Knowledge + Practice

Google Professional Cloud Architect (PCA) — Questions 526–600

955 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 8 of 13

526

Multi-Selecthard

An organization wants to implement a change management strategy for a microservices application on GKE, allowing gradual rollouts and immediate rollback if issues arise. Which three practices should they adopt? (Choose three.)

Answer options not yet available.

Why this answer

Canary deployments, feature flags, and automated rollbacks are key practices for gradual rollouts and rollback. Blue/green is also good, but not among the options. Manual approval slows rollouts.

Phased migrations are for database changes.

Full explanation →

527

MCQhard

A financial services company uses VPC Service Controls to protect their project containing BigQuery datasets and Cloud Storage buckets. They have a perimeter that includes the BigQuery service. Users report that they cannot export data from BigQuery to Cloud Storage using the web console. The export job fails with an access denied error. The team needs to allow exports while maintaining data exfiltration prevention. The users have the necessary IAM permissions (BigQuery Data Editor, Storage Object Admin) on the appropriate resources. What should the architect do?

A.Add Cloud Storage to the same VPC Service Controls perimeter.

B.Remove BigQuery from the VPC Service Controls perimeter.

C.Create an access level that permits exports during business hours.

D.Grant the users the Storage Object Admin role at the bucket level.

AnswerA

Correct: This allows controlled data flow between BigQuery and Cloud Storage within the perimeter.

Why this answer

VPC Service Controls perimeters enforce data exfiltration prevention by default, blocking egress from protected services (like BigQuery) to unprotected services (like Cloud Storage). Adding Cloud Storage to the same perimeter allows BigQuery to export data to Cloud Storage while still preventing data from leaving the perimeter. The users already have the necessary IAM roles (BigQuery Data Editor and Storage Object Admin), so the issue is solely the perimeter boundary, not permissions.

Exam trap

The trap here is that candidates often confuse IAM permissions with VPC Service Controls boundaries, assuming that granting the correct IAM roles (like Storage Object Admin) will resolve the access denied error, when in fact the error is caused by the perimeter blocking cross-service egress, not by insufficient IAM privileges.

How to eliminate wrong answers

Option B is wrong because removing BigQuery from the perimeter would disable all VPC Service Controls protections for BigQuery, exposing the datasets to data exfiltration risks, which contradicts the requirement to maintain data exfiltration prevention. Option C is wrong because access levels control ingress based on client attributes (e.g., IP address, device state) and do not affect egress permissions between services within a perimeter; the export failure is a perimeter boundary issue, not an access level restriction. Option D is wrong because the users already have the Storage Object Admin role at the bucket level (as stated in the question), and the error is an access denied from the perimeter, not from IAM; granting the same role again does not resolve the VPC Service Controls boundary.

Full explanation →

528

MCQeasy

Which IAM role should be granted to a user who needs to view but not modify resources in a project?

A.roles/editor

B.roles/viewer

C.roles/owner

D.roles/browser

AnswerB

Viewer provides read-only access.

Why this answer

The Viewer role (roles/viewer) provides read-only access to all resources in a project.

Full explanation →

529

Multi-Selecthard

Which THREE factors should be considered when choosing a Google Cloud region for deploying a low-latency application serving global users? (Choose three.)

Select 3 answers

A.Proximity to your user base to minimize network latency.

B.Availability of the specific Google Cloud services required by the application.

C.Pricing differences between regions due to variations in compute and storage costs.

D.Compliance with data residency requirements (e.g., GDPR, CCPA).

E.Number of zones in the region to ensure high availability.

AnswersA, B, D

Closer regions reduce round-trip time.

Why this answer

Deploying in a Google Cloud region geographically close to your user base minimizes network latency, which is critical for low-latency applications. Google Cloud's global network uses edge points of presence (PoPs) and premium tier routing to reduce round-trip time (RTT), but the physical distance between the region and users still directly impacts latency due to the speed of light and fiber optic propagation delays.

Exam trap

This exam often tests the misconception that high availability (zones) is equivalent to low latency for global users, but zones only provide redundancy within a region, not reduced network distance for geographically distributed users.

Full explanation →

530

MCQhard

An organization has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They launched a Compute Engine instance in subnet-a with an internal IP 10.0.1.2 and a public IP. They want the instance to only allow HTTPS traffic from the internet. Which firewall rule should they create?

A.Ingress rule: allow tcp:0-65535, source 0.0.0.0/0, target tag 'https-server'

B.Egress rule: allow tcp:443, destination 0.0.0.0/0, target tag 'https-server'

C.Ingress rule: allow tcp:443, source 10.0.0.0/16, target tag 'https-server'

D.Ingress rule: allow tcp:443, source 0.0.0.0/0, target tag 'https-server'

AnswerD

This rule correctly allows inbound HTTPS from any source to instances with the tag.

Why this answer

The instance needs to accept incoming HTTPS traffic (TCP port 443) from the internet. An ingress firewall rule with source 0.0.0.0/0 allows traffic from any external IP, and applying it to instances with the target tag 'https-server' ensures only tagged instances are affected. This matches the requirement to allow only HTTPS from the internet.

Exam trap

The trap here is that candidates often confuse ingress vs. egress rules or mistakenly restrict the source to the VPC range (10.0.0.0/16) thinking it includes the internet, when in fact it only allows traffic from within the VPC.

How to eliminate wrong answers

Option A is wrong because it allows all TCP ports (0-65535) from the internet, which violates the requirement to allow only HTTPS traffic (port 443). Option B is wrong because it is an egress rule, which controls outbound traffic from the instance, not inbound HTTPS traffic from the internet. Option C is wrong because it restricts the source to the internal VPC range (10.0.0.0/16), which blocks all internet traffic and does not meet the requirement for allowing HTTPS from the internet.

Full explanation →

531

MCQeasy

A developer accidentally deleted a bucket in Cloud Storage. The bucket had object versioning enabled. How can the bucket and its objects be restored?

A.Contact Cloud Support to restore the bucket from the undisclosed backup within a limited time window.

B.Restore the bucket from the Trash in the Cloud Console.

C.Enable bucket lock and then undo deletion.

D.Use the gsutil ls -a command to list deleted buckets and gsutil cp to restore.

AnswerA

Google can restore deleted buckets within a short period.

Why this answer

When a Cloud Storage bucket is deleted, even with versioning enabled, the bucket itself is removed along with its objects. Google Cloud does not provide a self-service restore option for deleted buckets; instead, it maintains an internal, undisclosed backup for a limited time (typically 7 days). Only Cloud Support can initiate the restoration process from this backup, making Option A the correct approach.

Exam trap

Google Cloud often tests the misconception that versioning provides a safety net for bucket deletion, but versioning only protects objects within an existing bucket—it does not prevent or undo the deletion of the bucket itself.

How to eliminate wrong answers

Option B is wrong because Cloud Storage does not have a 'Trash' feature for buckets; the Trash in Cloud Console is for Compute Engine resources like VM instances, not for storage buckets. Option C is wrong because bucket lock is a feature for retention policies (e.g., preventing object deletion or modification), not for undoing a bucket deletion; once a bucket is deleted, there is no 'undo deletion' operation. Option D is wrong because the `gsutil ls -a` command lists object versions within an existing bucket, not deleted buckets; there is no `gsutil` command to list or restore a deleted bucket.

Full explanation →

532

MCQmedium

A company has a microservices architecture on GKE. One service is failing due to resource exhaustion. How can they proactively prevent this?

A.Use vertical pod autoscaling.

B.Set up autoscaling based on CPU utilization.

C.Configure a horizontal pod autoscaler with custom metrics.

D.Implement a cluster autoscaler.

AnswerC

Custom metrics (e.g., memory usage, request queue depth) provide early detection of resource exhaustion and allow proactive horizontal scaling before failures occur.

Why this answer

A horizontal pod autoscaler with custom metrics (e.g., memory, request queue depth) can detect resource exhaustion early and scale pods before failure. Option A (vertical pod autoscaling) may not react fast enough or may not scale horizontally, which is needed for stateless microservices. Option B (CPU-based autoscaling) may not capture all types of resource exhaustion (e.g., memory leaks).

Option D (cluster autoscaler) scales nodes, not pods, so it does not directly address pod-level resource exhaustion.

Full explanation →

533

Matchingmedium

Match each GCP data processing service to its use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Stream and batch data processing (Apache Beam)

Managed Hadoop and Spark clusters

Asynchronous messaging for event ingestion

Visual data integration pipelines

Workflow orchestration (Apache Airflow)

Why these pairings

Dataflow is for unified stream/batch processing, Dataproc manages Spark/Hadoop, BigQuery is a serverless data warehouse, Pub/Sub is for messaging. Common confusions include mixing Dataflow with Dataproc and BigQuery with Pub/Sub.

Full explanation →

534

MCQeasy

A developer needs to store a database password securely and access it from a Cloud Run service. Which Google Cloud service should they use?

A.Cloud Storage

B.Firestore

C.Secret Manager

D.Cloud KMS

AnswerC

Secret Manager is designed for storing secrets with versioning and IAM.

Why this answer

Secret Manager securely stores secrets like passwords, API keys, and certificates. It integrates with Cloud Run via volume mounts or environment variables.

Full explanation →

535

Multi-Selecteasy

You need to enable high availability for a new Cloud SQL for MySQL instance. Which TWO configurations must you set? (Choose 2)

Select 2 answers

A.Set the 'cloudsql.mysql' database flag for HA

B.Create a read replica in a different region

C.Enable automatic backups

D.Select the 'High availability (regional)' option when creating the instance

E.Enable binary logging

AnswersC, D

Automatic backups are required for HA failover and point-in-time recovery.

Why this answer

To enable HA for Cloud SQL, you must create a regional instance (which automatically provisions a standby in a different zone) and ensure automatic backups are enabled (required for failover and PITR). Read replicas are for read scaling, not HA. Binary logging is for replication and PITR, but it is enabled by default for HA instances.

Database flags are not required for HA.

Full explanation →

536

MCQhard

A global gaming company deploys a leaderboard service using Cloud Spanner with a single-region configuration. They need a Recovery Point Objective (RPO) of 5 seconds and a Recovery Time Objective (RTO) of 1 minute in the event of a regional outage. What should they do?

A.Set up a cross-region read replica using Cloud SQL.

B.Use Compute Engine instances in multiple zones with a global load balancer to replicate data.

C.Configure cross-region backups with a 5-second recovery window.

D.Deploy Cloud Spanner in a multi-region configuration.

AnswerD

Multi-region Spanner provides synchronous replication across regions, enabling automatic failover with RPO near zero and RTO within minutes.

Why this answer

Cloud Spanner multi-region configurations provide automatic synchronous replication across regions, achieving RPO of near zero seconds and RTO of minutes (failover is automatic). Single-region does not provide cross-region failover. Multi-region is required for such low RPO/RTO.

Backups are point-in-time and slower to restore. Compute Engine is irrelevant.

Full explanation →

537

MCQeasy

A company needs to store secrets such as API keys and database passwords securely and access them from Compute Engine instances. Which service provides secret storage with built-in IAM integration and automatic rotation?

A.Secret Manager

B.Cloud HSM

C.Cloud Storage

D.Cloud KMS

AnswerA

Correct. Secret Manager is purpose-built for secrets.

Why this answer

Secret Manager is the correct service for storing secrets with IAM and versioning. It also supports rotation via Cloud Functions or Pub/Sub.

Full explanation →

538

Multi-Selectmedium

A company is designing a highly available application on GCE. Which TWO steps should they take to ensure reliability?

Select 2 answers

A.Use a global external HTTP(S) load balancer.

B.Use a managed instance group with autohealing.

C.Configure health checks that check the application endpoint.

D.Use persistent disks without snapshots.

E.Deploy instances in a single zone to avoid latency.

AnswersB, C

Automatically replaces unhealthy instances.

Why this answer

A managed instance group (MIG) with autohealing automatically replaces unhealthy VM instances based on health check results, ensuring the application remains available even if individual instances fail. This is a core reliability pattern for stateless applications on Compute Engine, as it provides self-healing infrastructure without manual intervention.

Exam trap

Google Cloud often tests the distinction between load balancing (traffic distribution) and instance-level recovery (autohealing), causing candidates to incorrectly select a global load balancer as the sole reliability measure without recognizing the need for health-check-driven instance replacement.

Full explanation →

539

MCQhard

An engineer is designing a Bigtable schema for time-series data consisting of sensor readings. Each sensor emits a reading every second. The access pattern is to retrieve all readings for a specific sensor within a time range. Which row key design will provide the best performance?

A.Use row key: [sensor_id]#[reverse_timestamp]

B.Use a single row per sensor with column qualifiers as timestamps

C.Use timestamp as the row key and sensor ID as column qualifier

D.Use a random prefix to distribute writes evenly

AnswerA

This ensures all readings for a sensor are close together and sorted by timestamp, optimizing range scans.

Why this answer

Bigtable stores rows sorted by key. A row key structured as [sensor_id]#[reverse_timestamp] ensures that all data for a sensor is contiguous, and sorting by reverse timestamp allows recent data to be retrieved first. A single row key per sensor with column qualifiers would cause hotspots and limit scalability.

Full explanation →

540

MCQmedium

A company is using Cloud SQL for PostgreSQL and needs to run a one-time heavy analytical query that takes over 30 minutes and uses 100% CPU. The production database is serving user traffic with high QPS. What should the company do to run the query without impacting production?

A.Run the query directly on the primary instance during low traffic hours.

B.Create a read replica of the production instance and run the query on the replica.

C.Use Cloud SQL's pgBouncer to pool connections and queue the query.

D.Create a clone of the production instance and run the query on the clone.

AnswerB

Read replicas are designed for offloading read-only workloads.

Why this answer

A read replica in Cloud SQL for PostgreSQL is a separate instance that asynchronously replicates data from the primary. Running the heavy analytical query on the replica offloads the CPU-intensive workload from the production primary, ensuring user-facing traffic with high QPS is not impacted. The replica can handle read-only queries without affecting the primary's performance or availability.

Exam trap

Google Cloud often tests the distinction between a read replica (which offloads read traffic) and a clone (which is a point-in-time copy not kept in sync), leading candidates to choose the clone option because they confuse it with a replica's ability to handle production queries without impact.

How to eliminate wrong answers

Option A is wrong because even during low traffic hours, a query using 100% CPU on the primary instance will still degrade performance for any concurrent user requests, risking latency spikes or timeouts. Option C is wrong because pgBouncer is a connection pooler that manages database connections, not a query scheduler or resource isolator; it cannot queue or throttle a single heavy query to prevent CPU saturation. Option D is wrong because a clone creates a new primary instance from a snapshot, which requires provisioning time and does not provide ongoing replication; it is suitable for testing or development but not for running a one-time query without impacting production, as the clone is not kept in sync and the heavy query still runs on a separate instance that does not offload the primary's workload.

Full explanation →

541

MCQeasy

Your company runs a critical application on Compute Engine instances in a managed instance group across three zones. The application writes logs to local disk. You are asked to improve the reliability of log retention and ensure logs are available in case of instance failure. You have already configured a health check that automatically recreates instances. However, after a recent zonal outage, logs from the affected instances were lost. You need to implement a solution that preserves logs even when instances are terminated. What should you do?

A.Increase the size of the local SSD to accommodate more logs and set a longer retention period.

B.Configure each instance to write logs to a persistent disk that is retained after instance deletion.

C.Install the Cloud Logging agent on each instance and configure it to stream application logs to Cloud Logging.

D.Mount a Cloud Storage bucket using gcsfuse on each instance and write logs directly to the bucket.

AnswerC

Cloud Logging provides centralized, durable log storage independent of instance lifecycle.

Why this answer

The Cloud Logging agent streams logs directly to Cloud Logging (now part of Google Cloud's operations suite), which stores logs independently of the Compute Engine instances. This ensures logs are preserved even if instances are terminated due to a zonal outage or health check recreation, as logs are sent to a centralized, durable logging service rather than being stored on local disk.

Exam trap

Google Cloud often tests the misconception that persistent disks or Cloud Storage buckets are sufficient for log durability, but the key requirement is centralized log management with automatic streaming, which only Cloud Logging provides without additional complexity or latency.

How to eliminate wrong answers

Option A is wrong because increasing local SSD size and retention period does not protect logs from instance termination; local SSDs are ephemeral and their data is lost when an instance is deleted or recreated. Option B is wrong because persistent disks are not automatically retained after instance deletion unless the 'delete-on-terminate' flag is set to false, and even then, logs would be tied to a specific disk that may not survive a zonal outage if not replicated; the question requires a solution that works across instance failures, not just disk retention. Option D is wrong because while gcsfuse can mount a Cloud Storage bucket, writing logs directly to a bucket introduces latency and potential consistency issues, and the bucket is not a log management solution; Cloud Logging is purpose-built for log ingestion, analysis, and retention.

Full explanation →

542

MCQeasy

You want to create a log-based alert in Cloud Logging that triggers when a specific error message appears in application logs. What is the first step?

A.Create a logs-based metric that filters for the error message

B.Configure a Pub/Sub notification channel for alerts

C.Create a log sink to export logs to Cloud Storage

D.Set up an alerting policy directly on the log entries without a metric

AnswerA

A logs-based metric is required to track the error count.

Why this answer

To create a log-based alert, you first define a logs-based metric that counts occurrences of the error pattern. Then you create an alerting policy that monitors this metric and triggers when the count exceeds a threshold. Notifications are configured in the alerting policy, not the metric.

Full explanation →

543

Multi-Selecthard

A financial services company is designing a multi-tier application on Google Cloud. The application must meet PCI DSS compliance, with data encrypted at rest and in transit. They plan to use Cloud SQL for PostgreSQL for transactional data and Cloud Storage for archival data. Which TWO actions should the architect take to meet compliance requirements?

Select 2 answers

A.Configure client-side encryption in the application code

B.Rely on Google-managed default encryption for all data

C.Enable customer-managed encryption keys (CMEK) on Cloud SQL and Cloud Storage

D.Use VPC Service Controls to restrict data access

E.Use Cloud HSM with a key generated outside of Google Cloud

AnswersC, D

CMEK provides control over key management required for PCI DSS.

Why this answer

Enabling CMEK on Cloud SQL and Cloud Storage allows the company to use their own encryption keys, which is often required by PCI DSS to demonstrate control over key management. CMEK ensures data at rest is encrypted with keys managed via Cloud KMS, providing auditability and separation of duties beyond Google-managed default encryption.

Exam trap

The trap here is that candidates often assume Google-managed default encryption is sufficient for PCI DSS, but the exam tests the nuance that many compliance frameworks require customer-managed keys (CMEK) to demonstrate control over the encryption process, not just encryption itself.

Full explanation →

544

MCQmedium

A company runs a web application on Google Kubernetes Engine (GKE) with Cluster Autoscaler enabled. During a traffic spike, the application becomes slow and some requests timeout. The cluster has sufficient CPU and memory headroom. What is the most likely cause and solution?

A.Increase the node pool's machine type to a larger size.

B.Enable Cluster Autoscaler to add more nodes.

C.Deploy the application in a regional cluster for higher availability.

D.Configure Horizontal Pod Autoscaler (HPA) based on CPU utilization or custom metrics.

AnswerD

HPA automatically scales pods based on load, resolving the timeout issue.

Why this answer

The cluster has sufficient CPU and memory headroom, indicating that the issue is not about cluster capacity but about pod-level scaling. The Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU utilization or custom metrics, which directly addresses the application slowdown and timeouts during traffic spikes by distributing the load across more pods.

Exam trap

Google Cloud often tests the distinction between node-level scaling (Cluster Autoscaler) and pod-level scaling (HPA), trapping candidates who assume that adding more nodes is the solution when the cluster already has headroom, whereas the real issue is insufficient pod replicas to handle the load.

How to eliminate wrong answers

Option A is wrong because increasing the node pool's machine type addresses node-level resource constraints, but the cluster already has sufficient CPU and memory headroom, so the bottleneck is at the pod level, not the node level. Option B is wrong because Cluster Autoscaler is already enabled and the cluster has headroom, so adding more nodes would not solve the problem of insufficient pod replicas to handle the traffic spike. Option C is wrong because deploying in a regional cluster improves availability and resilience to zone failures, but does not directly address the performance degradation and timeouts caused by insufficient application instances during a traffic spike.

Full explanation →

545

Multi-Selectmedium

Your organization is moving a legacy monolithic application to Google Kubernetes Engine (GKE). The application currently runs on a single virtual machine with a local MySQL database. You need to design a cloud-native architecture that improves scalability and reliability. Which two actions should you take? (Choose TWO.)

Select 2 answers

A.Deploy the entire application in a single container with a large custom machine type to handle load.

B.Refactor the application into microservices and deploy each as a separate deployment in GKE.

C.Expose the application using a simple Service of type LoadBalancer with round-robin distribution.

D.Use Cloud SQL for MySQL instead of running the database in the same cluster.

E.Use a single Pod with multiple containers that communicate via localhost to reduce latency.

AnswersB, D

Microservices allow independent scaling and faster deployments.

Why this answer

Refactoring the monolithic application into microservices and deploying each as a separate Deployment in GKE aligns with cloud-native principles, enabling independent scaling, fault isolation, and easier updates. This approach improves scalability and reliability by allowing each microservice to scale horizontally based on demand, and failures in one service do not cascade to others.

Exam trap

Google Cloud often tests the misconception that simply containerizing a monolith or using a larger machine type is sufficient for cloud-native scalability, when in fact true scalability requires decoupling components into independently scalable units and separating stateful services like databases.

Full explanation →

546

MCQeasy

An engineer runs the above command and sees two firewall rules that allow SSH access. A security review requires that SSH access be allowed only from the bastion subnet 10.0.1.0/24. What should the engineer do to meet the requirement?

A.Add a firewall rule with priority 500 that denies SSH from all IPs

B.Change the priority of allow-ssh-ingress to 2000

C.Delete the allow-ssh-ingress rule

D.Remove the target tag 'ssh-allowed' from allow-ssh-from-bastion

AnswerC

Deleting the overly permissive rule leaves only the bastion-specific rule, meeting the requirement.

Why this answer

The allow-ssh-ingress rule has a higher priority (lower number) than the allow-ssh-from-bastion rule, allowing SSH from any source IP. Deleting this rule ensures that only the lower-priority rule (allow-ssh-from-bastion) remains, which restricts SSH access to the bastion subnet 10.0.1.0/24. In Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence, so the allow-ssh-ingress rule (priority 1000) overrides the allow-ssh-from-bastion rule (priority 2000) for any traffic matching both.

Exam trap

Google Cloud often tests the misconception that adding a deny rule with a higher priority (lower number) will block unwanted traffic while preserving the allow rule, but candidates forget that the deny rule would also block the intended bastion traffic, breaking the requirement.

How to eliminate wrong answers

Option A is wrong because adding a deny rule with priority 500 would block SSH from all IPs, including the bastion subnet, since deny rules take precedence over allow rules at the same or lower priority; this would break the requirement to allow SSH from the bastion. Option B is wrong because changing the priority of allow-ssh-ingress to 2000 would make it equal to the allow-ssh-from-bastion rule, but both would still allow SSH from all IPs (since allow-ssh-ingress has no source restriction), and with equal priority the evaluation order is undefined, potentially still allowing unwanted access. Option D is wrong because removing the target tag 'ssh-allowed' from allow-ssh-from-bastion would prevent that rule from applying to any instances, effectively blocking all SSH access, including from the bastion subnet.

Full explanation →

547

MCQhard

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. Recently, they experienced a targeted attack that bypassed Cloud Armor's predefined rules. The attack involved a high rate of legitimate-looking requests from a small set of IPs that made the application unresponsive. The team needs to block the attack quickly without affecting legitimate users. What should they do?

A.Increase the load balancer's capacity to absorb the attack.

B.Configure rate limiting with a threshold based on the normal traffic pattern.

C.Enable Google Cloud Armor Adaptive Protection.

D.Add the attacking IPs to a Cloud Armor deny list.

AnswerC

Adaptive Protection learns normal traffic patterns and automatically blocks anomalous high-rate requests.

Why this answer

Cloud Armor Adaptive Protection uses machine learning to analyze traffic patterns and automatically create tailored rules to block application-layer DDoS attacks that bypass predefined rules. In this scenario, the attack consists of legitimate-looking requests from a small set of IPs, which Adaptive Protection can detect as anomalous and generate a custom signature to block without manual intervention, preserving access for legitimate users.

Exam trap

The trap here is that candidates may choose Option D (adding IPs to a deny list) because it seems like a quick fix, but Google Cloud tests the understanding that Cloud Armor Adaptive Protection is the correct automated solution for application-layer DDoS attacks with legitimate-looking traffic, not manual IP blocking.

How to eliminate wrong answers

Option A is wrong because increasing the load balancer's capacity only absorbs volumetric attacks but does not address the application-layer nature of this attack; the high rate of legitimate-looking requests will still exhaust application resources regardless of capacity. Option B is wrong because configuring rate limiting with a threshold based on normal traffic patterns requires prior knowledge of those patterns and may inadvertently block legitimate users if the threshold is set too low, or fail to block the attack if the threshold is too high; it also does not leverage Cloud Armor's adaptive capabilities. Option D is wrong because adding the attacking IPs to a deny list is reactive and assumes the IPs are static; the attack may use rotating IPs or spoofed addresses, making manual deny lists ineffective and unsustainable for a rapid response.

Full explanation →

548

MCQmedium

A company is deploying a web application on Compute Engine behind a global HTTP(S) load balancer. They want to restrict access to only traffic from specific IP ranges. Which load balancer feature should they use?

A.Cloud Armor security policies.

B.VPC firewall rules.

C.Identity-Aware Proxy (IAP).

D.Cloud CDN.

AnswerA

Cloud Armor can allow/deny traffic based on IP.

Why this answer

Cloud Armor security policies are the correct choice because they allow you to define IP-based allow/deny rules at the edge of Google's network, directly integrated with the global HTTP(S) load balancer. This provides granular access control based on source IP ranges before traffic reaches your backend instances, which is exactly what the requirement specifies.

Exam trap

The trap here is that candidates often confuse VPC firewall rules with Cloud Armor, assuming that firewall rules can filter on the original client IP behind a load balancer, but in reality, VPC firewall rules only see the load balancer's proxy IPs, making Cloud Armor the only viable option for IP-based access control at the edge.

How to eliminate wrong answers

Option B is wrong because VPC firewall rules operate at the instance level (network interface) and cannot filter traffic based on the original client IP when a global HTTP(S) load balancer is used, as the load balancer's health check and proxy IPs are seen instead. Option C is wrong because Identity-Aware Proxy (IAP) controls access based on user identity and context (e.g., Google accounts, OAuth), not on source IP ranges, and is designed for application-layer authentication, not network-layer IP filtering. Option D is wrong because Cloud CDN is a content delivery network that caches content at edge locations to improve latency and reduce load, and it does not provide any IP-based access control or security policy enforcement.

Full explanation →

549

MCQmedium

A team is using Cloud Build to deploy a microservice to Cloud Run. They want to ensure that only containers built from a specific trusted branch in their source repository are deployed to production. Which Cloud Build feature should they use?

A.Binary Authorization attestors

B.Cloud Build trigger branch filtering

C.Cloud Deploy delivery pipeline approvals

D.Artifact Registry IAM permissions

AnswerB

Cloud Build triggers can be scoped to specific branches using regex, ensuring only trusted branches trigger builds.

Why this answer

Cloud Build triggers can be configured to respond only to specific branches (e.g., 'main' or 'release/*'). By setting the trigger's included files filter and branch regex, they can restrict builds to that branch. Artifact Registry controls access to container images, but does not restrict deployment by branch.

Cloud Deploy is a separate service for progressive delivery. Binary Authorization enforces policies at deployment time but does not filter by branch.

Full explanation →

550

MCQeasy

A company wants to restrict access to a Cloud Storage bucket so that only a specific service account can read objects. The bucket contains sensitive data. Which identity and access management (IAM) approach should the architect use?

A.Grant the service account roles/iam.serviceAccountUser on the bucket.

B.Use a signed URL to allow access for the service account.

C.Grant the service account roles/storage.admin on the bucket.

D.Grant the service account roles/storage.objectViewer on the bucket and remove all other bindings.

AnswerD

This restricts read access to only the service account.

Why this answer

The principle of least privilege dictates that the service account should be granted only the minimal permissions required to read objects, which is roles/storage.objectViewer. By removing all other bindings, the bucket becomes accessible exclusively to that service account, ensuring that no other identities (users, groups, or other service accounts) can read the sensitive data. This approach directly enforces the requirement using IAM roles on the bucket resource.

Exam trap

Google Cloud often tests the misconception that granting a broad role like roles/storage.admin is acceptable for simplicity, but the trap here is that candidates overlook the principle of least privilege and the specific read-only requirement, leading them to choose an overly permissive role.

How to eliminate wrong answers

Option A is wrong because roles/iam.serviceAccountUser grants permission to impersonate the service account (e.g., to run jobs as that account), not to read objects from a Cloud Storage bucket; it does not provide any storage access. Option B is wrong because signed URLs are used to grant temporary access to specific objects for any user (including non-Google accounts) via a cryptographic signature, not to restrict access to a specific service account; they are not an IAM-based access control mechanism. Option C is wrong because roles/storage.admin grants full control over the bucket, including the ability to delete objects and modify bucket metadata, which violates the principle of least privilege and exceeds the read-only requirement.

Full explanation →

551

MCQeasy

A developer wants to store and retrieve non-relational data with flexible schema and automatic scaling. Which Google Cloud service should they use?

A.Cloud Bigtable.

B.Cloud SQL.

C.Firestore.

D.Cloud Spanner.

AnswerC

Firestore is NoSQL with flexible schema and auto-scaling.

Why this answer

Firestore is a NoSQL document database that supports flexible schema and automatic scaling, making it ideal for non-relational data. It offers real-time synchronization, offline support, and serverless scaling, which aligns with the requirement for storing and retrieving data without manual sharding or capacity planning.

Exam trap

Google Cloud often tests the distinction between NoSQL databases by presenting Cloud Bigtable as a trap for 'non-relational' requirements, but candidates overlook that Bigtable is optimized for analytical workloads with fixed column families, not for flexible schema and automatic scaling in transactional applications.

How to eliminate wrong answers

Option A is wrong because Cloud Bigtable is a wide-column NoSQL database designed for large analytical workloads (e.g., time-series, IoT) with high throughput, but it does not support flexible schema in the same way as Firestore (it requires predefined column families) and is not optimized for transactional, real-time client-side access. Option B is wrong because Cloud SQL is a fully managed relational database service (MySQL, PostgreSQL, SQL Server) that enforces a fixed schema and does not automatically scale beyond its instance limits without manual resizing or read replicas. Option D is wrong because Cloud Spanner is a globally distributed relational database that provides strong consistency and horizontal scaling, but it requires a predefined schema and SQL-based relational model, making it unsuitable for non-relational data with flexible schema.

Full explanation →

552

MCQhard

A company runs a critical web application behind an external HTTPS load balancer. The backend consists of a managed instance group of Compute Engine instances. Users report intermittent 502 Bad Gateway errors. The load balancer logs show occasional health check failures for some instances. The instances have a custom health check endpoint that returns a 200 status code only if the application is fully healthy. The application logs do not show any errors, and CPU/memory usage on the instances is normal. What should be the first troubleshooting step to identify the root cause?

A.Change the health check to a TCP check on the application's port

B.Increase the health check check interval and decrease the unhealthy threshold

C.Increase the number of instances in the managed instance group

D.Check the application's logs on the instances to see why the health check endpoint sometimes returns non-200

AnswerD

Correct. The health check endpoint is custom and returns a 200 only when fully healthy. Since instances appear normal, checking the application logs will reveal why the endpoint sometimes returns non-200.

Why this answer

The health check endpoint is custom and returns 200 only when the application is fully healthy. Since the instances show normal CPU/memory and application logs show no errors, the intermittent 502 errors and health check failures might be due to the health check endpoint itself returning non-200 sporadically. The first troubleshooting step is to examine the application logs on the instances to understand why the health check endpoint sometimes fails.

This will pinpoint the specific condition causing the health check to fail. Option A is incorrect because a TCP check would not validate application health and could mask the problem. Option B is incorrect because increasing the interval and decreasing the unhealthy threshold would delay detection or make it more sensitive, not address the root cause.

Option C is incorrect because adding instances does not fix the health check issue; it only spreads traffic if some instances are unhealthy.

Exam trap

The trap is to assume that normal CPU/memory and no application errors mean the instances are healthy; however, the health check endpoint itself may be the source of the problem due to a bug or misconfiguration.

Full explanation →

553

MCQhard

A media company uses Cloud CDN with an HTTP(S) Load Balancer to serve video content from Cloud Storage. After a month, they notice increased costs due to high cache miss rates. Analysis shows that many requests include a unique query parameter for analytics tracking. What is the most effective way to improve cache hit ratio while preserving analytics data?

A.Configure a custom cache key on the backend bucket to exclude the analytics parameter

B.Move the content to a different Cloud Storage bucket with no caching

C.Increase the minimum TTL on the backend bucket to 1 hour

D.Disable caching for requests with query parameters

AnswerA

Excluding the analytics parameter from the cache key ensures all requests for the same content share one cache entry, increasing hit ratio.

Why this answer

When query parameters are unique per request (like tracking IDs), they cause cache misses. The solution is to define a cache key that ignores that specific parameter, so the same content is cached once. Setting a custom cache key on the backend bucket is the correct approach.

Disabling CDN or increasing TTL does not solve the parameter issue. Removing caching altogether would hurt performance and increase egress costs.

Full explanation →

554

MCQmedium

A company runs a monolithic application on Compute Engine. They want to modernize by moving to microservices on Google Kubernetes Engine (GKE) to improve deployment frequency and resource utilization. However, they are concerned about the increased operational complexity. Which approach best balances modernization benefits with operational overhead?

A.Keep the monolithic application on Compute Engine and use Cloud Monitoring to optimize resource utilization.

B.Migrate all application components to Cloud Run and use Cloud Tasks for asynchronous communication.

C.Rewrite the entire application as microservices and deploy on GKE with Istio for service mesh.

D.Identify stateless components to migrate to Cloud Run, and keep stateful components on GKE with managed services like Cloud Spanner.

AnswerD

Balances modernization with reduced complexity by using serverless where appropriate.

Why this answer

It pragmatically balances modernization benefits with operational overhead by migrating only stateless components to Cloud Run (a fully managed serverless platform that reduces operational complexity) while keeping stateful components on GKE with managed services like Cloud Spanner. This approach improves deployment frequency and resource utilization without requiring a full rewrite, and it leverages Cloud Run's automatic scaling and zero infrastructure management to minimize operational burden.

Exam trap

Google Cloud often tests the misconception that full microservices migration (Option C) is always the best modernization path, but the trap here is that candidates overlook the operational overhead of service mesh and full rewrites, failing to recognize that a hybrid approach using serverless for stateless components reduces complexity while still achieving modernization goals.

How to eliminate wrong answers

Option A is wrong because it fails to modernize the architecture—keeping the monolithic application on Compute Engine does not improve deployment frequency or resource utilization, and Cloud Monitoring alone cannot address the core issues of monolithic scaling and slow deployments. Option B is wrong because migrating all application components to Cloud Run is impractical for stateful workloads (Cloud Run is stateless by design, with no persistent local storage), and Cloud Tasks alone does not solve the complexity of managing stateful services or inter-service communication in a microservices architecture. Option C is wrong because rewriting the entire application as microservices and deploying on GKE with Istio introduces significant operational overhead (service mesh configuration, sidecar proxies, and increased complexity) that contradicts the goal of balancing modernization benefits with operational overhead, and it ignores the possibility of a phased migration.

Full explanation →

555

Multi-Selectmedium

A company wants to monitor the performance of their microservices deployed on Cloud Run. They need to capture request latencies and error rates, and also trace requests across services. Which TWO services should they use?

Select 2 answers

A.Cloud Trace

B.Error Reporting

C.Cloud Profiler

D.Cloud Logging

E.Cloud Monitoring

AnswersA, E

Cloud Trace provides distributed tracing to capture request latencies across services.

Why this answer

Cloud Monitoring collects metrics like latency and error rates and can create dashboards and alerts. Cloud Trace collects latency data across services for distributed tracing.

Full explanation →

556

MCQmedium

A team needs to run load tests against their application deployed on GKE to validate performance under peak traffic. They want to simulate 100,000 concurrent users generating HTTP requests. Which tool should they use?

Answer options not yet available.

Why this answer

Cloud Load Testing tools (formerly known as Cloud Load Testing) can simulate large numbers of concurrent users generating HTTP requests against GKE deployments. Locust is an open-source tool, but the question asks for a Google Cloud tool. The managed service scales better for large tests.

Full explanation →

557

MCQmedium

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) and de-identify the data before loading it into BigQuery. Which Google Cloud service should they use?

A.Cloud DLP

B.Cloud Dataprep

C.Cloud Composer

D.Cloud Data Fusion

AnswerA

Cloud DLP is designed for inspecting and de-identifying sensitive data.

Why this answer

Cloud Data Loss Prevention (DLP) API can inspect data for PII and de-identify it using techniques like masking, tokenization, or bucketing.

Full explanation →

558

MCQeasy

Refer to the exhibit. A DevOps engineer created this Terraform configuration to deploy a Compute Engine instance. After applying, they notice the instance is not accessible from the internet. What is the most likely cause?

A.The machine type e2-medium does not support public IP addresses.

B.The instance is not attached to a VPC network.

C.No firewall rule allows ingress traffic to the instance.

D.The boot disk size is too small to run the operating system.

AnswerC

Firewall rules are needed to allow inbound traffic; the default network may not have appropriate rules.

Why this answer

The most likely cause is that no firewall rule allows ingress traffic to the instance. By default, GCP instances are created with a VPC network that has implied deny-all ingress rules, and unless a specific firewall rule (e.g., allowing tcp:22 for SSH or tcp:80 for HTTP) is applied to the instance's network tags or service account, all inbound traffic from the internet is blocked. The Terraform configuration shown in the exhibit likely omitted a `google_compute_firewall` resource or did not assign the necessary network tags to the instance.

Exam trap

Google Cloud often tests the misconception that assigning a public IP automatically makes an instance internet-accessible, but the trap here is that without a corresponding ingress firewall rule, the instance remains isolated regardless of the public IP.

How to eliminate wrong answers

Option A is wrong because the machine type e2-medium fully supports public IP addresses; public IP assignment is controlled by the `access_config` block in the Terraform resource, not by the machine type. Option B is wrong because every Compute Engine instance is automatically attached to a default VPC network unless explicitly overridden; the exhibit does not indicate any misconfiguration that would leave the instance networkless. Option D is wrong because the boot disk size (e.g., 10 GB default) is sufficient for most operating systems; the issue is about network accessibility, not disk capacity.

Full explanation →

559

MCQmedium

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

A.Firestore

B.Cloud Bigtable

C.Cloud Spanner

D.BigQuery

AnswerB

Bigtable is the correct choice: wide-column NoSQL, designed for time-series and IoT workloads, single-digit ms latency, and scales to millions of QPS with additional nodes.

Why this answer

Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

Full explanation →

560

MCQmedium

Refer to the exhibit. An engineer is reviewing health check logs for a target pool. The instance web-01 is still serving traffic despite two consecutive unhealthy health checks. Why is the instance not removed from the target pool?

A.The health check's timeoutSec is too high, causing delayed removal.

B.The forwarding rule is not using the target pool, so health checks have no effect.

C.The healthyThreshold is set to 2, requiring two healthy checks before re-adding, but the instance only had one healthy check.

D.The instance was removed after the second failure but then re-added after the next healthy check, so it is serving traffic again.

AnswerD

The instance was marked unhealthy after two consecutive failures, but the next health check succeeded, so it was re-added to the target pool.

Why this answer

The instance was removed from the target pool after the second consecutive unhealthy health check, but it was immediately re-added after the next healthy health check. This happens when the health check's `unhealthyThreshold` is set to 2, meaning two consecutive failures trigger removal, but the instance then passes a subsequent health check, causing it to be re-added and resume serving traffic. The logs show the instance is still serving traffic because it was removed and then re-added within the same monitoring window.

Exam trap

In Google Cloud, the health check's `unhealthyThreshold` determines how many consecutive failures before an instance is removed from the target pool. A common mistake is thinking that a low `healthyThreshold` prevents re-addition, but in fact, after removal, a single healthy check (if `healthyThreshold` is 1) will immediately re-add the instance. Candidates often overlook the immediate re-addition, expecting a delay or more healthy checks.

How to eliminate wrong answers

Option A is wrong because a high `timeoutSec` would delay the health check response, not cause the instance to be re-added after removal; it would simply make the health check slower to detect failures. Option B is wrong because the forwarding rule is explicitly associated with the target pool (as per the exhibit), so health checks do affect the target pool's instance membership. Option C is wrong because `healthyThreshold` controls how many consecutive healthy checks are required before an instance is considered healthy again, not the removal process; removal is governed by `unhealthyThreshold`, which is set to 2 in this scenario.

Full explanation →

561

MCQmedium

A company has a requirement to store application logs for 7 years for compliance. They are using Cloud Logging. What is the most cost-effective way to retain logs?

A.Set the log bucket retention to 7 years

B.Export logs to Cloud Storage with Object Lifecycle management to delete after 7 years

C.Export logs to BigQuery and run scheduled queries to delete old data

D.Use Cloud Logging's default retention and rely on backups

AnswerB

Cloud Storage is cost-effective for long-term retention with lifecycle rules.

Why this answer

Cloud Logging's default retention is limited (e.g., 30 days for logs in the default _Default bucket, and up to 365 days for custom log buckets). To meet a 7-year compliance requirement cost-effectively, you should export logs to Cloud Storage and use Object Lifecycle Management to delete objects after 7 years. Cloud Storage offers lower long-term storage costs than retaining logs in Logging's _Required or custom buckets, and lifecycle rules automate deletion without ongoing compute costs.

Exam trap

The trap here is that candidates assume Cloud Logging's retention settings can be extended arbitrarily, but the exam tests knowledge that log buckets have a hard 365-day maximum (except _Required at 400 days), making export to Cloud Storage with lifecycle rules the only viable long-term, cost-effective solution.

How to eliminate wrong answers

Option A is wrong because Cloud Logging log buckets have a maximum retention period of 365 days (1 year) for custom buckets, and the _Required bucket retains logs for 400 days; you cannot set a retention of 7 years directly in a log bucket. Option C is wrong because BigQuery storage costs are significantly higher than Cloud Storage for long-term archival, and running scheduled queries to delete old data incurs additional query costs and complexity. Option D is wrong because Cloud Logging's default retention (e.g., 30 days for _Default, 400 days for _Required) does not meet the 7-year requirement, and backups are not a native retention mechanism for compliance.

Full explanation →

562

MCQmedium

A company wants to implement an event-driven architecture where uploads to a Cloud Storage bucket trigger processing in a serverless function. The function must process each object within a few seconds and handle bursts of thousands of uploads. Which service should they use?

A.Google Kubernetes Engine

B.Cloud Run for Anthos

C.Compute Engine with autoscaling

D.Cloud Functions

AnswerD

Cloud Functions natively supports Cloud Storage triggers and auto-scales for bursts.

Why this answer

Cloud Functions is the correct choice because it is a fully managed, event-driven serverless compute service that natively triggers on Cloud Storage bucket events (e.g., object finalize/create). It automatically scales from zero to thousands of concurrent invocations within seconds, meeting the burst requirement, and has a maximum timeout of 9 minutes (well above the 'few seconds' requirement).

Exam trap

Candidates often mistakenly think that container-based or VM-based services like GKE, Cloud Run for Anthos, or Compute Engine can handle event-driven bursts as efficiently as Cloud Functions, ignoring the cold-start latency and management overhead.

How to eliminate wrong answers

Option A is wrong because Google Kubernetes Engine (GKE) is a container orchestration platform that requires cluster management, node autoscaling, and is not event-driven by default; it would need additional components like Cloud Storage triggers and Pub/Sub to achieve the same result, adding latency and complexity. Option B is wrong because Cloud Run for Anthos is a hybrid/multi-cloud container platform that runs on GKE clusters, inheriting the same overhead and not providing native Cloud Storage event triggers without extra configuration. Option C is wrong because Compute Engine with autoscaling requires managing virtual machine instances, installing runtime dependencies, and configuring scaling policies; it cannot scale from zero to thousands in seconds due to instance startup times (typically 30-90 seconds) and is not event-driven without additional polling or Pub/Sub integration.

Full explanation →

563

MCQmedium

A company uses BigQuery for analytics and has a large number of ad-hoc queries from different teams. Costs are rising unpredictably. They want to control costs while maintaining query performance. What should they do?

A.Use partitioning and clustering to reduce data scanned.

B.Reduce the number of slots available to each team.

C.Require each team to include a cost code in their queries.

D.Purchase flat-rate slots and assign them to a reservation for each team.

AnswerD

Flat-rate provides predictable cost and performance isolation.

Why this answer

Purchasing flat-rate slots and assigning them to a reservation for each team provides predictable, fixed-cost capacity for BigQuery. This eliminates the unpredictability of on-demand pricing while allowing teams to share a dedicated pool of slots, ensuring consistent query performance without unexpected cost spikes.

Exam trap

Google Cloud often tests the misconception that performance optimization techniques (like partitioning/clustering) alone can control costs, when in fact they only reduce per-query data scanned but do not cap total spending under on-demand pricing.

How to eliminate wrong answers

Option A is wrong because partitioning and clustering reduce data scanned per query, which lowers on-demand costs, but they do not cap total spending or prevent cost spikes from high query volumes; costs remain unpredictable if usage surges. Option B is wrong because reducing the number of slots available to each team would degrade query performance and cause queuing, violating the requirement to maintain performance; slots are a resource, not a cost control mechanism. Option C is wrong because requiring a cost code in queries only adds metadata for tracking and chargeback, but does not control or cap the actual compute costs incurred; it provides visibility, not cost control.

Full explanation →

564

MCQeasy

A company wants to connect their on-premises data center to Google Cloud with a dedicated, low-latency, and highly available connection. They need bandwidth of 10 Gbps. Which option should they choose?

A.Classic VPN

B.HA VPN over the public internet

C.Partner Cloud Interconnect

D.Dedicated Cloud Interconnect

AnswerD

Provides dedicated, high-bandwidth (10 Gbps), low-latency connections with SLA.

Why this answer

Dedicated Cloud Interconnect provides direct physical connections between on-premises and Google's network with speeds up to 100 Gbps per link. It offers high availability and low latency. HA VPN is over the public internet, Partner Interconnect depends on a partner, and Classic VPN is older.

Full explanation →

565

Multi-Selecthard

A company wants to optimize their cloud spending on Google Cloud. They have a mix of workloads including batch processing, real-time analytics, and web serving. Which TWO strategies should they implement to reduce costs without significant architectural changes? (Choose two.)

Select 2 answers

A.Use sustained use discounts for short-lived instances.

B.Use preemptible VMs for batch processing jobs that are fault-tolerant.

C.Purchase committed use discounts for 1-year or 3-year terms for stable workloads.

D.Right-size all Compute Engine instances by analyzing utilization metrics.

E.Migrate all web serving workloads to Cloud Functions to benefit from pay-per-use pricing.

AnswersB, C

Preemptible VMs are cost-effective for fault-tolerant workloads.

Why this answer

Preemptible VMs are short-lived, fault-tolerant instances that cost significantly less than standard VMs, making them ideal for batch processing jobs that can handle interruptions. This strategy directly reduces compute costs without requiring architectural changes, as the workloads are already designed to be resilient to failures.

Exam trap

The trap here is that candidates often confuse sustained use discounts (which require long-running instances) with preemptible VMs (which are for short-lived, fault-tolerant workloads), or they assume right-sizing is a 'no-change' strategy when it typically involves instance type modifications that affect architecture.

Full explanation →

566

MCQmedium

A company deploys a web application on Compute Engine behind a Global HTTPS Load Balancer. They need to restrict access to the application based on the client's IP address. Which Google Cloud service should they use?

A.VPC firewall rules

B.Identity-Aware Proxy (IAP)

C.Cloud Armor

D.Cloud CDN

AnswerC

Cloud Armor provides IP-based access control and DDoS protection for load balancers.

Why this answer

Cloud Armor is the correct choice because it provides IP-based access control at the edge of Google's network, integrated directly with the Global HTTPS Load Balancer. It allows you to create security policies with IP allow/deny rules that are evaluated before traffic reaches your Compute Engine instances, making it the appropriate service for client IP restriction at the load balancer level.

Exam trap

The trap here is that candidates often confuse VPC firewall rules with edge security, not realizing that VPC firewall rules cannot see the original client IP when a Global Load Balancer is in front, making Cloud Armor the only option for IP-based access control at the load balancer level.

How to eliminate wrong answers

Option A is wrong because VPC firewall rules operate at the instance network interface level, not at the load balancer edge, and they cannot inspect the original client IP address when traffic passes through a Global HTTPS Load Balancer (the source IP becomes the load balancer's IP). Option B is wrong because Identity-Aware Proxy (IAP) controls access based on user identity and context (e.g., OAuth2, device security), not on client IP addresses; it is designed for authentication and authorization, not network-layer IP filtering. Option D is wrong because Cloud CDN is a content delivery network service that caches content at edge locations to improve latency and reduce load; it does not provide IP-based access control or security policy enforcement.

Full explanation →

567

MCQeasy

A developer wants to run a stateless HTTP API that automatically scales based on incoming request traffic. The API is packaged as a Docker container. They want to minimize operational overhead and only pay for resources when the API is handling requests. Which service should they use?

A.App Engine Standard

B.Google Kubernetes Engine (GKE) Autopilot

C.Compute Engine with managed instance groups

D.Cloud Run

AnswerD

Cloud Run fully manages scaling and billing per request, ideal for stateless containers.

Why this answer

Cloud Run is a fully managed serverless container platform that automatically scales, including scaling to zero, and bills per request. GKE requires cluster management. Compute Engine requires VM management.

App Engine Standard does not support custom containers.

Full explanation →

568

MCQmedium

After deploying the above configuration, the application is not receiving traffic from the Kubernetes Service. The Service is correctly configured to target port 8080. What is the most likely issue?

A.The initialDelaySeconds for readiness probe is too short; increase it.

B.The port name is not defined; add a name to the container port.

C.The readiness probe is using HTTP but the container may not be ready on that path; change to TCP.

D.The image pull policy is not set to Always; new pods may use stale image.

E.The liveness probe uses tcpSocket; it should be HTTPGet.

AnswerC

If /healthz is not served, the probe fails and pod is not ready.

Why this answer

The readiness probe is configured as an HTTP GET request, but the application container may not be serving traffic on the specified HTTP path at startup. If the application listens on a TCP port but does not respond to HTTP GET on that path, the readiness probe will fail, causing the Service to not route traffic to the Pod. Changing the readiness probe to a TCP socket check ensures the probe only verifies that the port is open, which is more reliable when the application does not expose an HTTP endpoint for health checks.

Exam trap

Google Cloud often tests the distinction between readiness and liveness probes, and the trap here is that candidates confuse a failing readiness probe with a liveness probe issue, or assume that any HTTP probe is better than TCP without considering the application's actual behavior.

How to eliminate wrong answers

Option A is wrong because the initialDelaySeconds for the readiness probe being too short would cause the probe to start too early, potentially failing temporarily, but the application would eventually become ready; the issue described is that the application never receives traffic, indicating a persistent probe failure, not a timing issue. Option B is wrong because the port name is optional for Service targeting; the Service correctly targets port 8080 by number, so a missing port name does not prevent traffic routing. Option D is wrong because the image pull policy not being set to Always does not affect traffic routing; it only controls when the image is pulled, and stale images would still run and serve traffic if the container starts.

Option E is wrong because the liveness probe using tcpSocket is valid and does not affect traffic routing; the liveness probe is for restarting the container, not for Service traffic distribution.

Full explanation →

569

MCQmedium

A firewall rule is configured to allow inbound TCP traffic on ports 80 and 443 from the IP ranges 203.0.113.0/24 and 198.51.100.0/24 to instances with the tag 'web-server'. Which traffic will this rule allow?

A.Outbound TCP traffic on ports 80 and 443 from instances with tag 'web-server' to IP ranges

B.Inbound TCP traffic on ports 80 and 443 from IP ranges to all instances

C.Inbound TCP traffic on ports 80 and 443 from any IP address to instances with tag 'web-server'

D.Inbound TCP traffic on ports 80 and 443 from IP ranges to instances with tag 'web-server'

AnswerD

Matches the rule definition exactly.

Why this answer

The rule in question is an inbound firewall rule that allows TCP traffic on ports 80 and 443 from specific IP ranges to instances with the tag 'web-server'. Therefore, option D correctly describes the traffic allowed by this rule.

Exam trap

Google Cloud often tests the distinction between inbound and outbound rules and the scope of source/destination, where candidates mistakenly choose a rule that allows traffic from any IP or to all instances instead of the specific tagged group.

How to eliminate wrong answers

Option A is wrong because it describes outbound traffic, but the rule is for inbound traffic (implied by the direction of traffic flow in the question). Option B is wrong because it allows traffic to all instances, not just those with the 'web-server' tag, which is too permissive and does not match the rule's target. Option C is wrong because it allows traffic from any IP address, whereas the rule restricts sources to specific IP ranges, not any IP.

Full explanation →

570

Multi-Selecteasy

An engineer needs to troubleshoot a production issue on a Compute Engine instance. They suspect the instance is running out of memory. Which THREE actions should they take to diagnose the problem? (Choose THREE.)

Select 3 answers

A.SSH into the instance and run 'free -m' to check memory usage

B.Check Cloud Logging for OOM (out-of-memory) kernel messages

C.Increase the instance's memory by changing the machine type

D.Create a snapshot of the boot disk

E.View the instance's memory utilization metric in Cloud Monitoring

AnswersA, B, E

Running commands directly on the instance gives real-time memory usage.

Why this answer

Common troubleshooting involves checking instance metrics (Cloud Monitoring), analyzing logs (Cloud Logging), and connecting to the instance to run commands.

Full explanation →

571

MCQmedium

A company runs a web application on Compute Engine behind a Global HTTPS Load Balancer. Users report slow page loads, especially for static assets. The development team wants to cache content closer to users without modifying code. Which GCP service should they enable?

A.Cloud CDN

B.Cloud NAT

C.Cloud Armor

D.Cloud DNS

AnswerA

Cloud CDN caches static and dynamic content at Google's edge locations, reducing latency by serving content from a PoP near the user.

Why this answer

Cloud CDN uses Google's global edge cache to deliver content close to users. It can be enabled on the load balancer backend buckets (for Cloud Storage) or backend services (for Compute Engine). Cloud Armor is for security, Cloud DNS for domain resolution, and Cloud NAT for outbound connectivity.

Full explanation →

572

MCQmedium

A company uses preemptible VMs for batch processing. They notice that during peak hours, many instances are terminated before finishing their tasks. The operations team observes the output shown in the exhibit. Which action would best improve job completion rates without significantly increasing costs?

A.Increase the number of instances to compensate for terminations

B.Use sole-tenant nodes for these instances

C.Use instance groups with a mix of preemptible and regular VMs

D.Use committed use discounts for 1 year

E.Switch to regular VMs for critical jobs

AnswerC

Combines cost savings of preemptible with reliability of regular VMs.

Why this answer

Using a mixed instance group with both preemptible and regular VMs allows the batch processing job to continue on regular VMs when preemptible VMs are terminated during peak hours. This balances cost and reliability: preemptible VMs handle most of the workload at low cost, while regular VMs act as a fallback to ensure job completion without the full expense of switching entirely to regular VMs.

Exam trap

Google Cloud often tests the misconception that simply adding more preemptible VMs or switching entirely to regular VMs is the solution, but the correct answer requires a hybrid approach that balances cost and reliability using instance groups with a mix of VM types.

How to eliminate wrong answers

Option A is wrong because simply increasing the number of preemptible instances does not address the root cause of terminations during peak hours; it only increases the likelihood of more terminations and may lead to higher costs from repeated restarts. Option B is wrong because sole-tenant nodes provide dedicated hardware but do not prevent preemption; they are used for compliance or licensing, not for improving job completion rates of preemptible VMs. Option D is wrong because committed use discounts require a 1-year commitment and apply to regular VMs, not preemptible VMs, so they would increase costs without solving the termination issue.

Option E is wrong because switching all critical jobs to regular VMs would significantly increase costs, as regular VMs are more expensive than preemptible VMs, and the question asks for an improvement without significantly increasing costs.

Full explanation →

573

MCQmedium

A DevOps engineer needs to grant a CI/CD pipeline (running in a different Google Cloud project) the ability to deploy resources into a target project. The pipeline uses a service account. What is the best way to grant this access?

A.Use VPC peering to allow cross-project access.

B.Use Cloud NAT to enable communication.

C.Add the service account email as a member of the target project with appropriate roles.

D.Create a new service account in the target project and share the key with the pipeline.

AnswerC

Why this answer

IAM allows granting roles to a service account principal from another project by specifying the full email of the service account as a member.

Full explanation →

574

Multi-Selectmedium

A company runs a latency-sensitive web application on Compute Engine with a managed instance group (MIG) behind an HTTP load balancer. They want to reduce latency for users in Europe and Asia. Which THREE actions should they take?

Select 3 answers

A.Use a regional external load balancer for each region

B.Enable Cloud CDN to cache static content

C.Use a global external HTTP(S) Load Balancer

D.Use preemptible VMs to reduce costs in non-primary regions

E.Deploy managed instance groups in multiple regions (e.g., europe-west1, asia-east1)

AnswersB, C, E

CDN caches content at edge locations, reducing latency for repeated requests.

Why this answer

Creating MIGs in multiple regions and using a global HTTP Load Balancer distributes traffic to the closest region. Cloud CDN caches static content at edge locations, reducing latency. Enabling auto-scaling ensures there are enough instances to handle traffic.

Using a single regional load balancer would not serve multiple regions efficiently. Preemptible VMs are not suitable for latency-sensitive workloads.

Full explanation →

575

MCQeasy

A company wants to restrict data exfiltration from its Google Cloud projects by preventing resources from copying data to external IP addresses. Which service should they use?

A.HTTPS Load Balancer

B.VPC Service Controls

C.Cloud Armor

D.Cloud NAT

AnswerB

VPC Service Controls create a security perimeter around resources to prevent data exfiltration.

Why this answer

VPC Service Controls is the correct choice because it creates a security perimeter around Google Cloud resources, such as BigQuery or Cloud Storage, and prevents data exfiltration by blocking access from outside the perimeter or to external IP addresses. It enforces context-aware access policies that can deny egress traffic to non-permitted destinations, directly addressing the requirement to restrict copying data to external IPs.

Exam trap

A common misconception is that Cloud NAT provides security for outbound traffic, but it actually enables outbound connectivity and does not prevent data exfiltration to external IPs. Candidates often confuse outbound internet access with exfiltration prevention.

How to eliminate wrong answers

Option A is wrong because an HTTPS Load Balancer distributes incoming traffic and does not enforce egress data exfiltration controls; it operates at Layer 7 for ingress only. Option C is wrong because Cloud Armor provides web application firewall (WAF) and DDoS protection for incoming HTTP/S traffic, not egress data exfiltration prevention. Option D is wrong because Cloud NAT allows resources without external IPs to initiate outbound connections to the internet, which would actually facilitate data exfiltration rather than prevent it.

Full explanation →

576

Multi-Selectmedium

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the cluster can automatically scale based on custom metrics, such as the number of pending requests per pod. Which two steps should they take? (Choose TWO)

Select 2 answers

A.Deploy the Metrics Server in the cluster to expose custom metrics via the Custom Metrics API.

B.Modify the application to expose custom metrics via an endpoint and configure the HPA to reference the custom metric.

C.Enable the Cloud Monitoring API and create a custom dashboard to track pending requests.

D.Configure a HorizontalPodAutoscaler (HPA) with the target average CPU utilization set to 80%.

E.Enable GKE Autopilot mode to automatically manage scaling based on custom metrics.

AnswersA, B

The Metrics Server provides the Custom Metrics API, enabling HPA to use custom metrics.

Why this answer

The Metrics Server is required to expose custom metrics via the Custom Metrics API in GKE. Without it, the HorizontalPodAutoscaler (HPA) cannot retrieve the custom metrics needed for scaling decisions. Option B is correct because the application must expose custom metrics (e.g., pending requests) through an endpoint, and the HPA must be configured to reference that custom metric name to trigger scaling based on that specific value.

Exam trap

The trap here is confusing the Metrics Server (which exposes resource metrics) with the need for a custom metrics adapter; candidates often think the Metrics Server alone handles custom metrics, but it only serves CPU/memory, not application-level custom metrics like pending requests.

Full explanation →

577

MCQmedium

A company wants to encrypt data at rest in Cloud Storage using a key that they generate and manage themselves, not stored in Google Cloud. Which encryption type should they use?

A.Default encryption

B.Cloud HSM

C.CSEK

D.CMEK with Cloud KMS

AnswerC

Why this answer

CSEK (Customer-Supplied Encryption Keys) allows customers to provide their own encryption keys for Cloud Storage objects, which are used and then discarded by GCP.

Full explanation →

578

MCQmedium

A company wants to allow developers to create service accounts in a project but prevent them from granting the 'roles/iam.serviceAccountUser' role to any user. Which organization policy constraint should they set?

A.Set the constraint 'iam.restrictGrantableRoles' to ['roles/iam.serviceAccountUser'].

B.Set the constraint 'iam.allowedPolicyMemberDomains' to include only the company's domain.

C.Set the constraint 'iam.disableServiceAccountKeyCreation' to True.

D.Set the constraint 'iam.workloadIdentityPoolProviders' to deny all.

AnswerA

This constraint prevents granting the specified role, even if the user has permission to grant roles.

Why this answer

The 'iam.restrictGrantableRoles' organization policy constraint limits which roles can be granted to principals. By setting this constraint to include only 'roles/iam.serviceAccountUser', developers are allowed to create service accounts but are prevented from granting that specific role to any user. This constraint operates at the organization, folder, or project level and restricts the set of roles that can be granted in IAM policies, effectively blocking the assignment of the listed roles.

Exam trap

A common trap is confusing 'iam.restrictGrantableRoles' with 'iam.disableServiceAccountKeyCreation' because both relate to service accounts but address entirely different security controls. The former controls role granting, while the latter controls key creation.

How to eliminate wrong answers

Option B is wrong because 'iam.allowedPolicyMemberDomains' restricts which external domains can be members of IAM policies, not which roles can be granted; it does not prevent granting a specific role like 'roles/iam.serviceAccountUser'. Option C is wrong because 'iam.disableServiceAccountKeyCreation' only prevents the creation of service account keys, not the granting of roles to users. Option D is wrong because 'iam.workloadIdentityPoolProviders' controls which external identity providers can be used for workload identity federation, not the granting of IAM roles within a project.

Full explanation →

579

MCQhard

A company is using Cloud Armor with HTTP Load Balancing to protect a web application. They want to block traffic from specific IP ranges for all requests except those that include a valid reCAPTCHA token. Which Cloud Armor rule configuration should they use?

A.Use a rate-based rule to limit requests from those IP ranges and add a reCAPTCHA action.

B.Create a whitelist rule for the IP ranges and attach it as a deny rule with higher priority.

C.Create a deny rule for the IP ranges with a condition that the request does not contain a valid reCAPTCHA token.

D.Use Identity-Aware Proxy (IAP) to block the IPs and reCAPTCHA for others.

AnswerC

Deny unless token present; token evaluation via Cloud Armor rules.

Why this answer

Cloud Armor security rules support boolean conditions using operators like `request.path` or custom headers. By creating a deny rule for the specific IP ranges with a condition that the request does not contain a valid reCAPTCHA token (evaluated via the `hasRecaptchaToken()` function), you allow traffic from those IPs only when the token is present. This directly implements the requirement without affecting other traffic.

Exam trap

The trap here is confusing Cloud Armor's rule-based conditional logic with rate limiting or identity-based access controls, leading candidates to choose rate-based rules (A) or IAP (D) instead of recognizing that a deny rule with a condition on reCAPTCHA token presence directly solves the requirement.

How to eliminate wrong answers

Option A is wrong because rate-based rules limit request frequency, not block IP ranges based on reCAPTCHA presence; they would still allow some requests without a token. Option B is wrong because a whitelist rule allows traffic by default, and attaching it as a deny rule with higher priority contradicts the whitelist concept; Cloud Armor evaluates rules by priority, and a deny rule for those IPs would block all traffic regardless of reCAPTCHA. Option D is wrong because IAP is an identity and access management layer for authentication, not a network-level IP blocking mechanism; it cannot conditionally block IPs based on reCAPTCHA tokens.

Full explanation →

580

Multi-Selecteasy

A company is designing a data processing pipeline in Google Cloud that must be HIPAA compliant. Which three security features should they implement? (Choose three.)

Select 3 answers

A.Encrypt data in transit using TLS

B.Enable Data Loss Prevention (DLP) for data classification

C.Use Cloud CDN for faster delivery

D.Implement VPC Service Controls to prevent data exfiltration

E.Use Cloud HSM for encryption keys

AnswersA, D, E

Required by HIPAA for data in transit.

Why this answer

Encrypting data in transit using TLS is a mandatory security control for HIPAA compliance because it protects electronic protected health information (ePHI) from interception during transmission over networks. TLS 1.2 or higher ensures that data moving between clients, services, and Google Cloud endpoints is encrypted, meeting the HIPAA Security Rule requirement for integrity and confidentiality of ePHI in transit.

Exam trap

The trap here is that candidates confuse data classification tools like DLP with mandatory security controls, or mistake performance features like Cloud CDN for compliance requirements, when HIPAA specifically requires encryption, access controls, and audit trails.

Full explanation →

581

MCQmedium

A company stores infrequently accessed data in Cloud Storage Standard class. To reduce costs, they want to automatically move objects older than 90 days to a lower-cost storage class. Which approach should they use?

A.Configure a lifecycle policy to transition to Archive class

B.Use gsutil rewrite to manually change storage class

C.Set up Pub/Sub notifications for object changes

D.Enable object versioning

AnswerA

Lifecycle policies automatically move objects to lower-cost classes based on rules.

Why this answer

Cloud Storage lifecycle policies allow automatic transitions between storage classes based on conditions like age. Setting a rule to transition from Standard to Nearline, Coldline, or Archive after 90 days is the correct approach. Object versioning keeps multiple versions but doesn't change class.

Pub/Sub notifications notify events but don't act. gsutil rewrite can be scripted but is manual.

Full explanation →

582

MCQhard

A company uses Assured Workloads to meet FedRAMP compliance. They need to ensure that only authorized personnel can access data access audit logs for their projects. Which IAM role should they grant to the security team?

A.roles/logging.privateLogViewer

B.roles/logging.viewer

C.roles/iam.securityReviewer

D.roles/logging.admin

AnswerA

This role grants read access to Data Access audit logs and Admin Activity logs, which is the minimum required.

Why this answer

Data Access audit logs require the 'roles/logging.privateLogViewer' role (or equivalent) to view. Admin Activity logs are visible with 'roles/logging.viewer' or higher.

Full explanation →

583

MCQeasy

A company is migrating a legacy monolithic application to Google Cloud. The application currently runs on a single on-premises server and uses a local MySQL database. The company wants to minimize changes to the application code while improving scalability and reliability. Which migration strategy should the architect recommend?

A.Refactor the application into microservices and deploy on Google Kubernetes Engine.

B.Rehost the application on Compute Engine and use Cloud SQL for MySQL as the database.

C.Containerize the application with Docker and run it on Cloud Run.

D.Migrate the database to Firestore and rewrite the application to use Firestore APIs.

AnswerB

Rehosting on Compute Engine with Cloud SQL minimizes changes and improves scalability and reliability.

Why this answer

Rehosting (lift-and-shift) the monolithic application to Compute Engine with Cloud SQL for MySQL minimizes code changes while improving scalability and reliability. Cloud SQL provides managed MySQL with automated backups, replication, and failover, addressing the need for reliability without requiring application refactoring.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing containerization or microservices, forgetting that the primary constraint is minimizing code changes, not modernizing the architecture.

How to eliminate wrong answers

Option A is wrong because refactoring into microservices and deploying on GKE introduces significant code changes and complexity, contradicting the requirement to minimize changes. Option C is wrong because containerizing with Docker and running on Cloud Run requires the application to be stateless and HTTP-driven, which a legacy monolithic app with a local MySQL database typically is not; Cloud Run also does not support stateful workloads or persistent MySQL connections natively. Option D is wrong because migrating to Firestore and rewriting the application to use Firestore APIs requires substantial code changes and a shift from SQL to NoSQL, violating the minimize-changes constraint.

Full explanation →

584

MCQhard

An organization wants to enforce that all Compute Engine VMs are created with specific disk encryption keys. Which policy mechanism should they use?

A.Organization policies with constraints/compute.restrictDiskEncryptionKeyTypes

B.IAM roles with compute.diskEncryptionKey permissions

C.VPC Service Controls

D.Cloud Scheduler to check compliance

AnswerA

Enforces allowed encryption key types at the org level.

Why this answer

The Organization Policy constraint `constraints/compute.restrictDiskEncryptionKeyTypes` allows administrators to enforce that all Compute Engine VMs must use specific disk encryption key types (e.g., CMEK or CSEK). This policy is evaluated at resource creation time and blocks any VM that does not comply with the allowed key types, providing a preventive control rather than a reactive one.

Exam trap

The trap here is confusing IAM permissions (who can do something) with Organization Policy constraints (what is allowed to be done), leading candidates to choose IAM roles instead of the correct policy mechanism.

How to eliminate wrong answers

Option B is wrong because IAM roles with `compute.diskEncryptionKey` permissions control who can set or view encryption keys, but they do not enforce which key types must be used on VMs; IAM is an authorization mechanism, not a policy enforcement mechanism. Option C is wrong because VPC Service Controls are designed to protect data exfiltration by controlling access to Google Cloud APIs from outside a VPC perimeter, not to enforce disk encryption key types on Compute Engine VMs. Option D is wrong because Cloud Scheduler is a cron-like job scheduler that can trigger compliance checks, but it is a reactive, after-the-fact mechanism and cannot prevent non-compliant VM creation in real time.

Full explanation →

585

Multi-Selecthard

A financial services company must meet PCI DSS compliance requirements for a Google Kubernetes Engine (GKE) cluster processing credit card data. Which TWO actions are required to help achieve PCI DSS compliance? (Choose two.)

Select 2 answers

A.Enable GKE Dataplane V2 for network policy enforcement.

B.Enable Shielded GKE nodes.

C.Configure Cloud Audit Logs for the cluster.

D.Use GKE Sandbox for all untrusted workloads.

E.Enable Binary Authorization on the cluster.

AnswersB, E

Shielded nodes provide verifiable integrity of the node's boot and kernel, a PCI DSS requirement.

Why this answer

Shielded GKE nodes provide verifiable integrity of the node's operating system and boot process, which is essential for PCI DSS requirements related to protecting cardholder data against tampering. Shielded nodes use UEFI firmware, Secure Boot, and measured boot to ensure that only signed and trusted software runs on the node, helping to meet the 'Protect Cardholder Data' and 'Maintain a Vulnerability Management Program' objectives.

Exam trap

Google PCA often tests the distinction between 'required' and 'recommended' security controls; the trap here is that candidates may confuse optional security features like GKE Sandbox or Dataplane V2 with mandatory PCI DSS requirements, when in fact PCI DSS focuses on node integrity (Shielded nodes) and software supply chain security (Binary Authorization).

Full explanation →

586

MCQhard

An organization uses Cloud SQL for MySQL in a production environment. They need to ensure high availability with automatic failover in case of a zonal failure. Which configuration should they use?

A.Create a read replica in a different region.

B.Create a regional Cloud SQL instance with automatic failover.

C.Export the database daily and import into a new instance if failure occurs.

D.Deploy Cloud SQL across multiple regions using cross-region replication.

AnswerB

Regional instances provide a synchronous standby in another zone and automatic failover.

Why this answer

A regional Cloud SQL instance with automatic failover uses a primary and a standby zone within the same region, with synchronous replication between them. If the primary zone fails, Cloud SQL automatically promotes the standby to primary, ensuring high availability without data loss. This configuration meets the requirement for automatic failover during a zonal failure.

Exam trap

The trap here is that candidates confuse cross-region replication (available for other database engines) with the zonal high-availability feature for Cloud SQL for MySQL, or assume that a read replica can be used for automatic failover when it requires manual promotion.

How to eliminate wrong answers

Option A is wrong because a read replica in a different region provides read scalability and disaster recovery across regions, but it does not support automatic failover for the primary instance; failover would require manual promotion, which is not automatic. Option C is wrong because daily exports and manual imports are a backup and restore strategy, not a high-availability solution; it introduces significant downtime and potential data loss, failing the automatic failover requirement. Option D is wrong because Cloud SQL for MySQL does not support cross-region replication for automatic failover; cross-region replication is available for Cloud SQL for PostgreSQL and SQL Server, but for MySQL, it is limited to read replicas, which do not provide automatic failover.

Full explanation →

587

MCQmedium

A company wants to enforce that all API calls to GCP services from outside their corporate network come through a specific Cloud VPN tunnel. Which GCP service can enforce this policy?

A.VPC Service Controls

B.Cloud NAT

C.Identity-Aware Proxy

D.Cloud Armor

AnswerA

VPC Service Controls can use access levels to restrict API access to specific IP ranges, such as the VPN tunnel's egress IP.

Why this answer

VPC Service Controls with access levels can restrict access based on IP address ranges, including the VPN tunnel's egress IP.

Full explanation →

588

Multi-Selectmedium

A team is designing a disaster recovery plan for a critical application. They need to ensure RPO of less than 1 hour and RTO of less than 4 hours. The application runs on Compute Engine with persistent disks and uses Cloud SQL for MySQL. Which THREE actions should they take? (Choose 3.)

Select 3 answers

A.Deploy a Transfer Appliance to copy data to another region weekly

B.Use a regional managed instance group and rely on Google's automatic failover

C.Store application configuration and scripts in a multi-regional Cloud Storage bucket

D.Configure Cloud SQL cross-region replication to a replica in another region

E.Take regular snapshots of Compute Engine persistent disks and replicate them to another region using Cloud Storage

AnswersC, D, E

A multi-regional bucket ensures configuration is available globally and can be used to bootstrap instances in the DR region.

Why this answer

For Compute Engine, taking regular snapshots and creating instances from them in another region meets RPO/RTO. For Cloud SQL, enabling cross-region replication (asynchronous) provides failover capability. Using a single regional managed instance group does not provide DR across regions.

Transfer Appliance is for bulk data migration, not DR. A multi-region bucket is for storage but not directly for Compute Engine instances.

Full explanation →

589

MCQmedium

A company is migrating an on-premises PostgreSQL database to Cloud SQL with minimal downtime. The database is 1 TB and the network link has 500 Mbps bandwidth. Which migration approach is most appropriate?

A.Set up a Compute Engine instance with PostgreSQL replication and switch over.

B.Use BigQuery Data Transfer Service to replicate data.

C.Export the database as a SQL dump, transfer it to Cloud Storage, and import into Cloud SQL.

D.Use Database Migration Service to perform continuous replication and then promote Cloud SQL.

AnswerD

Database Migration Service supports continuous replication from on-premises to Cloud SQL with minimal downtime.

Why this answer

Database Migration Service (DMS) supports continuous replication from on-premises PostgreSQL to Cloud SQL using native PostgreSQL logical replication (pglogical or native publication/slot). This allows near-zero downtime by keeping the target in sync until promotion, which is ideal for a 1 TB database over a 500 Mbps link where a full dump/restore would take hours.

Exam trap

Google Cloud often tests the misconception that a simple dump-and-import (Option C) is acceptable for large databases, but the trap here is ignoring the 'minimal downtime' requirement, which demands a continuous replication solution like DMS rather than a batch export/import.

How to eliminate wrong answers

Option A is wrong because setting up a Compute Engine instance with PostgreSQL replication requires manual configuration of replication slots, failover scripts, and does not integrate with Cloud SQL's managed service, adding operational overhead and risk. Option B is wrong because BigQuery Data Transfer Service is designed for loading data into BigQuery, not for replicating PostgreSQL databases to Cloud SQL; it cannot perform continuous replication or handle transactional consistency. Option C is wrong because exporting a 1 TB database as a SQL dump and transferring it over a 500 Mbps link would take approximately 4.5 hours (1 TB * 8 / 500 Mbps) plus import time, causing significant downtime, and it does not support continuous replication for minimal downtime.

Full explanation →

590

Multi-Selecthard

A company wants to deploy a stateful application with strict low-latency requirements across multiple zones in a single region. They need to minimize inter-zone latency. Which THREE actions should they take? (Choose 3)

Select 3 answers

A.Place application instances in the same zone to minimize network hops

B.Use zonal SSD persistent disks

C.Deploy instances in a managed instance group across multiple zones

D.Use a regional internal TCP/UDP load balancer

E.Use Dedicated Interconnect for on-premises connection

AnswersA, B, D

Same zone reduces latency.

Why this answer

Placing all application instances in the same zone eliminates cross-zone network hops, which directly reduces inter-zone latency to near zero. For a stateful application with strict low-latency requirements, this co-location ensures that traffic between instances stays within a single failure domain, avoiding the additional latency introduced by traversing zone boundaries.

Exam trap

The trap here is that candidates often assume multi-zone deployment is always required for high availability, but the question explicitly prioritizes minimizing inter-zone latency, making same-zone placement the correct choice despite the trade-off in fault tolerance.

Full explanation →

591

MCQhard

A team runs a Cloud Spanner instance with a regional configuration. They need to increase write throughput for a global user base but are concerned about cost. What should they do?

A.Add more nodes to the instance

B.Use global indexes

C.Migrate to Cloud Firestore in Datastore mode

D.Switch to a multi-region configuration

AnswerA

Adding nodes increases both read and write throughput linearly.

Why this answer

Adding nodes increases throughput and cost proportionally. Switching to multi-region increases latency for writes (due to synchronous replication) and cost. Using global indexes won't increase baseline write throughput.

Recommending to use Firestore is not correct for this scenario.

Full explanation →

592

MCQeasy

A company runs a batch job every night that processes large CSV files stored in Cloud Storage. The job runs on a single Compute Engine VM and takes 4 hours to complete. The team wants to reduce execution time without increasing cost substantially. The job is CPU-intensive and can be parallelized. What should they do?

A.Migrate the job to Dataproc and run it as a Spark job.

B.Use Cloud Batch to run the job as a batch job that automatically scales.

C.Use a VM with more vCPUs and a higher CPU platform.

D.Split the input files into smaller chunks and use multiple VMs in a managed instance group with a job scheduler.

AnswerD

Parallelizing across multiple VMs reduces execution time with linear cost increase.

Why this answer

Splitting the input files into smaller chunks and using multiple VMs in a managed instance group with a job scheduler effectively parallelizes the CPU-intensive batch job without significantly increasing cost. This approach leverages existing Compute Engine resources and scales horizontally using multiple smaller, cost-effective VMs. Option A (Dataproc with Spark) introduces managed service overhead and potential cluster costs, which may increase expenses.

Option B (Cloud Batch) provides autoscaling but still requires the user to design parallelization and may not be as cost-efficient for this specific workload. Option C (using a VM with more vCPUs) increases cost due to vertical scaling and may not provide proportional performance gains. Thus, D is the most suitable choice.

Full explanation →

593

MCQhard

A company uses GKE Standard with node pools of preemptible VMs for batch jobs. They notice that during preemption events, pods take several minutes to become ready on new nodes because container images are large. They need to reduce startup time. Which approach is most effective?

A.Switch to GKE Autopilot.

B.Increase the size of the node pool.

C.Configure a DaemonSet to pre-pull the container image on all nodes.

D.Use a stateful set with persistent volumes to reuse data.

AnswerC

Pre-pulling ensures images are cached, significantly reducing startup time.

Why this answer

GKE with node auto-provisioning and a node pool of preemptible VMs using a daemonset to pre-pull images on all nodes ensures images are cached locally, reducing startup time after preemption.

Full explanation →

594

Multi-Selecthard

Which THREE factors should be considered when selecting a machine series for a Compute Engine instance running a memory-intensive batch job?

Select 3 answers

A.Network throughput.

B.Sustained use discount.

C.GPU availability.

D.Memory per vCPU ratio.

E.vCPU count.

AnswersA, D, E

Batch jobs often involve data transfer; higher throughput reduces time.

Why this answer

Network throughput (A) is a critical factor for a memory-intensive batch job because such jobs often involve reading or writing large datasets from persistent storage or other sources over the network. The instance series must provide sufficient network bandwidth to avoid I/O bottlenecks that could extend job completion time, even if the compute and memory resources are adequate.

Exam trap

Google Cloud often tests the distinction between factors that influence technical workload performance (like network throughput and memory ratio) versus cost-saving mechanisms (like sustained use discounts) that are applied automatically and do not affect the suitability of a machine series.

Full explanation →

595

Multi-Selectmedium

A company wants to connect their on-premises network to Google Cloud with high availability and bandwidth up to 10 Gbps. They need a dedicated connection with a Service Level Agreement (SLA). Which TWO options should they consider? (Choose TWO.)

Select 2 answers

A.Cloud Dedicated Interconnect

B.Classic VPN

C.Cloud CDN

D.Cloud Partner Interconnect

E.HA VPN

AnswersA, D

Dedicated Interconnect provides direct physical connection with up to 10 Gbps per circuit and SLA.

Why this answer

Cloud Interconnect provides dedicated connections with an SLA. Dedicated Interconnect offers 10 Gbps or more and is a physical connection. Partner Interconnect also provides dedicated bandwidth through a partner, but Classic VPN and HA VPN are over the internet and do not have a bandwidth SLA or dedicated connection.

Full explanation →

596

MCQmedium

A company uses Cloud Storage for backups of on-premises databases. They want to ensure that data is protected against accidental deletion or modification by users. Which combination of features should they enable?

A.Object versioning and lifecycle management to delete old versions.

B.Bucket locking with retention policy and bucket-level IAM restrictions.

C.Bucket locking with retention policy and object holds.

D.Object versioning and bucket locking with retention policy.

E.Object versioning and IAM conditions restricting access to specific IP ranges.

AnswerD

Versioning preserves overwrites; retention policy prevents deletion.

Why this answer

Object versioning protects against accidental deletion or modification by preserving all versions of an object, while a bucket lock with a retention policy enforces a minimum retention period, preventing premature deletion or alteration. Together, they provide both recoverability and immutable compliance, which is essential for backup data integrity.

Exam trap

Google Cloud often tests the misconception that object holds alone provide sufficient immutability, but they are per-object and temporary, whereas a bucket lock with a retention policy provides a bucket-wide, locked-in immutable period that cannot be bypassed even by the bucket owner.

How to eliminate wrong answers

Option A is wrong because lifecycle management to delete old versions actively removes data, which contradicts the goal of protecting against accidental deletion. Option B is wrong because bucket-level IAM restrictions alone do not prevent a user with sufficient permissions from deleting or modifying objects; they lack the versioning-based recovery mechanism. Option C is wrong because object holds are temporary and must be manually applied per object, making them impractical for broad backup protection and not providing the automatic version history that versioning offers.

Option E is wrong because IAM conditions restricting access to specific IP ranges only control network-level access, not the ability to delete or modify objects once accessed, and they do not provide any data recovery or immutability features.

Full explanation →

597

Multi-Selectmedium

A company is using Cloud NAT to allow instances in a private subnet to access the internet for updates. The security team wants to audit outbound connections. Which TWO steps should be taken to enable flow logs for Cloud NAT?

Select 2 answers

A.Enable private Google access on the subnet

B.Configure a log sink to export Cloud NAT logs to BigQuery

C.Enable VPC Flow Logs on the subnet

D.Create a new Cloud NAT gateway with logging enabled

E.Update the existing Cloud NAT gateway to enable flow logs

AnswersB, E

Exporting to BigQuery enables analysis and auditing of the flow logs.

Why this answer

Cloud NAT flow logs provide detailed records of outbound connections and are enabled directly on the Cloud NAT gateway itself. Option B is correct because configuring a log sink to export Cloud NAT logs to BigQuery is a valid step to audit outbound connections, but the primary step to enable logging is to update the existing Cloud NAT gateway to enable flow logs (Option E). Together, these two steps (B and E) allow you to capture and analyze outbound traffic for auditing.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs with Cloud NAT flow logs, thinking that enabling VPC Flow Logs on the subnet will capture NAT traffic, but Cloud NAT flow logs are a distinct feature that must be enabled specifically on the NAT gateway itself.

Full explanation →

598

MCQhard

A financial services company uses Cloud SQL for MySQL for a critical application. They need zero downtime during maintenance and automatic failover across zones. They configured a Cloud SQL instance with high availability (HA). During a recent regional outage, the application experienced 10 minutes of downtime. What should they add to improve availability?

A.Configure a warm standby instance in another region using migration.

B.Create a cross-region replica and promote on failure.

C.Use Cloud SQL Proxy with multiple endpoints.

D.Enable database flags for faster failover detection.

AnswerB

Cross-region replica can be promoted to a new primary to handle regional failures.

Why this answer

A cross-region replica provides a read-replica in a different region that can be promoted to a primary instance during a regional outage, enabling recovery with minimal downtime. This addresses the scenario where a single-region HA configuration (which uses zonal redundancy within the same region) cannot survive a full regional outage, as occurred in the question. Promoting the replica is a manual or automated failover action that restores write capability in the secondary region, reducing downtime from 10 minutes to seconds or minutes depending on replication lag.

Exam trap

The trap here is that candidates assume HA (zonal redundancy) protects against all outages, but the PCA exam tests understanding that HA is regional and cannot survive a full regional failure, requiring cross-region replicas for disaster recovery.

How to eliminate wrong answers

Option A is wrong because configuring a warm standby instance via migration implies a manual, non-automated process that does not provide automatic failover; it also requires additional setup and does not leverage Cloud SQL's built-in cross-region replica feature for seamless promotion. Option C is wrong because Cloud SQL Proxy is a tool for secure connectivity and connection pooling, not for failover or regional redundancy; multiple endpoints do not enable automatic failover across zones or regions. Option D is wrong because database flags for faster failover detection (e.g., innodb_flush_log_at_trx_commit) can improve performance but do not address regional outages; HA failover within a zone is already fast, but the issue is the entire region being unavailable.

Full explanation →

599

MCQmedium

A developer wants to deploy a Cloud Function that is triggered whenever a new object is created in a Cloud Storage bucket. Which trigger type should they choose?

A.Firestore trigger

B.Cloud Storage trigger

C.Pub/Sub trigger

D.HTTP trigger

AnswerB

Cloud Storage triggers allow functions to respond to object lifecycle events like finalize/create.

Why this answer

Cloud Functions can be triggered by Cloud Storage events such as google.storage.object.finalize (object creation). HTTP triggers are for HTTP requests. Pub/Sub triggers for messages.

Firestore triggers for document changes.

Full explanation →

600

Multi-Selectmedium

Which TWO services can be used to create a CI/CD pipeline for a containerized application on Google Cloud? (Choose 2)

Select 2 answers

A.Cloud Deploy

B.Cloud Functions

C.Cloud Build

D.Cloud Scheduler

E.Cloud Run

AnswersA, C

CD component.

Why this answer

Cloud Build builds and tests, and Cloud Deploy promotes releases. Both are essential for CI/CD.

Full explanation →

Page 8 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCA by domain

Target a specific domain to shore up weak areas.

Managing Implementation and Ensuring Solution and Operations Reliability Managing and Provisioning a Solution Infrastructure Designing for Security and Compliance Analysing and Optimising Technical and Business Processes Design and plan a cloud solution architecture Manage and provision cloud infrastructure Design for security and compliance Analyze and optimize technical and business processes Manage implementation of cloud architecture Ensure solution and operations reliability

See all domains with question counts →