Scenario practice questions

A company is designing a disaster recovery plan for their Cloud SQL for PostgreSQL instance. They want to ensure that the database can be recovered in another region within minutes with minimal data loss. Which three actions should they take? (Choose three.)

Trap 1: Configure a failover replica in a different zone within the same…

Only protects against zone failure, not regional disaster.

Trap 2: Enable automated backups with a retention period of 30 days

Backups are for within-region, not for quick cross-region recovery.

A
Enable point-in-time recovery
Allows recovery to a specific point in time, minimizing data loss.
B
Regularly test the failover procedure
Ensures the DR plan works when needed.
C
Configure a failover replica in a different zone within the same region
Why wrong: Only protects against zone failure, not regional disaster.
D
Enable cross-region replication using Cloud SQL's replica feature
Provides a readable replica in another region for failover.
E
Enable automated backups with a retention period of 30 days
Why wrong: Backups are for within-region, not for quick cross-region recovery.

Question 2mediummultiple choice

Refer to the exhibit. A developer wants to SSH into instance-1 from their local machine. Which command should they use?

Exhibit

NAME       ZONE        MACHINE_TYPE  PREEMPTIBLE  INTERNAL_IP   EXTERNAL_IP
instance-1 us-central1-a n1-standard-4 true        10.128.0.2    35.184.0.1
instance-2 us-central1-b n1-standard-4 false       10.128.0.3    35.184.0.2

Trap 1: gcloud compute ssh instance-2

This targets the wrong instance.

Trap 2: gcloud compute ssh instance-1 --project default

The project does not need to be specified explicitly if it's the current project.

Trap 3: gcloud compute ssh instance-1 --internal-ip

Internal IP cannot be reached from outside the VPC.

A
gcloud compute ssh instance-2
Why wrong: This targets the wrong instance.
B
gcloud compute ssh instance-1 --project default
Why wrong: The project does not need to be specified explicitly if it's the current project.
C
gcloud compute ssh instance-1 --internal-ip
Why wrong: Internal IP cannot be reached from outside the VPC.
D
gcloud compute ssh instance-1 --zone us-central1-a
This command uses the external IP via SSH keys managed by gcloud.

Question 3hardmultiple choice

A global e-commerce site uses an external HTTPS load balancer with a backend service pointing to a managed instance group. Some users report 503 errors during peak traffic. The backend instances are healthy and not overloaded. What is the most likely cause?

Trap 1: The CDN cache is not warming up properly

CDN issues cause cache misses, not 503.

Trap 2: The backend service's health check interval is too short

Health check issues cause 502, not 503.

Trap 3: The SSL certificate is expired

Expired certificate causes SSL errors, not 503.

A
The CDN cache is not warming up properly
Why wrong: CDN issues cause cache misses, not 503.
B
The backend service's health check interval is too short
Why wrong: Health check issues cause 502, not 503.
C
The SSL certificate is expired
Why wrong: Expired certificate causes SSL errors, not 503.
D
The load balancer's max rate per backend is configured too low
The load balancer enforces a rate limit at the backend level; exceeding it produces 503.

Question 4hardmultiple choice

A financial services company uses Cloud SQL for MySQL for a critical application. They need zero downtime during maintenance and automatic failover across zones. They configured a Cloud SQL instance with high availability (HA). During a recent regional outage, the application experienced 10 minutes of downtime. What should they add to improve availability?

Trap 1: Configure a warm standby instance in another region using migration.

Warm standby requires manual promotion and is not as reliable as managed replica.

Trap 2: Use Cloud SQL Proxy with multiple endpoints.

Cloud SQL Proxy improves connectivity but does not offer failover.

Trap 3: Enable database flags for faster failover detection.

Database flags can speed up failover but only within the same region.

A
Configure a warm standby instance in another region using migration.
Why wrong: Warm standby requires manual promotion and is not as reliable as managed replica.
B
Create a cross-region replica and promote on failure.
Cross-region replica can be promoted to a new primary to handle regional failures.
C
Use Cloud SQL Proxy with multiple endpoints.
Why wrong: Cloud SQL Proxy improves connectivity but does not offer failover.
D
Enable database flags for faster failover detection.
Why wrong: Database flags can speed up failover but only within the same region.

Question 5hardmultiple choice

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. Recently, they experienced a targeted attack that bypassed Cloud Armor's predefined rules. The attack involved a high rate of legitimate-looking requests from a small set of IPs that made the application unresponsive. The team needs to block the attack quickly without affecting legitimate users. What should they do?

Trap 1: Increase the load balancer's capacity to absorb the attack.

Increasing capacity does not stop the attack and may increase costs.

Trap 2: Configure rate limiting with a threshold based on the normal…

Rate limiting may block legitimate traffic if the threshold is too low, or be ineffective if too high.

Trap 3: Add the attacking IPs to a Cloud Armor deny list.

Blocking IPs is effective only if the attackers use fixed IPs, but they may change.

A
Increase the load balancer's capacity to absorb the attack.
Why wrong: Increasing capacity does not stop the attack and may increase costs.
B
Configure rate limiting with a threshold based on the normal traffic pattern.
Why wrong: Rate limiting may block legitimate traffic if the threshold is too low, or be ineffective if too high.
C
Enable Google Cloud Armor Adaptive Protection.
Adaptive Protection learns normal traffic patterns and automatically blocks anomalous high-rate requests.
D
Add the attacking IPs to a Cloud Armor deny list.
Why wrong: Blocking IPs is effective only if the attackers use fixed IPs, but they may change.

Question 6mediummultiple choice

A company is migrating its on-premises application to Google Cloud. The application requires low-latency access to a shared filesystem that can be mounted by multiple Compute Engine instances across different zones. Which storage solution should they use?

Trap 1: Create a Persistent Disk and attach it to all instances.

Persistent Disk is block storage and cannot be attached to multiple instances across zones for shared access.

Trap 2: Attach Local SSD to each instance and replicate data between them.

Local SSD is ephemeral and cannot be shared across instances, replication would add complexity and latency.

Trap 3: Use Cloud Storage FUSE to mount a bucket on each instance.

Cloud Storage is object storage and does not provide POSIX semantics required for shared filesystem.

A
Provision a Filestore instance and mount it on the instances.
Filestore provides a managed NFS filesystem that can be mounted by multiple VMs across zones for low-latency shared access.
B
Create a Persistent Disk and attach it to all instances.
Why wrong: Persistent Disk is block storage and cannot be attached to multiple instances across zones for shared access.
C
Attach Local SSD to each instance and replicate data between them.
Why wrong: Local SSD is ephemeral and cannot be shared across instances, replication would add complexity and latency.
D
Use Cloud Storage FUSE to mount a bucket on each instance.
Why wrong: Cloud Storage is object storage and does not provide POSIX semantics required for shared filesystem.