GCP Professional Cloud Ar - Free Practice Quiz

Question 1 of 60

A company wants to run a web application on Google Cloud that automatically scales to handle variable traffic, with no server management overhead. Which compute option best meets these requirements? (Google Cloud Professional Cloud Architect exam guide, 2023)

A Cloud Run, which automatically scales container instances to zero when idle and up to thousands under load, with no cluster or server management required B Compute Engine with manually managed instance groups and autoscaling policies C Google Kubernetes Engine (GKE) in Autopilot mode with manual replica configuration D App Engine Flexible environment with a fixed minimum instance count of two

1 / 60

Question 2 of 60

Your organization stores sensitive customer data in Cloud Storage buckets and must prevent data exfiltration to unauthorized Google Cloud projects. Which control is most appropriate? (Google Cloud Professional Cloud Architect, 2023)

A Use VPC Service Controls to define a security perimeter around the Cloud Storage API, blocking access from outside the perimeter B Apply bucket-level IAM policies that restrict access to specific service accounts C Enable uniform bucket-level access to remove per-object ACLs D Enable Cloud Armor policies on the storage bucket's load balancer

2 / 60

Question 3 of 60

A retail company needs a managed relational database that supports ACID transactions, automatic replication across multiple regions, and can handle millions of reads per second. Which Google Cloud service should they use? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Spanner, which provides globally distributed, strongly consistent relational storage with horizontal scaling B Bigtable with a multi-cluster configuration for high read throughput C Cloud SQL for PostgreSQL with read replicas in each region D Firestore in native mode with multi-region configuration

3 / 60

Question 4 of 60

An organization is designing a data pipeline that ingests streaming event data from IoT devices, processes it in real time, and loads results into BigQuery for analysis. Which fully managed Google Cloud service handles the stream processing step? (Google Cloud Professional Cloud Architect, 2023)

A Dataflow, which executes Apache Beam pipelines for both streaming and batch data processing in a fully managed, serverless manner B Cloud Run with HTTP triggers and Pub/Sub push subscriptions C Cloud Data Fusion for batch ETL pipeline orchestration D Cloud Composer (managed Apache Airflow) with scheduled DAGs for processing

4 / 60

Question 5 of 60

A startup wants to store and query JSON documents representing user profiles without defining a schema upfront, with automatic scaling and multi-region replication. Which Google Cloud database is most appropriate? (Google Cloud Professional Cloud Architect, 2023)

A Firestore, a serverless NoSQL document database that scales automatically and supports multi-region replication with strong consistency B Cloud Bigtable with JSON column families for flexible schema storage C Cloud SQL with a JSONB column type and read replicas D Memorystore for Redis with JSON module enabled

5 / 60

Question 6 of 60

A company migrating from on-premises to Google Cloud wants to connect their existing data center to Google Cloud with a dedicated, private connection that doesn't traverse the public internet. Which product provides this? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Interconnect (Dedicated Interconnect), which provides a direct physical connection from your data center to Google's network for low-latency, high-bandwidth private connectivity B Cloud VPN with IKEv2 tunnels for encrypted connectivity over the internet C Cloud CDN configured with an origin shield in the data center's region D Cloud DNS private zones peered with the on-premises DNS resolver

6 / 60

Question 7 of 60

Your application runs on Compute Engine and must access a Cloud Storage bucket securely without using service account keys stored in code or environment variables. What is the recommended approach? (Google Cloud Professional Cloud Architect, 2023)

A Attach a service account to the Compute Engine instance; the instance will automatically obtain tokens from the metadata server without any key management B Pass the key as a Kubernetes Secret mounted as a volume in the pod C Store the service account JSON key in a Cloud Storage bucket and download it at startup D Encode the service account key in base64 and set it as an environment variable in the instance template

7 / 60

Question 8 of 60

An e-commerce company needs to cache frequently accessed product data close to users globally to reduce latency and backend load. Which Google Cloud service should they add to their architecture? (Google Cloud Professional Cloud Architect, 2023)

A Cloud CDN, which caches static and dynamic content at Google's global edge points of presence closest to users B Datastore with composite indexes for fast query performance C Memorystore for Redis deployed in each regional cluster for backend caching D Cloud Spanner with multi-region configuration to serve reads from the nearest region

8 / 60

Question 9 of 60

A healthcare company must ensure all data stored in Google Cloud remains within the European Union for regulatory compliance. Which Cloud Storage configuration enforces this? (Google Cloud Professional Cloud Architect, 2023)

A Create a Cloud Storage bucket with a regional or multi-region location set to europe-west (EU), which restricts data storage to EU data centers B Apply a Google Cloud organization policy that restricts Compute Engine zones to EU regions C Enable CMEK with a Cloud KMS key in the eu key ring to restrict encryption scope D Configure a VPC Service Control perimeter to prevent data from leaving EU-region services

9 / 60

Question 10 of 60

A company wants to analyze petabytes of sales data using standard SQL without managing any infrastructure. Which Google Cloud product is designed for this use case? (Google Cloud Professional Cloud Architect, 2023)

A BigQuery, a fully managed, serverless data warehouse that runs SQL queries over petabytes of data with automatic resource provisioning B Cloud SQL with horizontal read replicas for parallel query execution C Dataproc with Apache Spark SQL running on a managed Hadoop cluster D Bigtable with SQL-like queries through its HBase API

10 / 60

Question 11 of 60

An operations team needs to monitor Compute Engine VM metrics, set alerting thresholds, and create dashboards across multiple projects from a single console. Which Google Cloud product provides this capability? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Monitoring (formerly Stackdriver), which collects metrics, logs, and traces across projects, supports threshold-based alerting, and provides customizable dashboards B Cloud Debugger for inspecting running application state without stopping VMs C Cloud Trace for analyzing request latency across services D Cloud Profiler for continuous CPU and memory profiling of production workloads

11 / 60

Question 12 of 60

Your company needs to deploy containerized microservices that communicate with each other over a private network, require automatic service discovery, and use Kubernetes APIs. Which Google Cloud service is most appropriate? (Google Cloud Professional Cloud Architect, 2023)

A Google Kubernetes Engine (GKE), which provides a managed Kubernetes control plane, private networking with VPC-native clusters, and built-in service discovery via kube-dns and Services B Cloud Functions with HTTP triggers and Pub/Sub for inter-service messaging C Compute Engine with Docker installed and a manual load balancer D Cloud Run with all services in the same VPC connector

12 / 60

Question 13 of 60

A company wants to prevent any Google Cloud project in their organization from having a Cloud Storage bucket accessible to the public internet (allUsers or allAuthenticatedUsers). What is the best approach? (Google Cloud Professional Cloud Architect, 2023)

A Set the 'storage.publicAccessPrevention' organization policy constraint to 'enforced' across the entire organization B Manually audit each bucket monthly using Cloud Security Command Center and remove public ACLs C Enable uniform bucket-level access on all buckets and rely on developers to not grant public access D Configure a Cloud Armor security policy on Cloud Storage to block public requests

13 / 60

Question 14 of 60

An application needs to process tasks asynchronously and reliably, ensuring no messages are lost if the processing service is temporarily unavailable. Which Google Cloud service is most appropriate? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Pub/Sub, a fully managed messaging service that durably stores messages until subscribers acknowledge them, decoupling producers from consumers B Cloud Storage with event triggers via Pub/Sub notifications C Cloud Tasks with HTTP target queues for direct service invocation D Cloud Scheduler for triggering periodic background jobs

14 / 60

Question 15 of 60

A team is deploying an application to Cloud Run and needs the service to access a Cloud SQL database securely without exposing the database to the internet. What is the recommended connection method? (Google Cloud Professional Cloud Architect, 2023)

A Use the Cloud SQL connector library (or Cloud SQL Auth Proxy built into Cloud Run) with the instance connection name â€” this establishes an encrypted, IAM-authorized connection without whitelisting IP addresses B Deploy Cloud Run in a VPC and use the Cloud SQL public IP with SSL certificates C Enable Cloud SQL Auth Proxy on a Compute Engine sidecar and route traffic through it D Add the Cloud Run service's egress IP range to the Cloud SQL authorized networks list

15 / 60

Question 16 of 60

Your company wants to implement infrastructure as code for all Google Cloud resources to enable repeatable deployments and version control of infrastructure. Which Google-native tool is most appropriate? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Shell scripts stored in a Cloud Source Repository B Terraform with the Google Cloud provider, or Cloud Deployment Manager â€” both support declarative infrastructure definitions stored in version control and repeatable deployments C Cloud Build pipelines with Docker containers for each resource type D gcloud CLI scripts wrapped in Cloud Functions for automated deployment

16 / 60

Question 17 of 60

A SaaS company provides different service tiers (free, professional, enterprise) from the same application. They need resource isolation between tiers. What Google Cloud organizational structure best supports this? (Google Cloud Professional Cloud Architect, 2023)

A Use a single project with separate VPCs for each service tier B Separate Google Cloud projects per service tier, organized under folders within a single organization â€” this provides billing, IAM, and quota isolation while enabling centralized governance via organization-level policies C Create separate Google Cloud organizations for each service tier D Use separate Cloud Storage buckets and BigQuery datasets with per-tier service accounts in the same project

17 / 60

Question 18 of 60

An architect needs to design a solution where multiple services write events to a central stream, and multiple consumer applications independently read those events at their own pace. Which Google Cloud product provides this publish-subscribe pattern? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Tasks with separate queues per consumer application B Cloud Pub/Sub â€” publishers push to a topic; each subscriber application creates its own subscription, maintaining an independent cursor so each consumer processes events at its own pace C Cloud Spanner change streams consumed by Dataflow for each service D Eventarc with multiple triggers pointing to different Cloud Functions

18 / 60

Question 19 of 60

A company needs to encrypt data in Cloud Storage using encryption keys that they manage and rotate themselves, rather than Google-managed keys. Which feature provides this? (Google Cloud Professional Cloud Architect, 2023)

A Client-side encryption with AES-256 before uploading to Cloud Storage B Customer-Managed Encryption Keys (CMEK) using Cloud KMS â€” the customer creates and controls the key in Cloud KMS; Google encrypts data with that key but cannot access it without customer authorization C Default Google-managed encryption, which already meets most compliance requirements D Customer-Supplied Encryption Keys (CSEK) hardcoded in the gsutil configuration

19 / 60

Question 20 of 60

A development team wants to build and deploy a new version of their application without taking down the current version, with the ability to roll back instantly if issues are detected. Which deployment strategy achieves this on Cloud Run? (Google Cloud Professional Cloud Architect, 2023)

A Blue-green deployment using two separate Cloud Run services with manual DNS cutover B Cloud Run traffic splitting â€” deploy the new revision and gradually shift traffic from the current revision to the new one; rolling back is an instant traffic re-split to the previous revision C Rolling updates using Compute Engine managed instance groups with a surge strategy D Canary releases using Cloud Armor traffic splitting rules

20 / 60

Question 21 of 60

A company is concerned about insider threats and wants to ensure that even privileged Google Cloud administrators cannot access customer data stored in Cloud Spanner without explicit customer approval. Which feature supports this? (Google Cloud Professional Cloud Architect, 2023)

A VPC Service Controls with admin-user exclusion rules B Access Transparency logs combined with Access Approval â€” logs show admin access in near-real-time; Access Approval requires customers to explicitly approve Google administrative access to their resources C Cloud Audit Logs with export to BigQuery for admin access monitoring D IAM Recommender to automatically downgrade admin permissions to least privilege

21 / 60

Question 22 of 60

Your organization wants to centrally manage and enforce security policies â€” such as disabling serial port access on VMs and requiring HTTPS-only load balancers â€” across all projects in the organization. Which mechanism achieves this? (Google Cloud Professional Cloud Architect, 2023)

A Apply IAM conditions to all service accounts restricting resource creation B Organization Policy Service with constraint-based policies applied at the organization or folder level â€” these are inherited by all descendant projects and cannot be overridden without explicit exception C Cloud Security Command Center findings with automated remediation via Cloud Functions D Service account impersonation restrictions set in each project's IAM policy

22 / 60

Question 23 of 60

A team needs a fully managed workflow orchestration service to coordinate multi-step data pipelines with retries, conditional branching, and scheduling. Which Google Cloud service is most appropriate? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Pub/Sub with dead-letter topics for retry logic B Cloud Composer, a managed Apache Airflow service for authoring, scheduling, and monitoring multi-step workflows as directed acyclic graphs (DAGs) C Cloud Functions chained via HTTP callbacks with Cloud Tasks for delay D Cloud Run with a custom retry loop implemented in the container

23 / 60

Question 24 of 60

A financial services company must archive all Cloud Audit Logs for seven years for regulatory compliance and make them immutable after writing. Which design pattern achieves this? (Google Cloud Professional Cloud Architect, 2023)

A Export logs to Cloud SQL with a trigger that prevents row deletion B Export Cloud Audit Logs via a Log Sink to a Cloud Storage bucket with Object Lock (retention policy) enabled â€” objects cannot be deleted or overwritten until the retention period expires C Export logs to BigQuery with a table expiration set to 7 years D Store logs in a Cloud Storage bucket with Lifecycle rules deleting objects after 7 years

24 / 60

Question 25 of 60

A team wants to discover, classify, and protect sensitive data (PII, financial information) stored across Cloud Storage and BigQuery. Which Google Cloud service performs this? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Security Command Center (SCC) Asset Inventory for discovering all data resources B Cloud Data Loss Prevention (Cloud DLP), which scans storage systems to detect, classify, and optionally de-identify sensitive data using 150+ built-in detectors and custom patterns C Forseti Security with a Cloud Storage scanner plugin D Data Catalog with auto-tagging policies for sensitive column classification

25 / 60

Question 26 of 60

Your application on Compute Engine needs to be protected from DDoS attacks and web application exploits such as SQL injection and cross-site scripting. Which Google Cloud service provides this protection? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Armor is deployed only on internal load balancers; use Cloud CDN for external protection B Cloud Armor, attached to an external HTTP(S) load balancer, provides DDoS mitigation, IP allowlisting/denylisting, and a managed WAF rule set covering OWASP Top 10 threats C VPC firewall rules with deny rules for known malicious IP ranges updated via Cloud Functions D Cloud IDS (Intrusion Detection System) for inline blocking of web exploits

26 / 60

Question 27 of 60

A company runs a three-tier application (web, application, database) on Compute Engine. They want to ensure that the database tier is not reachable from the internet. Which network design achieves this? (Google Cloud Professional Cloud Architect, 2023)

A Assign a private IP to the database instances and rely on IAM permissions to block external access B Place database instances in a subnet with no external IPs assigned and use VPC firewall rules that deny ingress from 0.0.0.0/0 to the database tier â€” only allow traffic from the application tier's subnet C Place database instances in a separate VPC with VPC peering to the application tier D Enable Private Google Access on the database subnet to restrict outbound traffic to Google APIs only

27 / 60

Question 28 of 60

Your company needs to build a recommendation engine that uses machine learning. They want to use a pre-built ML model without building or training their own. Which Google Cloud service offers pre-trained recommendation capabilities? (Google Cloud Professional Cloud Architect, 2023)

A Vertex AI Pipelines for orchestrating custom model training B Recommendations AI (part of Google Cloud AI), a managed service providing personalized recommendations using Google's recommendation algorithms without requiring ML expertise C BigQuery ML with a matrix factorization model trained on user behavior data D AutoML Tables for training a custom model on their product catalog data

28 / 60

Question 29 of 60

An architect is designing a globally distributed application that must remain available even if an entire Google Cloud region becomes unavailable. What infrastructure design achieves this? (Google Cloud Professional Cloud Architect, 2023)

A Deploy in a single multi-zone region; multiple zones within a region provide region-level redundancy B Deploy the application in at least two separate regions with a Global External Application Load Balancer routing traffic to the nearest healthy region â€” health checks automatically remove unhealthy backends C Use Cloud Spanner multi-region with the application in a single region D Enable Cloud CDN caching to serve content if the origin region fails

29 / 60

Question 30 of 60

A startup needs to run code in response to HTTP requests without provisioning or managing servers, and they want to pay only for execution time. Which Google Cloud service fits this need? (Google Cloud Professional Cloud Architect, 2023)

A Compute Engine with preemptible instances for low-cost execution on demand B Cloud Functions (2nd gen), which runs event-driven or HTTP-triggered code in a fully managed serverless environment, billing only for the time the function is executing C GKE with Autopilot mode, which provisions nodes automatically per workload D Cloud Run jobs for batch execution triggered by HTTP requests

30 / 60

Question 31 of 60

A company wants to give external partners read-only access to specific objects in a Cloud Storage bucket for a limited time, without creating Google accounts for the partners. Which mechanism enables this? (Google Cloud Professional Cloud Architect, 2023)

A Create a service account for each partner and share the JSON key file B Grant the partner's Google Workspace account storage.objectViewer IAM role on the bucket C Generate a signed URL with an expiration time â€” it allows temporary, time-limited access to a specific object without requiring the requester to authenticate with Google D Enable public access on the specific objects and provide the public URL

31 / 60

Question 32 of 60

Your organization uses Active Directory for identity management and wants employees to use their existing AD credentials to access Google Cloud resources without creating separate Google accounts. What solution supports this? (Google Cloud Professional Cloud Architect, 2023)

A Manually provision Google accounts for each AD user and sync passwords daily B Use Cloud Identity with local accounts mirroring the AD structure C Cloud Identity or Google Workspace with Active Directory federation via Google Cloud Directory Sync (GCDS) and AD FS as a SAML IdP â€” employees log in with AD credentials, and Cloud IAM grants are mapped to their federated identity D Configure SAML federation from AD FS to Google Cloud Identity using the gcloud CLI

32 / 60

Question 33 of 60

A team needs to deploy a stateful application (like a database) in Kubernetes that requires stable network identities and persistent storage even after pod restarts. Which Kubernetes workload type is appropriate? (Google Cloud Professional Cloud Architect, 2023)

A DaemonSet to run one database instance per node in the cluster B Deployment with a ReadWriteMany PersistentVolumeClaim shared across all replicas C StatefulSet â€” provides ordered deployment, stable DNS hostnames (pod-name-0, pod-name-1), and persistent volume claims that survive pod restarts and rescheduling D ReplicaSet with emptyDir volumes for temporary storage per pod

33 / 60

Question 34 of 60

Your Cloud Run service needs to read secrets (API keys, database passwords) at runtime without hardcoding them in environment variables or container images. What is the recommended approach? (Google Cloud Professional Cloud Architect, 2023)

A Embed the secrets in the container image using Docker build arguments at build time B Store secrets in a Cloud Storage object and read them at startup using the service account C Use Secret Manager to store secrets; mount them as environment variables or volumes in the Cloud Run service configuration using IAM-authenticated access D Encrypt secrets with Cloud KMS and store the ciphertext in application code

34 / 60

Question 35 of 60

A company wants to enforce that all VMs in a project use OS Login for SSH access, eliminating the need to manage SSH keys in project or instance metadata. Which organization policy constraint enforces this? (Google Cloud Professional Cloud Architect, 2023)

A Add the compute.osLogin IAM role to all users at the project level B Set the instanceMetadata 'enable-oslogin=true' on each VM individually C Set the 'compute.requireOsLogin' organization policy constraint on the project or folder â€” this forces OS Login for all new and existing VMs within scope D Configure Cloud Identity-Aware Proxy (IAP) for TCP forwarding as the SSH access method

35 / 60

Question 36 of 60

A data engineer needs to move data from an on-premises Oracle database to Cloud SQL for PostgreSQL as part of a migration. Which Google Cloud service is designed for this type of database migration? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Data Fusion with a JDBC source plugin running on a Compute Engine instance B gsutil for bulk data transfer from the Oracle export files to BigQuery C Database Migration Service (DMS), which provides managed, minimal-downtime migrations from supported source databases (including Oracle) to Google Cloud target databases D Dataflow with a custom JDBC connector reading from Oracle and writing to BigQuery

36 / 60

Question 37 of 60

A team is designing a microservices architecture and needs service-to-service authentication where services can verify each other's identity without managing shared secrets. Which Google Cloud approach achieves this? (Google Cloud Professional Cloud Architect, 2023)

A Configure mutual TLS (mTLS) with self-signed certificates managed by the development team B Use a shared API key stored in Secret Manager that all services use to authenticate to each other C Each service uses its attached service account; calling services pass their identity token in the Authorization header; receiving services verify the token using Google's public OIDC endpoint â€” this provides mutual authentication without shared secrets D Use Cloud Endpoints with an API key for each service-to-service interaction

37 / 60

Question 38 of 60

Your company stores 10 TB of infrequently accessed log data in Cloud Storage and wants to minimize storage costs while retaining access within seconds when needed. Which storage class is most cost-effective? (Google Cloud Professional Cloud Architect, 2023)

A Standard storage â€” highest availability, appropriate for all access patterns B Archive storage â€” lowest cost but with a 365-day minimum storage duration and higher retrieval costs, appropriate for data accessed less than once a year C Nearline storage â€” low-cost storage for data accessed less than once a month, with a 30-day minimum storage duration and retrieval costs, but access latency is milliseconds D Coldline storage â€” for data accessed less than once a quarter, with millisecond access latency but higher retrieval fees and a 90-day minimum storage duration.

38 / 60

Question 39 of 60

An organization wants to prevent any Compute Engine instance in a project from being assigned an external IP address. Which control achieves this? (Google Cloud Professional Cloud Architect, 2023)

A Remove the compute.networkAdmin role from all project IAM members B Apply a VPC firewall rule blocking outbound internet traffic from all instances C Set the 'compute.vmExternalIpAccess' organization policy to 'deny all' at the project or folder level â€” this prevents instances from having external IP addresses assigned D Use a Shared VPC with no external IP ranges and require all projects to use it

39 / 60

Question 40 of 60

A startup wants to quickly build and deploy a mobile backend with user authentication, a NoSQL database, and serverless functions, using Google's integrated platform. Which Google Cloud product set is most appropriate? (Google Cloud Professional Cloud Architect, 2023)

A Compute Engine + Cloud SQL + Cloud Identity for a traditional three-tier backend B GKE + Cloud Spanner + Cloud Endpoints for a production-grade mobile API backend C Firebase â€” includes Firebase Authentication, Firestore (NoSQL), Cloud Functions for Firebase, and Firebase Hosting, all tightly integrated for mobile and web app backends D App Engine + Cloud Datastore + Cloud IAP for a simple mobile backend

40 / 60

Question 41 of 60

A company's Cloud Run service receives traffic spikes that exceed its default concurrency and instance limits. What setting controls how many simultaneous requests a single Cloud Run instance can handle? (Google Cloud Professional Cloud Architect, 2023)

A The Cloud Run service's timeout setting, which determines how long each request can execute B The 'max-instances' setting, which limits how many containers can run but does not affect per-instance concurrency C The 'concurrency' setting on the Cloud Run service â€” increasing it allows each instance to handle more simultaneous requests before a new instance is started, reducing cold starts during spikes D The Cloud Armor rate-limiting rule that throttles incoming requests to Cloud Run

41 / 60

Question 42 of 60

A team wants to run machine learning training jobs on large GPU clusters without managing the underlying infrastructure. Which Google Cloud service is most appropriate? (Google Cloud Professional Cloud Architect, 2023)

A Compute Engine with GPU-attached instances managed manually by the team B GKE with GPU node pools managed by the team using Kubernetes job resources C Vertex AI Training â€” a managed service that runs training jobs on Google's infrastructure, supports distributed training on GPUs/TPUs, and handles cluster provisioning and teardown automatically D Dataproc with Spark ML for distributed machine learning on CPU clusters

42 / 60

Question 43 of 60

Your Dataflow pipeline is failing because the pipeline cannot write to BigQuery fast enough, causing a backlog in the streaming buffer. What is the most appropriate solution? (Google Cloud Professional Cloud Architect, 2023)

A Increase the Dataflow worker disk size to provide more buffer capacity B Decrease the BigQuery streaming insert batch size to reduce per-request latency C Enable Dataflow autoscaling and increase the maximum number of workers so the pipeline can parallelize writes to BigQuery across more workers D Switch from BigQuery streaming inserts to batch loads from Cloud Storage

43 / 60

Question 44 of 60

A company wants to manage multiple Google Cloud environments (development, staging, production) with strict separation of access controls and billing. Which organizational structure best supports this? (Google Cloud Professional Cloud Architect, 2023)

A Three separate Google Cloud organizations for complete isolation, each with their own billing account B A single project with three VPCs, one per environment, using firewall rules for separation C Three separate Google Cloud projects (dev, staging, prod), each linked to appropriate billing accounts and governed by folder-level organization policies â€” this provides IAM, billing, and quota isolation per environment D Three Cloud Storage buckets in a single project, each representing an environment

44 / 60

Question 45 of 60

An architect is designing a system that must process 100,000 small transactions per second with low latency and guarantee no duplicate payments. Which Google Cloud database supports ACID transactions at this scale? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Firestore â€” it supports ACID transactions on document groups B Bigtable â€” it supports atomic row-level reads and writes at massive scale C Cloud Spanner â€” it supports serializable ACID transactions globally with horizontal scaling capable of millions of operations per second D Cloud SQL â€” it supports ACID transactions up to the vertical limits of a single VM

45 / 60

Question 46 of 60

A company wants to migrate a legacy monolithic application to Google Cloud with minimal re-architecture in the first phase. Which compute option allows 'lift and shift' of VMs with the least effort? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Run by containerizing the monolith and deploying it serverlessly B App Engine Flexible environment with the monolith packaged as a Docker container C GKE by containerizing each component of the monolith into microservices D Compute Engine â€” migrate existing VMs using the Migrate to Virtual Machines service (formerly Velostrata), running the application on GCE without code changes

46 / 60

Question 47 of 60

Your application needs low-latency access to frequently accessed data, and you want a managed in-memory data store compatible with Redis. Which Google Cloud service provides this? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Bigtable with in-memory caching enabled at the HBase client layer B Cloud Storage with Nearline class for frequently accessed small objects C Cloud SQL with a pgmemcache extension for in-memory query caching D Memorystore for Redis â€” a fully managed Redis service providing sub-millisecond latency, high availability, and automatic failover

47 / 60

Question 48 of 60

A team needs to provide a unified SQL interface over multiple data sources (Cloud Storage, BigQuery, Cloud Spanner, and on-premises databases) without moving the data. Which Google Cloud feature enables federated querying? (Google Cloud Professional Cloud Architect, 2023)

A Dataflow with connectors to each source for unified stream processing B Data Catalog with federated metadata views across all sources C Cloud Data Fusion's replication jobs synchronizing all sources to BigQuery D BigQuery Omni and BigQuery federated queries â€” BigQuery can query external data sources (Cloud Storage via external tables, Cloud Spanner, Cloud SQL, and even AWS/Azure via Omni) using standard SQL without data movement

48 / 60

Question 49 of 60

A company wants to ensure that their Google Kubernetes Engine (GKE) cluster nodes are not accessible from the internet and that all master-to-node communication is private. Which GKE configuration achieves this? (Google Cloud Professional Cloud Architect, 2023)

A Deploy nodes in a Shared VPC and rely on the host project's IAM to block public access B Use GKE Autopilot, which automatically assigns internal IPs to all nodes by default C Configure VPC firewall rules to block all ingress to node ports 0-65535 from 0.0.0.0/0 D Enable Private Cluster mode in GKE â€” nodes receive only private IPs, the master endpoint can be made private, and all master-to-node traffic flows over Google's internal network

49 / 60

Question 50 of 60

An operations team wants to be alerted when the 99th percentile latency of their Cloud Run service exceeds 500ms for more than 5 minutes. Which combination of Google Cloud tools achieves this? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Trace automatically creates latency alerts without any configuration needed B Configure Cloud Profiler to send latency alerts to Cloud Monitoring when p99 exceeds the threshold C Export Cloud Run logs to BigQuery and run a scheduled query that counts high-latency requests, sending results to Cloud Pub/Sub D Use Cloud Monitoring to create an alerting policy on the run.googleapis.com/request_latencies metric (p99 percentile) with a threshold of 500ms and a 5-minute alignment period; configure a notification channel (email, PagerDuty, etc.)

50 / 60

Question 51 of 60

Your company processes sensitive medical records and must meet HIPAA requirements on Google Cloud. What is the first step in establishing HIPAA compliance? (Google Cloud Professional Cloud Architect, 2023)

A Enable Cloud DLP scanning on all storage resources containing medical records B Deploy all workloads in a dedicated Google Cloud region designated for healthcare C Enable VPC Service Controls and CMEK on all projects handling PHI D Execute a Business Associate Agreement (BAA) with Google â€” this is required before using Google Cloud to process PHI; without a BAA, use of GCP for PHI is not HIPAA-compliant regardless of technical controls

51 / 60

Question 52 of 60

A company wants to deploy a third-party application from the Google Cloud Marketplace without writing any deployment code. Which Cloud Marketplace feature enables this? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Marketplace provides only Docker images that must be deployed manually to GKE B Cloud Marketplace requires Terraform templates to be customized before deployment C Cloud Marketplace lists only open-source software that must be built from source code D Cloud Marketplace offers pre-configured solutions (VMs, Kubernetes apps, SaaS) that can be deployed with one click directly to the user's project, pre-licensed and ready to use

52 / 60

Question 53 of 60

A team wants to enable developers to deploy code changes to Cloud Run automatically whenever they push to their Git repository. Which Google Cloud service provides this CI/CD pipeline? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Composer DAG that watches Cloud Storage for deployment artifacts B Cloud Scheduler polling the Git repository every minute for changes and triggering a Pub/Sub message C Cloud Tasks with a Git webhook that triggers a Cloud Function deployer D Cloud Build triggers that watch a Cloud Source Repository or GitHub repository and execute a cloudbuild.yaml configuration on each push, building the container and deploying to Cloud Run

53 / 60

Question 54 of 60

A company needs to transfer 500 TB of data from AWS S3 to Cloud Storage as quickly as possible. Which Google Cloud service optimizes large-scale data transfers from other cloud providers? (Google Cloud Professional Cloud Architect, 2023)

A gsutil with parallel composite upload from a GCE instance in the destination region B BigQuery Data Transfer Service with a custom S3 connector C Cloud Data Fusion with an AWS S3 source plugin running on a large Dataproc cluster D Storage Transfer Service â€” a managed service that transfers data from AWS S3 (and other sources) to Cloud Storage at high bandwidth with scheduling, filtering, and incremental transfer support

54 / 60

Question 55 of 60

What is the purpose of a VPC in Google Cloud and how does it differ from a traditional data center network? (Google Cloud Professional Cloud Architect, 2023)

A A VPC is a physical network segment within a Google data center; VMs on the same VPC share hardware B A VPC is a container for IAM policies that restricts which Google Cloud services can be accessed C A VPC is a Cloud Storage bucket that stores VMs' virtual disks in a logically isolated namespace D A VPC is a logically isolated, software-defined global network within Google Cloud â€” it spans all regions by default, supports custom subnets per region, and uses Google's private backbone for inter-region communication without traversing the public internet

55 / 60

Question 56 of 60

Your company wants to use a single set of shared networking resources (VPC, subnets, firewall rules) across multiple Google Cloud projects to centralize network management. Which feature enables this? (Google Cloud Professional Cloud Architect, 2023)

A VPC peering between all projects, with each project maintaining its own VPC and firewall rules B Transit VPC with a hub-and-spoke model using Cloud VPN tunnels between projects C Private Service Connect connecting all projects' services through a central endpoint D Shared VPC â€” a host project owns and manages the VPC; service projects attach to it and deploy resources (VMs, GKE nodes) into the shared subnets, using the host project's centrally managed firewall rules and routes

56 / 60

Question 57 of 60

A developer needs to build an application that reacts to changes in a Cloud Firestore collection and performs actions (like sending email or updating another system) in real time. Which architecture accomplishes this? (Google Cloud Professional Cloud Architect, 2023)

A Use Eventarc with a Firestore event type to trigger a Dataflow streaming job B Poll the Firestore collection every second from a Compute Engine instance using the REST API C Configure a Pub/Sub subscription on the Firestore collection and process messages in Cloud Run D Use Firestore triggers in Cloud Functions â€” a function is invoked automatically whenever a document in the specified collection is created, updated, or deleted, with the change event passed as the function's argument

57 / 60

Question 58 of 60

A company plans to use Google Kubernetes Engine for production workloads. They want Google to manage the Kubernetes control plane and node infrastructure automatically, with per-pod billing. Which GKE mode delivers this? (Google Cloud Professional Cloud Architect, 2023)

A GKE Standard mode with cluster autoscaler enabled â€” Google manages the control plane but nodes require manual configuration B GKE private cluster mode, which automatically provisions nodes based on pod scheduling requests C GKE Autopilot with the 'manualNodeManagement' flag enabled for occasional node access D GKE Autopilot mode â€” Google manages both the control plane and the nodes, enforces security best practices automatically, and bills per pod resource request rather than per provisioned node

58 / 60

Question 59 of 60

A company wants to centralize security findings from Cloud Security Command Center, third-party tools, and custom detectors into a single pane of glass for their security operations team. Which Google Cloud feature supports ingesting external findings? (Google Cloud Professional Cloud Architect, 2023)

A Cloud Logging with log-based metrics aggregating findings from all sources B Cloud Monitoring with custom dashboards displaying findings from integrated partners C Chronicle SIEM with Pub/Sub connectors pulling findings from each tool separately D Security Command Center (SCC) Premium with its Findings API â€” external tools can write findings to SCC using the API; all findings appear in the unified SCC dashboard alongside native findings

59 / 60

Question 60 of 60

What is the primary difference between Cloud Storage Object Versioning and Object Lifecycle Management? (Google Cloud Professional Cloud Architect, 2023)

A Versioning is for disaster recovery; Lifecycle Management is for compliance archiving only B Versioning applies to individual objects; Lifecycle Management applies to entire buckets C Versioning requires CMEK; Lifecycle Management works with any encryption type D Versioning preserves all historical versions of an object when it is overwritten or deleted; Lifecycle Management applies automated rules (delete after N days, transition to cheaper storage class) to manage object lifecycle and costs â€” the two features are complementary and often used together

60 / 60

GCP Professional Cloud Architect Beginner Quiz