not a configuration management service; it cannot automatically apply agent installation to VMs created outside its deployment scope. Option D is wrong because Cloud Build is a CI/CD service for building and testing artifacts, and it cannot be triggered directly by new VM creation events; there is no native event trigger for Compute Engine VM creation in Cloud Build.

Full explanation →

463

MCQhard

A company runs a critical application on Compute Engine with a stateful workload. They want to achieve 99.99% availability within a single region. Which architecture should they recommend?

A.Two instances in different zones with a zonal persistent disk each and data replication using a custom script

B.One instance in a single zone with a persistent disk snapshot every hour

C.Two instances in different zones with a regional persistent disk attached to the active instance and failover using a load balancer

D.Four instances across two zones with a regional persistent disk and active-passive failover using a health check

AnswerC

Regional disk replicates data synchronously across zones; load balancer provides automated failover.

Why this answer

It uses a regional persistent disk, which synchronously replicates data across two zones within the same region, ensuring data durability and availability. The active instance in one zone attaches the disk, and a load balancer with health checks detects failures and redirects traffic to the standby instance in the other zone, enabling automatic failover to meet the 99.99% availability target.

Exam trap

Google Cloud often tests the misconception that more instances or zones automatically increase availability, but the key is the data replication mechanism—regional persistent disks provide synchronous replication, while zonal disks with custom scripts or snapshots introduce data loss or latency that fails the 99.99% SLA.

How to eliminate wrong answers

Option A is wrong because zonal persistent disks are tied to a single zone and cannot be attached to instances in another zone; a custom script for data replication introduces latency and potential data loss, failing to meet the synchronous replication needed for 99.99% availability. Option B is wrong because a single instance with hourly snapshots provides no automatic failover and can result in up to an hour of data loss, which is insufficient for 99.99% availability (which allows only ~52.56 minutes of downtime per year). Option D is wrong because four instances across two zones with a regional persistent disk is over-provisioned and unnecessarily complex; the active-passive failover using a health check can be achieved with just two instances, and adding more instances does not improve availability beyond what the regional disk and load balancer already provide.

Full explanation →

464

MCQeasy

A company is deploying a web application on Compute Engine. They want to ensure that only authenticated users can access the application. Which Google Cloud service should they use?

A.Identity-Aware Proxy

B.Cloud Load Balancing

C.Cloud CDN

D.Cloud DNS

AnswerA

IAP uses identity and context to enforce access control.

Why this answer

Identity-Aware Proxy (IAP) is the correct choice because it enforces access control at the edge of Google's network, verifying user identity and context before allowing traffic to reach the Compute Engine instance. IAP uses OAuth 2.0 and signed headers to authenticate users, ensuring only authorized requests are forwarded to the backend, without requiring any changes to the application itself.

Exam trap

The trap here is that candidates often confuse network-level services like Cloud Load Balancing or Cloud CDN with security controls, assuming they provide authentication simply because they sit in front of the application, but they lack any identity verification mechanism.

How to eliminate wrong answers

Option B (Cloud Load Balancing) is wrong because it distributes traffic across instances but does not authenticate users; it operates at Layer 4 or Layer 7 without any built-in identity verification. Option C (Cloud CDN) is wrong because it caches content at edge locations to reduce latency, but it does not enforce user authentication; it can be combined with IAP but alone provides no access control. Option D (Cloud DNS) is wrong because it translates domain names to IP addresses and has no mechanism for user authentication or authorization.

Full explanation →

465

MCQhard

An application running on GKE Autopilot is experiencing intermittent failures due to resource limits. The team wants to ensure that the application always has enough CPU and memory without manual node management. What should they do?

A.Use horizontal pod autoscaling only

B.Increase the resource requests and limits in the pod specification

C.Create a new node pool with larger machine types

D.Switch to GKE Standard and manage node pools manually

AnswerB

Autopilot uses pod resource requests to automatically provision nodes. Increasing requests ensures more resources are allocated.

Why this answer

GKE Autopilot manages nodes automatically. To ensure resources, they should adjust the resource requests and limits in the pod spec. GKE Autopilot automatically scales nodes based on pod resource requests.

They do not need to manage node pools. Increasing machine type is not possible directly in Autopilot.

Full explanation →

466

MCQeasy

Which Google Cloud service allows you to create alerting policies based on log entries?

A.Cloud Logging

B.Cloud Audit Logs

C.Error Reporting

D.Cloud Monitoring

AnswerD

Cloud Monitoring is the centralized service for monitoring, alerting, and dashboards. Alerting policies, including those that use log-based metrics as a condition, are defined and managed in Cloud Monitoring. This is the correct answer.

Why this answer

Cloud Monitoring is the service that manages alerting policies, including those triggered by log-based metrics. While Cloud Logging provides the interface to create log-based metrics from log entries, the alerting policy itself is created and managed in Cloud Monitoring. Therefore, the correct service for creating alerting policies based on log entries is Cloud Monitoring.

Full explanation →

467

MCQmedium

A company wants to perform load testing on a new microservice deployed on GKE. They need to simulate thousands of concurrent users with realistic traffic patterns. They also want to monitor latency and error rates during the test. Which Google Cloud tool should they use?

A.Locust

B.Cloud Load Testing

C.Cloud Deploy

D.Cloud Shell

AnswerB

Cloud Load Testing is a managed service for load testing with distributed agents and monitoring integration.

Why this answer

Cloud Load Testing (formerly known as Cloud Load Testing) is a managed service for creating load tests with distributed agents. It can simulate thousands of users and integrates with Cloud Monitoring. Locust is an open-source tool but not managed by GCP.

Cloud Deploy is for continuous delivery. Cloud Shell is a command-line environment.

Full explanation →

468

MCQeasy

A company has a Cloud SQL for PostgreSQL instance that experiences high connection overhead. Developers frequently open and close connections. Which solution reduces connection overhead without code changes?

A.Increase max_connections in Cloud SQL

B.Configure PgBouncer as a sidecar

C.Switch to Private IP

D.Use Cloud SQL Auth Proxy

AnswerB

PgBouncer is a lightweight connection pooler that reduces overhead by reusing connections.

Why this answer

Cloud SQL Auth Proxy provides secure connections but does not pool. PgBouncer is a connection pooler for PostgreSQL; it maintains a pool of connections and reuses them. Increasing max_connections doesn't reduce overhead.

Using private IP alone doesn't pool.

Full explanation →

469

MCQhard

A company has a VPC Service Perimeter that protects a project containing BigQuery datasets. They want to allow an external customer's BigQuery job to query data across the perimeter boundary using a private connection. Which configuration is required?

A.Remove the project from the service perimeter temporarily.

B.Create an ingress rule in the service perimeter that allows access from the external customer's VPC network.

C.Use Access Transparency to log cross-perimeter access.

D.Grant the external customer's service account the BigQuery User role.

AnswerB

Ingress rules allow traffic from specified sources into the perimeter.

Why this answer

To allow access from outside the perimeter, you can use VPC Service Controls with ingress rules. Additionally, the external customer must use a private connection, such as Cloud VPN or Dedicated Interconnect, to access the perimeter. The ingress rule specifies the source and resources.

Full explanation →

470

MCQmedium

A developer wants to store a database password securely and have it automatically rotated every 30 days. The password is used by a Compute Engine instance. Which Google Cloud service should they use?

A.Secret Manager

B.Cloud Storage with customer-supplied encryption keys

C.Cloud Key Management Service (Cloud KMS)

D.Environment variables in Compute Engine

AnswerA

Secret Manager stores secrets and supports automatic rotation.

Why this answer

Secret Manager can store secrets and has built-in rotation capabilities. You can set a rotation period and a rotation function (e.g., Cloud Function) to generate a new password. This is the recommended service.

Full explanation →

471

MCQeasy

An engineer needs to create a custom dashboard in Cloud Monitoring to track the 99th percentile latency of their application over the last 7 days. Which type of metric should they use?

A.Distribution metric

B.Delta metric

C.Cumulative metric

D.Gauge metric

AnswerA

Distribution metrics track a statistical distribution of values and can compute percentiles like 99th.

Why this answer

Cloud Monitoring supports metric types: gauge, delta, and cumulative. Distribution metrics can be used to calculate percentiles. The 99th percentile latency is typically captured as a distribution metric.

Full explanation →

472

MCQhard

A financial services company runs a critical PostgreSQL database on Cloud SQL. They need to ensure automatic failover to a replica in another zone within the same region with minimal data loss. What configuration should they choose?

A.Use Database Migration Service to replicate to a second Cloud SQL instance

B.Enable point-in-time recovery (PITR) and increase backup retention

C.Create a cross-region read replica and manually promote it on failure

D.Configure a Cloud SQL HA instance with a failover replica in a different zone

AnswerD

HA configuration provides automatic failover with a synchronous standby replica in a different zone, minimizing data loss.

Why this answer

Cloud SQL for PostgreSQL offers a High Availability (HA) configuration that provisions a standby instance in a different zone within the same region. Automatic failover is provided with synchronous replication to minimize data loss.

Full explanation →

473

MCQeasy

When creating a Compute Engine instance from a custom image stored in another project, which gcloud flag is required?

A.--image-project

B.--source-instance

C.--image

D.--image-family

AnswerA

Correct. The `--image-project` flag is required to specify the project ID that contains the custom image, enabling cross-project image usage.

Why this answer

When creating a Compute Engine instance from a custom image stored in another project, the `--image-project` flag is required to specify the project that contains the image. Without this flag, gcloud defaults to the current project and will not find the image. The `--image` flag is also required to specify the image name, but the question specifically highlights the cross-project situation, making `--image-project` the distinctive required flag.

Exam trap

Candidates often think that `--image` is sufficient, but when using an image from another project, `--image-project` is mandatory; otherwise the instance creation will fail.

How to eliminate wrong answers

Option A is wrong because `--image-project` is not required when using a custom image from another project; it is only needed when specifying a public image from a different project (e.g., `--image-project debian-cloud`). Option B is wrong because `--source-instance` is used to create an image from an existing instance, not to specify an image when creating a new instance. Option D is wrong because `--image-family` is used to select the latest non-deprecated image from a family (e.g., `ubuntu-2204-lts`), not to reference a specific custom image by name.

Full explanation →

474

MCQmedium

A company wants to use BigQuery with a predictable monthly cost, regardless of query volume. They have a steady state of around 500 concurrent slots. Which pricing model should they choose?

A.Sustained use discounts

B.Committed use discounts for BigQuery

C.Slot reservations (flat-rate)

D.On-demand pricing

AnswerC

Reservations provide fixed cost based on number of slots, predictable for steady workloads.

Why this answer

BigQuery slot reservations (flat-rate) provide a fixed monthly cost based on reserved slots, suitable for predictable workloads. On-demand pricing charges per query and can vary.

Full explanation →

475

MCQeasy

A company wants to automate the creation and management of Google Cloud resources using an infrastructure-as-code tool that supports configuration drift detection and is Google Cloud-native. Which tool should they use?

A.Cloud Deployment Manager

B.Terraform

C.Cloud SDK

D.Cloud Build

AnswerA

Cloud Deployment Manager is the native IaC tool for Google Cloud.

Why this answer

Cloud Deployment Manager is Google Cloud's native infrastructure-as-code service that supports YAML, Python, and Jinja templates and can detect configuration drift.

Full explanation →

476

MCQhard

Your company runs a data pipeline on Google Cloud using Cloud Dataflow for streaming processing from Pub/Sub to BigQuery. The pipeline writes to a BigQuery table partitioned by day. The data is used for real-time dashboards. Recently, a spike in traffic caused the Dataflow pipeline to fall behind, and the dashboard displayed stale data. You need to design the pipeline to handle traffic spikes without data loss or long delays. The pipeline must be cost-efficient and use defaults where possible. Which solution should you implement?

A.Enable autoscaling in the Dataflow pipeline and use Streaming Engine to handle larger throughput

B.Modify the pipeline to use a batch (non-streaming) approach, writing hourly batches from Pub/Sub to BigQuery

C.Create a Cloud Scheduler job that increases the number of Dataflow workers every 5 minutes based on Pub/Sub subscription backlog

D.Change the Dataflow worker machine type from n1-standard-4 to n1-highmem-8

AnswerA

Correct: autoscaling dynamically adjusts workers; Streaming Engine reduces checkpoint overhead.

Why this answer

Enabling autoscaling in Dataflow allows the pipeline to dynamically adjust the number of workers based on the processing backlog, while Streaming Engine offloads the shuffle and state storage to Google-managed resources, reducing the impact of traffic spikes. This combination ensures the pipeline can scale up quickly to handle increased throughput without data loss or long delays, and it remains cost-efficient by scaling down when demand decreases.

Exam trap

Google Cloud often tests the misconception that manual scaling (Option C) or static resource changes (Option D) are sufficient for handling spikes, when in fact Dataflow's built-in autoscaling and Streaming Engine are the designed, cost-efficient solutions for dynamic workloads.

How to eliminate wrong answers

Option B is wrong because switching to a batch approach introduces inherent latency (hourly batches) that would make the real-time dashboard stale, violating the requirement for minimal delays; it also does not handle spikes within the batch window. Option C is wrong because using Cloud Scheduler to manually adjust worker count every 5 minutes is reactive, not adaptive, and cannot respond quickly enough to sudden spikes; Dataflow's native autoscaling is designed to adjust more granularly and efficiently. Option D is wrong because simply changing the worker machine type to a larger instance (n1-highmem-8) does not address the need for dynamic scaling; it increases cost without guaranteeing sufficient capacity during spikes and does not leverage Dataflow's autoscaling capabilities.

Full explanation →

477

MCQmedium

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

A.Cloud Spanner

B.BigQuery

C.Firestore

D.Cloud Bigtable

AnswerD

Bigtable is the correct choice: wide-column NoSQL, designed for time-series and IoT workloads, single-digit ms latency, and scales to millions of QPS with additional nodes.

Why this answer

Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

Full explanation →

478

MCQhard

A financial services company runs a stateful backend service on Google Kubernetes Engine (GKE) using StatefulSets with Persistent Volumes. They observe that after a node failure, the pod is rescheduled on a different node but the Persistent Volume cannot be attached because it is still "released" and not "available". What is the most likely cause and solution?

A.The PersistentVolume has retain policy "Retain"; manually delete and recreate the volume.

B.The PersistentVolume has reclaim policy "Recycle"; it is not supported in GKE.

C.The PersistentVolumeClaim was not created with the correct storage class; recreate with reclaim policy "Delete".

D.The PersistentVolumeClaim's access mode is ReadWriteOnce, which prevents attachment to a new node; change to ReadWriteMany.

E.The PersistentVolume has reclaim policy "Retain" and the previous pod's volume attachment is not cleared; use a StatefulSet with volumeClaimTemplates and reclaim policy "Delete".

AnswerA

Retain policy leaves PV in 'Released' state; manual intervention is needed.

Why this answer

When a PersistentVolume (PV) has a reclaim policy of 'Retain', after the PersistentVolumeClaim (PVC) is deleted, the PV enters a 'Released' state and is not automatically recycled for reuse. The underlying storage resource (e.g., a Compute Engine persistent disk) still exists but the PV cannot be re-attached until an administrator manually deletes the PV and recreates it, or edits the PV to remove the claim reference. This explains why the pod rescheduled on a new node cannot attach the volume.

Exam trap

Google Cloud often tests the distinction between PV reclaim policies and the 'Released' vs 'Available' states, where candidates mistakenly think the issue is with the PVC's access mode or storage class rather than the PV's manual cleanup requirement.

How to eliminate wrong answers

Option B is wrong because the 'Recycle' reclaim policy is deprecated and not supported in GKE, but the scenario describes a 'Released' state, not a 'Recycle' issue. Option C is wrong because the storage class and reclaim policy are not the cause; the problem is the PV's 'Retain' policy, not the PVC's creation parameters. Option D is wrong because ReadWriteOnce allows attachment to a single node at a time, but after a node failure the PVC is unbound and can be re-attached to a new node; the issue is the PV's state, not the access mode.

Option E is wrong because while using volumeClaimTemplates with reclaim policy 'Delete' would avoid the problem, the existing PV has 'Retain' policy, and the solution is to manually handle the released PV, not to change the StatefulSet definition.

Full explanation →

479

MCQmedium

A DevOps engineer notices that a GKE cluster has nodes that are frequently preempted. They want to reduce costs but maintain resilience. What should they do?

A.Use node auto-repair

B.Use preemptible VMs for all nodes

C.Use committed use discounts

D.Use a regional cluster with multiple zones

AnswerD

Regional clusters distribute nodes across zones, improving resilience to zone-level preemption.

Why this answer

A regional cluster with multiple zones distributes workloads across zones, so if nodes in one zone are preempted, the cluster remains resilient by using nodes in other zones. This reduces costs by allowing the use of preemptible VMs (which are cheaper) while maintaining high availability, as the cluster can tolerate zone-level failures. The key is that regional clusters provide a managed control plane and node distribution across zones, which is essential for resilience against preemption.

Exam trap

The trap here is that candidates may think preemptible VMs are inherently unreliable and thus avoid them entirely, or they may confuse node auto-repair (which fixes health issues) with resilience against preemption, missing the key benefit of a regional architecture that distributes risk across zones.

How to eliminate wrong answers

Option A is wrong because node auto-repair only fixes unhealthy nodes (e.g., those with kernel issues) but does not prevent or mitigate the impact of preemption, which is a deliberate termination by GCP. Option B is wrong because using preemptible VMs for all nodes would cause the entire cluster to fail if all nodes are preempted simultaneously, offering no resilience; preemptible VMs can be terminated at any time within 24 hours. Option C is wrong because committed use discounts require a 1- or 3-year commitment and do not address the resilience issue; they reduce costs for sustained usage but do not protect against preemption.

Full explanation →

480

MCQhard

A company running a globally distributed application uses Firestore in Native mode. They need strong consistency for reads and writes across multiple regions. Which deployment strategy should they use?

A.Use Bigtable with replication

B.Use Firestore in Datastore mode

C.Use Firestore in multi-region (nam5 or eur3)

D.Use Cloud Spanner

AnswerD

Cloud Spanner provides strong ACID transactions across regions, meeting the requirement for strong consistency.

Why this answer

Firestore supports multi-region replication but only provides eventual consistency across regions. Cloud Spanner offers strong consistency globally. Firestore in Datastore mode also offers eventual consistency.

Therefore, for strong consistency across regions, Cloud Spanner is required.

Full explanation →

481

MCQhard

An organization needs to connect an on-premises data center to Google Cloud using Dedicated Interconnect with a 10 Gbps link. They require high availability and want to achieve 99.99% SLA. What is the minimum number of VLAN attachments and Interconnect connections needed?

A.Two Interconnect connections, each with one VLAN attachment.

B.One Interconnect connection with two VLAN attachments.

C.Four Interconnect connections with one VLAN attachment each.

D.Two Interconnect connections, each with two VLAN attachments.

AnswerA

Two connections in different edge availability domains provide 99.99% SLA.

Why this answer

To achieve 99.99% SLA with Dedicated Interconnect, you need two separate Interconnect connections (for physical diversity) and each connection must have at least one VLAN attachment. The SLA requires redundant paths; a single Interconnect connection, even with multiple VLAN attachments, does not provide physical diversity and thus cannot meet the 99.99% uptime target.

Exam trap

The trap here is that candidates confuse VLAN attachments with physical redundancy, thinking multiple VLAN attachments on a single Interconnect connection can achieve the 99.99% SLA, but the SLA explicitly requires two separate Interconnect connections for physical diversity.

How to eliminate wrong answers

Option B is wrong because one Interconnect connection with two VLAN attachments provides only logical redundancy on the same physical link; a single fiber cut or device failure would still cause an outage, failing the 99.99% SLA requirement. Option C is wrong because four Interconnect connections with one VLAN attachment each is excessive and unnecessary; the minimum to meet the SLA is two connections, not four. Option D is wrong because two Interconnect connections each with two VLAN attachments is over-provisioned; the SLA only requires one VLAN attachment per connection, and adding extra attachments does not improve the SLA beyond what two physically diverse connections already provide.

Full explanation →

482

MCQhard

A media streaming company uses Google Cloud CDN to deliver content. They notice that users in certain regions experience high latency despite CDN caching. The content is dynamic based on user location (e.g., local news). What should they do to improve performance?

A.Deploy Cloud Run services in multiple regions and use a global external HTTPS load balancer with backend services to route requests to the nearest region

B.Use Cloud Functions with a regional HTTP trigger and Cloud CDN to cache the responses

C.Use Cloud Armor to route traffic to the nearest point of presence

D.Configure Cloud CDN to use cache keys based on user location headers

AnswerA

This reduces latency for dynamic content by serving from the nearest region.

Why this answer

Deploying Cloud Run services in multiple regions and using a global external HTTPS load balancer with backend services enables location-based routing via the load balancer's anycast IP and backend service configuration. The load balancer automatically routes user requests to the nearest Cloud Run backend that has capacity, reducing latency for dynamic, location-specific content that cannot be effectively cached by Cloud CDN.

Exam trap

Google Cloud often tests the misconception that Cloud CDN alone can solve latency for dynamic content, but the trap here is that dynamic, location-specific content cannot be effectively cached, so the correct solution is to deploy compute resources closer to users and use a global load balancer for intelligent routing.

How to eliminate wrong answers

Option B is wrong because Cloud Functions with a regional HTTP trigger cannot be fronted by Cloud CDN for dynamic content; Cloud CDN caches responses at edge locations, but the content is dynamic based on user location, so caching would serve stale or incorrect content to users in different regions. Option C is wrong because Cloud Armor is a web application firewall and DDoS protection service, not a traffic routing mechanism; it cannot route traffic to the nearest point of presence based on latency or geography. Option D is wrong because configuring Cloud CDN to use cache keys based on user location headers does not solve the latency issue for dynamic content; the content is already uncacheable or must be generated per region, and cache keys only affect how cached responses are served, not the origin latency.

Full explanation →

483

MCQhard

A financial services company needs a disaster recovery plan for a critical application running on GKE. The application uses Cloud SQL for MySQL. The RPO is 5 minutes and RTO is 15 minutes. Which design meets these requirements cost-effectively?

A.Use Cloud SQL cross-region replication (MySQL) with a failover replica in another region, and deploy GKE cluster in that region with the same configuration.

B.Use Cloud SQL for MySQL with multi-region database flag and route traffic to nearest region via Cloud Load Balancing.

C.Set up VPC peering between two regions and use Cloud DNS to direct traffic in failover.

D.Use Cloud SQL backups to Cloud Storage and restore in another region, with GKE cluster recreated via Deployment Manager.

AnswerA

Cross-region replication can meet 5 min RPO.

Why this answer

Cloud SQL cross-region replication provides an asynchronous replica in another region with a typical replication lag of a few seconds, meeting the 5-minute RPO. The failover replica can be promoted in minutes, and deploying a GKE cluster in the same region with identical configuration allows the application to connect to the promoted replica, achieving the 15-minute RTO. This approach is cost-effective because you only pay for the replica and the second GKE cluster when needed for failover testing or actual disaster recovery.

Exam trap

The trap here is that candidates often confuse Cloud SQL's cross-region replication with Cloud Spanner's multi-region configuration, or assume that network-level solutions like VPC peering and DNS can satisfy data replication requirements without a dedicated database replication mechanism.

How to eliminate wrong answers

Option B is wrong because Cloud SQL for MySQL does not support a 'multi-region database flag'; that concept applies to Spanner, not MySQL, and Cloud SQL does not have built-in multi-region routing via Cloud Load Balancing for MySQL instances. Option C is wrong because VPC peering and Cloud DNS alone do not provide any database replication or failover mechanism; they only handle network connectivity and DNS resolution, leaving the critical data un-replicated and unable to meet the RPO/RTO. Option D is wrong because restoring from Cloud SQL backups to Cloud Storage and recreating a GKE cluster via Deployment Manager would take significantly longer than 15 minutes due to backup download, restore time, and cluster provisioning, failing the RTO requirement.

Full explanation →

484

MCQhard

A company runs batch processing jobs on a GKE cluster using preemptible node pools. The jobs are fault-tolerant and can be interrupted. However, the cluster is experiencing high costs due to underutilized nodes. The batch jobs run for 2-3 hours each. What is the most cost-effective optimization?

A.Switch to compute-optimized (C2) machine types for faster job completion.

B.Use regional persistent disks for stateful workloads to improve performance.

C.Reduce the number of min-nodes in the node pool to zero during idle times and use cluster autoscaler.

D.Create multiple node pools with different machine types and use node auto-provisioning with preemptible nodes and custom machine types.

AnswerD

Node auto-provisioning with custom machine types ensures resources match job requirements, reducing waste.

Why this answer

The most cost-effective because it leverages node auto-provisioning with preemptible nodes and custom machine types, which dynamically creates node pools tailored to the specific resource requirements of each batch job. This eliminates waste from over-provisioned nodes while maintaining fault tolerance for interruptible workloads. Combined with preemptible instances (up to 60-80% cheaper than regular VMs), this approach minimizes cost without sacrificing job completion, as the jobs are already designed to handle interruptions.

Exam trap

Google Cloud often tests the misconception that simply reducing node count (Option C) is sufficient for cost optimization, ignoring that node auto-provisioning with custom machine types can eliminate waste from mismatched instance sizes, which is the primary driver of underutilization costs in preemptible node pools.

How to eliminate wrong answers

Option A is wrong because switching to compute-optimized (C2) machine types increases per-node cost significantly (C2 instances are premium-priced for high CPU performance) and does not address underutilization; faster job completion may reduce runtime but not overall cost if nodes remain idle. Option B is wrong because regional persistent disks are designed for stateful workloads requiring high availability and durability, but the batch jobs are fault-tolerant and stateless; adding regional PDs increases storage costs without improving compute utilization. Option C is wrong because reducing min-nodes to zero and using cluster autoscaler only scales down idle nodes, but the cluster autoscaler cannot change machine types or right-size nodes for specific jobs; it still uses the same preemptible node pool configuration, leaving potential waste from mismatched instance sizes.

Full explanation →

485

MCQmedium

A company uses Cloud SQL for MySQL for its transactional database. They need to ensure automatic failover in case of a zonal outage with minimal data loss. What configuration should they use?

Answer options not yet available.

Why this answer

Cloud SQL High Availability (HA) configuration creates a standby instance in a different zone within the same region. If the primary fails, it automatically fails over to the standby, minimizing downtime. Backup and PITR help with data loss but do not provide automatic failover.

Full explanation →

486

MCQhard

A company runs a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage and low-latency access across multiple zones. The application needs to perform well even during zonal failures. Which storage solution should they use?

A.Zonal persistent disk with snapshots to another zone

B.Local SSDs attached to nodes

C.Cloud Filestore

D.Regional persistent disk

AnswerD

Regional PD replicates across zones and provides high availability.

Why this answer

Regional persistent disks (RPDs) synchronously replicate data across two zones in the same region, providing both the persistent storage and low-latency access required by the stateful application. This ensures that if one zone fails, the disk can be attached to a pod in the surviving zone without data loss or significant performance degradation, meeting the high-availability and multi-zone access requirements.

Exam trap

The trap here is that candidates confuse high-availability features like snapshots or local SSDs with true synchronous replication, overlooking that only regional persistent disks provide both persistence and zero-RPO failover across zones without manual restore steps.

How to eliminate wrong answers

Option A is wrong because zonal persistent disks with snapshots to another zone introduce recovery time (snapshot restore) and potential data loss (snapshot frequency), failing to provide the synchronous, low-latency multi-zone access needed during zonal failures. Option B is wrong because local SSDs are ephemeral and tied to a specific node; data is lost if the node or zone fails, and they cannot be shared across zones, violating the persistent storage requirement. Option C is wrong because Cloud Filestore is a managed NFS file storage service designed for shared file systems, not for low-latency block storage access required by stateful applications on GKE, and it introduces network latency compared to directly attached persistent disks.

Full explanation →

487

MCQhard

A company has a Cloud SQL for PostgreSQL instance with high read traffic. They want to offload read queries without modifying the application. Which strategy should they implement?

A.Increase the machine type of the primary instance

B.Implement a caching layer using Memorystore

C.Create read replicas and configure the application to use them

D.Migrate to Cloud Spanner for better scalability

AnswerC

Read replicas offload reads without app changes.

Why this answer

Creating read replicas in Cloud SQL for PostgreSQL allows you to offload read traffic from the primary instance without modifying the application, because the replicas are fully managed and can serve read queries directly. The application can be configured to point to the read replica's endpoint, which handles SELECT statements while the primary continues to handle writes. This is the most direct and cost-effective solution for high read traffic when application changes are not permitted.

Exam trap

Google Cloud often tests the misconception that caching (Memorystore) is the only way to offload reads, but the key constraint here is 'without modifying the application,' which eliminates caching because it requires application-level cache integration.

How to eliminate wrong answers

Option A is wrong because increasing the machine type of the primary instance only scales vertically, which does not offload read queries—it simply gives the same instance more resources, and the application still sends all traffic to a single endpoint. Option B is wrong because implementing a caching layer using Memorystore would require modifying the application to check the cache before querying the database, which violates the requirement of not modifying the application. Option D is wrong because migrating to Cloud Spanner is a significant architectural change that requires application modifications (e.g., using Spanner-specific client libraries and handling strong consistency differently), and it is overkill for simply offloading read traffic.

Full explanation →

488

MCQhard

An organization needs to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can read the data. They want to prevent data exfiltration via the internet. Which combination of services should they use?

A.Firewall Rules and Cloud VPN

B.Cloud Armor and Cloud NAT

C.VPC Service Controls and Private Google Access

D.IAM Conditions and Cloud CDN

AnswerC

VPC Service Controls create a perimeter around Cloud Storage, and Private Google Access allows access from VMs using private IPs.

Why this answer

VPC Service Controls create service perimeters that protect Cloud Storage and other services. Private Google Access allows on-premises or VM access via private IP. Together they restrict access to the VPC network.

Full explanation →

489

MCQhard

A company runs a critical application on GKE with etcd for configuration storage. They want to back up etcd data for disaster recovery. Which tool should they use?

A.gcloud container clusters describe

B.Backup for GKE

C.etcdctl

D.Velero

AnswerD

Velero is the standard tool for backing up Kubernetes clusters, including etcd snapshots.

Why this answer

Velero (formerly Heptio Ark) is an open-source tool for backing up and restoring Kubernetes resources, including etcd snapshots. gcloud container clusters describe does not back up, Backup for GKE is a managed service but not specifically for etcd, and etcdctl is a command-line tool for etcd but is not typically used for automated backups in GKE.

Full explanation →

490

MCQmedium

A company uses Cloud SQL for PostgreSQL and needs to recover a database to a specific point in time within the last week, down to the second. Which feature should they enable?

Answer options not yet available.

Why this answer

Point-in-time recovery (PITR) allows restoring to a specific timestamp within the backup retention period. Automated backups alone only allow restoring to the time of the backup. PITR uses write-ahead logs to replay transactions.

Full explanation →

491

MCQeasy

A company wants to monitor the performance of their application against a Service Level Objective (SLO) of 99.9% availability over a 30-day rolling window. They plan to use Google Cloud's operations suite (formerly Stackdriver). Which metric should they use as the Service Level Indicator (SLI) for availability?

A.Successful request ratio

B.Error rate

C.Request latency

D.CPU utilization

AnswerA

Availability SLI is often the ratio of successful responses (e.g., HTTP 200-499) to total requests. This directly measures uptime.

Why this answer

Availability is typically measured as the fraction of successful requests (e.g., HTTP 200-499) vs total requests. The other options are valid SLIs for other aspects: latency, error rate, or saturation.

Full explanation →

492

MCQeasy

A company needs to retain object versions in Cloud Storage for 90 days to protect against accidental deletion or modification. After 90 days, versions should be deleted. What feature should they enable?

A.Object versioning only

B.Retention policy

C.Object holds

D.Object lifecycle management with a rule to delete versions after 90 days

AnswerD

Lifecycle rules can delete old versions based on age. This meets the requirement.

Why this answer

Object versioning in Cloud Storage keeps multiple versions of an object. Object lifecycle management can be configured to delete versions older than a specified number of days.

Full explanation →

493

Multi-Selectmedium

An organization wants to use VPC Service Controls to protect a Cloud Storage bucket and a BigQuery dataset from data exfiltration. They want to allow access from a specific on-premises network via a Cloud VPN. Which TWO components are required? (Choose 2)

Select 2 answers

A.A service perimeter that includes the Cloud Storage bucket and BigQuery dataset

B.An access level that includes the IP range of the on-premises network

C.Cloud Interconnect (Dedicated or Partner)

D.VPC firewall rules allowing traffic from on-premises

E.Private Google Access enabled on the VPC subnet

AnswersA, B

The service perimeter defines the protected resources.

Why this answer

VPC Service Controls use access levels (often based on IP address) to allow or deny access. A service perimeter defines the protected resources. Cloud VPN provides the encrypted connection from on-premises.

Cloud Interconnect is an alternative but not required. Private Google Access is for VMs in the VPC, not on-premises. VPC firewall rules do not apply to Google Cloud services.

Full explanation →

494

Multi-Selecthard

An organization wants to use Cloud KMS to manage encryption keys for data in Cloud Storage and BigQuery. They require that key material never leaves a hardware security module (HSM) and must be FIPS 140-2 Level 3 certified. Which TWO actions should they take?

Select 2 answers

A.Create a key ring with protection level 'HSM'

B.Use Cloud External Key Manager (Cloud EKM)

C.Use Customer-Supplied Encryption Keys (CSEK)

D.Create a key ring with protection level 'software'

E.Use a Cloud HSM cluster

AnswersA, E

HSM protection level ensures keys are generated in and remain in the HSM.

Why this answer

To use HSM-backed keys, create a key ring with protection level HSM via Cloud HSM. Cloud KMS supports HSM keys that never leave the HSM.

Full explanation →

495

MCQmedium

An organization wants to define an SLO for their API hosted on Cloud Endpoints. Which metric should they use as a Service Level Indicator (SLI) for availability?

A.Number of HTTP 5xx errors

B.Request latency at the 99th percentile

C.Ratio of HTTP 200 responses to total requests

D.CPU utilization of backend instances

AnswerC

This directly measures the availability of the API.

Why this answer

For an availability SLO, the SLI must measure the proportion of successful requests. In Cloud Endpoints, availability is defined as the ratio of successful (HTTP 200) responses to total requests, as this directly reflects whether the API is functioning correctly. Option C is correct because it captures the fraction of requests that completed without error, which is the standard definition of availability in service-level monitoring.

Exam trap

Google Cloud often tests the distinction between availability and performance metrics, so the trap here is that candidates confuse latency (a performance SLI) with availability, or they mistakenly think that counting only server-side errors (5xx) is sufficient for an availability SLI, ignoring that availability is a ratio of successful to total requests.

How to eliminate wrong answers

Option A is wrong because HTTP 5xx errors are only one component of unavailability; they do not account for other failure modes (e.g., timeouts, 4xx errors caused by infrastructure issues) and using just the count of 5xx errors would not produce a ratio suitable for an availability SLI. Option B is wrong because request latency at the 99th percentile measures performance, not availability; an API can be available but slow, and latency is used for a different SLO (e.g., responsiveness). Option D is wrong because CPU utilization of backend instances is an infrastructure metric that does not directly measure whether the API is serving requests successfully; high CPU may indicate performance issues but does not equate to availability failures.

Full explanation →

496

MCQmedium

A company wants to restrict access to their Cloud Storage bucket so that only requests from within a specific VPC network are allowed, and all other traffic (including internet) is denied. They also need to allow access from on-premises through a VPN. Which configuration should they use?

A.Configure the bucket with VPC Service Controls and enable Private Google Access

B.Use IAM conditions to restrict access based on IP address

C.Use firewall rules to allow traffic only from the VPC IP range

D.Set up Cloud VPN and use Cloud NAT for egress

AnswerA

VPC Service Controls create a service perimeter, and Private Google Access allows access from VMs and on-premises via VPN.

Why this answer

VPC Service Controls create a service perimeter around the bucket, and private Google Access allows resources in the VPC to use the bucket's private IP addresses. The on-premises network can connect via VPN using VPC Private Google Access. Public access is blocked by the perimeter.

Firewall rules alone cannot block internet traffic to a public bucket.

Full explanation →

497

MCQeasy

A company wants to provision multiple similar environments (dev, test, prod) with consistent networking configurations. Which approach is a best practice for infrastructure as code?

A.Use Ansible playbooks to run ad-hoc commands.

B.Use a single Terraform configuration with workspaces.

C.Run separate gcloud commands for each environment.

D.Use Cloud Deployment Manager templates with environment-specific parameters.

AnswerB

Workspaces allow reusable configuration across environments.

Why this answer

Terraform workspaces allow you to manage multiple distinct environments (e.g., dev, test, prod) from a single configuration by maintaining separate state files. This ensures consistent networking configurations across environments while avoiding duplication of code, which is a core best practice for infrastructure as code.

Exam trap

Google Cloud often tests the misconception that environment-specific parameters in Deployment Manager templates are equivalent to Terraform workspaces, but the trap is that Terraform's workspace feature provides native state isolation and multi-cloud portability, whereas Deployment Manager is GCP-specific and lacks the same level of abstraction for consistent multi-environment management.

How to eliminate wrong answers

Option A is wrong because Ansible playbooks are primarily for configuration management and ad-hoc command execution, not for declaratively provisioning cloud infrastructure with state management and drift detection. Option C is wrong because running separate gcloud commands for each environment is imperative, error-prone, and lacks version control and repeatability, violating IaC principles. Option D is wrong because Cloud Deployment Manager templates with environment-specific parameters can work but are less portable and flexible than Terraform workspaces, and Terraform is the more widely adopted multi-cloud IaC tool for consistent provisioning.

Full explanation →

498

MCQhard

A company runs a global e-commerce platform on Google Kubernetes Engine (GKE) with a Cloud SQL for MySQL database. During promotions, traffic spikes cause database connection limits to be exceeded, leading to errors. The application uses the Cloud SQL Auth Proxy. What is the MOST scalable and cost-effective solution?

A.Configure the Cloud SQL Auth Proxy to use private IP and increase pool size

B.Upgrade the Cloud SQL instance to a higher tier with more connections

C.Increase the number of Cloud SQL Auth Proxy replicas

D.Use a connection pooler such as ProxySQL deployed in the GKE cluster

AnswerD

ProxySQL pools connections to the database, allowing many application connections to be multiplexed over fewer database connections, reducing load on the database and avoiding connection limits.

Why this answer

Connection pooling (e.g., using PgBouncer for PostgreSQL, but for MySQL, similar poolers like ProxySQL or built-in connection pooling) allows the application to reuse connections and handle many concurrent requests without hitting database connection limits. Increasing the database tier or proxy instances adds cost and may not address the underlying issue of connection churn.

Full explanation →

499

MCQmedium

A company uses Cloud Monitoring to track the performance of their application. They want to create an alert that triggers when the 99th percentile latency exceeds 500ms over a rolling 5-minute window. Which type of SLO and alert should they use?

A.Request-based SLO with window-based alert

B.Event-based SLO with window-based alert

C.Window-based SLO with request-based alert

D.Time-based SLO with event-based alert

AnswerA

Request-based SLO measures performance of requests; window-based alert evaluates over a time window.

Why this answer

Request-based SLOs are appropriate for latency metrics; a window-based alert evaluates over a time window. Event-based and time-based are not standard SLO types. The correct combination is request-based SLO with window-based alert.

Full explanation →

500

MCQeasy

A startup wants to deploy a containerized web application that scales automatically to zero when not in use, and only pays for resources consumed during request processing. Which compute service should they choose?

A.Cloud Functions

B.Cloud Run

C.Google Kubernetes Engine (GKE) Standard

D.Compute Engine with preemptible VMs

AnswerB

Cloud Run scales to zero automatically and charges per request, making it cost-effective for variable workloads.

Why this answer

Cloud Run is the correct choice because it is a fully managed serverless platform that automatically scales your containerized application to zero when there are no incoming requests, and you only pay for the resources (vCPU, memory, and networking) consumed during request processing. This aligns perfectly with the requirement for a containerized web app that scales to zero and uses a pay-per-use model.

Exam trap

The trap here is that candidates often confuse Cloud Functions (event-driven, not containerized) with Cloud Run (containerized, HTTP-driven), or assume that GKE Standard can scale to zero, but it cannot because the node pool must have at least one node running to host the control plane and system pods.

How to eliminate wrong answers

Option A is wrong because Cloud Functions is a serverless compute service for event-driven functions, not for containerized applications; it does not support custom container images and is limited to specific runtimes. Option C is wrong because GKE Standard requires you to manage a cluster of nodes that incur costs even when idle, and it does not automatically scale to zero; you pay for the underlying VMs regardless of workload. Option D is wrong because Compute Engine with preemptible VMs does not scale to zero automatically; you pay for the VM instances while they are running, and preemptible VMs can be terminated at any time, making them unsuitable for a web application that needs to handle requests reliably.

Full explanation →

501

MCQmedium

A company has a Cloud SQL for PostgreSQL instance in a single zone. To achieve high availability, they want to ensure automatic failover with zero data loss and minimal downtime. Which configuration should they use?

A.Deploy a read replica in the same zone and enable automatic failover

B.Enable automatic backups and point-in-time recovery

C.Add a cross-region read replica and configure failover manually

D.Configure a Cloud SQL regional instance with a failover replica in a different zone

AnswerD

This is the correct HA configuration for Cloud SQL, providing automatic failover and synchronous replication.

Why this answer

Cloud SQL HA requires a regional instance with a failover replica in a different zone within the same region. This provides automatic failover and synchronous replication to ensure zero data loss. Read replicas are for read scaling, not automatic failover.

Cross-region replication does not provide automatic failover.

Full explanation →

502

MCQhard

A data engineer needs to automatically detect and redact sensitive data such as credit card numbers from text files uploaded to Cloud Storage before the data is loaded into BigQuery. Which GCP service should be used?

A.Cloud Data Loss Prevention (DLP) API

B.Cloud KMS

C.Cloud Audit Logs

D.Cloud Vision API

AnswerA

DLP provides inspection and de-identification of sensitive data.

Why this answer

Cloud Data Loss Prevention (DLP) API can inspect text for sensitive patterns and de-identify (redact, mask, etc.) the content. It can be triggered via Cloud Functions or Cloud Workflows on file upload.

Full explanation →

503

Multi-Selecteasy

Which TWO IAM predefined roles grant read-only access to Cloud Storage objects but not the ability to list buckets?

Select 2 answers

A.roles/storage.legacyBucketReader

B.roles/storage.objectViewer

C.roles/storage.objectAdmin

D.roles/storage.viewer

E.roles/storage.admin

AnswersA, B

Allows reading objects if you know the bucket, but does not grant storage.buckets.list.

Why this answer

Roles/storage.legacyBucketReader, is correct because it grants read access to Cloud Storage objects (via the storage.objects.get permission) but does not include the storage.buckets.list permission, so users cannot list buckets. Option B, roles/storage.objectViewer, is correct because it provides read-only access to objects (storage.objects.get and storage.objects.list) without the ability to list buckets, as it lacks storage.buckets.list.

Exam trap

The trap here is that candidates often confuse roles/storage.viewer (which includes bucket listing) with roles/storage.objectViewer (which does not), or assume that any 'viewer' role excludes bucket listing, but the storage.viewer role actually includes storage.buckets.list, making it incorrect for this specific requirement.

Full explanation →

504

MCQhard

An organization requires that all Compute Engine instances in a project must have a specific tag for firewall rule compliance. How can they enforce this?

A.Use IAM roles to restrict instance creation

B.Use a startup script to add the tag

C.Use a mandatory tag via organization policy

D.Use Cloud Asset Inventory

AnswerC

Organization policies can enforce constraints like `compute.requireTags`.

Why this answer

Organization Policies in Google Cloud can enforce constraints that require resources, including Compute Engine instances, to have specific labels or tags. The `compute.requireOsLogin` or custom constraint `compute.requireInstanceTag` can be used to mandate that all instances must have a particular tag, and any instance creation that violates this policy will be denied at the API level, ensuring compliance without relying on user behavior.

Exam trap

The trap here is that candidates often confuse IAM roles with Organization Policies, thinking that restricting creation permissions (Option A) is sufficient, but IAM cannot enforce resource-level attributes like tags, which is a common misconception in policy-based governance questions.

How to eliminate wrong answers

Option A is wrong because IAM roles control who can create instances, not what tags are applied to the instances; they cannot enforce a specific tag value. Option B is wrong because a startup script runs after the instance is created, so it cannot prevent the creation of an instance without the required tag, and the instance would already exist in violation of the firewall rule compliance. Option D is wrong because Cloud Asset Inventory is a service for discovering and monitoring cloud resources, not for enforcing policies or preventing non-compliant resource creation.

Full explanation →

505

MCQeasy

A company wants to ensure that all audit logs for a project are retained for 7 years for compliance purposes. Which type of audit logs in Cloud Logging should they configure for the longest retention?

A.Export all audit logs to Cloud Storage with a retention policy

B.Admin Activity audit logs

C.Data Access audit logs

D.System Event audit logs

AnswerA

Exporting to Cloud Storage allows you to set a retention policy of 7 years.

Why this answer

Cloud Logging retains logs for a default period, but for long-term retention you can export logs to Cloud Storage. All audit logs (Admin Activity, Data Access, System Event) can be exported and stored in a bucket with retention policies. The question might refer to the default retention: Admin Activity logs are retained for 400 days, Data Access for 30 days, but you can export to Cloud Storage for longer.

The best answer is to export all audit logs to Cloud Storage.

Full explanation →

506

MCQeasy

Which Google Cloud service automatically computes the optimal size or tier for underutilized Compute Engine instances and generates recommendations to reduce cost?

A.Cloud Monitoring

B.Cloud Profiler

C.Cost Management

D.Recommender (Active Assist)

AnswerD

The Recommender service includes rightsizing recommendations for underutilized VMs.

Why this answer

Active Assist includes rightsizing recommendations that analyze VM utilization and suggest appropriate machine types or tiers to reduce cost without sacrificing performance.

Full explanation →

507

MCQhard

An e-commerce platform uses Cloud Spanner in a multi-region configuration. They want to achieve the highest possible availability SLA. Which deployment configuration should they choose?

Answer options not yet available.

Why this answer

Cloud Spanner offers a 99.999% SLA for multi-region configurations. To achieve this, you must use a multi-region instance (e.g., nam3, eur3) that replicates data across at least three regions. A single-region configuration only offers 99.99% SLA.

Full explanation →

508

MCQmedium

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to optimize costs without sacrificing availability. They have varying traffic patterns. Which strategy should they recommend?

A.Use committed use discounts with a 3-year term on all nodes.

B.Use GKE Autopilot with a single node pool.

C.Use a regional cluster with node pools of different machine types.

D.Use node auto-provisioning with preemptible nodes.

AnswerD

Node auto-provisioning dynamically creates node pools and preemptible nodes lower cost.

Why this answer

Node auto-provisioning with preemptible nodes allows the cluster to automatically scale and use low-cost, short-lived instances for fault-tolerant workloads. Preemptible nodes are up to 60-91% cheaper than regular instances, and node auto-provisioning ensures that only the required node types are created, optimizing cost without sacrificing availability for stateless microservices that can handle interruptions.

Exam trap

This question tests the common misconception that committed use discounts (CUDs) are always the best cost-saving strategy. The trap is that CUDs require a 1- or 3-year commitment and lack flexibility for varying traffic patterns. Node auto-provisioning with preemptible nodes provides dynamic cost optimization by scaling resources up and down automatically and using short-lived, low-cost instances suitable for fault-tolerant microservices.

How to eliminate wrong answers

Option A is wrong because committed use discounts with a 3-year term lock in capacity and cost, which is inflexible for varying traffic patterns and can lead to over-provisioning or under-utilization, increasing costs rather than optimizing them. Option B is wrong because GKE Autopilot with a single node pool abstracts node management but does not inherently optimize for varying traffic; Autopilot charges per pod resource request, which can be more expensive than preemptible nodes for bursty workloads, and a single node pool lacks the flexibility to match different machine types to workload needs. Option C is wrong because a regional cluster with node pools of different machine types improves availability and flexibility but does not directly address cost optimization; without using preemptible or spot instances, it still incurs standard on-demand pricing, missing the primary cost-saving opportunity.

Full explanation →

509

MCQmedium

Your team uses Cloud SQL for PostgreSQL for an e-commerce application. You want to perform point-in-time recovery (PITR) to recover from a logical error that occurred 10 minutes ago. Which prerequisites are required?

A.Automated backups must be enabled, and the instance must be using the InnoDB storage engine

B.Automated backups and binary logging must be enabled

C.Point-in-time recovery is not supported for Cloud SQL PostgreSQL

D.Automated backups must be enabled, and write-ahead logging (WAL) must be active

AnswerD

PostgreSQL PITR requires automated backups and WAL.

Why this answer

Cloud SQL PITR requires automated backups and binary logging (for MySQL) or write-ahead logging (for PostgreSQL) to be enabled. Automated backups must be configured, and the instance must be using the appropriate database flags. For PostgreSQL, 'cloudsql.logical_decoding' and 'cloudsql.enable_pitr' are needed.

Full explanation →

510

MCQmedium

The exhibit shows the output of a 'gcloud compute instances describe' command for an instance. What is the most likely impact on reliability if the host machine needs maintenance?

A.The instance will be terminated and then restarted, causing a brief downtime.

B.The instance will not be affected because automatic restart is enabled.

C.The instance will be backed up automatically before maintenance.

D.The instance will be live migrated to another host without interruption.

AnswerA

With TERMINATE, the instance is shut down and later restarted on a healthy host, resulting in downtime.

Why this answer

When a host machine requires maintenance, Google Compute Engine instances that are not configured for live migration will be terminated and then restarted on another host. This behavior is determined by the 'onHostMaintenance' setting; if it is set to 'TERMINATE' (the default for instances with GPUs or preemptible VMs), the instance stops and restarts, causing brief downtime. The exhibit likely shows 'onHostMaintenance: TERMINATE' or the instance lacks live migration support, making termination and restart the expected outcome.

Exam trap

Google Cloud often tests the distinction between 'automatic restart' (which handles crash recovery) and 'onHostMaintenance' (which handles planned maintenance), causing candidates to mistakenly think automatic restart prevents downtime during maintenance.

How to eliminate wrong answers

Option B is wrong because 'automatic restart' is a separate setting that controls whether an instance restarts after a failure or crash, not how it behaves during host maintenance; it does not prevent downtime from maintenance events. Option C is wrong because Google Compute Engine does not automatically back up instances before host maintenance; backups must be configured separately via snapshots or images. Option D is wrong because live migration is only possible if the instance has 'onHostMaintenance' set to 'MIGRATE' and does not have GPUs, local SSDs, or preemptible status; the exhibit likely shows a configuration that disables live migration, such as a GPU attached or the setting explicitly set to 'TERMINATE'.

Full explanation →

511

MCQmedium

A security team needs to detect and redact personally identifiable information (PII) from documents uploaded to Cloud Storage before they are stored. Which GCP service should they use?

A.Cloud Audit Logs

B.Cloud Data Loss Prevention (DLP) API

C.Security Command Center

D.Access Transparency

AnswerB

Why this answer

Cloud DLP (Data Loss Prevention) API can inspect and de-identify sensitive data in documents and can be integrated with Cloud Storage workflows.

Full explanation →

512

Multi-Selectmedium

A company is moving a legacy application to Google Cloud. The application uses a PostgreSQL database and must be re-platformed with minimal code changes. They require high availability across zones and automatic failover within the same region. Which TWO database services meet these requirements? (Choose 2.)

Select 2 answers

A.AlloyDB for PostgreSQL

B.Cloud SQL for PostgreSQL

C.Firestore

D.Cloud Bigtable

E.Cloud Spanner

AnswersA, B

AlloyDB is PostgreSQL-compatible, provides high availability, and requires minimal code changes.

Why this answer

Cloud SQL for PostgreSQL provides regional high availability with automatic failover across zones. AlloyDB is PostgreSQL-compatible, offers high availability with a primary and standby instance, and is optimized for performance. Cloud Spanner is globally distributed but requires more code changes.

Bigtable is not PostgreSQL-compatible. Firestore is NoSQL.

Full explanation →

513

MCQhard

An organization wants to establish a dedicated, low-latency connection between their on-premises data center and GCP with a guaranteed SLA of 99.99% uptime. They anticipate high bandwidth usage but want to avoid per-GB egress charges. Which connectivity option should they choose?

A.Dedicated Cloud Interconnect

B.Partner Cloud Interconnect

C.Cloud VPN with HA VPN gateway

D.Classic VPN

AnswerA

Dedicated Interconnect provides 99.99% SLA, high bandwidth, and no egress charges, meeting all requirements.

Why this answer

Dedicated Cloud Interconnect provides a direct physical connection with SLA up to 99.99%, high bandwidth, and no egress charges, ideal for high-volume hybrid workloads.

Full explanation →

514

MCQhard

An engineer is troubleshooting a Cloud Build trigger that fails with the error 'PERMISSION_DENIED: Cloud Build service account does not have permission to access Artifact Registry'. The build needs to push a Docker image to Artifact Registry. What is the correct IAM role to assign to the Cloud Build service account?

A.roles/artifactregistry.writer

B.roles/artifactregistry.viewer

C.roles/editor

D.roles/storage.objectAdmin

AnswerA

This role allows uploading artifacts to Artifact Registry, which includes pushing Docker images.

Why this answer

The Cloud Build service account (usually project-number@cloudbuild.gserviceaccount.com) needs the Artifact Registry Writer role to push images. Editor role is too broad; Viewer is read-only; Storage Object Admin is for Cloud Storage, not Artifact Registry.

Full explanation →

515

MCQmedium

A company has a multi-project Google Cloud environment with strict compliance requirements. They need to ensure that all projects enforce a uniform set of constraints, such as requiring CMEK for Compute Engine disk encryption and blocking the use of public IPs on VMs. They have defined these constraints using Organization Policies at the organization level. However, the security team discovers that some projects are not enforcing the constraints because they have been overridden at the project level by the respective project owners. The security team wants a solution that prevents project-level overrides while maintaining the ability to apply exceptions at a folder level when approved. What should they do?

A.Deploy Forseti Security to automatically remediate when projects override policies.

B.Use Cloud Asset Inventory to monitor for non-compliant projects and alert the security team.

C.Manually remove the overridden policies in each project and set the constraints at the organization level again.

D.Move all projects under a common folder and set the Organization Policies at that folder level with 'enforce: true'.

AnswerD

Folder-level policies cannot be overridden by project-level policies, ensuring enforcement while allowing folder-level exceptions.

Why this answer

Setting the Organization Policy at the folder level with 'enforce: true' ensures project-level overrides are blocked, while still allowing folder-level exceptions. Option A is wrong because Forseti Security can automate remediation but does not prevent overrides natively; it's not a replacement for organizational policy enforcement. Option B is wrong because Cloud Asset Inventory only monitors and alerts; it does not enforce policies.

Option C is wrong because manually removing overrides is not scalable and does not prevent future overrides.

Full explanation →

516

MCQhard

A data analytics team needs to run complex SQL queries on a large dataset stored in Cloud Storage (CSV files). The queries are ad-hoc and require fast execution. The data is updated daily. Which Google Cloud service should they use to query the data directly in Cloud Storage with minimal setup?

A.Dataproc

B.BigQuery

C.Dataflow

D.Cloud SQL

AnswerB

BigQuery supports external tables that query data directly from Cloud Storage, enabling fast ad-hoc SQL.

Why this answer

BigQuery can query external data sources including Cloud Storage using federated queries, but for ad-hoc SQL on CSV files, BigQuery is the best choice. Cloud SQL is not designed for external data. Dataproc is for Spark/Hadoop.

Dataflow is for stream/batch processing.

Full explanation →

517

Multi-Selectmedium

Which TWO actions are required to allow a private GKE cluster to pull container images from Artifact Registry in the same project?

Select 2 answers

A.Create a firewall rule allowing outbound traffic to Artifact Registry IP ranges.

B.Set up VPC Network Peering with the Artifact Registry service.

C.Configure Cloud NAT for the GKE cluster.

D.Enable Private Google Access on the subnet where the GKE nodes are deployed.

E.Grant the Artifact Registry Reader role to the GKE service account.

AnswersD, E

Private Google Access allows nodes without external IPs to reach Google APIs.

Why this answer

Private Google Access enables GKE nodes with only internal IP addresses to reach Google APIs and services, including Artifact Registry, over Google's private network rather than the public internet. Option E is correct because the GKE node's service account must have the Artifact Registry Reader role (roles/artifactregistry.reader) to authenticate and pull container images from the registry.

Exam trap

Google Cloud often tests the misconception that Cloud NAT is required for private clusters to access Google APIs, but Private Google Access is the correct mechanism for reaching Google-managed services like Artifact Registry without public IPs.

Full explanation →

518

MCQmedium

A company needs to connect their on-premises data center to Google Cloud with a dedicated, low-latency, and highly available connection. They require at least 10 Gbps throughput and want to avoid internet-based VPN. Which connectivity option should they choose?

A.Dedicated Cloud Interconnect

B.Partner Cloud Interconnect

C.Classic VPN

D.HA VPN

AnswerA

Dedicated Interconnect provides a direct, private connection with up to 10 Gbps per circuit, low latency, and high availability.

Why this answer

Dedicated Cloud Interconnect provides a direct physical connection between on-premises and Google Cloud, offering high throughput (10 Gbps or more), low latency, and high availability. Partner Interconnect uses a third-party provider, introducing potential latency. HA VPN uses the internet but can be high availability; still internet-based.

Classic VPN is a single tunnel with lower reliability.

Full explanation →

519

Multi-Selectmedium

A company runs a web application on GKE and wants to expose it to the internet using a global HTTP(S) load balancer with Cloud CDN. Which TWO GCP resources are required to configure this setup? (Choose TWO.)

Select 2 answers

A.Kubernetes Ingress resource with a GCE ingress controller

B.Cloud NAT gateway

C.Backend service with health check configuration

D.A Kubernetes Service of type LoadBalancer

E.Cloud VPN tunnel

AnswersA, C

Ingress with GCE controller creates an external HTTP(S) load balancer and integrates with Cloud CDN.

Why this answer

A is correct because a Kubernetes Ingress resource with a GCE ingress controller is required to integrate a GKE application with a global HTTP(S) load balancer. The GCE ingress controller provisions a Google Cloud HTTP(S) load balancer and configures the necessary forwarding rules, URL maps, and backend services to route external traffic to the appropriate Kubernetes Services. This setup is essential for enabling Cloud CDN, which caches content at Google's global edge points.

Exam trap

The trap here is that candidates often confuse a Kubernetes Service of type LoadBalancer (which creates a regional Layer 4 load balancer) with the need for a global HTTP(S) load balancer, failing to recognize that only an Ingress with the GCE controller can provide the global, Layer 7 load balancing required for Cloud CDN.

Full explanation →

520

MCQhard

A financial services company is designing a multi-region disaster recovery architecture for a critical application. The application runs on Compute Engine with a stateful backend using Cloud Spanner. The Recovery Time Objective (RTO) is 1 hour, and the Recovery Point Objective (RPO) is 15 minutes. What architecture meets these requirements cost-effectively?

A.Deploy the application in two regions with active-active traffic load balancing and Cloud Spanner multi-region configuration.

B.Deploy in one region with scheduled snapshots to Cloud Storage and use persistent disk snapshots for recovery.

C.Deploy in two regions with active-passive using Cloud Load Balancing and Cloud Spanner backup/restore.

D.Use a single region with Cloud SQL for PostgreSQL and enable cross-region replication using Cloud SQL replica.

AnswerA

Cloud Spanner multi-region provides synchronous replication with RPO < 15 min and automatic failover meets RTO.

Why this answer

It uses Cloud Spanner's multi-region configuration, which provides synchronous replication across regions with automatic failover, meeting an RPO of 15 minutes (typically seconds) and an RTO of 1 hour. Active-active traffic load balancing with Compute Engine ensures that the application can immediately route traffic to the healthy region, minimizing downtime without the need for manual failover or backup/restore operations.

Exam trap

The trap here is that candidates often confuse Cloud Spanner's backup/restore (asynchronous, slow) with its multi-region configuration (synchronous, fast), or assume that active-passive with backups can meet low RTO/RPO when in reality only synchronous replication can achieve sub-minute RPO and automatic failover.

How to eliminate wrong answers

Option B is wrong because scheduled snapshots to Cloud Storage and persistent disk snapshots are asynchronous and can take longer than 15 minutes to capture, potentially exceeding the RPO; also, recovery from snapshots involves manual steps that likely exceed the 1-hour RTO. Option C is wrong because Cloud Spanner backup/restore is an asynchronous process that can take hours to restore a database, far exceeding the 1-hour RTO, and active-passive setups introduce failover delays that may not meet the RTO. Option D is wrong because Cloud SQL for PostgreSQL with cross-region replication uses asynchronous replication, which can result in data loss exceeding the 15-minute RPO, and Cloud SQL does not support the same multi-region synchronous replication capabilities as Cloud Spanner.

Full explanation →

521

MCQmedium

An organization has multiple GCP projects managed by a central operations team. They want to define a common VPC configuration in a host project and allow service projects to use it. Which networking feature should they use?

A.Shared VPC

B.Private Service Connect

C.Cloud VPN

D.VPC peering

AnswerA

Shared VPC enables a host project to share VPC networks with service projects.

Why this answer

Shared VPC allows a host project to contain shared VPC networks that service projects can use. VPC peering is for connecting separate networks. Private Service Connect is for accessing managed services.

Cloud VPN is for on-premises connectivity.

Full explanation →

522

Multi-Selectmedium

A team is deploying a stateful application on GKE. They want to ensure that the application's pods are distributed across different zones for high availability and that during cluster upgrades, at least one pod remains available. Which THREE features should they configure?

Select 3 answers

A.Pod topology spread constraints

B.StatefulSet for the application

C.Cluster autoscaler

D.Horizontal Pod Autoscaler

E.PodDisruptionBudget

AnswersA, B, E

This spreads pods across zones or other topology domains.

Why this answer

Pod topology spread constraints distribute pods across zones. PodDisruptionBudget ensures minimum available pods during voluntary disruptions. Cluster autoscaler is not directly for availability, but for scaling nodes.

StatefulSet is for stateful workloads but doesn't guarantee zone distribution without constraints.

Full explanation →

523

Multi-Selecteasy

A company wants to store infrequently accessed archival data that must be retained for 7 years. They need low storage cost and retrieval times of a few hours are acceptable. Which TWO storage classes should they consider? (Choose TWO.)

Select 2 answers

A.Nearline

B.Standard

C.Regional

D.Coldline

E.Archive

AnswersD, E

Coldline is low-cost for infrequent access (quarterly) and retrieval in hours.

Why this answer

Coldline has a 90-day minimum storage duration and is for data accessed less than once a quarter. Archive has a 365-day minimum and is for data accessed less than once a year. Both are suitable for archival with retrieval times in hours (Coldline) or longer (Archive).

Standard and Nearline are for more frequently accessed data.

Full explanation →

524

MCQmedium

A company is migrating its on-premises Oracle database to Cloud SQL for PostgreSQL. The database team wants to minimize downtime during migration. Which approach should they use?

A.Set up Oracle GoldenGate to replicate to Cloud SQL.

B.Use Database Migration Service for PostgreSQL with continuous migration from Oracle via Homogeneous Migration.

C.Take a physical backup of Oracle and restore to Cloud SQL.

D.Export the database as a dump file, upload to Cloud Storage, and import into Cloud SQL.

AnswerB

DMS supports minimal downtime via continuous replication.

Why this answer

Database Migration Service (DMS) for PostgreSQL with continuous migration is the correct approach because it supports ongoing change data capture (CDC) from Oracle to Cloud SQL for PostgreSQL, enabling near-zero downtime. DMS handles schema conversion and data replication continuously, allowing the target to stay synchronized until a cutover, which minimizes downtime compared to batch methods.

Exam trap

Google Cloud often tests the misconception that any 'migration service' automatically supports heterogeneous migrations, but here the trap is that Database Migration Service for PostgreSQL is specifically designed for PostgreSQL targets and includes built-in schema conversion from Oracle, whereas options like GoldenGate or dump/restore are either too complex or cause downtime.

How to eliminate wrong answers

Option A is wrong because Oracle GoldenGate is a third-party tool that requires separate licensing, complex configuration, and is not natively integrated with Cloud SQL for PostgreSQL; it is overkill and not the recommended Google Cloud service for this migration. Option C is wrong because a physical backup of Oracle (e.g., RMAN) is platform-specific and cannot be directly restored to Cloud SQL for PostgreSQL, which uses a different database engine and storage format. Option D is wrong because exporting as a dump file and importing is a one-time, offline process that requires the source database to be quiesced or taken offline, causing significant downtime, and does not support continuous replication.

Full explanation →

525

MCQmedium

A company runs a critical application on Compute Engine and needs a disaster recovery strategy with a Recovery Time Objective (RTO) of less than 5 minutes and a Recovery Point Objective (RPO) of less than 1 minute. The application state is stored on persistent disks. Which solution meets these requirements?

A.Scheduled snapshots to multi-regional Cloud Storage bucket

B.Managed instance group with regional persistent disks across multiple zones

C.VM images stored in a different region using Cloud Storage

D.Cloud Storage Coldline with lifecycle policies

AnswerB

Regional PDs replicate data synchronously across zones, enabling fast failover and RPO under 1 minute.

Why this answer

Managed instance groups with multi-zone deployment and regional persistent disks provide synchronous replication across zones, achieving low RPO (seconds) and automatic failover for RTO under 5 minutes. Snapshots have higher RPO. VM images are for static boot disks.

Coldline storage is for archiving.

Full explanation →

Page 7 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCA by domain

Target a specific domain to shore up weak areas.

Managing Implementation and Ensuring Solution and Operations Reliability Managing and Provisioning a Solution Infrastructure Designing for Security and Compliance Analysing and Optimising Technical and Business Processes Design and plan a cloud solution architecture Manage and provision cloud infrastructure Design for security and compliance Analyze and optimize technical and business processes Manage implementation of cloud architecture Ensure solution and operations reliability

See all domains with question counts →