Google Professional Cloud Architect (PCA) — Questions 826–900

Option A is correct because Cloud Build allows you to define build steps that run sequentially by default, but you can parallelize independent steps by using the `waitFor` field to specify dependencies. This reduces total build time by running non-dependent steps concurrently, which is a key optimization for CI/CD pipelines. Splitting into multiple builds is also a valid approach for parallel execution.

Option C is correct because implementing exponential backoff in the subscriber retry logic allows the subscriber to gradually increase the delay between retries when messages are not acknowledged, reducing the likelihood of overwhelming the system and preventing message buildup. This approach aligns with Cloud Pub/Sub's recommended practices for handling transient failures, as it gives the subscriber time to recover without exhausting the ack deadline or causing excessive redelivery.

These are core networking services in GCP.

Option B is correct because clustering tables on commonly filtered columns in BigQuery allows the query engine to prune blocks of data that don't match the filter, reducing the amount of data scanned and thus lowering query costs. This is especially effective when combined with partitioning, as it further narrows the scan to relevant clusters within a partition.

Option B is correct because Traffic Director, based on the xDS API (Envoy), can manage traffic routing across regions. By deploying a mirrored environment in another region and configuring Traffic Director with failover policies, you can redirect traffic to the secondary region if the primary fails, enabling a robust active-passive or active-active DR strategy.

A PDB limits the number of pods of a replicated application that can be down simultaneously from voluntary disruptions (e.g., node upgrades, cluster autoscaler evictions).

Option A is correct because Spanner contention arises when multiple transactions try to update the same row concurrently, causing aborts. By redesigning the schema to use a separate table for frequently updated rows and batching updates into a single transaction, you reduce the number of overlapping locks on hot rows. This minimizes lock conflicts and aborts, improving throughput without changing Spanner's underlying TrueTime-based concurrency control.

BigQuery CMEK requires creating a Cloud KMS key in the desired region and associating it with the dataset using DDL. Default encryption uses Google-managed keys; Cloud DLP is for de-identification; EKM is for on-prem key integration.

Option D is correct because Cloud SQL's high availability (HA) configuration uses a synchronous write to a standby instance in a different zone within the same region. This ensures that every transaction committed on the primary is also committed on the standby before acknowledging the client, guaranteeing zero data loss during a zone outage. Automatic failover to the standby occurs with no manual intervention, meeting both the automatic failover and zero data loss requirements.

Availability = (total time - downtime) / total time. 30 days = 43200 minutes. (43200 - 30) / 43200 = 99.93%. The closest higher but achievable SLO would be 99.9%, because 99.95% would allow only 21.6 minutes downtime. Typically SLOs are stated as 99.9%, 99.95%, etc.

Intermittent 503 errors during traffic spikes often indicate that new VM instances are being started but are not yet ready to serve traffic, causing the load balancer to forward requests to them prematurely. Configuring a health check with a sufficient initial delay (grace period) in the MIG ensures that newly created instances are given time to fully initialize and pass health checks before they receive traffic, preventing 503 errors. This directly addresses the root cause by allowing the application to become healthy before being added to the load balancer's backend.

Archive storage class is the most cost-effective option for backups that are accessed infrequently and can tolerate retrieval delays. It offers the lowest storage cost among Google Cloud Storage classes, with a default retrieval time of minutes to hours, making it ideal for long-term backup data that does not require immediate access.

Cloud KMS is the correct choice because it provides a centralized, managed service for creating, rotating, and destroying encryption keys used by Google Cloud services. It integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest, and it supports customer-managed encryption keys (CMEK) for granular control. For data in transit, Cloud KMS can be used to manage keys for TLS or application-level encryption, though Google Cloud automatically encrypts all network traffic by default.

A Cloud Interconnect or Cloud VPN connection is required to establish private, encrypted connectivity between on-premises hosts and a VPC network. This provides the network path for on-premises traffic to reach Google APIs using internal IP addresses, bypassing the public internet. Without this direct connection, on-premises hosts cannot leverage Private Google Access, which only applies to traffic originating within Google Cloud subnets.

For Cloud Functions (1st gen), setting --ingress-settings=internal-only restricts invocation to within the project. For Cloud Functions (2nd gen), using an ingress setting of 'all' allows external invocation; using 'internal-only' blocks external calls.

The rotationPeriod is 7776000 seconds, which equals 90 days. The nextRotationTime is set to 2024-04-01, 90 days after creation, confirming automatic rotation every 90 days.

Nearline storage is designed for data accessed less than once a month but requires retrieval within minutes, making it ideal for backup data that needs quick availability. It offers lower cost than Standard storage while still supporting sub-minute retrieval times, aligning with the scenario's access and latency requirements.

Compute Engine provides full control over the virtual machine, including the OS and kernel parameters, making it ideal for legacy applications that require custom configurations.

The firewall rule 'allow-ssh' currently allows SSH from all IPs (0.0.0.0/0) to instances with tag 'ssh-allowed'. To restrict to a specific IP range, the source_ranges must be updated to ['203.0.113.0/24']. The instance already has the tag 'ssh-allowed', so no change to tags is needed.

Option A is correct because Workload Identity allows you to bind a Kubernetes service account to a GCP service account, enabling pods to authenticate to Google Cloud APIs (e.g., Cloud Storage) without managing or storing service account keys. This eliminates the security risk of key leakage and simplifies credential rotation. Option D is correct because Workload Identity must be explicitly enabled on the GKE cluster (using the `--workload-pool` flag or via the console) before the binding can be established.

Admin Activity audit logs record all API calls that modify configuration or metadata of resources. They are retained for 400 days by default.

The access_config block with an empty block (no nat_ip specified) still creates an ephemeral external IP. To disable public IP, the entire access_config block must be removed.

Optimizing pipeline logic to minimize shuffle reduces resource usage and cost. Increasing workers or using larger machine types may improve performance but increase cost. Switching to batch mode would lose real-time processing capability.

Option C is correct because the 'Delete action with condition age: 30' directly instructs Cloud Storage to remove objects 30 days after their creation time. The 'age' condition is measured from the object's creation timestamp, which aligns perfectly with the requirement to delete objects exactly 30 days after creation.

These are fundamental networking concepts in GCP.

Packet Mirroring (Network Intelligence Center) is correct because it clones the actual packet contents (headers and payload) from VM instances and forwards them to a collector for deep packet inspection, enabling detailed troubleshooting of network traffic between VMs in a VPC. This service captures full packet data, including application-layer information, which is essential for diagnosing issues like packet loss, latency, or protocol errors.

HA VPN provides a 99.99% SLA when configured with two VPN gateways (each with two tunnels) for a total of four tunnels, and the tunnels are configured to use two different edge availability domains in Google Cloud and two different interfaces on the on-premises VPN device.

Cloud Armor provides WAF capabilities that can be attached to HTTPS Load Balancers to filter requests based on OWASP signatures.

Cloud Run is the best choice because it automatically scales to zero when idle, scales up to handle HTTP traffic spikes, and requires minimal configuration—just deploy a container. It is cost-effective as you pay only for resources used during request processing, and it supports stateless web applications natively without managing servers or clusters.

Binary Authorization enforces that only signed container images from trusted authorities can be deployed on GKE. It integrates with Cloud KMS for signing and can be configured with attestors.

The log message 'Interface flapping due to changes in the underlying network' indicates that the BGP session is unstable because the physical or logical interface is going up and down. An MTU mismatch across the network path can cause packet fragmentation issues, leading to intermittent connectivity and interface flaps as the router detects and recovers from the problem. This is the most likely cause because it directly affects the stability of the underlying network path.

Option A is correct because it directly reduces manual toil by automating the initial response to common issues like high latency. Cloud Monitoring triggers a Cloud Function that performs automated checks and, if latency spikes, rolls back the last deployment, eliminating the need for human intervention during the critical first response phase.

Cloud Build triggers can be configured with regular expressions to match changed files in specific directories, so builds are only started for relevant changes. Build steps define actions but not triggers; cloudbuild.yaml is the build configuration file; Artifact Registry is a storage service.

Option C is correct because Deployments support rolling updates and pod anti-affinity can spread pods across zones for high availability. StatefulSets are for stateful workloads, DaemonSets for node-level daemons, and Jobs for batch tasks.

Option B is correct because a managed instance group with autoscaling based on CPU utilization automatically adjusts the number of stateless compute instances in response to traffic spikes, ensuring the application can handle sudden load increases without manual intervention. This aligns with the requirement for stateless instances behind a global load balancer, as autoscaling adds or removes instances based on real-time CPU metrics, providing elasticity and high availability.

Option C is correct because an instance template with automatic restart enables Compute Engine to automatically restart a VM instance if it crashes or is terminated due to a non-user-initiated failure. This feature is configured at the instance level and ensures that the application recovers quickly without manual intervention, improving availability for a single-instance workload.

Option D is correct because Cloud Spanner multi-region instance configurations (e.g., nam-eur-asia) provide synchronous replication across multiple regions, ensuring strong global consistency and zero RPO. This architecture uses Paxos-based replication to commit writes only after they are durably stored in a majority of regions, so a region failure does not lose any committed data. The 99.999% availability SLA is met by automatic failover within the multi-region setup without manual intervention.

Health checks ensure traffic only goes to healthy instances; URL map defines routing; forwarding rule exposes the IP.

Assured Workloads provides compliance controls including FedRAMP, and allows creating a folder with specific regulatory requirements. VPC Service Controls can be used within that folder to restrict data movement.

In Cloud Monitoring, an alerting policy can have multiple notification channels (email, Pub/Sub, PagerDuty, SMS). The CPU utilization metric is available via the 'cloudsql.googleapis.com' metric type.

The Horizontal Pod Autoscaler (HPA) is the correct choice because it automatically scales the number of pod replicas in a GKE deployment based on observed CPU utilization (or other custom metrics). This directly meets the requirement of scaling pods with minimal operational overhead, as HPA is a native Kubernetes resource that requires no manual intervention once configured.

WAF rules (preconfigured rules for SQLi, XSS), rate limiting (optional), and geographic restrictions (geo-based access control) are all features of Cloud Armor.

Clustering on frequently filtered columns reorganizes the data within partitions based on the values of those columns, which allows BigQuery to prune blocks more effectively during queries. This directly addresses the performance degradation by reducing the amount of data scanned, without requiring additional storage or compute resources.

A PersistentVolumeClaim (PVC) is the correct resource because it allows a pod to request persistent storage that survives pod restarts. In GKE, a PVC binds to a PersistentVolume (PV), which can be backed by Compute Engine persistent disks, ensuring data remains available even if the pod is rescheduled or restarted.

A 503 error from an external HTTPS load balancer with healthy backends typically indicates that the load balancer is throttling requests. The 'max rate per backend' setting limits the number of requests per second that the load balancer forwards to each backend instance. When this limit is exceeded, the load balancer returns 503 errors even though the instances themselves are not overloaded, which matches the scenario of peak traffic.

Log sinks can route logs to BigQuery, and exclusion filters can be applied to filter out specific logs before they are ingested.

B is correct because data transfer between Compute Engine instances in the same region but different zones uses internal IP addresses within the same VPC, which incurs no egress costs. Google Cloud does not charge for traffic between instances using internal IPs within the same region, regardless of zone, as long as they are in the same VPC network. This is the most cost-effective approach for minimizing egress costs.

Dataflow is the fully managed service for executing Apache Beam pipelines, with autoscaling and serverless execution. Pub/Sub is the ingestion service. Cloud Composer is Airflow, not streaming; Dataproc is for Spark/Hadoop; Dataprep is for data preparation.

Spend-based committed use discounts apply to a dollar amount of spend on eligible instance types, allowing flexibility to change machine types as long as the spend commitment is met. Resource-based committed use discounts are tied to specific machine types (e.g., n1-standard-4) and cannot be changed without breaking the commitment.

The node pool's service account needs the Pub/Sub Publisher role. The exhibit shows the nodes are using the default compute engine service account with only pubsub scope (no roles). The fix is to assign a service account with the necessary IAM role.

GKE Autopilot supports canary deployments using Kubernetes native features like multiple Deployments with a Service selector using a common label, and adjusting replica counts to control traffic. Istio or Traffic Director are not required. Cloud Deploy can be used but the simplest approach is to use a single Kubernetes Service with label selectors pointing to both Deployments and scaling replicas.

Regional persistent disks (PD) provide synchronous replication of data between two zones in the same region, enabling automatic failover for a GCE instance without manual intervention. This meets the 1-hour RTO by allowing the instance to be recreated or failed over to the secondary zone quickly, and it is more cost-effective than maintaining a full replica instance because you only pay for the disk storage and replication, not for an idle compute instance.

Option D is correct because Cloud Spanner uses a single global configuration with regional read replicas. If the instance does not have a read replica in the region where the clients are located, read requests must traverse the network to a replica in another region, causing higher latency. Even with stale reads, the physical distance to the nearest replica directly impacts read latency.

Binary Authorization enforces deployment policies that require images to be signed by trusted authorities (e.g., using Cloud KMS) and verified before being deployed to GKE.

Cloud Run is a fully managed serverless container platform that scales down to zero and charges per request, making it ideal for variable workloads that need to minimize cost when idle.

Option A is correct because Google Cloud Dedicated Interconnect supports high availability configurations using two 10 Gbps circuits to provide redundancy and meet SLA requirements. This setup ensures that if one circuit fails, traffic can be rerouted through the other, maintaining connectivity.

Anthos Service Mesh (based on Istio) can be used for fine-grained traffic splitting using VirtualService and DestinationRule resources. Cloud Deploy also supports canary deployments but is primarily for continuous delivery, not traffic splitting at the mesh level. For managed service mesh, Anthos Service Mesh is the correct choice.