CCNA Design and plan a cloud solution architecture Questions

Taints on nodes prevent pods from being scheduled unless the pods have corresponding tolerations. If the other nodes have taints that the nginx pods do not tolerate, the scheduler will only place them on nodes without those taints, which in this case is default-pool-1. This is a common scenario when nodes are dedicated to specific workloads or have special hardware.

Cluster autoscaler and HorizontalPodAutoscaler are complementary controls: the HPA adjusts replica count based on demand signals, and the cluster autoscaler provisions or removes nodes to match the resulting scheduling pressure. This combination gives the retailer elasticity during flash sales and near-zero node cost overnight without manual intervention.

A global external Application Load Balancer delivers a single global anycast IP, terminates TLS at Google's edge, and uses health-checked backends to route to the nearest region. Cloud Armor security policies attach to the backend service and provide DDoS and web application firewall protection. Regional load balancers cannot offer one global IP, and Layer 4 proxy or passthrough load balancers do not terminate HTTP(S) at the edge or support Cloud Armor in the required way.

The frontend pods are CPU-bound during peak hours, causing increased response times. Increasing the number of frontend pods via the Horizontal Pod Autoscaler (HPA) by lowering the target CPU utilization threshold distributes the load across more replicas, directly addressing the bottleneck without additional infrastructure cost. This is the most cost-effective initial step because it leverages existing resources and autoscaling capabilities.

Cloud CDN integrated with a global external Application Load Balancer and a Cloud Storage backend bucket delivers content from Google's global edge, cutting latency for worldwide users and reducing origin egress by serving cached responses. The bucket stays private because only the load balancer's service account is granted read access, so the architecture meets both the caching and privacy requirements.

Separating storage from compute with Cloud Storage and using ephemeral Dataproc clusters lets the team process nightly data without paying for idle infrastructure, while still selecting machine types and cluster sizes per job. Persistent clusters, self-managed Hadoop, and a full BigQuery rewrite each fail at least one requirement around management overhead or preserving existing Spark logic.

The deciding factors are the containerized workload, the lack of Kubernetes skills, and the desire for consumption-based pricing with automatic scaling. Cloud Run accepts a container image, manages all infrastructure, and scales instances up and down with request load, including down to zero when idle. That removes cluster operations entirely while still billing per use, which is exactly the profile the team described.

Workload-scoped, keyless authentication on Compute Engine is achieved by attaching a dedicated service account to the instance template used by the MIG. The metadata server issues short-lived tokens to the application, so no static keys exist to leak or rotate, and the identity disappears with the instances. Granting only roles/storage.objectViewer on the specific bucket enforces least privilege for the reporting workload.

The issue is specifically with Cloud Spanner query latency under high load. Enabling interleaved tables and adding secondary indexes optimizes data locality and query performance, reducing the need for expensive cross-table joins and full table scans. This directly addresses the root cause of increased latency and timeouts in the catalog service.

Google Cloud offers separate global load balancers for different protocols. The global external HTTP(S) load balancer handles HTTP(S) traffic with proximity-based routing, while the global external TCP proxy load balancer handles TCP traffic with global anycast IP and proximity routing. Using both together provides the required support for both protocols in a multi-region architecture.

A private GKE cluster with a private endpoint and public endpoint disabled means the Kubernetes API server is only reachable from within the cluster's VPC network. The developer's workstation is outside the VPC, so attempts to reach the master IP (34.67.89.12) will time out, even though other external IPs are reachable. This is a common configuration for security-sensitive workloads that require the API server to be isolated from the public internet.

Cloud Run is a serverless compute platform that runs stateless containers, scales automatically with traffic, and charges only for resources consumed during request processing. It eliminates infrastructure management, letting the startup focus on code. Its ability to scale to zero and handle variable traffic makes it ideal for a frontend and backend API with unpredictable load.

VPC peering requires bidirectional connections; both sides must initiate peering. IP ranges must not overlap.

Delegating project creation and billing to folder-level roles gives each business unit autonomy while keeping the grant in one place per unit. Applying organization policies at the organization node enforces network and security guardrails through inheritance, so the central team controls every descendant without per-project work. Together these choices satisfy autonomy, central control, and a small number of top-level IAM bindings.

Enabling Cloud CDN caches content at Google's globally distributed edge caches, reducing latency for users in regions far from the origin Compute Engine instances. This directly addresses the high-latency issue without adding complexity, as it requires no changes to the application architecture and is a simple configuration toggle on the load balancer backend bucket or backend service.

It represents a lift-and-shift migration that minimizes code changes by running the monolithic application on Compute Engine instances. The stateful service can use persistent disks for local disk writes, while the stateless web server runs on the same or separate instances, preserving the existing architecture without refactoring.

BigQuery is the correct choice because it is a fully managed, petabyte-scale analytics database that supports standard SQL and integrates with Pub/Sub for real-time data ingestion. It minimizes administration and offers cost-effective pricing, making it ideal for moving an on-premises data warehouse to Google Cloud.

The `--enable-private-ip-google-access` flag allows VM instances in a subnet to reach Google APIs and services (such as Cloud Storage, BigQuery, and Cloud Pub/Sub) using only their internal (private) IP addresses, without needing an external IP address. This works by routing traffic through Google's internal network to the Google Front End (GFE), bypassing the public internet.

The correct choices are to place both tiers in the same VPC with firewall rules restricting traffic, and to enable Private Service Access for Cloud SQL. This ensures internal communication without public internet exposure. Using a single VPC simplifies security, and Private Service Access provides private connectivity to Cloud SQL, meeting the requirement to minimize public exposure.

Read replicas are the native Cloud SQL for MySQL mechanism for horizontal read scaling with asynchronous replication. Because the application tolerates slightly stale data, the replication lag is acceptable, and no code changes are needed beyond pointing read connections at the replica. A high-availability standby is not readable, Firestore requires a rewrite, and vertical scaling does not scale reads horizontally.

Cloud HSM with Cloud KMS provides hardware security module-backed keys that are FIPS 140-2 Level 3 validated. It allows you to control key rotation and use them for encryption at rest across Google Cloud services. Google-managed keys do not give customer control, CMEK with standard Cloud KMS does not guarantee HSM storage, and CSEK requires external key management without HSM integration.

Deploying GKE clusters in multiple regions and using a multicluster ingress with a global external HTTP(S) load balancer enables traffic routing to the closest healthy backend cluster based on latency or geography, and automatically fails over to another region if one becomes unavailable. The global external backend configuration allows the load balancer to distribute traffic across multiple regional GKE clusters, providing both proximity-based routing and high availability.

The scenario calls for delegated administration, separate billing, central networking, and organization-wide guardrails. A hierarchy of folders by business unit and environment lets policy and IAM inherit cleanly, projects give billing and isolation boundaries, and a dedicated shared networking project is the canonical host for shared VPC. Flattening everything, collapsing into one project, or splitting into multiple organizations each breaks at least one of these requirements.

The global external HTTP(S) Load Balancer is the only option that provides global anycast load balancing, URL path-based routing, Google-managed SSL certificates for TLS termination, and integration with Cloud Armor for DDoS protection. It is designed for external HTTP(S) traffic and meets all the stated requirements for a global e-commerce platform.

BigQuery is Google Cloud's fully managed, petabyte-scale analytics data warehouse that supports ANSI SQL and integrates with BI tools. It is serverless, highly scalable, and designed for analytical workloads. Cloud SQL is for transactional databases, Cloud Spanner is for global transactional consistency, and Cloud Bigtable is a NoSQL database for high-throughput applications, none of which are optimized for petabyte-scale SQL analytics.

Preemptible VMs (now called Spot VMs) are Compute Engine instances that last up to 24 hours and can be terminated at any time by Google Cloud. Because the batch jobs are interruptible, using preemptible VMs reduces compute costs by up to 60-91% compared to standard on-demand VMs, directly meeting the goal of minimizing costs.

The global external Application Load Balancer is the only listed option that combines managed edge TLS termination, custom hostname support through Google-managed certificates, and URL-map-based path routing to multiple backends. Because it is a fully managed global proxy, it scales automatically and removes the operational burden of running reverse-proxy VMs, satisfying both the functional and operational requirements.

Restoring to an existing instance may overwrite data; best practice is to restore to a new instance.

Regional managed instance groups (MIGs) with internal load balancing are correct because they keep all compute instances within a single region, minimizing network hops and latency between components. Internal load balancing provides a single IP address for stateful TCP sessions without introducing the latency of a global proxy, and it supports session affinity (e.g., client IP affinity) to maintain stateful connections.

Zero recovery point objective demands synchronous cross-region replication, which only a multi-region Cloud Spanner instance provides. Sub-minute recovery demands application compute already running in a second region with automated traffic failover. Combining a multi-region Spanner instance with regional GKE clusters in two regions behind a global external Application Load Balancer satisfies both constraints simultaneously.

The IAM policy grants `roles/storage.objectViewer` to `allUsers`, which makes the bucket's objects publicly readable by anyone on the internet. This is a security risk because it allows anonymous access without authentication or logging. The recommended practice is to remove the `allUsers` member and instead use signed URLs (which embed a time-limited access token) to grant temporary, controlled access to specific objects.

Surviving a zonal outage with minimal data loss and no custom failover logic requires managed, zone-redundant building blocks at every tier. A regional managed instance group combined with a global external Application Load Balancer keeps serving traffic when a zone disappears, and a regional Cloud SQL instance promotes its standby automatically. Together these services remove the need for the small operations team to write or run replication and failover scripts.

Cloud External Key Manager allows Cloud KMS to wrap data encryption keys with key material held in an external key management system outside Google Cloud. Because access to the wrapped keys requires the external system, the company controls generation and rotation and can deny access by making the external key unavailable, meeting the regulatory requirements for both Cloud Storage and BigQuery.

The three requirements are EU data residency, self-controlled key hardware, and instant revocation. Only an external key manager integration satisfies all three because the keys physically live in the firm's data center and Google must reach out to them for every unwrap operation. Location constraints in organization policy handle the residency requirement, and severing the external key path provides the immediate revocation the security team wants.

Global external HTTP(S) Load Balancing is the only option that provides a single global anycast IP, edge termination, and automatic multi-region failover for HTTP(S) workloads. Regional proxies lack global anycast, Cloud DNS geo-routing introduces DNS caching delays and multiple IPs, and internal load balancing is not internet-facing. The chosen design satisfies global low latency and region-failure survivability.

Spreading the service across zones with a regional managed instance group, pairing it with a Cloud SQL regional instance that has a standby in another zone, and using Memorystore Standard Tier with automatic failover together address zone failure at every tier. Each component exposes stable endpoints, so the application keeps its existing connection strings.

Data residency is about where bytes are physically stored and replicated, so the architecture must pin personal data to regionally scoped datasets and buckets in the required country and use VPC Service Controls to stop egress. Encryption keys and network topology do not constrain physical location. Only anonymized aggregates may cross into the central analytics project.

The access pattern is predictable: hot for 30 days, then cold for years. Object Lifecycle Management transitions objects between storage classes in place, so applications keep reading the same object names while the per-gigabyte cost drops as access frequency falls. Approaches that move objects to another bucket or change the default class either break read paths or fail to reclassify existing data.

Folders under the organization node enable policy inheritance and delegated administration, letting central teams set guardrails while business units own their projects. Separate Cloud Billing accounts per business unit isolate costs and budgets. Labels, over-broad organization roles, and networking alone do not deliver the required policy control and billing separation.

Cloud External Key Manager is the only option that keeps key material outside Google Cloud in a partner HSM while still integrating with Google Cloud services for encryption at rest. It supports customer-controlled rotation and, critically, allows the customer to revoke Google's access by disabling the external key. CMEK and GMEK keep key custody inside Google, which does not meet the external control and revocation mandate.

Cloud KMS with customer-managed encryption keys gives the company full control over key creation, rotation, and usage. It integrates with Cloud Audit Logs to record key operations. The other options either do not provide customer control, lack auditability, or are not specific to the requirement.

The failure mode is losing messages when a single region is unavailable and the retention window closes. Keeping Pub/Sub message data in more than one region through a message storage policy or global endpoint, plus running the Dataflow job regionally in two locations each with its own subscription, gives both durability of the messages and a surviving processing path. Retention tuning, object storage substitution, and autoscaling do not remove the single-region dependency.

Spreading a regional managed instance group across three zones means a zone outage only removes a fraction of capacity, and health-checked load balancing automatically diverts traffic from failed instances and restores it on recovery. This delivers unattended, in-region failover with low latency, unlike single-zone groups, unmanaged instances, or global routing that can add distance.

Stateful containerized workloads requiring stable identity and persistent storage per replica map directly to Kubernetes StatefulSets, and the team's existing Kubernetes skills make GKE the natural fit. Serverless container and function platforms abstract away the instance, so they cannot provide per-replica persistent disks or stable network identities.

Zone-level resilience for Cloud SQL comes from high availability mode, which maintains a standby in a separate zone and performs automatic failover without operator intervention. Read replicas address regional disasters and require manual promotion, while zonal deployments and vertical scaling leave the database exposed to a single-zone failure. The regional HA configuration matches the availability and operational requirements at a predictable cost.

Cloud CDN caches content at Google's globally distributed edge points of presence, so readers in Europe and Asia are served from nearby locations while the authoritative data stays in the us-central1 regional bucket. Writes remain simple and centralized. Changing the bucket to a multi-region or dual-region location does not cover all three continents, and moving the origin to Asia violates the write-location requirement.

The principle of least privilege dictates that the service account should be granted only the minimal permissions required to read objects, which is roles/storage.objectViewer. By removing all other bindings, the bucket becomes accessible exclusively to that service account, ensuring that no other identities (users, groups, or other service accounts) can read the sensitive data. This approach directly enforces the requirement using IAM roles on the bucket resource.

The landing zone needs organization-level enforcement that propagates automatically. A resource location organization policy at the root keeps data in approved European regions, and a Shared VPC host project with hierarchical firewall policies and a central inspection project centralizes and logs egress. Together these meet the security requirements while minimizing per-project work.

Two independent constraints must be satisfied: Google APIs stay reachable while workloads have no public addresses, and on-premises traffic stays off the internet. Private Google Access on the subnet handles the first by routing API traffic internally, and a Cloud VPN or Interconnect link with Cloud Router BGP handles the second by providing private connectivity to the fraud-detection system. Cloud NAT, external IPs, and proxy VMs all push traffic onto the public internet.

Rehosting (lift-and-shift) the monolithic application to Compute Engine with Cloud SQL for MySQL minimizes code changes while improving scalability and reliability. Cloud SQL provides managed MySQL with automated backups, replication, and failover, addressing the need for reliability without requiring application refactoring.

Database Migration Service (DMS) supports continuous replication from on-premises PostgreSQL to Cloud SQL using native PostgreSQL logical replication (pglogical or native publication/slot). This allows near-zero downtime by keeping the target in sync until promotion, which is ideal for a 1 TB database over a 500 Mbps link where a full dump/restore would take hours.

The requirement is one logical anycast endpoint that terminates arbitrary TCP and picks the nearest healthy region. A global external proxy Network Load Balancer does exactly that, with SSL or TCP proxy target proxies and health-checked regional backends. Application Load Balancers are HTTP(S)-only, DNS geolocation needs per-region records, and Interconnect plus an internal passthrough load balancer cannot accept public device traffic.

Cloud Run scales to zero and then out automatically, which matches unpredictable promotional spikes while keeping idle cost near zero. Cloud Spanner provides a managed relational store that scales reads and writes horizontally with automatic replication, so the team never manages replicas or failover. Together they cover the compute and data tiers without the operational overhead of self-managed alternatives.

Global external Application Load Balancers route HTTP traffic to the nearest healthy backend across regions and support serverless NEGs for Cloud Run, while multi-region Cloud Spanner provides strongly consistent, automatically replicated data with regional failover. Together they meet the global latency, regional resilience, and low-overhead goals. Regional load balancers, proxy network load balancers, and DNS-based routing each fall short on at least one requirement.

Cloud Spanner with a multi-region configuration is the correct choice because it provides strong global consistency, low-latency reads and writes across regions, and automatic horizontal scaling to handle a 10x growth in workload. Its multi-region replication ensures synchronous replication for disaster recovery while maintaining ACID transactions, which is critical for a database requiring consistent low-latency access.

The two goals are preventing analysts from reading identifiers and logging all access to raw records. De-identifying or tokenizing identifiers before the analytics layer sees them meets the first goal, and enabling Data Access audit logs on the services holding raw records meets the second. Broad viewer grants, generic storage protections, and encryption alone do not de-identify data or provide the necessary read-level audit trail.

Cloud Pub/Sub provides scalable, asynchronous ingestion for unpredictable IoT data spikes, Cloud Dataflow enables stream processing for near real-time aggregations with sub-second latency, and Cloud Bigtable offers low-latency, high-throughput storage ideal for serving aggregated results directly to a dashboard. This combination meets the requirements of unpredictable volume, real-time processing, and low-latency queries.

Ultra-low latency between tightly coupled components depends on physical proximity and adequate network throughput. Compact placement policies schedule instances close together on the same rack, reducing switch hops and jitter, while the higher total egress bandwidth tier removes the default throughput cap that would otherwise throttle a heavy small-message workload. Keeping all components in a single zone avoids inter-zone round trips entirely, which is essential for the stated sub-millisecond requirement.

The pipeline needs durable stream ingestion, managed stream processing with enrichment, and a warehouse for analyst SQL. Pub/Sub absorbs bursts and decouples producers, Dataflow handles autoscaling stream transforms and joins, and BigQuery stores and queries the results. Alternatives either require cluster management, cannot run analytics at scale, or use services not intended for continuous streaming.

Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google's network, offering high bandwidth (10 or 100 Gbps per link) and a 99.99% uptime SLA when configured with redundant links. This meets the requirements for high bandwidth and a reliable, SLA-backed connection better than any other option.

The `--preemptible` flag in Google Cloud Platform (GCP) creates preemptible VM instances, which are short-lived, cost-effective instances that can be terminated at any time by GCP. The primary benefit is a significant cost reduction—up to 60-91% lower than standard instances—making them ideal for batch jobs, fault-tolerant workloads, and non-critical tasks. This flag does not affect startup time, availability guarantees, or provide free access to specialized hardware.

A Dataflow streaming pipeline with autoscaling is the most suitable choice because it automatically adjusts worker count to handle bursty Pub/Sub traffic, integrates natively with Cloud Storage and BigQuery, and minimizes operational overhead. It provides exactly-once processing and handles backpressure, ensuring reliable and scalable analytics during month-end peaks.

The global external Application Load Balancer is built for internet-facing global services: it provides a single anycast IP, terminates TLS at Google's edge, and uses Google's global network to send each user to the nearest healthy backend. A regional load balancer cannot give one global IP, and layer 4 passthrough options do not terminate TLS or perform HTTP-aware global routing.

BigQuery is a serverless, highly scalable data warehouse that supports SQL and real-time analytics. It is fully managed, so the healthcare company can focus on analyzing data rather than managing infrastructure. It handles petabyte-scale datasets and daily ingestion of millions of records without manual scaling, making it the best fit for the requirements.

Cloud Spanner is the Google Cloud database that provides synchronous multi-region replication with external consistency, so losing a region does not lose committed writes and reads stay strongly consistent. Regional endpoints let each continent's application instances talk to nearby replicas while the multi-region quorum maintains durability and correctness.